CCNA Network Questions — Page 3 of 3

151

MCQmedium

In ACI, which construct defines the set of endpoints that can communicate based on contracts?

A.VRF

B.Bridge Domain

C.Tenant

D.EPG

AnswerD

EPGs are the policy enforcement boundary.

Why this answer

In Cisco ACI, an Endpoint Group (EPG) is the logical grouping of endpoints (such as servers, VMs, or storage) that share the same policy requirements. Contracts define the rules for communication between EPGs, specifying which EPGs can talk to each other and what services (e.g., HTTP, SSH) are allowed. Thus, the EPG construct directly defines the set of endpoints that can communicate based on contracts.

Exam trap

Cisco often tests the distinction between EPGs and Bridge Domains, where candidates mistakenly think a Bridge Domain defines endpoint communication because it handles Layer 2 forwarding, but contracts are applied at the EPG level, not the Bridge Domain level.

How to eliminate wrong answers

Option A is wrong because a VRF (Virtual Routing and Forwarding) is a Layer 3 construct that provides network segmentation and routing isolation, not a grouping of endpoints for contract-based communication. Option B is wrong because a Bridge Domain is a Layer 2 forwarding context that defines a broadcast domain and subnet, but it does not directly define which endpoints can communicate based on contracts; contracts are applied between EPGs, not Bridge Domains. Option C is wrong because a Tenant is the highest-level container in ACI that holds policies, networking constructs, and applications, but it does not itself define endpoint communication; contracts are applied between EPGs within or across tenants.

Practice this question →

152

Multi-Selecteasy

A network engineer is verifying VPC configuration on a pair of Nexus switches. Which two commands should be used to check VPC status and consistency? (Choose two.)

Select 2 answers

A.show vpc role

B.show vpc consistency-parameters

C.show vpc peer-keepalive

D.show vpc

E.show vpc statistics

AnswersB, D

This checks for configuration mismatches between VPC peers.

Why this answer

(show vpc) is correct because it displays the overall VPC status, including the local and peer VPC system MAC, role, and the operational state of each VPC member port. Option B (show vpc consistency-parameters) is correct because it verifies that critical parameters (e.g., STP mode, VLAN interfaces, MTU) are consistent between the two VPC peers, which is essential for VPC to function correctly and avoid traffic black-holing.

Exam trap

Cisco often tests the distinction between commands that show operational status (show vpc) versus those that verify configuration synchronization (show vpc consistency-parameters), leading candidates to mistakenly select 'show vpc role' or 'show vpc peer-keepalive' as sufficient for consistency checks.

Practice this question →

153

MCQhard

A network engineer is configuring Cisco Nexus VXLAN with BGP EVPN. The VTEPs are using loopback0 as the NVE source. The physical interfaces are up, but the NVE interface remains down. What is the most likely cause?

A.The loopback0 interface is not reachable via the underlay network.

B.The NVE interface is not configured with source-interface.

C.The VLAN 1 is not associated with the NVE interface.

D.The loopback0 interface is not created.

AnswerA

The NVE source must be routable in the underlay. If loopback0 is not advertised by IGP, the NVE interface stays down.

Why this answer

The NVE interface requires the specified source interface (loopback0) to have IP reachability via the underlay network to establish VXLAN tunnels. If loopback0 is not reachable (e.g., due to missing OSPF/IS-IS routes or incorrect underlay configuration), the NVE interface will remain in a down state even if the physical interfaces are up. This is because the NVE interface depends on the underlay routing to encapsulate and forward VXLAN traffic.

Exam trap

Cisco often tests the dependency of the NVE interface on underlay IP reachability, tricking candidates into focusing on NVE-specific configuration errors (like missing source-interface) rather than verifying the underlay routing for the loopback address.

How to eliminate wrong answers

Option B is wrong because the NVE interface is already configured with source-interface loopback0 (as stated in the question), so the absence of that configuration is not the issue. Option C is wrong because VLAN 1 association with the NVE interface is not required for the NVE interface to come up; VLANs are mapped to VNIs after the NVE is operational. Option D is wrong because the loopback0 interface is explicitly mentioned as the NVE source, implying it exists; if it were not created, the NVE configuration would fail at the CLI level, not just keep the interface down.

Practice this question →

154

Multi-Selectmedium

Which three components are part of the VXLAN overlay architecture? (Choose three.)

Select 3 answers

A.VTEP (Virtual Tunnel Endpoint)

B.VPC peer-link

C.Spine switches only in VXLAN

D.IP transport network (underlay)

E.VNI (VXLAN Network Identifier)

AnswersA, D, E

Correct. VTEPs encapsulate and decapsulate VXLAN frames.

Why this answer

A VTEP is a fundamental component of VXLAN overlay architecture because it encapsulates and decapsulates Layer 2 Ethernet frames into UDP packets for transport over the IP underlay network. It serves as the tunnel endpoint where VXLAN traffic originates and terminates, enabling Layer 2 extension across Layer 3 boundaries.

Exam trap

Cisco often tests the distinction between overlay components (VTEP, VNI) and underlay infrastructure (spine switches, IP transport), leading candidates to incorrectly include spine switches as part of the overlay architecture.

Practice this question →

155

MCQhard

A data center design requires Layer 2 extension between two sites using OTV. The network engineer notices that MAC addresses from Site A are not learned at Site B. OTV adjacency is up, and both sites have the same overlay interface configured. Which configuration issue is most likely the cause?

A.The OTV control group is misconfigured on one side.

B.The spanning tree root bridge is different at each site.

C.The multicast group range for the overlay does not match.

D.The site VLAN is not allowed on the OTV join interface.

AnswerD

The join interface must be a trunk that carries the site VLAN for OTV to forward traffic.

Why this answer

D is correct because the OTV join interface must have the site VLAN allowed; if the site VLAN is not permitted on the join interface, the OTV edge device cannot send or receive encapsulated traffic for that VLAN, preventing MAC address learning between sites even though the OTV adjacency is up.

Exam trap

Cisco often tests the distinction between control-plane (adjacency) and data-plane (VLAN transport) issues, and the trap here is that candidates assume a working OTV adjacency guarantees all VLANs are extended, overlooking the need to explicitly allow the site VLAN on the join interface.

