CCNA Network Questions — Page 2 of 3

MCQhard

In a VXLAN BGP EVPN fabric, which component is responsible for handling BUM traffic using ingress replication, and how does the VTEP learn the list of remote VTEPs to replicate to?

A.The ingress VTEP learns remote VTEPs via IGMP snooping.

B.The egress VTEP sends unicast copies to all other VTEPs.

C.The ingress VTEP learns remote VTEPs via MP-BGP EVPN Type 3 routes.

D.The spine switch performs replication to all leaf VTEPs.

AnswerC

Type 3 routes advertise VNI and VTEP IP, enabling ingress replication list.

Why this answer

In a VXLAN BGP EVPN fabric, ingress replication is the default method for handling BUM traffic, where the ingress VTEP replicates packets and sends unicast copies to each remote VTEP. The ingress VTEP learns the list of remote VTEPs from MP-BGP EVPN Type 3 routes (Inclusive Multicast routes), which advertise the VNI and the originating VTEP's IP address, allowing the ingress VTEP to build its replication list.

Exam trap

Cisco often tests the misconception that the spine switch performs replication or that IGMP snooping is used for VTEP discovery, when in fact the ingress VTEP uses MP-BGP EVPN Type 3 routes to learn remote VTEPs and handle BUM traffic via ingress replication.

How to eliminate wrong answers

Option A is wrong because IGMP snooping is used for optimizing multicast group membership in Layer 2 networks, not for learning remote VTEPs in an EVPN fabric; VTEP discovery relies on BGP EVPN Type 3 routes. Option B is wrong because egress VTEPs do not send unicast copies to other VTEPs; replication is performed by the ingress VTEP, not the egress. Option D is wrong because the spine switch in a VXLAN EVPN fabric acts as a route reflector and does not perform data-plane replication; replication is handled by the ingress VTEP using ingress replication.

Practice this question →

MCQmedium

Which statement about RSTP (802.1w) is true?

A.RSTP reduces convergence time by using a proposal/agreement handshake

B.RSTP uses a timer-based convergence similar to STP

C.RSTP requires explicit configuration of edge ports to prevent loops

D.RSTP elects the root bridge based on the highest MAC address

AnswerA

The handshake allows rapid transition to forwarding.

Why this answer

RSTP (802.1w) significantly reduces convergence time compared to legacy STP by using a proactive proposal/agreement handshake mechanism. Instead of relying on timers (like STP's 30-50 second convergence), RSTP switches immediately negotiate port roles and transition to forwarding by exchanging proposal and agreement BPDUs, enabling sub-second convergence in a properly designed network.

Exam trap

Cisco often tests the misconception that RSTP eliminates all timers, but the trap here is that RSTP still uses timers (e.g., hello time, forward delay) as a backup mechanism when the handshake fails, such as over half-duplex links or when a switch does not support RSTP.

How to eliminate wrong answers

Option B is wrong because RSTP does not rely on timer-based convergence like STP; it uses the proposal/agreement handshake to achieve rapid convergence, though it still uses timers as a fallback for certain scenarios (e.g., max age for BPDU loss). Option C is wrong because RSTP edge ports (configured with 'spanning-tree portfast') are not required to prevent loops; they are an optimization to immediately transition to forwarding on access ports, but RSTP still prevents loops through its normal operation on non-edge ports. Option D is wrong because RSTP elects the root bridge based on the lowest bridge ID (bridge priority + MAC address), not the highest MAC address; the root bridge is the switch with the smallest bridge ID value.

Practice this question →

MCQmedium

During a network upgrade, an engineer applies a new OSPF configuration on a Nexus 9000 spine. After the change, several leaf switches lose connectivity to each other. The engineer examines the logs and sees OSPF adjacency flapping. What is the most likely cause?

A.Duplicate router IDs.

B.OSPF hello timer mismatch.

C.MTU mismatch on the fabric links.

D.Incorrect area configuration.

AnswerA

Duplicate router IDs cause OSPF neighbors to flap.

Why this answer

Duplicate router IDs cause OSPF adjacency flapping because OSPF uses the Router ID (RID) to uniquely identify each router in the OSPF domain. When two routers share the same RID, they reject each other's Hello packets, leading to repeated adjacency resets. In a Nexus 9000 spine-leaf topology, this often occurs when the spine's RID is accidentally configured to match an existing leaf's RID, disrupting the entire fabric's OSPF convergence.

Exam trap

Cisco often tests the distinction between 'adjacency flapping' (caused by duplicate RIDs or mismatched authentication) and 'failure to form adjacency' (caused by hello/dead timer or MTU mismatches), so candidates mistakenly choose MTU or timer issues when the symptom is flapping rather than non-formation.

How to eliminate wrong answers

Option B is wrong because an OSPF hello timer mismatch prevents adjacency formation entirely (neighbors remain in INIT state), not flapping; flapping implies adjacency is established and then breaks. Option C is wrong because an MTU mismatch on fabric links typically causes OSPF to fail to form adjacency (stuck in EXSTART/EXCHANGE) due to database descriptor packet rejection, not flapping. Option D is wrong because an incorrect area configuration would cause a type mismatch in Hello packets (area ID field), preventing adjacency from forming at all, not causing established adjacencies to flap.

Practice this question →

MCQmedium

What does the oversubscription ratio in a spine-leaf fabric represent?

A.Ratio of spine to leaf bandwidth

B.Ratio of server bandwidth to leaf uplink bandwidth

C.Ratio of total fabric bandwidth to total server bandwidth

D.Number of spine switches per leaf

AnswerB

Commonly 3:1 or 4:1.

Why this answer

In a spine-leaf fabric, the oversubscription ratio specifically compares the total bandwidth available from the servers (leaf southbound ports) to the total uplink bandwidth from the leaf to the spine (leaf northbound ports). This ratio determines how much potential congestion exists when multiple servers contend for uplink capacity, directly impacting performance in a non-blocking or oversubscribed design.

Exam trap

Cisco often tests the distinction between oversubscription ratio (server-to-uplink on a leaf) and overall fabric capacity, leading candidates to mistakenly choose the total fabric bandwidth ratio (Option C) instead of the leaf-level server-to-uplink ratio.

How to eliminate wrong answers

Option A is wrong because the ratio of spine to leaf bandwidth is not a defined metric in fabric design; oversubscription focuses on server-to-uplink contention, not spine-to-leaf bandwidth comparison. Option C is wrong because total fabric bandwidth to total server bandwidth is a broader capacity metric, not the oversubscription ratio, which specifically measures leaf-level server vs. uplink bandwidth. Option D is wrong because the number of spine switches per leaf relates to redundancy and path diversity, not bandwidth oversubscription.

Practice this question →

MCQmedium

A network engineer is designing a spine-leaf fabric with oversubscription ratio 3:1. Each leaf switch has 48x10G host-facing ports and 4x40G uplinks to spines. What is the oversubscription ratio per leaf?

A.2:1

B.4:1

C.3:1

D.1.2:1

AnswerC

Correct: 480/160 = 3.

Why this answer

The oversubscription ratio per leaf is calculated by dividing the total host-facing bandwidth by the total uplink bandwidth. Each leaf has 48x10G host ports (480G total) and 4x40G uplinks (160G total). 480G / 160G = 3:1, matching the design target.

Exam trap

Cisco often tests the oversubscription calculation by providing port counts and speeds, and the trap here is that candidates may incorrectly sum the uplink bandwidth (e.g., 4x40G = 160G) but then divide host bandwidth by the number of uplinks instead of total uplink bandwidth, or confuse oversubscription with the ratio of host ports to uplink ports.

How to eliminate wrong answers

Option A is wrong because 2:1 would require 240G of uplink bandwidth (e.g., 6x40G), not the 160G provided. Option B is wrong because 4:1 would require only 120G of uplink bandwidth (e.g., 3x40G), which underestimates the actual uplink capacity. Option D is wrong because 1.2:1 would require 400G of uplink bandwidth (e.g., 10x40G), far exceeding the 160G available.

Practice this question →

MCQhard

In a BGP EVPN deployment, route type 2 (MAC/IP advertisement) is used to advertise MAC addresses. What additional information is carried in route type 2 for IP routing?

A.IP address and route distinguisher

B.IP address and MAC address

C.IP prefix and next-hop

D.MAC address and VNI

AnswerB

Route type 2 contains the MAC address and optionally the IP address for host routing.

Why this answer

In BGP EVPN, route type 2 (MAC/IP Advertisement Route) is used to advertise both MAC addresses and their associated IP addresses. The additional information carried for IP routing is the IP address and the MAC address, enabling the control plane to support both Layer 2 bridging and Layer 3 routing (e.g., host route advertisement for IP-based forwarding). This is defined in RFC 7432, where the route type 2 NLRI includes a MAC address field and an optional IP address field.

Exam trap

Cisco often tests the distinction between route type 2 (MAC/IP advertisement) and route type 5 (IP prefix route), trapping candidates who confuse the IP address field in type 2 with an IP prefix or next-hop information.

How to eliminate wrong answers

Option A is wrong because the route distinguisher (RD) is part of the EVPN NLRI prefix, not an additional field carried specifically for IP routing; it is used to distinguish overlapping IP prefixes across different VRFs. Option C is wrong because route type 2 carries a single IP address (e.g., a /32 host route), not an IP prefix and next-hop; IP prefix and next-hop are associated with route type 5 (IP prefix route). Option D is wrong because while the MAC address and VNI are present in route type 2, the VNI is part of the EVPN NLRI for identifying the broadcast domain, not an additional element for IP routing; the question specifically asks for the additional information carried for IP routing, which is the IP address.

Practice this question →

MCQmedium

An engineer configures vPC on a pair of Nexus switches. The vPC peer-keepalive link fails, but the vPC peer-link remains operational. What is the expected behavior?

A.Both switches suspend all vPC member ports to avoid loops.

B.The primary switch reloads to prevent a split-brain scenario.

C.The vPC domain remains operational with both switches forwarding traffic.

D.The secondary switch suspends its vPC member ports.

AnswerC

Keepalive is not critical if peer-link is up; domain stays up.

Why this answer

When the vPC peer-keepalive link fails but the peer-link remains up, the vPC domain continues to operate normally because the peer-link is used for control-plane synchronization and data-plane forwarding. The peer-keepalive is only a secondary heartbeat to detect a dual-active scenario when the peer-link is down. Since the peer-link is still functional, both switches can exchange vPC consistency parameters and forward traffic without risk of loops.

Exam trap

Cisco often tests the misconception that the peer-keepalive is the primary mechanism for loop prevention, when in fact the peer-link is critical for control-plane sync and the peer-keepalive only acts as a backup heartbeat for dual-active detection.

How to eliminate wrong answers

Option A is wrong because vPC member ports are only suspended when the peer-link fails, not when only the peer-keepalive fails; the peer-link ensures loop-free operation. Option B is wrong because the primary switch does not reload; a reload only occurs if the peer-link fails and the secondary switch is configured as the 'bridge assurance' or 'auto-recovery' mechanism, but not for a peer-keepalive failure alone. Option D is wrong because the secondary switch suspends its vPC member ports only if the peer-link fails and it cannot detect the primary via peer-keepalive (dual-active scenario); with the peer-link up, the secondary remains active.

Practice this question →

MCQmedium

In a VXLAN overlay network, what is the primary purpose of ingress replication for BUM traffic?

A.To reduce the need for ARP suppression

B.To forward broadcast, unknown unicast, and multicast traffic without requiring multicast in the underlay

C.To enable multipathing of BUM traffic across multiple paths

D.To assign VXLAN Network Identifiers (VNIs) to tenant traffic

AnswerB

Ingress replication sends BUM traffic as unicast to each remote VTEP.

Why this answer

Ingress replication is a technique used in VXLAN overlay networks to handle BUM (Broadcast, Unknown unicast, Multicast) traffic without requiring a multicast-enabled underlay. The ingress VTEP (VXLAN Tunnel End Point) replicates the BUM packet and sends a separate unicast copy to each remote VTEP in the same VXLAN Network Identifier (VNI) segment, ensuring all relevant endpoints receive the traffic while relying solely on unicast routing in the underlay.

Exam trap

Cisco often tests the distinction between ingress replication and multicast-based replication, and the trap here is that candidates may confuse ingress replication with ARP suppression or assume it provides multipathing, when in fact it is solely a method to forward BUM traffic without multicast in the underlay.

How to eliminate wrong answers

Option A is wrong because ARP suppression is a separate feature that reduces ARP broadcast traffic by caching IP-to-MAC mappings on the VTEP, not a function of ingress replication. Option C is wrong because ingress replication does not inherently enable multipathing; it simply replicates packets to each remote VTEP, and multipathing for BUM traffic is typically achieved through equal-cost multipath (ECMP) load balancing of the encapsulated unicast packets. Option D is wrong because VNI assignment is a fundamental part of VXLAN configuration that maps tenant traffic to specific overlay segments, independent of how BUM traffic is replicated.

Practice this question →

MCQeasy

A network engineer is configuring a VPC peer-link on a Nexus switch. Which interface configuration is required for the peer-link port-channel?

A.switchport mode trunk

B.spanning-tree port type edge trunk

C.switchport mode access

D.no switchport

AnswerA

Trunk mode allows multiple VLANs to traverse the peer-link.

Why this answer

A VPC peer-link is a special port-channel that carries control traffic (e.g., Cisco Fabric Services over Ethernet) and data traffic between VPC peer switches. It must be configured as a trunk (switchport mode trunk) to allow multiple VLANs, including the VPC VLAN and the peer-keepalive link VLAN, to traverse the link. Without trunk mode, the peer-link cannot properly forward the necessary VLAN traffic for VPC operation.

Exam trap

Cisco often tests the distinction between a VPC peer-link (which must be a Layer 2 trunk) and a VPC peer-keepalive link (which is a Layer 3 routed link), causing candidates to confuse the two and incorrectly apply 'no switchport' to the peer-link.

How to eliminate wrong answers

Option B is wrong because 'spanning-tree port type edge trunk' is used for access ports connected to end hosts to enable PortFast and BPDU guard, not for a VPC peer-link which is a core infrastructure link that should use a normal spanning-tree port type (e.g., network or normal). Option C is wrong because 'switchport mode access' restricts the interface to a single VLAN, which would prevent the peer-link from carrying the multiple VLANs required for VPC data and control traffic. Option D is wrong because 'no switchport' places the interface into routed (Layer 3) mode, but a VPC peer-link must operate at Layer 2 to forward VLAN-tagged frames between the VPC peers.

Practice this question →

MCQmedium

Which statement is true about the VLANs carried on a VPC peer-link?

A.The peer-link carries only the VLANs allowed on the member interfaces.

B.The peer-link carries all VLANs that are allowed on the trunk interface.

C.The peer-link requires spanning-tree port type edge trunk configuration.

D.The peer-link must be configured as a layer 3 interface.

AnswerB

The peer-link is a trunk that can carry any VLAN allowed on it.

Why this answer

In a vPC domain, the peer-link is a special trunk that carries all VLANs allowed on the trunk interface, including those not present on any member port. This ensures that orphaned traffic (traffic arriving on the peer-link destined for a device connected to the other vPC peer) can be forwarded correctly. The peer-link must carry all VLANs to maintain Layer 2 connectivity and loop-free behavior without relying on spanning tree.

Exam trap

Cisco often tests the misconception that the peer-link only carries VLANs present on member ports, when in fact it must carry all VLANs allowed on the trunk to support orphan port traffic and maintain vPC loop-free operation.

How to eliminate wrong answers

Option A is wrong because the peer-link carries all VLANs allowed on the trunk interface, not only those allowed on the member interfaces; restricting VLANs would break traffic for orphan ports. Option C is wrong because the peer-link does not require spanning-tree port type edge trunk; it typically uses a regular trunk with spanning-tree BPDU filtering or guard enabled, but edge trunk is not a requirement. Option D is wrong because the peer-link must be a Layer 2 trunk interface, not a Layer 3 interface, as it carries VLAN traffic between vPC peers.

Practice this question →

MCQeasy

Which command is used to verify the OSPF neighbor state in NX-OS?

A.show ospf neighbors

B.show ip ospf neighbors

C.show running-config ospf

D.show ip route ospf

AnswerB

Correct command.

Why this answer

In NX-OS, the correct command to verify OSPF neighbor state is 'show ip ospf neighbors'. This command displays the OSPF neighbor table, including neighbor ID, priority, state (e.g., FULL, 2WAY), and dead timer. The 'ip' keyword is mandatory in NX-OS to specify the IPv4 address family, distinguishing it from other protocols like OSPFv3 for IPv6.

Exam trap

Cisco often tests the exact syntax difference between IOS and NX-OS, where NX-OS requires the 'ip' keyword in OSPF commands (e.g., 'show ip ospf neighbors' vs. the IOS-compatible 'show ip ospf neighbor'), and candidates mistakenly use the IOS-style command without the 'ip' keyword.

How to eliminate wrong answers

Option A is wrong because 'show ospf neighbors' is not a valid command in NX-OS; it lacks the required 'ip' keyword and will result in an error. Option C is wrong because 'show running-config ospf' displays the OSPF configuration, not neighbor states; it shows parameters like router-id, network types, and area assignments, but not dynamic neighbor adjacency information. Option D is wrong because 'show ip route ospf' displays the OSPF-learned routes in the routing table, not neighbor states; it shows prefixes and next-hop information, not the adjacency status of OSPF neighbors.

Practice this question →

MCQmedium

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

A.Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.

B.Disable vPC on both switches and reconfigure the port channels.

C.Reconfigure the vPC domain with a lower priority on the secondary switch.

D.Increase the vPC peer-keepalive hold timeout to 5 seconds.

AnswerA

A dedicated keepalive link ensures reliable communication and prevents split-brain.

Why this answer

When the vPC peer link fails, the peer-keepalive link is used by the secondary switch to detect that the primary is still alive and to avoid becoming the primary (which would cause a split-brain scenario). Using a dedicated management interface or a separate VRF ensures the keepalive messages are isolated from the data plane and remain reachable even if the peer link goes down, allowing the secondary to correctly keep its vPC member ports in a suspended state and maintain convergence.

Exam trap

Cisco often tests the misconception that the peer-keepalive link is only for role negotiation during normal operation, when in fact it is critical for preventing split-brain during peer-link failures, and candidates may overlook the need for its isolation from the data plane.

How to eliminate wrong answers

Option B is wrong because disabling vPC and reconfiguring port channels is a disruptive, manual process that does not address the keepalive failure and would cause unnecessary downtime; vPC convergence relies on the keepalive link to prevent split-brain, not on reconfiguration. Option C is wrong because changing the vPC domain priority on the secondary switch does not affect the keepalive link's functionality; priority determines the role (primary/secondary) but does not fix a failing keepalive path. Option D is wrong because increasing the hold timeout to 5 seconds only delays the detection of a keepalive failure, potentially prolonging a split-brain scenario; it does not ensure the keepalive link is reliable or isolated.

Practice this question →

MCQmedium

In VXLAN overlay networks, which mechanism is used to forward broadcast, unknown unicast, and multicast (BUM) traffic when multicast is not enabled in the underlay?

A.Head-end replication

B.Egress replication

C.Ingress replication

D.Multicast replication

AnswerC

Ingress replication sends a copy of the BUM frame to each remote VTEP as unicast VXLAN packets.

Why this answer

In VXLAN overlay networks, when multicast is not enabled in the underlay, ingress replication is used to forward BUM traffic. With ingress replication, the source VTEP (ingress node) replicates the BUM packet and sends a separate unicast-encapsulated copy to each remote VTEP in the VXLAN segment. This avoids reliance on underlay multicast trees, making it suitable for networks that do not support multicast routing.

Exam trap

Cisco often tests the distinction between 'ingress replication' and 'head-end replication'—the trap is that candidates confuse the generic concept of head-end replication with the specific VXLAN term 'ingress replication', leading them to select the less precise option.

How to eliminate wrong answers

Option A is wrong because head-end replication is a generic term that can describe any replication performed at the source, but in VXLAN the specific standardized term for this mechanism when multicast is disabled is 'ingress replication', not 'head-end replication'. Option B is wrong because egress replication would imply the destination VTEP performs replication, which is not how VXLAN BUM handling works; replication is always performed at the ingress VTEP. Option D is wrong because multicast replication relies on underlay multicast (e.g., PIM) to distribute BUM traffic, which is explicitly not enabled in this scenario.

Practice this question →

Multi-Selecteasy

Which TWO characteristics are true about Cisco VPC? (Choose two)

Select 2 answers

A.VPC allows dual-homing of a server to two different switches.

B.VPC keepalive uses Layer 2 connectivity.

C.VPC requires a dedicated management VLAN.

D.VPC peer-link can be a single link or EtherChannel.

E.VPC member ports can be on different VLANs on each peer.

AnswersA, D

VPC enables a server to connect to two switches simultaneously, treating them as a single logical node.

Why this answer

Cisco Virtual PortChannel (vPC) allows a server to be dual-homed to two different switches, enabling active-active load balancing and link redundancy. This is achieved by making the two switches appear as a single logical switch to the downstream device using the vPC protocol, which synchronizes state and forwarding information across the peer link.

Exam trap

Cisco often tests the misconception that vPC keepalive uses Layer 2 connectivity, when in fact it requires Layer 3 reachability, and that vPC member ports can have mismatched VLANs, which is not allowed because the VLAN configuration must be consistent across both peers for the vPC to operate correctly.

Practice this question →

Multi-Selectmedium

A network engineer is planning a VXLAN EVPN fabric. Which two statements about VXLAN Network Identifiers (VNIs) are correct? (Choose two.)

Select 2 answers

A.VXLAN encapsulates Layer 2 frames in UDP packets

B.VNI values range from 1 to 4096

C.VNI is a 24-bit field in the VXLAN header

D.VXLAN uses TCP for encapsulation

E.VNI is used only for Layer 3 routing

AnswersA, C

VXLAN uses MAC-in-UDP encapsulation.

Why this answer

VXLAN encapsulates Layer 2 Ethernet frames inside UDP packets (typically UDP destination port 4789). This allows Layer 2 segments to be extended over a Layer 3 IP network, which is the fundamental purpose of VXLAN in a data center fabric.

Exam trap

Cisco often tests the VNI range (24-bit vs. 12-bit VLAN ID) to catch candidates who confuse VXLAN VNIs with traditional VLAN IDs.

Practice this question →

MCQhard

Which VXLAN EVPN route type is used for discovering VTEPs and building the BUM forwarding tree?

A.Type 1

B.Type 3

C.Type 2

D.Type 5

AnswerB

Inclusive Multicast Ethernet Tag.

Why this answer

B is correct because VXLAN EVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route) is specifically used to advertise the VXLAN tunnel endpoint (VTEP) IP addresses and the VNI (VXLAN Network Identifier) for BUM (Broadcast, Unknown unicast, Multicast) traffic. This route type enables the discovery of remote VTEPs and builds the multicast forwarding tree (either via ingress replication or PIM-based multicast) necessary for BUM traffic delivery in a VXLAN EVPN fabric.

Exam trap

Cisco often tests the distinction between Route Type 2 (MAC/IP advertisement) and Route Type 3 (BUM tree), so the trap here is that candidates mistakenly associate MAC address learning (Type 2) with VTEP discovery, when in fact Type 3 is the dedicated route for building the BUM forwarding tree and discovering remote VTEPs for broadcast and unknown traffic.

How to eliminate wrong answers

Option A is wrong because Route Type 1 (Ethernet Auto-Discovery Route) is used for redundancy and fast convergence (e.g., advertising ESI labels for multihoming), not for VTEP discovery or BUM tree building. Option C is wrong because Route Type 2 (MAC/IP Advertisement Route) advertises MAC addresses and host IPs along with their VTEP and VNI mappings, but it does not handle BUM forwarding tree construction. Option D is wrong because Route Type 5 (IP Prefix Route) is used for advertising external IP prefixes (e.g., from a WAN or data center interconnect) and is not involved in VTEP discovery or BUM traffic handling.

Practice this question →

MCQeasy

In a VXLAN environment, what is the function of a VTEP?

A.It manages the VXLAN multicast groups

B.It encapsulates and decapsulates VXLAN packets

C.It acts as a DHCP server for tenant VMs

D.It provides Layer 3 routing between VXLAN segments

AnswerB

VTEP is responsible for VXLAN encapsulation/decapsulation.

Why this answer

A VTEP (VXLAN Tunnel Endpoint) is the device that performs VXLAN encapsulation and decapsulation. It takes an original Layer 2 frame, adds a VXLAN header (with a VNI to identify the tenant segment), a UDP header (port 4789), and an outer IP/Ethernet header, then sends the packet over the underlay network. On the receiving side, the VTEP strips these headers and forwards the original frame to the destination host.

This encapsulation/decapsulation function is the core purpose of a VTEP in a VXLAN environment.

Exam trap

Cisco often tests the distinction between the VTEP's core encapsulation/decapsulation role and the separate functions of multicast group management, DHCP services, or Layer 3 routing, leading candidates to confuse the VTEP with a VXLAN gateway or a multicast router.

How to eliminate wrong answers

Option A is wrong because VXLAN multicast groups are used for BUM traffic (broadcast, unknown unicast, multicast) in multicast-mode VXLAN, but managing those groups is a function of the underlay network (e.g., PIM) or the control plane, not a specific function of the VTEP itself. Option C is wrong because a VTEP is a networking device (switch or router) that handles tunnel encapsulation; DHCP services for tenant VMs are provided by dedicated DHCP servers or the hypervisor, not by the VTEP. Option D is wrong because Layer 3 routing between VXLAN segments is performed by a VXLAN gateway (which may be a VTEP with routing capabilities, such as a VXLAN routing gateway or a VRF-aware device), but the fundamental function of a VTEP is encapsulation/decapsulation, not routing.

Practice this question →

MCQhard

Refer to the exhibit. What is the most likely cause of the NVE interface being down?

A.The VXLAN destination UDP port is incorrect.

B.The overlay VLAN is not configured.

C.The source interface is not configured.

D.The VNI list is empty.

AnswerC

The output shows 'Source Interface: not configured', which prevents NVE from coming up.

Why this answer

The NVE (Network Virtualization Edge) interface requires a valid source interface (typically a loopback) to establish VXLAN tunnels. If the source interface is not configured under the NVE interface, the interface remains in a down state because it cannot form VXLAN overlay adjacencies. This is the most common cause of an NVE interface being down in Cisco NX-OS.

Exam trap

Cisco often tests the specific requirement that the NVE interface must have a source interface configured to come up, and candidates mistakenly think an empty VNI list or incorrect UDP port would cause the interface to be down, but those affect traffic forwarding, not the interface state.