How to eliminate wrong answers

Option A is wrong because the OTV control group is used for control-plane communication (IS-IS adjacency), and if it were misconfigured, the OTV adjacency would not form; the question states adjacency is up, so the control group is correctly configured. Option B is wrong because OTV does not rely on spanning tree; it uses its own loop-prevention mechanism (authoritative edge device) and isolates STP domains, so different root bridges at each site do not affect MAC learning. Option C is wrong because the multicast group range for the overlay is used for data-plane transport; if it did not match, traffic would not be forwarded, but the question specifies the same overlay interface configuration, implying the multicast group range is consistent.

Practice this question →

156

MCQeasy

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

A.Set OSPF priority to 255 on the interface

B.Set OSPF priority to 0 on the interface

C.Change the OSPF network type to point-to-point

D.Configure the interface as passive under OSPF

AnswerB

Priority 0 means the router will never become DR or BDR.

Why this answer

Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

Exam trap

Cisco often tests the misconception that setting a high priority (like 255) ensures a router does not become DR, when in fact it does the opposite; the trap here is confusing priority 0 (ineligible) with priority 255 (most likely to be elected).

How to eliminate wrong answers

Option A is wrong because setting OSPF priority to 255 (the highest possible value) makes the switch the most likely candidate to become the DR, which directly contradicts the requirement. Option C is wrong because changing the network type to point-to-point eliminates the DR/BDR election entirely, which may not be desirable if the segment is truly multi-access and other routers need to participate in elections; it also changes OSPF behavior (e.g., no hello/dead interval mismatches) and could break adjacency with neighbors expecting a broadcast network. Option D is wrong because configuring the interface as passive under OSPF suppresses OSPF hello packets entirely, preventing the switch from forming any OSPF adjacencies on that interface, which is more restrictive than simply avoiding DR status.

Practice this question →

157

MCQeasy

A multicast application requires that all receivers join the same group using PIM sparse mode. Which router is responsible for forwarding traffic from the source to the RP?

A.Rendezvous point (RP)

B.First-hop router

C.Last-hop router

D.Source-specific router

AnswerB

The source's DR unicasts the traffic to the RP.

Why this answer

In PIM sparse mode, the first-hop router (the router directly connected to the multicast source) is responsible for encapsulating the source's multicast traffic in unicast PIM register messages and forwarding them to the rendezvous point (RP). This process establishes the initial path and triggers the RP to join the source-specific tree (SPT) toward the source.

Exam trap

Cisco often tests the misconception that the RP originates or forwards traffic from the source, when in fact the first-hop router is the one that encapsulates and sends the source traffic to the RP using PIM register messages.

How to eliminate wrong answers

Option A is wrong because the RP is the meeting point for receivers and sources, but it does not forward traffic from the source to itself; it receives register messages from the first-hop router and then joins the SPT toward the source. Option C is wrong because the last-hop router (the router directly connected to receivers) is responsible for sending PIM join messages toward the RP and later switching to the SPT, not for forwarding traffic from the source to the RP. Option D is wrong because there is no standard 'source-specific router' in PIM sparse mode; the concept of source-specific multicast (SSM) uses a different model (PIM-SSM) where receivers join directly to the source via (S,G) state, bypassing the RP entirely.

Practice this question →

158

Multi-Selecthard

An engineer is designing a Cisco ACI multi-site solution. Which two considerations are critical for inter-site connectivity? (Choose two.)

Select 2 answers

A.Configure a stretch VLAN across sites.

B.Use a separate OSPF process per site.

C.Deploy a L3Out at each site for external connectivity.

D.Use a single APIC cluster for both sites.

E.Ensure IP connectivity between the sites for the underlay.

AnswersC, E

Each site typically has its own L3Out.

Why this answer

In Cisco ACI Multi-Site, each site operates with its own APIC cluster and independent fabric. A L3Out at each site is critical because it provides external connectivity for that site's endpoints, allowing traffic to exit locally rather than being hair-pinned across the inter-site network. This design optimizes traffic flow and aligns with the Multi-Site architecture where sites are managed separately but interconnected via the Inter-Site Network (ISN).

Exam trap

Cisco often tests the misconception that a single APIC cluster can manage multiple sites, but in reality, each site requires its own APIC cluster for independent operation and fault isolation.

Practice this question →

159

MCQhard

An engineer is troubleshooting BGP EVPN control plane. They issue 'show bgp l2vpn evpn' and see Type-3 routes but no Type-2 routes for any VNI. Which condition is most likely?

A.The VTEP has not learned any MAC addresses

B.The overlay VNI is not mapped to a VLAN

C.The BGP neighbor is not from the same AS

D.The EVPN address-family is not enabled

AnswerA

Type-2 routes carry MAC/IP information. Without any MACs learned, no Type-2 routes are generated.

Why this answer

Type-3 routes (Inclusive Multicast Ethernet Tag routes) are generated automatically when an EVPN VNI is configured, regardless of MAC learning. Type-2 routes (MAC/IP Advertisement routes) are only generated after the VTEP learns MAC addresses from data-plane traffic or from local endpoints. The absence of Type-2 routes with Type-3 present indicates the VTEP has not yet learned any MAC addresses for that VNI.

Exam trap

Cisco often tests the distinction between control-plane-generated routes (Type-3) and data-plane-triggered routes (Type-2), trapping candidates who assume both route types appear simultaneously upon VNI configuration.

How to eliminate wrong answers

Option B is wrong because an unmapped overlay VNI would prevent Type-3 routes from being generated as well, but the question states Type-3 routes are present. Option C is wrong because BGP EVPN sessions can operate between different AS numbers (eBGP) or the same AS (iBGP); AS mismatch does not selectively suppress Type-2 routes while allowing Type-3 routes. Option D is wrong because if the EVPN address-family were not enabled, no EVPN routes (including Type-3) would appear in the BGP table.

Practice this question →

160

MCQhard

A data center network uses MST to interoperate with a legacy switch that supports only RSTP. Which MST configuration parameter must match between the MST region and the legacy switch?

A.Region name

B.Revision number

C.No parameters need to match; the boundary port runs RSTP.