How to eliminate wrong answers

Option A is wrong because the VXLAN destination UDP port (default 4789) is a static value used for encapsulation and does not affect the operational state of the NVE interface itself; an incorrect port would cause packet drops but not bring the interface down. Option B is wrong because the overlay VLAN is configured under the bridge domain or VNI mapping, not directly on the NVE interface, and its absence would prevent traffic forwarding but not cause the NVE interface to be down. Option D is wrong because an empty VNI list means no VNIs are mapped to the NVE, which would prevent VXLAN traffic but the NVE interface can still be up/up if the source interface is properly configured.

Practice this question →

MCQmedium

An engineer is configuring OSPF on a Nexus 9000 switch in a data center spine-leaf topology. Which OSPF network type is most appropriate on the point-to-point links between leaf and spine switches to ensure fast convergence?

A.broadcast

B.point-to-multipoint

C.point-to-point

D.non-broadcast

AnswerC

Point-to-point is optimal for direct links, avoids DR/BDR.

Why this answer

In a spine-leaf topology, the links between leaf and spine switches are typically point-to-point, even if they are Ethernet interfaces. Configuring the OSPF network type as point-to-point on these links eliminates the need for a Designated Router (DR) and Backup Designated Router (BDR) election, which reduces OSPF adjacency formation time and ensures faster convergence. This network type also allows OSPF to use multicast hello packets (224.0.0.5) without the overhead of a DR/BDR election, making it the most appropriate choice for fast convergence.

Exam trap

Cisco often tests the misconception that 'broadcast' is the default and therefore acceptable for all Ethernet links, but the trap here is that candidates overlook the DR/BDR election overhead on point-to-point links, which directly impacts convergence time in a spine-leaf design.

How to eliminate wrong answers

Option A is wrong because the broadcast network type requires a DR/BDR election, which adds delay in adjacency formation and convergence, and is unnecessary for point-to-point links. Option B is wrong because point-to-multipoint is designed for non-broadcast multi-access (NBMA) networks where a single interface connects to multiple neighbors, not for dedicated point-to-point links, and it does not leverage the fast adjacency benefits of point-to-point. Option D is wrong because non-broadcast is used for NBMA environments (e.g., Frame Relay) where neighbors must be statically configured and DR/BDR election is still required, which is inefficient and slower for point-to-point links.

Practice this question →

MCQmedium

In a centralized anycast gateway VXLAN EVPN design, which is a requirement?

A.Each VTEP has a unique anycast IP address.

B.All VTEPs share a common anycast IP address for the default gateway.

C.The anycast gateway is configured on the spine switches.

D.The route reflector is an external BGP speaker.

AnswerB

This is the definition of centralized anycast gateway.

Why this answer

In a centralized anycast gateway VXLAN EVPN design, all VTEPs share a common anycast IP address and MAC address for the default gateway. This allows any VTEP to serve as the first-hop router for hosts, enabling optimal east-west traffic forwarding without requiring a separate gateway device. The anycast IP is configured on each VTEP's VLAN interface, and the same IP/MAC is advertised via EVPN Type-2 routes.

Exam trap

Cisco often tests the misconception that the anycast gateway is configured on spine switches or that each VTEP uses a unique anycast IP, when in fact the shared anycast IP/MAC on leaf VTEPs is the defining requirement.

How to eliminate wrong answers

Option A is wrong because each VTEP does not have a unique anycast IP address; instead, all VTEPs share the same anycast IP and MAC for the default gateway. Option C is wrong because the anycast gateway is configured on the leaf switches (VTEPs), not on the spine switches, which act as route reflectors or underlay forwarders. Option D is wrong because the route reflector can be an internal BGP speaker (e.g., a spine switch) and does not have to be an external BGP speaker; in fact, iBGP is commonly used within the fabric.

Practice this question →

MCQeasy

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets?

A.VNI

B.VXLAN tunnel

C.VXLAN gateway

D.VTEP

AnswerD

VTEP performs VXLAN encapsulation/decapsulation.

Why this answer

The VTEP (VXLAN Tunnel Endpoint) is the device that performs encapsulation and decapsulation of Ethernet frames into UDP packets. It is the edge component in a VXLAN network that maps tenant traffic to VXLAN segments and handles the actual tunneling by adding the VXLAN header (including VNI) and outer UDP/IP headers.

Exam trap

Cisco often tests the distinction between the VTEP (the device that does encapsulation) and the VXLAN tunnel (the logical path), so candidates mistakenly pick 'VXLAN tunnel' because they associate 'tunnel' with encapsulation, but the tunnel is the path, not the endpoint.

How to eliminate wrong answers

Option A is wrong because VNI (VXLAN Network Identifier) is a 24-bit segment identifier in the VXLAN header that distinguishes tenant traffic, but it does not perform encapsulation or decapsulation. Option B is wrong because a VXLAN tunnel is the logical path between VTEPs over the underlay network, not the component that encapsulates or decapsulates frames. Option C is wrong because a VXLAN gateway connects VXLAN and non-VXLAN networks (e.g., VLAN-to-VXLAN bridging) and may perform translation, but the fundamental encapsulation/decapsulation function is always done by the VTEP.

Practice this question →

MCQmedium

An engineer is troubleshooting high CPU utilization on a Nexus 7700 switch. The output of 'show process cpu' shows high usage from the 'netstack' process. Which action should the engineer take to identify the cause?

A.Enable 'feature netstack' to get more details.

B.Reboot the switch to clear the process.

C.Check for broadcast storms using 'show interface'.

D.Use 'show system internal netstack stats'.

AnswerD

This command shows internal netstack counters and helps isolate the issue.

Why this answer

The 'netstack' process handles network stack operations, including packet processing and forwarding. The 'show system internal netstack stats' command provides detailed internal statistics about the netstack process, such as packet drops, buffer usage, and error counters, which help pinpoint the root cause of high CPU utilization.

Exam trap

Cisco often tests the distinction between generic interface troubleshooting and process-specific internal diagnostics, leading candidates to choose a broad command like 'show interface' instead of the targeted internal command for the identified process.

How to eliminate wrong answers

Option A is wrong because 'feature netstack' is not a valid command; netstack is an internal process, not a feature that can be enabled. Option B is wrong because rebooting the switch is a disruptive, temporary fix that does not identify the underlying cause and may mask the issue. Option C is wrong while broadcast storms can cause high CPU, the question specifically identifies the 'netstack' process, and 'show interface' does not provide netstack-specific statistics; the correct diagnostic command targets the process directly.

Practice this question →

Multi-Selectmedium

An engineer is designing a VXLAN EVPN fabric with multicast-based BUM replication. Which two components are required to support this? (Choose two.)

Select 2 answers

A.A multicast group address per VNI

B.NVE interface with multicast group

C.BGP EVPN address family

D.PIM enabled on the underlay

E.Ingress replication configured

AnswersA, D

Multicast group maps to VNI for BUM traffic.

Why this answer

In a VXLAN EVPN fabric using multicast-based BUM replication, each VNI must be mapped to a unique multicast group address in the underlay. This allows the underlay multicast tree to efficiently deliver broadcast, unknown unicast, and multicast traffic to all VTEPs that are members of that VNI, without requiring the ingress VTEP to replicate packets individually.

Exam trap

Cisco often tests the distinction between the control plane (BGP EVPN) and the data plane (multicast or ingress replication) for BUM traffic, and the trap here is that candidates mistakenly think BGP EVPN is required for multicast-based replication, when in fact BGP EVPN is for route exchange and the underlay multicast handles the actual packet replication.

Practice this question →

MCQmedium

A data center architect is designing a spine-leaf network with 40 leaf switches and 4 spine switches. Each leaf has 48 x 25G server-facing ports and 8 x 100G uplinks to the spines. What is the oversubscription ratio from server to spine?

A.2:1

B.3:1

C.1.5:1

D.4:1

AnswerC

Correct calculation.

Why this answer

The oversubscription ratio is calculated by comparing the total server-facing bandwidth to the total uplink bandwidth. Each leaf switch has 48 x 25G server ports = 1200 Gbps of server-facing capacity, and 8 x 100G uplinks = 800 Gbps of spine-facing capacity. The ratio is 1200:800, which simplifies to 1.5:1, meaning the server-facing side has 1.5 times the bandwidth of the uplinks.

Exam trap

Cisco often tests the oversubscription ratio by providing port counts and speeds, and the trap here is that candidates mistakenly use the number of uplinks (8) as the total uplink bandwidth in Gbps, or incorrectly assume the server ports are 50G or 100G, leading to ratios like 2:1 or 3:1.

How to eliminate wrong answers

Option A (2:1) is wrong because it incorrectly assumes the server ports are 50G each or that the uplinks provide only 400 Gbps total, rather than calculating the actual 1200 Gbps down to 800 Gbps up. Option B (3:1) is wrong because it might result from miscalculating the server bandwidth as 48 x 50G = 2400 Gbps or misreading the uplink count as 4 x 100G = 400 Gbps, leading to 2400:800 or 1200:400. Option D (4:1) is wrong because it typically arises from confusing the number of uplinks (8) with their aggregate bandwidth, or from incorrectly assuming each server port is 100G, yielding 4800:800 or 4800:1200.

Practice this question →

100

MCQhard

Which of the following is a requirement for VPC peer keepalive to function correctly?

A.Must use the same IP subnet as peer-link

B.Must be a Layer 3 interface with unique VRF

C.Must be a direct Layer 2 connection

D.Must be in the same VLAN as peer-link

AnswerB

Recommended to use a dedicated VRF for keepalive.

Why this answer

VPC peer keepalive requires a Layer 3 interface with a unique VRF to ensure that keepalive messages are sent over a dedicated, isolated path that is independent of the peer-link. This prevents the keepalive from being disrupted by issues on the peer-link and allows the VPC peers to detect failures even when the peer-link is down. The keepalive uses UDP port 3200 and must be routed through a separate VRF to avoid conflicts with the management or default routing tables.

Exam trap

Cisco often tests the misconception that VPC peer keepalive must be a direct Layer 2 connection or share the same subnet as the peer-link, when in fact it requires a Layer 3 interface with a unique VRF to ensure fault isolation.

How to eliminate wrong answers

Option A is wrong because VPC peer keepalive must use a different IP subnet than the peer-link; using the same subnet would cause routing conflicts and prevent proper isolation. Option C is wrong because VPC peer keepalive requires a Layer 3 routed interface, not a direct Layer 2 connection, as it relies on IP routing to traverse the keepalive path. Option D is wrong because the keepalive interface must be in a different VLAN (or no VLAN at all) than the peer-link; being in the same VLAN would create a Layer 2 loop and defeat the purpose of a separate keepalive path.

Practice this question →

101

MCQmedium

In a VXLAN overlay, what is the role of the VXLAN Network Identifier (VNI)?

A.It identifies the VXLAN tunnel source and destination IP

B.It identifies the overlay Layer 2 network segment

C.It is the multicast group address for BUM traffic

D.It is used for ECMP load balancing

AnswerB

VNI uniquely identifies a Layer 2 segment across the overlay.

Why this answer

The VXLAN Network Identifier (VNI) is a 24-bit field in the VXLAN header that uniquely identifies an overlay Layer 2 network segment, allowing multiple isolated Layer 2 domains to coexist over a shared Layer 3 underlay. It is analogous to a VLAN ID in traditional networking but provides up to 16 million segments, enabling scalable network virtualization.

Exam trap

The trap here is that candidates confuse the VNI with the multicast group address used for BUM traffic, but the VNI is a segment identifier, not a multicast address; Cisco often tests this by listing 'multicast group' as a distractor to see if you understand the separation of overlay identification from underlay forwarding.

How to eliminate wrong answers

Option A is wrong because the VXLAN tunnel source and destination IP addresses are defined by the VTEP (VXLAN Tunnel Endpoint) configuration, not by the VNI; the VNI identifies the Layer 2 segment, not the tunnel endpoints. Option C is wrong because the multicast group address for BUM (Broadcast, Unknown Unicast, Multicast) traffic is configured separately in the underlay network (e.g., using PIM or head-end replication), while the VNI is used to map the overlay segment to the appropriate multicast group or replication list. Option D is wrong because ECMP (Equal-Cost Multi-Path) load balancing in VXLAN is typically based on the outer UDP source port (derived from the inner packet hash) or the outer IP header, not the VNI; the VNI is a static identifier and does not influence load-balancing decisions.

Practice this question →

102

MCQmedium

In a Cisco ACI fabric, a tenant has multiple bridge domains with different subnets. The administrator wants to allow traffic between two EPGs in the same tenant but different bridge domains. Which ACI construct is required to enable communication?

A.Contracts with filters and subjects

B.Shared L3Out

C.VRF route leaking

D.VMM domain integration

AnswerA

Contracts specify allowed traffic between EPGs.

Why this answer

In Cisco ACI, EPGs in different bridge domains are isolated by default. To enable communication between them, a contract must be applied that defines the allowed traffic. Contracts use filters and subjects to specify permitted protocols and ports, and are the only native ACI mechanism for inter-EPG communication across bridge domains within the same tenant.

Exam trap

Cisco often tests the misconception that EPGs in the same tenant can communicate without a contract, but in ACI, all inter-EPG traffic (even within the same tenant) requires a contract unless the EPGs are in the same bridge domain and have unicast routing enabled.

How to eliminate wrong answers

Option B is wrong because a Shared L3Out is used to provide external connectivity (e.g., to a WAN or internet), not to enable communication between EPGs within the same tenant. Option C is wrong because VRF route leaking is a feature for inter-VRF routing in traditional networking, but ACI uses contracts for policy-based forwarding and does not rely on route leaking for intra-tenant EPG communication. Option D is wrong because VMM domain integration integrates ACI with hypervisor managers (e.g., VMware vCenter) for automated EPG deployment, but it does not itself enable traffic between EPGs in different bridge domains.

Practice this question →

103

MCQmedium

A network engineer is troubleshooting a VXLAN EVPN problem where some endpoints are not reachable. The output of 'show bgp l2vpn evpn' shows Type-3 routes but no Type-2 routes for a specific VNI. What should the engineer check?

A.The route-target import/export is misconfigured.

B.BGP session is not established.

C.The VNI is not configured under the NVE interface.

D.The VLAN corresponding to the VNI has no active ports.

AnswerD

Type-2 routes carry MAC/IP information. Without active ports in the VLAN, no MACs are learned, so no Type-2 routes are advertised.

Why this answer

Type-3 routes (IMET routes) are used for BUM traffic forwarding and are advertised when the VNI is configured under the NVE interface, even if no endpoints are active. Type-2 routes (MAC/IP advertisement routes) are only generated when the switch learns a MAC address on a VLAN associated with that VNI. If Type-3 routes exist but Type-2 routes are missing, the VNI is correctly configured for the overlay, but no active ports in the corresponding VLAN are learning MAC addresses, preventing Type-2 route generation.

Exam trap

Cisco often tests the distinction between control-plane (BGP route types) and data-plane (VNI/NVE configuration) readiness, trapping candidates who assume Type-3 routes imply full VNI functionality without checking for active MAC learning on the access side.

How to eliminate wrong answers

Option A is wrong because a route-target import/export misconfiguration would prevent the reception or advertisement of all EVPN route types (including Type-3), not selectively block Type-2 routes while allowing Type-3. Option B is wrong because if the BGP session were not established, no EVPN routes (neither Type-2 nor Type-3) would appear in the 'show bgp l2vpn evpn' output. Option C is wrong because if the VNI were not configured under the NVE interface, the switch would not generate any EVPN routes for that VNI, including Type-3 routes.

Practice this question →

104

MCQeasy

In a spine-leaf architecture using eBGP, which of the following is the recommended BGP configuration for the spine switches?

A.No BGP; use OSPF instead

B.Single ASN for all spines

C.Unique ASN for each spine switch

D.Same ASN as leaves

AnswerC

Each spine gets a unique ASN so that leaves see multiple AS paths, enabling ECMP.

Why this answer

In eBGP-based spine-leaf architectures, each spine switch should use a unique ASN to enable BGP’s loop prevention mechanism (the AS_PATH attribute). This ensures that leaf switches can detect and discard routes received from two different spines that originated from the same leaf, preventing routing loops and allowing load balancing across multiple spines. A unique ASN per spine is the recommended design per Cisco’s best practices for data center fabrics.

Exam trap

Cisco often tests the misconception that all spine switches should share a single ASN for simplicity, but the trap here is that this breaks eBGP’s loop prevention and prevents ECMP load balancing across spines.

How to eliminate wrong answers

Option A is wrong because OSPF is not recommended in spine-leaf fabrics due to its lack of scalability, slow convergence, and inability to support multipathing as efficiently as eBGP; eBGP is the preferred underlay routing protocol for modern data center designs. Option B is wrong because using a single ASN for all spines would cause BGP to treat routes from different spines as having the same AS_PATH, potentially leading to loop prevention issues and preventing the leaf from load-balancing across multiple spines. Option D is wrong because using the same ASN as leaves violates eBGP’s requirement for different ASNs between peers; if spines and leaves share an ASN, BGP will not form an eBGP session (it becomes iBGP) and the design loses the loop-prevention and path-selection benefits of eBGP.

Practice this question →

105

Matchingmedium

Match each Cisco UCS Manager CLI command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays hardware details of servers

Enters organization configuration mode

Creates a logical server definition

Configures virtual network interface card

Applies pending configuration changes

Why these pairings

In UCS Manager CLI, 'scope server' enters server management mode, 'scope chassis' enters chassis management mode, and 'show environment' displays environmental status. Other commands like 'scope fabric-interconnect' or 'show server' have different functions.

Practice this question →

106

MCQmedium

In a VXLAN EVPN fabric, which component is responsible for encapsulating and decapsulating VXLAN packets?

A.NVE

B.VNI

C.VXLAN gateway

D.VTEP

AnswerD

VTEP is the tunnel endpoint that handles encapsulation.

Why this answer

The VTEP (VXLAN Tunnel Endpoint) is the component responsible for encapsulating Ethernet frames in VXLAN packets and decapsulating them at the destination. It performs the UDP encapsulation with a VXLAN header, using the VNI to identify the Layer 2 segment, and forwards traffic over the underlay network. In an EVPN fabric, the VTEP also participates in the control plane to learn remote MAC and IP addresses via MP-BGP.

Exam trap

Cisco often tests the distinction between the VTEP as the functional endpoint and the NVE as the logical interface, leading candidates to mistakenly select NVE when the question asks for the component responsible for encapsulation.

How to eliminate wrong answers

Option A is wrong because NVE (Network Virtualization Edge) is a logical interface on the VTEP that enables VXLAN encapsulation and decapsulation, but it is not the physical or logical component that performs the encapsulation itself; the VTEP is the overall endpoint. Option B is wrong because VNI (VXLAN Network Identifier) is a 24-bit segment ID used to identify a specific Layer 2 overlay network, not a component that encapsulates or decapsulates packets. Option C is wrong because a VXLAN gateway is a device that bridges VXLAN and non-VXLAN networks (e.g., VLAN-to-VXLAN or VXLAN-to-VXLAN), but the encapsulation and decapsulation function is still performed by the VTEP component within that gateway.

Practice this question →

107

Multi-Selecthard

Which TWO statements are true about Cisco ACI contracts? (Choose two)

Select 2 answers

A.Contracts can be reused across multiple EPGs.

B.Contracts are unidirectional from consumer to provider.

C.A contract can include multiple subjects.

D.Subjects within a contract specify only the destination ports.

E.Contracts are always bidirectional.

AnswersA, C

A contract can be applied to many EPG pairs, allowing reuse and simplified policy management.

Why this answer

Cisco ACI contracts are designed as reusable policy constructs. Once a contract is defined, it can be applied to multiple EPGs (Endpoint Groups) without redefining the rules, promoting consistency and reducing administrative overhead. This reusability is a core principle of ACI's policy-based networking model.

Exam trap

A common misconception is that ACI contracts are bidirectional by default. In reality, contracts are unidirectional from provider to consumer by default. To allow traffic in both directions, you must explicitly add a filter that permits the reverse direction.

The exam often tests this distinction.

Practice this question →

108

MCQhard

A network engineer is designing a spine-leaf fabric with oversubscription ratio of 3:1. Each leaf switch uses 40 Gbps uplinks to the spine and has 48 x 10 Gbps server ports. How many spine links are needed per leaf to achieve the target oversubscription?

A.3

B.4

C.2

D.5

AnswerB

4 uplinks give 160 Gbps, oversubscription = 480/160 = 3:1.

Why this answer

The oversubscription ratio is the ratio of server-facing bandwidth to spine-facing bandwidth. Each leaf has 48 x 10 Gbps = 480 Gbps of server-facing capacity. To achieve a 3:1 oversubscription ratio, the spine-facing bandwidth must be 480 Gbps / 3 = 160 Gbps.

Since each uplink is 40 Gbps, you need 160 / 40 = 4 spine links per leaf.

Exam trap

Cisco often tests the ability to correctly compute oversubscription by dividing server bandwidth by uplink bandwidth, not the other way around, and candidates may mistakenly multiply or invert the ratio.

How to eliminate wrong answers

Option A (3) is wrong because 3 x 40 Gbps = 120 Gbps, which gives an oversubscription ratio of 480/120 = 4:1, not 3:1. Option C (2) is wrong because 2 x 40 Gbps = 80 Gbps, resulting in a 6:1 oversubscription ratio. Option D (5) is wrong because 5 x 40 Gbps = 200 Gbps, which yields a 2.4:1 oversubscription ratio, under-subscribing the fabric and wasting uplink ports.

Practice this question →

109

MCQmedium

An engineer is configuring VXLAN bridging and routing on a Cisco Nexus 9000 switch. Which configuration is required to enable inter-VNI routing?

A.Configure a VLAN interface under the bridge domain.

B.Enable ip routing under VRF.

C.Configure anycast gateway MAC.

D.Configure a VRF and associate the VLAN interface to it.

AnswerC

Provides a common gateway MAC across all leaf switches, enabling seamless routing between VNIs.

Why this answer

Inter-VNI routing requires a shared anycast gateway MAC address across all VTEPs in the same VXLAN fabric. This allows the switch to respond to ARP requests for the gateway IP and forward traffic between different VNIs without relying on a traditional routed interface. The anycast gateway MAC is configured under the VLAN interface (SVI) using the 'fabric forwarding anycast-gateway-mac' command.

Exam trap

Cisco often tests the misconception that simply enabling IP routing or associating an SVI to a VRF is sufficient for inter-VNI routing, when in fact the anycast gateway MAC is the mandatory configuration that enables the distributed gateway functionality.

How to eliminate wrong answers

Option A is wrong because configuring a VLAN interface under the bridge domain is part of VXLAN bridging, not routing; inter-VNI routing requires an SVI with anycast gateway, not just a VLAN interface in the bridge domain. Option B is wrong because enabling 'ip routing' under VRF is a prerequisite for any L3 forwarding but does not specifically enable inter-VNI routing; the critical missing piece is the anycast gateway MAC. Option D is wrong because associating a VLAN interface to a VRF is necessary for VRF-based routing but alone does not enable inter-VNI routing; the anycast gateway MAC must be configured on the SVI to allow the switch to act as a distributed gateway.

Practice this question →

110

Multi-Selecthard

In an ACI fabric, which THREE components are required to define a policy that allows communication between two EPGs?

Select 3 answers

A.Contract

B.Consumer EPG

C.L3Out

D.Tenant

E.Provider EPG

AnswersA, B, E

Contract defines the allowed communication.

Why this answer

A contract is required because it defines the rules (filters, subjects, and actions) that govern traffic between EPGs. Without a contract, no communication is allowed between EPGs, even within the same tenant. The consumer EPG initiates the communication and the provider EPG hosts the service, so both are mandatory endpoints of the contract relationship.

Exam trap

Cisco often tests the misconception that a tenant or L3Out is part of the inter-EPG policy definition, but the trap here is that only the contract, consumer EPG, and provider EPG are the three mandatory components to enable communication between two EPGs.

Practice this question →

111

MCQmedium

Which command is used on a Cisco Nexus switch to display the VXLAN network identifier (VNI) associated with a specific VLAN?

A.show vxlan vni

B.show vlan id 100

C.show interface nve 1

D.show running-config vxlan

AnswerA

This command lists VNIs and their associated VLANs.

Why this answer

The 'show vxlan vni' command on Cisco Nexus switches displays the VXLAN network identifier (VNI) and its mapping to VLANs, including the associated VLAN ID and segment state. This command directly answers the question by showing the VNI-to-VLAN binding, which is essential for verifying VXLAN overlay configurations.

Exam trap

Cisco often tests the distinction between commands that show VXLAN configuration versus operational state, and the trap here is that candidates confuse 'show interface nve 1' (which shows VNI membership on the NVE) with the command that specifically maps a VLAN to its VNI, leading them to select option C instead of the correct 'show vxlan vni'.

How to eliminate wrong answers

Option B is wrong because 'show vlan id 100' displays traditional VLAN information (like ports and name) but does not show any VXLAN VNI mappings, as VXLAN operates at a different encapsulation layer. Option C is wrong because 'show interface nve 1' shows the NVE interface configuration and state (source IP, VNI membership, etc.) but does not directly display the VNI associated with a specific VLAN; it lists VNIs configured on the NVE but not their VLAN bindings. Option D is wrong because 'show running-config vxlan' displays the VXLAN configuration commands (like 'vni' and 'member vni') but does not show the operational mapping of VNI to VLAN in a concise, per-VLAN lookup format.

Practice this question →

112

MCQeasy

Which protocol is used to carry VXLAN encapsulation and facilitates the exchange of MAC reachability information between VTEPs in a VXLAN EVPN fabric?

A.eBGP

B.OSPF

C.MP-BGP

D.PIM

AnswerC

MP-BGP with EVPN address family carries MAC/VNI routes between VTEPs.

Why this answer

In a VXLAN EVPN fabric, MP-BGP (Multiprotocol BGP) is the control plane protocol used to advertise MAC reachability information between VTEPs. It carries VXLAN encapsulation information via the BGP EVPN address family (AFI L2VPN / SAFI EVPN), enabling VTEPs to learn remote MAC addresses and VNI mappings without relying on data-plane flooding.

Exam trap

Cisco often tests the distinction between the control plane (MP-BGP) and the data plane (VXLAN) or underlay protocols (OSPF, PIM), leading candidates to mistakenly choose OSPF or PIM for MAC reachability exchange.