D.VLAN-to-instance mapping

AnswerC

MST interacts with RSTP via boundary ports using RSTP BPDUs.

Why this answer

When an MST region connects to a legacy switch running only RSTP, the boundary port on the MST switch automatically runs RSTP to interoperate. No MST-specific parameters (region name, revision number, or VLAN-to-instance mapping) need to match because the legacy switch is not part of the MST region; it simply runs RSTP on the link.

Exam trap

Cisco often tests the misconception that MST and RSTP require matching configuration parameters for interoperability, when in fact the boundary port automatically falls back to RSTP, making MST-specific parameters irrelevant for the legacy switch.

How to eliminate wrong answers

Option A is wrong because the region name is used only within an MST region to identify switches belonging to the same region; a legacy RSTP switch does not participate in MST, so no region name matching is required. Option B is wrong because the revision number is an MST-specific parameter that must match only among switches within the same MST region; it has no meaning for an RSTP-only switch. Option D is wrong because VLAN-to-instance mapping is an MST configuration that defines how VLANs map to MST instances inside a region; a legacy RSTP switch does not use MST instances, so this mapping is irrelevant for interoperability.

Practice this question →

161

MCQhard

An ACI fabric has multiple tenants and the requirement to allow only HTTP traffic from the web EPG to the app EPG. The contract must restrict traffic to TCP port 80. Which ACI object defines that specific port?

A.EPG

B.Subject

C.Filter

D.Contract

AnswerC

Filters define the specific protocol and port settings.

Why this answer

In ACI, filters define the L4/L5 parameters such as protocol and port. The filter for TCP port 80 is created and then used in the subject.

Practice this question →

162

MCQhard

An engineer is designing a spine-leaf fabric using eBGP for the underlay. The spine switches are in AS 65000 and each leaf switch uses a different private AS from 65001 to 65010. For optimal convergence and to avoid BGP path hunting, which BGP feature should be configured on the spines?

A.allowas-in 1

B.disable-peer-as-check

C.bestpath as-path multipath-relax

D.maxas-limit 10

AnswerA

Allowas-in 1 permits the spine to accept updates containing its own AS once, which is needed when leaf uses spine AS as part of AS path.

Why this answer

In a BGP underlay with a common spine AS (65000) and unique leaf AS, each leaf may receive routes from multiple spines. Without 'allowas-in', when a spine receives a route from a leaf that already contains the spine's own AS in the AS_PATH (because another spine previously advertised it), the spine would reject the update due to AS loop detection. Configuring 'allowas-in 1' on spines allows them to accept routes containing their own AS once, enabling them to consider all available paths and avoid path hunting.

Options B, C, and D are incorrect: 'disable-peer-as-check' would ignore AS checks altogether, potentially causing loops; 'multipath-relax' allows multipath with different AS_PATHs but doesn't address the path-hunting issue; 'maxas-limit' limits the maximum AS number but is not relevant to this scenario.

Practice this question →

163

Multi-Selectmedium

Which THREE components are part of an EVPN VXLAN fabric? (Choose three)

Select 3 answers

A.IS-IS

B.MP-BGP

C.VRF

D.NVE interface

E.VPC

AnswersB, C, D

MP-BGP is the standard control plane for EVPN, advertising MAC/IP routes and other attributes.

Why this answer

MP-BGP is the control plane protocol for EVPN VXLAN fabrics. It advertises MAC/VPN reachability information using EVPN address families (L2VPN AFI/SAFI 70/128) and enables overlay route distribution between VTEPs. Without MP-BGP, the fabric cannot dynamically learn remote MAC addresses or maintain a scalable, loop-free control plane.

Exam trap

Cisco often tests the distinction between underlay protocols (like IS-IS or OSPF) and overlay components (like MP-BGP, NVE, VRF), and candidates mistakenly select an underlay protocol as part of the EVPN VXLAN fabric.

Practice this question →

164

MCQhard

A data center designer is evaluating oversubscription ratios in a spine-leaf topology with 40 leaf switches and 4 spine switches. Each leaf has 4x100G uplinks to spines, and each spine has 40x100G downlinks. The leaf switches have 48x25G server ports. What is the oversubscription ratio from the server ports to the spine uplinks?

A.2:1

B.4:1

C.3:1

D.5:1

AnswerC

1200G server / 400G uplink = 3:1.

Why this answer

The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48x25G server ports = 1200G, and 4x100G uplinks = 400G, giving a leaf-level ratio of 3:1 (1200:400). Since all leaves are identical and the spine count doesn't affect the leaf-level ratio, the overall ratio remains 3:1.

Exam trap

Cisco often tests the misconception that the spine switch port count or total fabric bandwidth should be used in the ratio calculation, leading candidates to incorrectly include spine downlinks or total aggregate bandwidth instead of focusing on the leaf-level server-to-uplink ratio.

How to eliminate wrong answers

Option A (2:1) is wrong because it would require 600G of uplink bandwidth per leaf (e.g., 6x100G), not the given 4x100G. Option B (4:1) is wrong because it would imply 48x25G server ports (1200G) divided by 300G uplinks, but the uplinks are 400G, not 300G. Option D (5:1) is wrong because it would require only 240G of uplink bandwidth per leaf, which is less than the actual 400G.

Practice this question →

165

Multi-Selecteasy

Which two commands are used to verify Spanning Tree Protocol (STP) status on a Cisco Nexus switch? (Choose two.)

Select 2 answers

A.show stp brief

B.show vlan spanning-tree

C.show spanning-tree

D.show spanning-tree detail

E.show running-config spanning-tree

AnswersC, D

Correct. Displays STP state for all VLANs.

Why this answer

On Cisco Nexus switches, the correct command to verify Spanning Tree Protocol status is 'show spanning-tree'. This command displays the STP state for all VLANs, including root bridge, port roles, and port states. Option C is correct because it is the standard Cisco command for viewing STP information across all VLANs.

Exam trap

Cisco often tests the distinction between configuration verification commands (like 'show running-config') and operational status commands (like 'show spanning-tree'), leading candidates to mistakenly choose 'show running-config spanning-tree' when they need to verify real-time STP state.

Practice this question →

166

MCQhard

An organization has deployed a pair of Nexus 93180YC-EX switches as vPC peers in a data center. The switches are connected to a server with two 10GbE interfaces configured as an LACP port-channel. The vPC configuration has been verified and was working correctly for months. After a scheduled maintenance window that included upgrading the NX-OS software from version 7.0(3)I7(1) to 7.0(3)I7(5), the server begins experiencing frequent link flaps on the port-channel. The server administrator reports that every 5-10 minutes, the link goes down for about 2 seconds and then recovers. The network team checks the logs on the Nexus switches and sees repeated messages: 'LACP-3-MISCONFIG: Port-channel <channel> is misconfigured: partner not on same aggregator.' The 'show vpc brief' output shows all vPCs in the 'up' state. The 'show port-channel summary' shows the port-channel is up with both member ports in the bundle. What is the most likely root cause?

A.The LACP fast rate timer default changed to slow in the new software, causing a timeout mismatch with the server.

B.The vPC delay-restore timer is set too low, causing the vPC to prematurely come up before LACP is fully up.

C.The vPC peer-link VLAN allowed list does not include the server's VLAN, causing intermittent drops.

D.The LACP system priority is not configured consistently between the vPC peers, causing the LACP system identifier to differ.

AnswerD

In a vPC, the LACP system identifier must be identical on both peers to appear as a single partner to the server. Inconsistent system priority leads to different identifiers, triggering the misconfiguration log and link flaps.

Why this answer

In a vPC setup, both peer switches must have the same LACP system identifier (derived from system priority and MAC address) so the server sees a single logical partner. If the LACP system priority is not consistent across the peers, the system identifiers will differ, causing the server to detect multiple partners, leading to the 'partner not on same aggregator' error and link flaps. Option A is incorrect because the LACP rate timer mismatch would cause constant timeout issues, not intermittent flaps with the specific log message.

Option B is incorrect because VLAN mismatch would cause persistent connectivity failures, not intermittent flaps. Option C is incorrect because delay-restore timer affects recovery after link failure, not during steady-state operation.

Practice this question →

167

Multi-Selectmedium

In Cisco ACI, when creating a contract, which three components are part of the contract definition? (Choose three.)

Select 3 answers

A.VRF

B.Endpoint IP address

C.Subject

D.Filter

E.Provider/Consumer

AnswersC, D, E

Subject defines the communication characteristics.

Why this answer

In Cisco ACI, a contract defines the rules for communication between endpoint groups (EPGs). The contract definition consists of three mandatory components: Subject, Filter, and Provider/Consumer. The Subject specifies the direction and type of traffic allowed, the Filter defines the specific protocols and ports (e.g., TCP/UDP, ICMP), and the Provider/Consumer labels establish which EPG offers the service and which consumes it.

Without these three, the contract cannot enforce policy-based connectivity.

Exam trap

Cisco often tests the misconception that VRF or Endpoint IP addresses are part of the contract definition, but in ACI, contracts are purely policy constructs that do not include Layer 3 routing contexts or individual host addresses.

Practice this question →

168

Multi-Selecthard

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Select 3 answers

A.Both switches must use the same routing protocol

B.The peer-keepalive link must be carried over the peer-link

C.Both switches must run the same NX-OS software version

D.A dedicated peer-link port-channel must be configured

E.The vPC domain ID must be identical on both switches

AnswersC, D, E

Same version ensures feature compatibility and stability.

Why this answer

Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.

Exam trap

Cisco often tests the misconception that the peer-keepalive link must traverse the peer-link, when in fact it must be a separate Layer 3 path to avoid a single point of failure for vPC health monitoring.

Practice this question →

169

Multi-Selecthard

Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?

Select 2 answers

A.Enable the address-family l2vpn evpn under the BGP configuration.

B.Enable IGMP snooping on all VLANs extended over VXLAN.

C.Configure the same anycast gateway MAC and IP address on all VTEPs in the VLAN.

D.Set the VXLAN destination UDP port to 8472.

E.Create an NVE interface with a loopback interface as the source.

AnswersA, C

BGP EVPN is required for route distribution.

Why this answer

In VXLAN EVPN, BGP is used as the control plane to exchange MAC and IP reachability information. Enabling the address-family l2vpn evpn under BGP configuration is mandatory to advertise EVPN routes (type-2 and type-3) between VTEPs, which is the foundation of the centralized anycast gateway model.

Exam trap

Cisco often tests the distinction between mandatory EVPN control plane steps (BGP address-family l2vpn evpn) and generic VXLAN data plane steps (NVE interface, UDP port), leading candidates to select options like creating the NVE interface or setting the UDP port as 'necessary' for EVPN, when they are actually prerequisites for VXLAN itself but not the two specific steps asked for enabling VXLAN EVPN with centralized anycast gateway.

Practice this question →

170

MCQhard

Refer to the exhibit. A network administrator configured VXLAN EVPN as above. The VTEP can communicate with neighbors on VNI 5001, but cannot reach the default gateway for VNI 5002. What is the problem?

A.The default route in VRF TenantA is not exported.

B.The route-target for VNI 5002 is missing.

C.The VNI 5002 does not have an associated VLAN.

D.The NVE interface does not have ingress-replication configured.

AnswerB

The configuration lacks a separate RD and route-target for VNI 5002, preventing EVPN route exchange for that VNI.

Why this answer

The VXLAN EVPN configuration for VNI 5002 is missing the route-target import/export statements under the VRF TenantA address-family l2vpn evpn. Without the route-target, the VTEP cannot import EVPN type-2 and type-3 routes for VNI 5002, preventing it from learning the default gateway's MAC/IP or the IMET route needed for BUM traffic. This explains why the VTEP can communicate on VNI 5001 (which has route-targets) but not reach the gateway on VNI 5002.

Exam trap

Cisco often tests the distinction between Layer 2 VNI (which needs VLAN association and ingress-replication) and Layer 3 VNI (which needs route-target configuration), and the trap here is that candidates assume a missing VLAN or ingress-replication is the root cause, when the real issue is the missing route-target for the Layer 3 VNI under the VRF.