How to eliminate wrong answers

Option A is wrong because eBGP alone does not support the EVPN address family or carry MAC/VXLAN information; MP-BGP with the L2VPN EVPN address family is required. Option B is wrong because OSPF is a link-state IGP that distributes IP routes, not MAC reachability or VXLAN encapsulation attributes. Option D is wrong because PIM is a multicast routing protocol used for underlay multicast replication in VXLAN, not for exchanging MAC reachability information in the control plane.

Practice this question →

113

MCQmedium

In a Cisco ACI fabric, a new EPG is created and associated with a bridge domain that has 'Unicast Routing' enabled. However, endpoints in that EPG cannot communicate with endpoints in other EPGs in the same VRF. What is missing?

A.The EPG must be attached to a Layer 3 outside

B.The bridge domain must have 'L3 Unknown Multicast Flooding' set

C.A contract between the EPGs

D.A route leak between bridge domains

AnswerC

Inter-EPG communication requires a contract; without it, packets are dropped.

Why this answer

In Cisco ACI, communication between EPGs within the same VRF is not allowed by default; it requires a contract. A contract defines the policies (allow/deny) and filters for traffic between EPGs. Without a contract, all traffic is dropped, even if the bridge domain has unicast routing enabled.

Option C is correct because the missing element is the contract that explicitly permits inter-EPG communication.

Exam trap

Cisco often tests the misconception that enabling unicast routing on a bridge domain is sufficient for inter-EPG communication, when in fact contracts are mandatory in ACI to allow any traffic between EPGs.

How to eliminate wrong answers

Option A is wrong because attaching a Layer 3 outside is used for external connectivity (e.g., to a router or WAN), not for enabling communication between EPGs within the same VRF. Option B is wrong because 'L3 Unknown Multicast Flooding' controls how unknown multicast traffic is handled (flood or forward to a multicast router), not unicast routing between EPGs. Option D is wrong because route leaking between bridge domains is not a native ACI concept; inter-EPG routing within the same VRF is handled by the ACI fabric automatically via the contract policy, not by explicit route leaks.

Practice this question →

114

MCQeasy

Refer to the exhibit. What is the current state of the VPC domain?

A.VPC domain not configured

B.Peer-link down

C.Consistency check failed

D.Operational

AnswerD

All fields indicate normal operation.

Why this answer

The exhibit shows the output of 'show vpc' with the vPC domain ID set to 100, the peer-keepalive link status as 'Active', and the peer-link status as 'up'. The vPC role is 'primary' and the operational status is listed as 'operational', which indicates that the vPC domain is fully functional and all consistency checks have passed. Therefore, the current state is operational.

Exam trap

Cisco often tests the distinction between the peer-link being 'up' and the vPC domain being 'operational', where candidates may incorrectly assume a peer-link failure when the domain is actually operational, or confuse a consistency check failure with a peer-link issue.

How to eliminate wrong answers

Option A is wrong because the output clearly shows a vPC domain ID of 100, peer-keepalive link status as 'Active', and peer-link status as 'up', indicating the domain is configured. Option B is wrong because the peer-link status is explicitly shown as 'up' in the output, not down. Option C is wrong because the operational status is 'operational' and there is no indication of a consistency check failure; a failed consistency check would show a 'failed' or 'suspended' status for the vPC.

Practice this question →

115

Drag & Dropmedium

Arrange the steps to create a service profile template in Cisco UCS Manager.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Service profile template requires UUID pool, vNIC template, profile creation, server pool association, and assignment.

Practice this question →

116

MCQeasy

In a Cisco NX-OS environment, which command is used to verify the operational state of a virtual Port Channel (vPC) peer link?

A.show vpc brief

B.show port-channel summary

C.show running-config vpc

D.show vpc consistency-parameters

AnswerA

Displays vPC peer status, peer-link status, and consistency.

Why this answer

The 'show vpc brief' command displays the operational state of the vPC peer link, including whether the peer link is up, the role of the switch (primary/secondary), and the status of the vPC domain. This command is specifically designed to verify the health and operational status of the vPC peer link and member ports in a Cisco NX-OS environment.

Exam trap

Cisco often tests the distinction between commands that show configuration versus operational state, leading candidates to mistakenly choose 'show running-config vpc' (which only shows static configuration) instead of 'show vpc brief' (which shows live operational status).

How to eliminate wrong answers

Option B is wrong because 'show port-channel summary' displays the status of all port-channel interfaces, but it does not provide vPC-specific operational details such as peer link status, vPC role, or consistency checks. Option C is wrong because 'show running-config vpc' shows the configured vPC parameters (e.g., domain ID, peer keepalive settings) but not the real-time operational state of the peer link. Option D is wrong because 'show vpc consistency-parameters' is used to verify that vPC member ports have consistent configuration parameters across both peers, not to check the operational state of the peer link itself.

Practice this question →

117

MCQmedium

An engineer is configuring OSPF on a Cisco Nexus switch in a data center. The network consists of multiple point-to-point links. To improve convergence, the engineer wants to reduce the dead interval to 10 seconds. Which command sets the dead interval correctly?

A.ip ospf dead-interval 30

B.ip ospf hello-interval 10

C.ip ospf dead-interval 10

D.ip ospf dead-interval 40

AnswerC

Sets dead interval to 10 seconds.

Why this answer

The 'ip ospf dead-interval 10' command directly sets the OSPF dead interval to 10 seconds on a Cisco Nexus switch. The dead interval is the time a router waits without receiving a hello packet before declaring the neighbor down, and reducing it to 10 seconds speeds up convergence on point-to-point links.

Exam trap

Cisco often tests the distinction between the 'ip ospf dead-interval' and 'ip ospf hello-interval' commands, trapping candidates who confuse the two or assume that changing the hello interval automatically adjusts the dead interval.

How to eliminate wrong answers

Option A is wrong because 'ip ospf dead-interval 30' sets the dead interval to 30 seconds, not 10, which does not meet the requirement. Option B is wrong because 'ip ospf hello-interval 10' sets the hello interval to 10 seconds, not the dead interval; while related, this command does not directly configure the dead interval. Option D is wrong because 'ip ospf dead-interval 40' sets the dead interval to 40 seconds, which is longer than the desired 10 seconds and would actually slow convergence.

Practice this question →

118

MCQmedium

In a Cisco ACI fabric, which object represents a collection of endpoints that share the same forwarding behavior and security policies?

A.VRF

B.Tenant

C.Endpoint Group (EPG)

D.Bridge Domain (BD)

AnswerC

EPG is a collection of endpoints with shared policies.

Why this answer

In Cisco ACI, an Endpoint Group (EPG) is a logical object that groups endpoints (e.g., servers, VMs) with identical forwarding behavior and security policies. EPGs are the fundamental unit for applying contracts (security policies) and defining communication rules within the fabric, ensuring consistent traffic handling across all members.

Exam trap

Cisco often tests the distinction between an EPG and a Bridge Domain, where candidates mistakenly think the BD (Layer 2 domain) defines security policies, but in ACI, security is applied at the EPG level via contracts.

How to eliminate wrong answers

Option A is wrong because a VRF (Virtual Routing and Forwarding) is a Layer 3 routing domain that provides path isolation and route separation, not a collection of endpoints with shared forwarding and security policies. Option B is wrong because a Tenant is a top-level administrative container for policies and objects (like EPGs, VRFs, BDs) but does not itself represent a group of endpoints. Option D is wrong because a Bridge Domain (BD) defines a Layer 2 forwarding domain and subnet, but it is the EPG that maps endpoints to the BD and applies security policies via contracts.

Practice this question →

119

MCQmedium

An organization is deploying a new leaf-spine fabric with Cisco ACI. The requirement is to allow inter-tenant communication between two EPGs in different tenants. Which configuration object is necessary to enable this communication?

A.A common VRF that spans both tenants.

B.A filter that permits the required traffic.

C.A bridge domain that connects both EPGs.

D.A shared contract between the two EPGs.

AnswerD

Contracts define allowed communication; shared contracts work across tenants.

Why this answer

In Cisco ACI, inter-tenant communication between EPGs in different tenants requires a shared contract. A contract defines the rules (filters) that permit traffic between EPGs, and when it is marked as 'shared,' it can be consumed by EPGs across tenant boundaries. This allows the provider EPG in one tenant to expose services to a consumer EPG in another tenant without merging the tenants' VRFs or bridge domains.

Exam trap

Cisco often tests the misconception that a shared VRF or bridge domain is required for inter-tenant communication, but the correct mechanism is a shared contract that applies policy across tenant boundaries without merging the underlying network constructs.

How to eliminate wrong answers

Option A is wrong because a common VRF spanning both tenants is not a configuration object for inter-tenant communication; VRFs are tenant-scoped and cannot be shared across tenants—each tenant has its own private VRF namespace. Option B is wrong because a filter alone only defines the traffic type (e.g., TCP port 80) but does not provide the policy framework (contract) needed to permit traffic between EPGs; a filter must be part of a contract. Option C is wrong because a bridge domain connects EPGs within the same tenant and VRF, not across tenants; inter-tenant communication requires a contract, not a shared bridge domain.

Practice this question →

120

Multi-Selecteasy

Which two VXLAN control plane options are supported on Cisco Nexus 9000 switches? (Choose two.)

Select 2 answers

A.Multicast

B.OTV

C.Static VXLAN tunnel

D.OpenFlow

E.MP-BGP EVPN

AnswersA, E

Traditional VXLAN uses multicast for BUM traffic and MAC learning.

Why this answer

VXLAN on Cisco Nexus 9000 switches supports both multicast-based control plane (using IGMP/PIM to flood BUM traffic) and MP-BGP EVPN (RFC 7432) as the control plane for distributing MAC/VTEP reachability. Multicast is the traditional method for handling BUM traffic in VXLAN fabrics, while MP-BGP EVPN provides a more scalable, standards-based control plane with host route advertisement and multi-tenancy.

Exam trap

Cisco often tests the distinction between VXLAN control plane options and other overlay technologies (like OTV) or configuration methods (like static tunnels), leading candidates to confuse supported control planes with unrelated features.

Practice this question →

121

Multi-Selecthard

Which three checks are part of the vPC type-1 consistency check? (Choose three.)

Select 3 answers

A.Port-channel load-balancing method

B.STP mode

C.VLAN interface state

D.MTU on the peer-link

E.MST region name

AnswersB, C, E

STP mode (e.g., RSTP, MST) must match.

Why this answer

Type-1 consistency parameters are critical and must match on both vPC peers; they include STP mode, MST region, VLAN configuration, and vPC-related parameters like role priority. STP mode, MST region name, and VLAN interface configuration are type-1.

Practice this question →

122

MCQmedium

A network administrator is troubleshooting a vPC pair and needs to verify the operational status of the vPC peer-link. Which NX-OS command displays vPC status including peer-link and member port states?

A.show vpc brief

B.show vpc consistency-parameters

C.show vpc peer-keepalive

D.show vpc

AnswerD

Shows vPC status, peer-link status, and member ports.

Why this answer

The 'show vpc' command (without any keyword) is the correct choice because it displays comprehensive vPC operational status, including the peer-link state (up/down), member port states, and vPC consistency status. This single command provides a high-level summary of all vPC components, making it the go-to command for initial troubleshooting of vPC peer-link and member port health.

Exam trap

The trap is that 'show vpc brief' does display the peer-link status (up/down), so candidates may think it provides sufficient information. However, it omits detailed member port states (e.g., individual port channel members and their status), which are essential for verifying operational health. The correct command 'show vpc' includes both peer-link status and per-member port details.

How to eliminate wrong answers

Option A is wrong because 'show vpc brief' displays a condensed output showing only vPC IDs, port channels, and their status, but it does not include detailed peer-link state or member port status. Option B is wrong because 'show vpc consistency-parameters' is used to verify that vPC configuration parameters (e.g., STP, VLANs) are consistent between the two vPC peers, not to show operational status of the peer-link or member ports. Option C is wrong because 'show vpc peer-keepalive' only displays the status of the Layer 3 keepalive link between vPC peers, which is separate from the peer-link (the Layer 2 port-channel used for data traffic and control-plane synchronization).

Practice this question →

123

MCQhard

In a Cisco ACI fabric, an external L3Out is configured to advertise a subnet to the outside. Which object must be created in the tenant to define the Layer 3 outside network connection?

A.L3Out

B.External EPG

C.Contract

D.Bridge Domain

AnswerA

L3Out is the object that defines the external connection.

Why this answer

In Cisco ACI, an L3Out is the object that defines the Layer 3 outside network connection for a tenant. It is created within the tenant to specify the routing protocol (e.g., OSPF, BGP, EIGRP) and the external subnet that will be advertised to the outside world. Without an L3Out, the fabric cannot establish external connectivity or advertise routes.

Exam trap

The trap here is that candidates often confuse the External EPG (which groups external endpoints) with the L3Out itself, but the L3Out is the actual configuration object that defines the Layer 3 outside network connection and routing policies.

How to eliminate wrong answers

Option B is wrong because an External EPG (External Endpoint Group) is a logical grouping of external endpoints that consume or provide services, but it is not the object that defines the Layer 3 outside network connection; it is associated with an L3Out. Option C is wrong because a Contract defines the policy for communication between EPGs (e.g., allow/deny traffic), not the Layer 3 outside network connection itself. Option D is wrong because a Bridge Domain is a Layer 2 forwarding context within a tenant that handles internal subnet traffic, not external Layer 3 routing.