How to eliminate wrong answers

Option A is wrong because the default route in VRF TenantA is not relevant; the issue is with EVPN route import for VNI 5002, not with route leaking or export of a default route. Option C is wrong because VNI 5002 can operate without an associated VLAN if it is used for Layer 3 VNI (IRB) or if the VLAN mapping is done elsewhere; the exhibit shows no VLAN association, but that is not the cause of the gateway unreachability. Option D is wrong because ingress-replication is configured under the NVE interface for VNI 5001 and 5002 (as shown in the exhibit), so the problem is not missing replication; the missing route-target prevents the VTEP from learning the gateway's MAC/IP via EVPN.

Practice this question →

171

MCQeasy

Which BGP variant is commonly used in data center EVPN fabrics to carry Layer 2 and Layer 3 network information?

A.eBGP

B.MP-BGP

C.iBGP

D.OSPF

AnswerB

MP-BGP with EVPN address family carries overlay information.

Why this answer

MP-BGP (Multiprotocol BGP) is the correct variant because it carries both Layer 2 (MAC/VXLAN) and Layer 3 (IP/VRF) network information in EVPN fabrics via BGP EVPN address families (L2VPN EVPN and IP VPN). It extends BGP with multiprotocol extensions (RFC 4760) to support Network Layer Reachability Information (NLRI) for Ethernet segments, MAC addresses, and IP prefixes, which is essential for VXLAN-based data center fabrics.

Exam trap

Cisco often tests the distinction between the BGP deployment mode (eBGP/iBGP) and the protocol variant (MP-BGP), leading candidates to confuse eBGP or iBGP as the answer when the question specifically asks for the variant that carries Layer 2 and Layer 3 information.

How to eliminate wrong answers

Option A is wrong because eBGP (External BGP) is a deployment mode (between different autonomous systems), not a protocol variant that supports multiple address families; EVPN fabrics can use eBGP as the transport for MP-BGP sessions, but the variant itself is MP-BGP. Option C is wrong because iBGP (Internal BGP) is a deployment mode within a single AS and does not inherently provide multiprotocol extensions; while iBGP can carry MP-BGP address families, the question asks for the variant that carries Layer 2/3 info, which is MP-BGP, not iBGP. Option D is wrong because OSPF is a link-state IGP that only carries IPv4/IPv6 routing information and cannot transport Layer 2 MAC/VXLAN or EVPN NLRI; it lacks the multiprotocol extensions and address family support required for EVPN.

Practice this question →

172

MCQmedium

An engineer needs to enable equal-cost multipath (ECMP) routing in a spine-leaf fabric using OSPF. Which OSPF feature allows load balancing across multiple equal-cost paths?

A.OSPF network type

B.OSPF area type

C.maximum-paths command

D.OSPF cost metric

AnswerC

This command sets the number of ECMP paths.

Why this answer

The maximum-paths command is the OSPF feature that directly controls the number of equal-cost routes installed in the routing table, enabling ECMP load balancing across multiple equal-cost paths. By default, OSPF installs only one best path, but increasing the maximum-paths value allows the router to use up to that many equal-cost routes simultaneously.

Exam trap

Cisco often tests the misconception that OSPF automatically load-balances across equal-cost paths without any configuration, but in reality the maximum-paths command must be explicitly set to a value greater than 1 to enable ECMP.

How to eliminate wrong answers

Option A is wrong because OSPF network type (e.g., broadcast, point-to-point) affects neighbor discovery and LSA flooding behavior, not the ability to load-balance across equal-cost paths. Option B is wrong because OSPF area type (e.g., standard, stub, NSSA) controls route summarization and LSA filtering, not ECMP load balancing. Option D is wrong because OSPF cost metric is used to calculate path preference and determine which paths are equal-cost, but it does not enable or disable load balancing; the maximum-paths command is required to actually use multiple equal-cost paths.

Practice this question →

173

MCQmedium

In VXLAN, which method of handling BUM traffic replicates packets to remote VTEPs only when there is a known receiver behind that VTEP?

A.Ingress replication

B.Egress replication

C.Multicast-based replication

D.Head-end replication

AnswerA

The ingress VTEP replicates packets to each remote VTEP with known receivers.

Why this answer

Ingress replication is the correct method because in VXLAN, the ingress VTEP replicates BUM (Broadcast, Unknown unicast, Multicast) traffic and sends a copy to each remote VTEP only if that VTEP has at least one receiver (i.e., a host or VM) that has joined the relevant multicast group or is reachable via the VNI. This avoids unnecessary replication to VTEPs with no interested receivers, optimizing bandwidth and reducing load on the underlay network.

Exam trap

Cisco often tests the distinction between 'ingress replication' and 'multicast-based replication' by making candidates think multicast is always more efficient, but the trap here is that multicast-based replication sends BUM to all VTEPs in the multicast group regardless of receiver presence, whereas ingress replication only sends to VTEPs with known receivers, making it more efficient in many scenarios.

How to eliminate wrong answers

Option B (Egress replication) is wrong because egress replication is not a standard VXLAN BUM handling method; the term is sometimes misused to describe replication at the destination VTEP, but Cisco’s VXLAN implementations use ingress replication or multicast-based replication. Option C (Multicast-based replication) is wrong because it relies on an underlay multicast group (e.g., PIM) to distribute BUM traffic to all VTEPs in the VNI, regardless of whether a receiver exists behind each VTEP, which can waste bandwidth and requires multicast routing in the underlay. Option D (Head-end replication) is wrong because this is a generic term sometimes used interchangeably with ingress replication, but Cisco specifically uses the term 'ingress replication' in VXLAN documentation; 'head-end replication' is more commonly associated with MPLS L2VPN or EVPN, not VXLAN BUM handling.

Practice this question →

174

MCQmedium

An engineer is configuring a new VLAN on a Nexus switch that is part of a vPC pair. Which step is mandatory to ensure the VLAN is created on both vPC peers?

A.Use vPC peer-gateway to propagate VLANs.

B.Create the VLAN on the secondary peer only; the primary will learn via STP.

C.Create the VLAN on the primary peer only; it will sync automatically.

D.Create the VLAN on both peers manually.

AnswerD

Manual creation on both switches is required unless using config-sync.

Why this answer

In a vPC domain, VLANs are not automatically synchronized between peers. The engineer must manually create the VLAN on both vPC peers to ensure it is present in the local VLAN database on each switch. This is because vPC relies on consistent local configuration on both devices for proper operation, and there is no built-in mechanism to propagate VLAN definitions from one peer to the other.

Exam trap

The trap here is that candidates often assume vPC automatically synchronizes all configurations between peers, but in reality, only specific operational states are synced, while VLAN definitions must be manually created on both switches.

How to eliminate wrong answers

Option A is wrong because vPC peer-gateway is used to enable routing of traffic with the peer's MAC address, not to propagate VLANs. Option B is wrong because creating the VLAN only on the secondary peer will not cause the primary to learn it via STP; STP does not synchronize VLAN databases. Option C is wrong because the primary peer does not automatically sync VLANs to the secondary peer; both peers require explicit manual configuration.

Practice this question →

175

MCQeasy

Refer to the exhibit. An engineer is configuring a server-facing interface on a Nexus switch. The server is running VMware ESXi with multiple virtual machines in VLANs 10, 20, and 30. After applying the configuration, the ESXi host reports that it cannot communicate on VLAN 30. Which configuration change should be made?

A.Remove the 'spanning-tree port type edge trunk' command

B.Change the native VLAN to 30

C.Create VLAN 30 in the global VLAN database

D.Configure the port as an access port in VLAN 30

AnswerC

If VLAN 30 does not exist, the switch will not forward traffic for it even if allowed on the trunk.

Why this answer

VLAN 30 must exist in the global VLAN database before it can be used on any interface. Even though the interface configuration allows VLAN 30 as a trunked VLAN, the switch will not forward traffic for a VLAN that has not been created globally. Without the 'vlan 30' command in global configuration mode, the VLAN is not present in the switch's VLAN database, and the interface will not pass traffic for that VLAN.

Exam trap

Cisco often tests the misconception that configuring a VLAN on an interface (e.g., 'switchport trunk allowed vlan add 30') automatically creates the VLAN in the global database, but in NX-OS, the VLAN must be explicitly created first.

How to eliminate wrong answers

Option A is wrong because removing 'spanning-tree port type edge trunk' would disable PortFast and BPDU guard on the trunk, which is unrelated to VLAN 30 communication failure; it would only affect STP convergence and loop prevention. Option B is wrong because changing the native VLAN to 30 would cause all untagged traffic to be placed in VLAN 30, but the issue is that VLAN 30 does not exist globally, and the native VLAN mismatch could also cause connectivity problems for other VLANs. Option D is wrong because configuring the port as an access port in VLAN 30 would remove the trunk and prevent the ESXi host from carrying multiple VLANs (10, 20, 30) to the virtual machines, breaking the required trunking behavior.

Practice this question →

176

MCQeasy

In a VXLAN overlay network, which component is responsible for encapsulating and decapsulating packets and resides at the edge of the underlay network?

A.VNI

B.NSX Controller

C.VTEP

D.Leaf switch

AnswerC

Correct: VTEP is the tunnel endpoint.

Why this answer

C is correct because the VXLAN Tunnel Endpoint (VTEP) is the device at the edge of the underlay network that performs encapsulation and decapsulation of VXLAN packets. It adds a VXLAN header (including a 24-bit VNI) and outer UDP/IP headers to original Layer 2 frames, and removes them on the receiving side. This function is defined in RFC 7348 and is essential for extending Layer 2 segments over a Layer 3 underlay.

Exam trap

Cisco often tests the distinction between the data-plane component (VTEP) and the control-plane component (NSX Controller or EVPN), leading candidates to mistakenly select the controller as the encapsulating device.

How to eliminate wrong answers

Option A is wrong because VNI (VXLAN Network Identifier) is a 24-bit segment ID in the VXLAN header that identifies the overlay network segment, not a component that encapsulates or decapsulates packets. Option B is wrong because NSX Controller is a management and control plane component in VMware NSX that handles VXLAN configuration and MAC/VTEP learning, but it does not perform data-plane encapsulation or decapsulation. Option D is wrong because a leaf switch is a top-of-rack switch in a spine-leaf architecture; while it can function as a VTEP if configured, the term 'leaf switch' alone does not specify the encapsulation/decapsulation role, and not all leaf switches are VTEPs.

Practice this question →

177

Multi-Selecthard

Which THREE are valid methods for handling BUM traffic in VXLAN? (Choose three.)

Select 3 answers

A.Ingress replication

B.Egress replication

C.ARP suppression

D.Multicast-based replication

E.Flood and learn

AnswersA, C, D

Replicates from ingress VTEP.

Why this answer

Ingress replication is a valid method for handling BUM traffic in VXLAN where the ingress VTEP replicates broadcast, unknown unicast, and multicast frames to all remote VTEPs in the VXLAN segment. This approach does not require a multicast routing infrastructure in the underlay, making it simpler to deploy in networks that lack multicast support. It is defined in RFC 7348 and is commonly used in VXLAN EVPN fabrics.

Exam trap

Cisco often tests the distinction between 'ingress replication' and 'multicast-based replication' as the two primary BUM handling methods, while 'ARP suppression' is a separate optimization feature that reduces BUM traffic but is not a replication method itself.

Practice this question →

178

MCQhard

An engineer is troubleshooting a vPC consistency check failure. Which parameter must be identical on both vPC peer switches to avoid a consistency check violation for a vPC member port?

A.Allowed VLAN list on the port channel

B.STP root guard setting

C.MTU size

D.Spanning-tree port type

AnswerA

Mismatched allowed VLANs cause consistency check failure and may suspend the vPC.

Why this answer

In a vPC environment, the allowed VLAN list on the port channel must be identical on both peer switches for a vPC member port. If the lists differ, the vPC consistency check fails, causing the port to be suspended or placed in a consistency-check failure state. This ensures that both peers forward the same set of VLANs across the vPC, preventing asymmetric forwarding and potential loops.

Exam trap

The trap here is that candidates often confuse vPC consistency check parameters with STP or MTU settings, but Cisco specifically tests that the allowed VLAN list on the port channel must match, while other parameters like STP guard or MTU are not part of the Type-1 consistency check.