Practice this question →

124

MCQeasy

Which VPC component is used to send Layer 2 control plane traffic between peer switches?

A.VPC consistency check

B.VPC peer keepalive

C.VPC member port

D.VPC peer-link

AnswerD

The peer-link is a Layer 2 port-channel that carries control and data traffic between peers.

Why this answer

The VPC peer-link is the special port channel that carries Layer 2 control plane traffic (such as BPDUs, HSRP hellos, and IGMP queries) between the two VPC peer switches. It ensures that both peers have a consistent view of the Layer 2 topology and can synchronize state for protocols like STP and vPC. Without the peer-link, control plane traffic would not be exchanged, breaking the VPC domain's ability to operate as a single logical switch.

Exam trap

Cisco often tests the distinction between the peer-link (which carries Layer 2 control plane traffic) and the peer-keepalive link (which only carries Layer 3 heartbeats), leading candidates to mistakenly select the peer-keepalive option.

How to eliminate wrong answers

Option A is wrong because VPC consistency check is a validation mechanism that verifies configuration parameters (e.g., STP mode, MTU) are identical on both peers, but it does not carry any traffic. Option B is wrong because VPC peer keepalive uses a separate Layer 3 link (typically a management or routed interface) to exchange periodic keepalive messages to detect peer failures; it does not carry Layer 2 control plane traffic. Option C is wrong because VPC member port is an individual port that belongs to a VPC and forwards data traffic, but it does not carry control plane traffic between the peers.

Practice this question →

125

MCQhard

In a VXLAN EVPN multi-tier design, which feature ensures traffic between leaf switches takes the optimal path without hair-pinning through a spine?

A.Anycast gateway

B.Type-2 routes

C.ECMP

D.ARP suppression

AnswerC

ECMP enables load distribution across multiple spines, avoiding hair-pinning.

Why this answer

C is correct because Equal-Cost Multipath (ECMP) in a VXLAN EVPN multi-tier design allows leaf switches to load-balance traffic across multiple equal-cost spine paths, ensuring that traffic between leaf switches takes the most direct route without being forced to hair-pin through a spine. ECMP leverages the underlying IP fabric's routing to forward VXLAN-encapsulated packets over any available spine, avoiding suboptimal forwarding that would occur if a single spine were used as a relay.

Exam trap

Cisco often tests the misconception that Anycast Gateway or ARP suppression directly influences inter-leaf forwarding paths, when in fact ECMP is the mechanism that enables optimal multi-path routing in the underlay to avoid hair-pinning.

How to eliminate wrong answers

Option A is wrong because Anycast Gateway (e.g., using the same IP and MAC on multiple VTEPs) is designed to provide first-hop redundancy and optimal host-to-gateway forwarding, not to prevent hair-pinning of leaf-to-leaf traffic through a spine. Option B is wrong because Type-2 routes (MAC/IP advertisement routes) are used in EVPN to advertise host reachability and MAC-to-IP bindings, not to influence the path selection between leaf switches. Option D is wrong because ARP suppression is a feature that reduces broadcast traffic by caching ARP replies on the VTEP, but it does not affect the forwarding path or prevent hair-pinning through a spine.

Practice this question →

126

MCQmedium

An engineer notices that a vPC peer link is flapping. Which vPC component must be operational for the vPC to function correctly?

A.vPC member port

B.vPC consistency check

C.vPC peer link

D.vPC peer keepalive link

AnswerC

Peer link must be up for vPC to operate.

Why this answer

The vPC peer link is the critical component that must be operational for the vPC to function correctly. It carries control-plane traffic (e.g., Cisco Fabric Services over Ethernet, or CFSoE) and data-plane traffic between the two vPC peer switches. If the peer link flaps, the vPC domain cannot synchronize the necessary state information, causing the vPC to fail or become unstable.

Exam trap

Cisco often tests the misconception that the peer keepalive link is the most critical component for vPC operation, but in reality, the peer link is essential for data and control-plane synchronization, while the keepalive link is only a secondary heartbeat mechanism.

How to eliminate wrong answers

Option A is wrong because vPC member ports are the individual ports that belong to the vPC, but they are not required to be operational for the vPC itself to function; the vPC can exist even if member ports are down. Option B is wrong because the vPC consistency check is a validation mechanism that ensures configuration parameters match between peers, but it does not directly cause the vPC to function or flap; it only flags mismatches. Option D is wrong because the vPC peer keepalive link is used solely for monitoring the liveness of the peer switch via a Layer 3 path (e.g., using UDP on port 3200), and its failure does not cause the vPC to flap; it only triggers a secondary check if the peer link fails.

Practice this question →

127

MCQhard

Refer to the exhibit. What is the most likely cause of neighbor 10.1.1.3 being stuck in EXSTART?

A.Duplicate router ID.

B.OSPF network type mismatch.

C.MTU mismatch between the interfaces.

D.The interface is configured as passive.

AnswerC

MTU mismatch prevents DBD packets from being sent successfully.

Why this answer

In OSPF, the EXSTART state indicates that neighbors are negotiating the master/slave relationship and exchanging Database Description (DBD) packets. If the MTU of the interface on one side is larger than the MTU on the other, the larger DBD packet will be silently dropped, preventing the neighbor from progressing past EXSTART. This is a classic symptom of an MTU mismatch, as the OSPF adjacency will remain stuck in EXSTART or EXCHANGE.

Exam trap

Cisco often tests the MTU mismatch trap by having candidates confuse it with a network type mismatch, but the key differentiator is that MTU issues cause the adjacency to stall specifically in EXSTART/EXCHANGE, while network type mismatches prevent the adjacency from forming past INIT/2WAY.

How to eliminate wrong answers

Option A is wrong because a duplicate router ID would cause the adjacency to flap or remain in INIT/2WAY, not EXSTART, as OSPF detects the duplicate during the Hello exchange. Option B is wrong because an OSPF network type mismatch (e.g., broadcast vs. point-to-point) typically results in neighbors stuck in INIT or 2WAY, not EXSTART, due to mismatched Hello/dead intervals or DR/BDR election issues. Option D is wrong because a passive interface suppresses OSPF Hellos entirely, preventing any neighbor discovery, so the adjacency would never reach EXSTART.

Practice this question →

128

MCQmedium

An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?

A.It carries data traffic between vPC peers.

B.It is used to synchronize MAC address tables between peers.

C.It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.

D.It provides a Layer 3 keepalive to detect peer failure and should be on a separate VLAN.

AnswerC

Correct: peer keepalive is a Layer 3 heartbeat, often over mgmt0 or dedicated interface.

Why this answer

The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.

Exam trap

Cisco often tests the misconception that the vPC peer keepalive is a Layer 2 VLAN-based mechanism, but it is actually a Layer 3 IP keepalive that uses a management or dedicated routed interface, not a VLAN.

How to eliminate wrong answers

Option A is wrong because the vPC peer keepalive link never carries data traffic; data traffic between vPC peers flows only over the vPC peer-link (Layer 2 trunk). Option B is wrong because MAC address synchronization is performed over the vPC peer-link using Cisco Fabric Services (CFS), not over the keepalive link. Option D is wrong because the keepalive is a Layer 3 (IP) mechanism, not a Layer 2 VLAN-based keepalive; it uses a management or dedicated routed interface and does not require a separate VLAN.

Practice this question →

129

MCQmedium

An engineer is configuring a VXLAN EVPN fabric. Which address family must be enabled under BGP to exchange MAC/VTEP reachability information?

A.address-family ipv4 unicast

B.address-family l2vpn vpls

C.address-family vpnv4

D.address-family l2vpn evpn

AnswerD

This is the correct address family for EVPN.

Why this answer

In a VXLAN EVPN fabric, BGP is used as the control plane to exchange MAC and VTEP reachability information. The correct address family for this is 'l2vpn evpn' (address-family l2vpn evpn), which carries EVPN NLRI (Network Layer Reachability Information) as defined in RFC 7432. This enables the distribution of MAC addresses, IP-to-MAC bindings, and VTEP endpoints across the overlay network.

Exam trap

Cisco often tests the distinction between 'l2vpn vpls' and 'l2vpn evpn' — candidates mistakenly choose VPLS because it also deals with Layer 2 overlays, but VXLAN EVPN specifically requires the EVPN address family, not VPLS.

How to eliminate wrong answers

Option A is wrong because 'address-family ipv4 unicast' is used for exchanging traditional IPv4 unicast routes, not for MAC/VTEP reachability in an EVPN overlay. Option B is wrong because 'address-family l2vpn vpls' is used for VPLS (Virtual Private LAN Service) control plane signaling, which is a different technology and not compatible with VXLAN EVPN. Option C is wrong because 'address-family vpnv4' is used for MPLS Layer 3 VPNs (RFC 4364) to carry VPN-IPv4 routes, not for Layer 2 MAC/VTEP information in a VXLAN fabric.

Practice this question →

130

MCQeasy

Which NX-OS command displays the vPC consistency parameters and status on a Cisco Nexus switch?

A.show vpc peerlink

B.show vpc brief

C.show vpc consistency-parameters

D.show running-config vpc

AnswerC

Correct: displays type-1 and type-2 consistency.

Why this answer

The 'show vpc consistency-parameters' command is the correct choice because it directly displays the vPC consistency parameters and their status, which are critical for ensuring that both vPC peer switches have identical configurations for type-1 parameters (e.g., STP, VLANs, MTU). If these parameters mismatch, the vPC will be suspended to prevent traffic loops or forwarding issues. This command is the dedicated tool for verifying consistency before and after vPC configuration changes.

Exam trap

Cisco often tests the distinction between commands that show configuration versus runtime status, and the trap here is that candidates confuse 'show running-config vpc' (which shows configuration) with the dedicated consistency check command, or assume 'show vpc brief' includes consistency details when it only shows a high-level summary.

How to eliminate wrong answers

Option A is wrong because 'show vpc peerlink' displays the status and details of the vPC peer-link (e.g., port channel, keepalive), not the consistency parameters. Option B is wrong because 'show vpc brief' provides a summary of vPC status, role, and peer-link health, but does not list the individual consistency parameters or their compliance. Option D is wrong because 'show running-config vpc' shows the configured vPC commands in the running configuration, not the runtime consistency check results or parameter status.

Practice this question →

131

MCQeasy

A network engineer is troubleshooting high CPU utilization on a Nexus 9000 switch. Which command is most useful to identify the process consuming the most CPU?

A.show processes cpu history

B.show process cpu sort

C.show system resources

D.show cpu usage

AnswerB

This command sorts processes by CPU usage, allowing identification of the most intensive process.

Why this answer

The 'show process cpu sort' command on Nexus 9000 switches displays the current CPU utilization sorted by the process consuming the most CPU, allowing the engineer to quickly identify the top CPU consumer. This command provides a real-time, sorted list of processes with their CPU usage percentages, which is directly useful for troubleshooting high CPU utilization.

Exam trap

Cisco often tests the distinction between 'show processes cpu' (which lists all processes unsorted) and 'show process cpu sort' (which sorts by CPU usage), and the trap here is that candidates may confuse 'show cpu usage' with a valid command or assume 'show system resources' provides process-level detail.

How to eliminate wrong answers

Option A is wrong because 'show processes cpu history' shows historical CPU utilization data in a graphical format over time, not the current processes consuming CPU, so it cannot identify the specific process causing the spike. Option C is wrong because 'show system resources' displays overall system resource usage (memory, CPU, buffers) but does not break down CPU usage by individual process, making it insufficient for pinpointing the culprit process. Option D is wrong because 'show cpu usage' is not a valid command on Nexus 9000 switches; the correct command for a summary of CPU usage is 'show processes cpu', which lists all processes but not sorted by CPU consumption.

Practice this question →

132

MCQmedium

In a data center running MST, which region configuration parameter must match on all switches for them to be part of the same region?

A.Spanning-tree mode

B.Bridge priority

C.Max-age and hello time

D.Region name, revision number, and VLAN-to-instance mapping

AnswerD

All three must match for consistent region membership.

Why this answer

In Multiple Spanning Tree (MST), switches must agree on three parameters to belong to the same MST region: the region name, the revision number, and the VLAN-to-instance mapping. These parameters are exchanged in MST BPDUs, and if any differ, the switches treat each other as being in different regions, which can lead to suboptimal or incorrect spanning-tree behavior.

Exam trap

Cisco often tests the specific three required MST region parameters (name, revision, mapping) to trap candidates who confuse global spanning-tree settings or timer values with region membership criteria.

How to eliminate wrong answers

Option A is wrong because spanning-tree mode (e.g., PVST+, Rapid PVST+, or MST) is a global protocol setting, not a region-specific parameter; switches can run MST but still be in different regions if their region configuration differs. Option B is wrong because bridge priority is a per-switch or per-instance value used for root bridge election, not a region-matching parameter. Option C is wrong because max-age and hello time are timer values used in spanning-tree operation across all regions, not parameters that define region membership.

Practice this question →

133

MCQmedium

In a spine-leaf architecture, what is the primary advantage of using a full mesh between spines and leaves?

A.It provides uniform low-latency paths between any two leaves

B.It reduces the total number of ports required

C.It removes the requirement for Spanning Tree Protocol

D.It eliminates the need for VLANs in the data center

AnswerA

Each leaf is one hop from any spine, ensuring low latency.

Why this answer

In a spine-leaf architecture, a full mesh between spines and leaves ensures that every leaf switch is connected to every spine switch. This design provides multiple equal-cost paths between any two leaf switches, allowing for uniform low-latency forwarding because traffic can traverse a single spine hop without congestion or path asymmetry. The full mesh eliminates the need for complex path selection and guarantees predictable, consistent latency across the fabric.

Exam trap

Cisco often tests the misconception that a full mesh reduces port count or eliminates VLANs, but the real advantage is uniform low-latency paths due to the equal-cost multipath design.

How to eliminate wrong answers

Option B is wrong because a full mesh between spines and leaves actually increases the total number of ports required (each leaf needs a port per spine, and each spine needs a port per leaf), not reduces them. Option C is wrong because while spine-leaf architectures inherently avoid loops due to the Layer 3 design (using routing protocols like OSPF or BGP), the full mesh itself does not remove the requirement for Spanning Tree Protocol; rather, the use of Layer 3 routing at the spine eliminates the need for STP. Option D is wrong because VLANs are still used in data center fabrics for segmentation and tenant isolation, even in a spine-leaf topology; the full mesh does not eliminate VLANs.

Practice this question →

134

Drag & Dropmedium

Arrange the steps to configure a vPC domain on a pair of Cisco Nexus switches.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

vPC requires feature vPC, then domain creation, keepalive link, peer-link, and member ports.

Practice this question →

135

MCQmedium

A network engineer is troubleshooting an OSPF adjacency issue between two Nexus switches. The neighbors are stuck in the EXSTART state. What is the most likely cause?

A.Hold timer mismatch

B.Incorrect area ID

C.MTU mismatch

D.Duplicate router ID

AnswerC

MTU mismatch leads to DBD packet rejection, keeping the neighbor in EXSTART.

Why this answer

When OSPF neighbors are stuck in the EXSTART state, the most common cause is an MTU mismatch. In EXSTART, the routers exchange Database Description (DBD) packets, which must be no larger than the interface MTU. If one interface has a smaller MTU, the DBD packet is dropped, preventing the adjacency from progressing to the Exchange state.

Cisco Nexus switches default to an MTU of 1500 bytes, but any mismatch will cause this issue.

Exam trap

Cisco often tests the MTU mismatch trap by making candidates confuse it with other OSPF adjacency issues, such as area ID or timer mismatches, which cause different stuck states (e.g., INIT or 2-WAY) rather than EXSTART.

How to eliminate wrong answers

Option A is wrong because a hold timer mismatch causes neighbors to be stuck in the INIT or 2-WAY state, not EXSTART; OSPF uses the Hello/Dead interval for neighbor discovery, not DBD exchange. Option B is wrong because an incorrect area ID prevents the adjacency from forming at all, typically leaving neighbors in the DOWN or ATTEMPT state, as OSPF requires matching area IDs in Hello packets. Option D is wrong because a duplicate router ID causes OSPF to reject the neighbor entirely, resulting in a state of DOWN or ATTEMPT, not EXSTART, as the router ID is verified during the Hello exchange.

Practice this question →

136

MCQeasy

Which Cisco Data Center Network Manager component is used for centralized fabric management and automation of Nexus switches?

A.DCNM

B.Cisco ISE

C.Prime Infrastructure

D.APIC

AnswerA

Correct: DCNM manages Nexus switches.

Why this answer

Cisco Data Center Network Manager (DCNM) is the centralized management platform specifically designed for fabric management, provisioning, and automation of Nexus switches in data center environments. It provides a single pane of glass for configuring, monitoring, and troubleshooting Nexus-based fabrics, including VXLAN EVPN, Cisco ACI, and traditional SAN/Nexus environments.

Exam trap

Cisco often tests the distinction between DCNM (for traditional Nexus fabric management) and APIC (for ACI fabric management), so candidates mistakenly choose APIC when the question mentions 'automation of Nexus switches' without specifying ACI.

How to eliminate wrong answers

Option B (Cisco ISE) is wrong because Cisco Identity Services Engine is a policy-based access control and authentication platform (RADIUS/802.1X), not a fabric management or automation tool for Nexus switches. Option C (Prime Infrastructure) is wrong because Cisco Prime Infrastructure is a lifecycle management tool for campus and branch networks (routers, switches, wireless), not designed for data center fabric automation of Nexus switches. Option D (APIC) is wrong because the Application Policy Infrastructure Controller is the centralized controller for Cisco ACI (Application Centric Infrastructure) fabrics, not for standalone Nexus switch management or traditional NX-OS automation.

Practice this question →

137

MCQeasy

In a spine-leaf data center architecture, what is the primary purpose of using equal-cost multipath (ECMP) routing?

A.To enable VXLAN encapsulation between VTEPs

B.To ensure loop-free Layer 2 topology

C.To provide load balancing across multiple paths between leaf and spine switches

D.To reduce the number of VLANs required in the fabric

AnswerC

ECMP distributes traffic across multiple equal-cost paths, increasing throughput and redundancy.

Why this answer

In a spine-leaf architecture, ECMP is used to distribute traffic across multiple equal-cost paths between leaf and spine switches. This provides load balancing by hashing flows across available uplinks, maximizing bandwidth utilization and ensuring no single link is overwhelmed. ECMP is a Layer 3 routing feature that operates with protocols like OSPF or BGP, not a Layer 2 or encapsulation mechanism.

Exam trap

Cisco often tests ECMP in the context of VXLAN/EVPN fabrics, and the trap here is confusing ECMP's role in load-balancing underlay traffic with VXLAN's role in overlay encapsulation, leading candidates to mistakenly associate ECMP with VXLAN tunnel establishment.

How to eliminate wrong answers

Option A is wrong because VXLAN encapsulation between VTEPs is enabled by configuring a VXLAN tunnel and a Network Virtualization Edge (NVE) interface, not by ECMP; ECMP can be used to load-balance VXLAN-encapsulated traffic but is not its primary purpose. Option B is wrong because ensuring a loop-free Layer 2 topology is the function of Spanning Tree Protocol (STP) or its alternatives like TRILL/SPB, while ECMP operates at Layer 3 and does not prevent Layer 2 loops. Option D is wrong because reducing the number of VLANs is achieved through VXLAN segmentation and VLAN-to-VNI mapping, not through ECMP routing.

Practice this question →

138

Multi-Selectmedium

An engineer is deploying a new VXLAN fabric and must ensure that the control plane can handle MAC advertisement without flooding. Which TWO protocols can be used for control plane learning in VXLAN? (Select two.)

Select 2 answers

A.IGMP Snooping

B.OpenFlow

C.VXLAN data plane learning

D.MP-BGP EVPN

E.OSPF

AnswersB, D

OpenFlow is a protocol for SDN controllers that can manage forwarding tables. In some VXLAN implementations, an SDN controller using OpenFlow can act as the control plane for MAC advertisement, eliminating flooding. Therefore, this is correct.

Why this answer

MP-BGP EVPN (Option D) is the primary control plane protocol for VXLAN, defined in RFC 7432, enabling MAC address advertisement without flooding. OpenFlow (Option B) is used in SDN controllers to manage forwarding tables, and in some VXLAN implementations (e.g., VMware NSX), it can serve as the control plane for MAC learning. IGMP Snooping (A) handles multicast group management, not MAC advertisement.

VXLAN data plane learning (C) is the flood-and-learn method, which the question explicitly wants to avoid. OSPF (E) is a routing protocol, not a VXLAN control plane.

Exam trap

Candidates often select only MP-BGP EVPN because it is the most well-known, but fail to recognize that OpenFlow can also serve as a control plane protocol in SDN-based VXLAN solutions. They might also mistakenly choose IGMP Snooping or OSPF due to familiarity with multicast or routing, ignoring the specific requirement for control plane learning.

Practice this question →

139

MCQhard

A data center architect is designing an ACI fabric with VMM integration to VMware vSphere. The goal is to allow dynamic policy assignment to virtual machines. What is the correct configuration hierarchy to enable this?

A.Create a VMM domain under the infra tenant and associate it with the physical domain.

B.Create a VMM domain under the tenant, integrate with vCenter, and map EPGs to port groups.

C.Use a Layer 4-Layer 7 service graph to connect VMs directly.

D.Configure VXLAN directly on the vSphere distributed switch.

AnswerB

This is the correct method for VMM integration.

Why this answer

VMM integration in ACI requires creating a VMM domain under a tenant (or common tenant), integrating it with vCenter, and then mapping EPGs to vSphere port groups. This allows dynamic policy assignment to VMs based on their port group membership, enabling micro-segmentation and automated policy enforcement as VMs move across hosts.

Exam trap

Cisco often tests the misconception that VMM domains belong to the infra tenant or that VXLAN must be manually configured on the vSphere switch, when in fact the VMM domain is tenant-scoped and the ACI fabric handles VXLAN encapsulation transparently.

How to eliminate wrong answers

Option A is wrong because VMM domains are not created under the infra tenant; they are created under a regular tenant (or common tenant) and associated with a physical domain only if needed for VLAN/VXLAN encapsulation, but the primary integration is with vCenter, not the physical domain. Option C is wrong because Layer 4-Layer 7 service graphs are used for inserting service appliances (like firewalls or load balancers) into traffic flows, not for directly connecting VMs or enabling dynamic policy assignment via VMM integration. Option D is wrong because VXLAN is configured on the ACI leaf switches (via the VMM domain and EPG mappings), not directly on the vSphere distributed switch; the vSphere switch uses port groups that are mapped to EPGs, but VXLAN encapsulation is handled by the ACI fabric.

Practice this question →

140

Multi-Selecteasy

A data center architect is designing a spine-leaf fabric with OSPF as the underlay routing protocol. Which two statements about OSPF in this design are correct? (Choose two.)

Select 2 answers

A.OSPF neighbors are formed between leaf and spine switches over the fabric links.

B.OSPF supports ECMP by default, which is essential for load balancing in the fabric.

C.Passive interfaces are configured on the server-facing ports of leaf switches.

D.OSPF must be replaced by BGP in a VXLAN EVPN fabric.

E.OSPF areas must be different for leaf and spine switches to prevent routing loops.

AnswersA, B

Correct. OSPF neighbors are formed between leaf and spine switches over the fabric links, establishing Layer 3 adjacency for the underlay.

Why this answer

In a spine-leaf fabric using OSPF as the underlay, OSPF neighbors are formed directly between leaf and spine switches over the physical fabric links. Option B is correct because OSPF supports ECMP by default, enabling load balancing across multiple equal-cost paths in the fabric. Option C is incorrect: while passive interfaces are often configured on server-facing ports to prevent OSPF neighbor formation with servers, the question asks for two correct statements about OSPF in the design, and the other two options (A and B) are more fundamental to OSPF operation in the underlay.

Options D and E are clearly incorrect; OSPF can coexist with BGP in VXLAN EVPN, and OSPF areas can be the same across leaf and spine switches.

Exam trap

Cisco often tests the misconception that OSPF must be replaced by BGP in VXLAN EVPN fabrics, but the correct understanding is that OSPF serves as the underlay and BGP as the overlay, and they can operate together. Also, candidates may think that all three statements (A, B, C) are correct, but only two are correct per the question's requirement.

Practice this question →

141

MCQmedium

An engineer is configuring OSPF in a data center fabric with multiple Nexus 9000 switches. To ensure fast convergence after a link failure, which OSPF feature should be enabled?

A.OSPF authentication

B.OSPF Fast Hello

C.OSPF LSA throttling

D.OSPF stub area

AnswerB

Fast Hello sends hellos at sub-second intervals for fast failure detection.

Why this answer

OSPF Fast Hello reduces the dead interval to less than 1 second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF to detect a link failure in milliseconds rather than the default 40 seconds, significantly improving convergence time in a data center fabric where rapid failover is critical.

Exam trap

Cisco often tests the distinction between features that improve failure detection speed (like Fast Hello or BFD) versus features that optimize LSA propagation or reduce database size (like LSA throttling or stub areas), leading candidates to confuse convergence optimization with detection acceleration.

How to eliminate wrong answers

Option A is wrong because OSPF authentication (MD5 or SHA) provides security against routing attacks but does not affect convergence speed after a link failure. Option C is wrong because OSPF LSA throttling controls the rate at which LSAs are generated and flooded, which helps prevent network instability during flapping but does not directly speed up failure detection. Option D is wrong because configuring an OSPF stub area reduces the size of the LSDB by blocking Type 5 LSAs, which can improve CPU and memory usage but has no impact on the speed of detecting a link failure.

Practice this question →

142

MCQhard

You are a network engineer at a financial institution. The company has two data centers: DC1 and DC2, connected via a dark fiber link. Each data center has a pair of Nexus 7000 switches in a vPC configuration. The dark fiber link connects to a port on each Nexus 7000 pair using a Layer 2 port-channel. The requirement is to extend VLAN 100 between the two data centers for a critical application that requires a stretched Layer 2 domain. The current configuration has the port-channel on both sides set to mode 'active' with LACP. VLAN 100 is allowed on the trunk. The application servers report intermittent connectivity issues, with some packets being dropped. Upon inspection, you notice that the MAC address table on the Nexus 7000 in DC1 shows the MAC address of the server in DC2 on the dark fiber port-channel interface, but also on a local access port connected to a different server in the same VLAN. What is the most likely cause of the intermittent connectivity?

A.The dark fiber link is experiencing high latency, causing MAC address timeouts.

B.LACP is misconfigured on one side, causing the port-channel to operate as individual links.