How to eliminate wrong answers

Option B is wrong because STP root guard setting is a per-port STP feature that does not affect vPC consistency checks; vPC consistency checks focus on parameters that must be identical across the peer link, not STP guard configurations. Option C is wrong because MTU size is not a required identical parameter for vPC member ports; MTU mismatches can cause fragmentation issues but are not part of the vPC consistency check violation criteria. Option D is wrong because spanning-tree port type (e.g., edge, network, normal) is not checked for consistency across vPC peers; vPC consistency checks involve Layer 2 parameters like VLAN lists and port-channel mode, not STP port roles.

Practice this question →

179

MCQmedium

A financial services company is migrating its core banking application to a new data center built on Cisco Nexus 9000 switches with VXLAN EVPN. The application requires active-active multihoming for its servers, which are dual-homed to two leaf switches. The network team has configured vPC on the leaf switches for the server connections. After the migration, the application team reports that some packets are being dropped during failover events when one of the vPC member links goes down. The network team confirms that vPC is properly configured and the peer-keepalive is functioning. What is the most likely cause of packet drops during failure?

A.The vPC peer-gateway feature is not enabled.

B.The vPC orphan port configuration is missing.

C.The vPC role is not configured with preempt.

D.The vPC consistency parameters are not identical between the peer switches.

AnswerD

Mismatched parameters cause forwarding inconsistencies.

Why this answer

In a vPC setup, if the consistency parameters (such as STP, VLAN, or interface configurations) are not identical between the two vPC peer switches, the vPC will not forward traffic correctly during a link failure. This mismatch can cause packet drops during failover events, even though the peer-keepalive is functioning. The Cisco Nexus 9000 series requires strict consistency checks to ensure loop-free and seamless failover in VXLAN EVPN environments.

Exam trap

Cisco often tests the misconception that peer-keepalive or peer-gateway features are the primary cause of failover packet drops, when in reality, consistency parameter mismatches are the most common culprit in vPC failure scenarios.

How to eliminate wrong answers

Option A is wrong because the vPC peer-gateway feature is used to allow a vPC peer switch to forward traffic destined for the other peer's gateway MAC address, which is not directly related to packet drops during a vPC member link failure. Option B is wrong because orphan ports are ports that are not part of a vPC and require special handling to avoid traffic black-holing, but the scenario describes dual-homed servers using vPC, not orphan ports. Option C is wrong because the vPC role preempt feature controls which switch becomes the primary after a reboot, but it does not cause packet drops during a failover event when a link goes down.

Practice this question →

180

MCQhard

A network administrator is configuring a Cisco Nexus switch to use NX-API for automation. Which statement about NX-API is true?

A.NX-API supports JSON-RPC and RESTful API calls

B.NX-API requires the use of Python scripts exclusively

C.NX-API only supports XML data format

D.NX-API requires a separate license and is not included in NX-OS

AnswerA

NX-API provides both JSON-RPC and REST interfaces.

Why this answer

NX-API is a feature on Cisco Nexus switches that provides both a RESTful API using HTTP/HTTPS and a JSON-RPC interface for programmatic access to the switch's CLI commands. This dual support allows automation tools to interact with the switch using standard web protocols and data formats, making option A correct.

Exam trap

Cisco often tests the misconception that NX-API is limited to a single data format or requires a specific scripting language, when in fact it supports multiple formats and any HTTP-capable client.

How to eliminate wrong answers

Option B is wrong because NX-API does not require Python scripts exclusively; it supports any programming language or tool capable of making HTTP/HTTPS requests, such as Python, JavaScript, or curl. Option C is wrong because NX-API supports both XML and JSON data formats, not only XML; JSON is often preferred for its lighter weight and easier integration with modern automation frameworks. Option D is wrong because NX-API is included in the base NX-OS software and does not require a separate license; it is enabled via the 'feature nxapi' command.

Practice this question →

181

MCQmedium

Which MST configuration parameter must match across all switches in the same MST region?

A.Port cost

B.Root bridge

C.Region name, revision, and VLAN mapping

D.Bridge priority

AnswerC

These define the MST region.

Why this answer

In MST (Multiple Spanning Tree) protocol, switches in the same MST region must share the same region name, revision number, and VLAN-to-instance mapping. These parameters define the region boundary; if any differ, switches will treat each other as being in different regions, breaking MST interoperability and causing them to run separate spanning trees (e.g., PVST+).

Exam trap

Cisco often tests the misconception that bridge priority or root bridge must match across a region, but the trap here is that only the three region parameters (name, revision, VLAN mapping) must be identical; other spanning-tree parameters are per-instance or per-switch and do not define region membership.

How to eliminate wrong answers

Option A is wrong because port cost is a per-port parameter used for path selection within a spanning tree instance, not a region-wide parameter that must match across switches. Option B is wrong because the root bridge is dynamically elected per MST instance (or per spanning tree) and does not need to be configured identically across switches in the same region. Option D is wrong because bridge priority is a per-switch value used in root bridge election and can differ among switches in the same MST region without affecting region membership.

Practice this question →

182

MCQmedium

In ACI, a contract is defined between two EPGs. Which component specifies the type of traffic allowed?

A.VRF

B.Filter

C.Subject

D.Tenant

AnswerC

The subject in a contract contains one or more filters and defines the direction and applicability.

Why this answer

A contract contains subjects, which include filters that define traffic types.

Practice this question →

183

MCQmedium

Which feature in NX-OS allows for direct API calls to the switch for automation purposes?

A.NX-API

B.Python scripting

C.Bash shell

D.SNMP

AnswerA

NX-API is the REST API for Nexus switches.

Why this answer

NX-API (option A) is the correct answer because it is the native NX-OS feature that exposes a RESTful API interface, allowing direct HTTP/HTTPS calls (e.g., GET, POST, PUT, DELETE) to the switch for automation and programmability. This enables tools like Ansible, Postman, or custom scripts to send structured data (JSON/XML) to configure, monitor, and manage the switch without requiring CLI parsing or SSH sessions.

Exam trap

Cisco often tests the distinction between a direct API (NX-API) and automation tools (Python, Bash) that may use APIs indirectly, leading candidates to confuse scripting languages or shell access with the actual API endpoint.