C.There is an asymmetric routing issue between the data centers.

D.Spanning Tree Protocol is not blocking one of the redundant paths, creating a loop.

AnswerD

A loop causes MAC flapping and intermittent connectivity.

Why this answer

The MAC address table showing the same MAC address on both the dark fiber port-channel and a local access port indicates a Layer 2 loop. In a vPC environment with a Layer 2 extension between data centers, Spanning Tree Protocol (STP) should block one of the redundant paths to prevent loops. If STP fails to block the appropriate port, frames loop, causing MAC address flapping and intermittent packet drops.

Exam trap

The trap here is that candidates often attribute intermittent connectivity to LACP or routing issues, but the key clue is the MAC address appearing on two different interfaces in the same VLAN, which is a definitive sign of a Layer 2 loop that STP should have prevented.

How to eliminate wrong answers

Option A is wrong because high latency does not cause MAC address timeouts or flapping; MAC aging timers are independent of latency, and high latency would cause retransmissions, not MAC table instability. Option B is wrong because LACP misconfiguration would cause the port-channel to operate as individual links, which could lead to inconsistent forwarding but not the specific symptom of the same MAC appearing on both a port-channel and a local access port; this symptom is classic for a loop. Option C is wrong because asymmetric routing is a Layer 3 issue, but the problem occurs in a stretched Layer 2 domain where routing is not involved; asymmetric routing would not cause MAC address flapping on the same VLAN.

Practice this question →

143

MCQmedium

In a spine-leaf architecture using eBGP as the routing protocol, what is the primary purpose of using eBGP rather than iBGP between spine and leaf switches?

A.To enable faster convergence than OSPF

B.To avoid the need for an IGP and simplify configuration

C.To support EVPN address families

D.To allow for unequal-cost load balancing

AnswerB

eBGP in a spine-leaf eliminates the need for an IGP and provides simple, scalable routing.

Why this answer

In a spine-leaf architecture using eBGP, the primary purpose is to avoid the need for an IGP (such as OSPF or IS-IS) and simplify configuration. eBGP between spine and leaf switches allows each leaf to be in a different private AS (e.g., 65001–650XX), and the spine can use the BGP AS_PATH to detect and prevent loops without requiring an underlying IGP. This eliminates the complexity of running a separate IGP for underlay routing, reducing operational overhead and configuration steps.

Exam trap

Cisco often tests the misconception that eBGP is chosen for faster convergence or for EVPN support, but the real reason in a spine-leaf architecture is to eliminate the need for a separate IGP, simplifying the underlay design.

How to eliminate wrong answers

Option A is wrong because eBGP does not inherently provide faster convergence than OSPF; OSPF can converge in sub-second time with fast hello timers and LSA throttling, while BGP convergence depends on BGP timers and route processing. Option C is wrong because EVPN address families can be supported over both eBGP and iBGP; the choice of eBGP over iBGP is not driven by EVPN support but by the desire to avoid an IGP. Option D is wrong because eBGP does not support unequal-cost load balancing; BGP by default selects only the best path (single path) and requires specific features like BGP multipath (which works only for equal-cost paths) or BGP-LU for unequal-cost, and this is not the primary reason for using eBGP in spine-leaf.

Practice this question →

144

MCQhard

In an EVPN-VXLAN fabric, a network engineer notices that MAC addresses learned from an external router are not being advertised as EVPN type-2 routes. The external router is connected to a leaf switch via a Layer 3 port. Which additional configuration is needed on the leaf switch?

A.Configure `redistribute host-routes` under the BGP address-family l2vpn evpn.

B.Configure `evpn` under the VLAN interface associated with the external router's VLAN.

C.Configure `ip arp evpn` on the Layer 3 interface.

D.Configure `routing-config` under BGP to enable both MAC-VRF and IP-VRF.

AnswerC

Allows the switch to advertise the neighbor's MAC and IP via EVPN.

Why this answer

When an external router is connected via a Layer 3 port, the leaf switch learns the router's MAC address through ARP, not through a VLAN. To advertise this MAC as an EVPN type-2 route, the `ip arp evpn` command must be configured on the Layer 3 interface. This command enables the switch to synchronize ARP entries into the EVPN BGP control plane, allowing MAC/IP advertisement for directly connected hosts on routed interfaces.

Exam trap

Cisco often tests the distinction between VLAN-based EVPN (where MACs are learned from the bridge domain) and routed interface EVPN (where MACs come from ARP), leading candidates to incorrectly choose VLAN-related options like `evpn` under the VLAN interface when the scenario involves a Layer 3 port.

How to eliminate wrong answers

Option A is wrong because `redistribute host-routes` under BGP address-family l2vpn evpn is used to redistribute host routes from the routing table into EVPN, not to advertise MAC addresses learned via ARP; it addresses IP prefix advertisement, not MAC-VRF type-2 routes. Option B is wrong because `evpn` under a VLAN interface is used to enable EVPN for a VLAN-based service (e.g., IRB), but the external router is connected via a Layer 3 port, not a VLAN; this configuration would not apply to a routed interface. Option D is wrong because `routing-config` under BGP is not a valid command; the correct approach for MAC-VRF and IP-VRF is to configure separate address-family contexts (e.g., `address-family l2vpn evpn` and `vrf definition`) and the `routing-config` keyword does not exist in Cisco NX-OS EVPN configuration.

Practice this question →

145

MCQeasy

Which Cisco NX-OS feature allows automation and programmatic access to device configuration and monitoring using REST APIs?

A.NX-API

B.Python scripting

C.Bash shell access

D.SNMP

AnswerA

NX-API is the REST API interface for NX-OS.

Why this answer

NX-API is the correct answer because it provides a REST-based API interface on Cisco NX-OS devices, allowing automation and programmatic access to configuration and monitoring via HTTP/HTTPS methods (GET, POST, PUT, DELETE). It exposes the device's CLI commands as RESTful API calls, enabling tools like Ansible, Postman, or custom scripts to interact with the switch without requiring SSH or direct CLI access.

Exam trap

Cisco often tests the distinction between direct scripting (Python/Bash) and API-based automation, leading candidates to confuse Python scripting (which can consume APIs) with the actual API endpoint itself (NX-API).

How to eliminate wrong answers

Option B is wrong because Python scripting, while powerful for automation, does not inherently provide REST API access; it typically relies on libraries like requests to consume APIs or uses NX-API indirectly. Option C is wrong because Bash shell access provides a Linux shell environment on NX-OS but lacks native REST API capabilities; it is used for low-level system tasks, not for structured API-based configuration. Option D is wrong because SNMP is a monitoring protocol (MIB-based) that supports read/write operations but is not designed for RESTful programmatic configuration; it uses OIDs and traps, not HTTP methods or JSON/XML payloads.

Practice this question →

146

MCQhard

A large cloud provider is building a new data center using Cisco ACI with multiple leaf and spine switches. They plan to host thousands of tenants with overlapping IP addresses in different VRFs. The network team has deployed the fabric with a common security policy. During testing, they discover that traffic from Tenant A to Tenant B is being allowed even though a contract should deny it. The APIC policy shows the contract is applied to the EPGs and the deny rule is present. What is the most likely cause of the policy not being enforced?

A.The fabric is using VRF leaking that bypasses contracts.

B.The contract is not configured with the correct subject.

C.The leaf switches have not downloaded the updated policy.

D.The EPGs are in the same bridge domain.

AnswerC

Leaves may have stale policy if not refreshed.

Why this answer

In Cisco ACI, the leaf switches enforce contracts locally based on the policy downloaded from the APIC. If a contract is correctly configured on the APIC but traffic is still permitted, the most likely cause is that the leaf switches have not yet received or applied the updated policy. This can happen due to a delay in policy propagation, a communication issue between the APIC and leaf switches, or the leaf not having completed the policy resolution process.

Exam trap

Cisco often tests the misconception that once a contract is configured on the APIC, it is immediately enforced everywhere, ignoring the asynchronous policy download and local leaf switch policy resolution process.

How to eliminate wrong answers

Option A is wrong because VRF leaking in ACI is explicitly controlled by contracts and does not bypass them; any inter-VRF traffic must still be permitted by a contract. Option B is wrong because the contract subject is only relevant for defining filters and actions; if the deny rule is present and applied to the EPGs, the subject configuration is not the cause of the policy not being enforced. Option D is wrong because EPGs in the same bridge domain can communicate only if a contract allows it; being in the same bridge domain does not automatically bypass contract enforcement.

Practice this question →

147

MCQeasy

Which protocol is used by Cisco ACI fabric to distribute endpoint information among spines?

A.IS-IS

B.OSPF

C.BGP

D.COOP

AnswerD

COOP (Council of Oracles Protocol) is the ACI-specific protocol for endpoint database distribution.

Why this answer

D is correct because the Cisco ACI fabric uses the Council of Oracle Protocol (COOP) specifically to distribute endpoint information (such as IP-to-MAC bindings and location) among spine switches. COOP operates as a lightweight, publish-subscribe protocol that runs between leaf and spine switches, ensuring that all spines maintain a consistent endpoint database without the overhead of a full routing protocol.

Exam trap

Cisco often tests the distinction between the underlay routing protocol (IS-IS) and the overlay endpoint distribution protocol (COOP), so candidates mistakenly choose IS-IS because they recall it is used in ACI, but they fail to recognize that endpoint distribution is a separate function handled by COOP.

How to eliminate wrong answers

Option A is wrong because IS-IS is used as the underlay routing protocol in ACI to establish reachability between leaf and spine switches, not to distribute endpoint information. Option B is wrong because OSPF is not used in ACI fabric; the underlay is based on IS-IS with a link-state database, and OSPF would add unnecessary complexity and is not designed for endpoint distribution. Option C is wrong because BGP is used in ACI for external routing (e.g., connecting to outside networks via L3Out) and for the Overlay-1 control plane, but it does not distribute internal endpoint information among spines; that is the role of COOP.

Practice this question →

148

MCQhard

In a vPC domain, a consistency check failure is observed for the vPC keepalive link. What is the impact on the vPC domain operation?

A.The vPC peer link will be suspended.

B.The secondary switch will shutdown its vPC member ports.

C.The vPC domain will continue to operate but with reduced reliability.

D.Both switches will independently forward traffic via the vPC peer link.

AnswerC

The keepalive is a secondary monitoring mechanism; its loss increases risk of split-brain if the peer link fails.

Why this answer

The vPC keepalive link is used as a secondary heartbeat to detect dual-active scenarios when the peer link fails. A consistency check failure on the keepalive link does not directly affect data forwarding; the vPC domain continues to operate, but the loss of this redundancy mechanism reduces reliability because the switches can no longer reliably detect a split-brain condition without the peer link.

Exam trap

Cisco often tests the distinction between the keepalive link and the peer link; the trap here is that candidates assume any consistency check failure will suspend the vPC domain, but only failures on the peer link or critical parameters (like vPC VLAN consistency) cause suspension, while keepalive failures merely degrade redundancy.

How to eliminate wrong answers

Option A is wrong because the vPC peer link is suspended only when there is a peer-link failure or a consistency check failure on the peer link itself, not on the keepalive link. Option B is wrong because the secondary switch shuts down its vPC member ports only when a dual-active detection occurs (e.g., peer link fails and keepalive is also lost), not due to a keepalive consistency check failure alone. Option D is wrong because both switches independently forwarding traffic via the vPC peer link describes a split-brain scenario that happens when the peer link fails and the keepalive link is also lost, not when only the keepalive consistency check fails.

Practice this question →

149

Multi-Selectmedium

When troubleshooting a VXLAN EVPN fabric with Cisco Nexus 9000 switches, which three commands provide information about the EVPN operation? (Choose three.)

Select 3 answers

A.show bgp l2vpn evpn summary.

B.show l2route mac all.

C.show running-config interface nve1.

D.show nve peers.

E.show ip interface brief.

AnswersA, B, D

Shows BGP EVPN session status.

Why this answer

The 'show bgp l2vpn evpn summary' command is correct because it displays the BGP session status for the L2VPN address family, which is the control plane protocol for VXLAN EVPN. This command shows neighbor states, prefixes received, and route table statistics, directly indicating whether EVPN route exchange is operational.

Exam trap

Cisco often tests the distinction between configuration commands (like 'show running-config interface nve1') and operational verification commands (like 'show nve peers'), leading candidates to mistakenly select configuration-only outputs as evidence of EVPN operation.

Practice this question →

150

Multi-Selectmedium

An OSPF router in a broadcast network has not formed a neighbor relationship. What are three possible causes? (Choose three.)

Select 3 answers

A.Authentication incorrect

B.MTU mismatch

C.Area ID mismatch

D.Hello interval mismatch

E.Network type mismatch

AnswersB, D, E

Causes the routers to stay in ExStart state during database exchange.

Why this answer

In OSPF, an MTU mismatch prevents the formation of a neighbor relationship because OSPF routers compare the MTU value in Database Description (DBD) packets. If the receiving router's interface MTU is smaller than the DBD packet size, the packet is dropped, and the neighbor state remains stuck in EXSTART/EXCHANGE. This is a common issue on broadcast networks where different link types or misconfigured interfaces exist.

Exam trap

Cisco often tests the MTU mismatch as a subtle cause of OSPF neighbor failure, especially since it is less obvious than Hello/Dead interval or Area ID mismatches, and candidates may overlook it or confuse it with Layer 2 issues.

Practice this question →