How to eliminate wrong answers

Option B is wrong because Python scripting is a method for writing automation scripts that can run on the switch or remotely, but it does not provide direct API endpoints; it typically uses libraries like requests to call NX-API or other APIs. Option C is wrong because Bash shell provides a Linux shell environment on NX-OS for running commands and scripts, but it is not an API; it requires interactive access or SSH, not direct HTTP-based API calls. Option D is wrong because SNMP is a protocol for monitoring and managing network devices via MIBs and OIDs, but it is not designed for direct API calls for automation; it is primarily used for read/write operations with a different data model and lacks the flexibility of RESTful APIs.

Practice this question →

184

Multi-Selectmedium

A network engineer is troubleshooting an OSPF adjacency that fails to reach FULL state between two Nexus 9000 switches. Which TWO are common causes for this issue?

Select 2 answers

A.Mismatched OSPF process ID

B.Mismatched area ID

C.Mismatched router ID

D.Mismatched hello/dead timers

E.Mismatched network type

AnswersB, D

OSPF neighbors must belong to the same area to form an adjacency.

Why this answer

OSPF requires that both routers in a neighbor relationship belong to the same area. If the area IDs differ, the routers will not exchange routing information and the adjacency will stall at the EXSTART or EXCHANGE state, never reaching FULL. This is a fundamental OSPF neighbor requirement defined in RFC 2328.

Exam trap

Cisco often tests the misconception that the OSPF process ID must match between neighbors, but it is only locally significant and does not affect adjacency formation.

Practice this question →

185

MCQeasy

In a Cisco ACI fabric, which component is responsible for managing the policy repository, fault monitoring, and API endpoints?

A.DCNM

B.APIC controller

C.Spine switch

D.Leaf switch

AnswerB

The APIC is the central controller for policy, monitoring, and API access.

Why this answer

The APIC (Application Policy Infrastructure Controller) is the centralized management and policy engine in Cisco ACI. It maintains the policy repository (the logical and physical policy model), aggregates faults and events from all fabric nodes, and exposes northbound REST API endpoints for automation and integration. Without the APIC, the fabric cannot enforce policies or provide a single point of management.

Exam trap

Cisco often tests the misconception that spine or leaf switches perform centralized management functions, when in fact they are pure forwarding elements with no policy repository or API endpoint capabilities.

How to eliminate wrong answers

Option A is wrong because DCNM (Data Center Network Manager) is a separate management platform for traditional NX-OS environments and does not serve as the policy repository or API endpoint for ACI fabrics; it is not the controller for ACI. Option C is wrong because a spine switch is a high-speed forwarding element that only handles inter-leaf traffic and does not host the policy repository, fault monitoring, or API endpoints. Option D is wrong because a leaf switch is a top-of-rack device that enforces policy at the edge but does not manage the centralized policy repository or expose northbound APIs.

Practice this question →

186

MCQmedium

An engineer is configuring vPC on a pair of Nexus switches. Which statement correctly describes the vPC peer-keepalive link?

A.It is used to forward data traffic between vPC peers

B.It must be a dedicated Layer 2 link between vPC peers

C.It carries BPDUs to prevent loops

D.It is a Layer 3 link used to verify the health of the vPC peer

AnswerD

The peer-keepalive is a Layer 3 heartbeat used to detect peer failure.

Why this answer

The vPC peer-keepalive link is a Layer 3 link used exclusively to monitor the health of the vPC peer. It sends periodic keepalive messages (typically using UDP port 3200) to detect if the peer switch has failed, enabling the surviving switch to take over the vPC traffic. This link does not carry data traffic, BPDUs, or control-plane information beyond the keepalive probes.

Exam trap

The trap here is that candidates confuse the vPC peer-keepalive link with the vPC peer-link, assuming the keepalive link must be a dedicated Layer 2 trunk or that it carries data or BPDUs, when in fact it is a simple Layer 3 health-check path.

How to eliminate wrong answers

Option A is wrong because the vPC peer-keepalive link is not used to forward data traffic; data traffic between vPC peers is forwarded over the vPC peer-link (a Layer 2 trunk). Option B is wrong because the peer-keepalive link does not have to be a dedicated Layer 2 link; it is a Layer 3 link that can be routed over the management network or a separate Layer 3 interface, and it does not require dedicated hardware. Option C is wrong because BPDUs are carried on the vPC peer-link (Layer 2 trunk) to prevent loops, not on the peer-keepalive link, which is Layer 3 and does not participate in spanning-tree.

Practice this question →

187

MCQmedium

A data center network uses MST with multiple instances. Different VLANs are mapped to different MST instances to utilize multiple spanning tree paths. Which MST parameter must be identical on all switches in the same region to ensure proper operation?

A.MST region name and revision number

B.Port path cost

C.Bridge priority

D.Max age timer

AnswerA

Correct: region name and revision must match for region consistency.

Why this answer

In MST, all switches within the same region must agree on the region name and revision number to form a consistent MST region. If these parameters differ, switches will treat each other as being in different regions, causing the MST instances to be recalculated as separate CST (Common Spanning Tree) regions, which can lead to suboptimal or broken load balancing across VLANs.

Exam trap

Cisco often tests the misconception that any consistent STP parameter (like bridge priority or timers) is sufficient for MST region formation, but the trap is that only the region name, revision number, and VLAN-to-instance mapping must match—other parameters like timers or priorities are per-instance or per-switch and do not affect region membership.

How to eliminate wrong answers

Option B is wrong because port path cost is a per-port parameter used to influence root port selection and path cost calculation within an MST instance, but it does not define or affect region membership. Option C is wrong because bridge priority is a per-switch parameter used for root bridge election within an MST instance, not for region identification. Option D is wrong because the max age timer is a global STP timer that controls how long a BPDU is considered valid, and while it must be consistent across a bridged network for loop-free operation, it is not a region-specific parameter and does not determine MST region boundaries.

Practice this question →

188

Multi-Selecthard

Which two benefits does EVPN provide compared to traditional VPLS? (Choose two.)

Select 2 answers

A.Simpler BGP configuration

B.Load balancing of traffic across multiple active paths

C.Reduced MAC address learning

D.No need for MPLS

E.Support for IP routing

AnswersB, E

EVPN allows active-active multihoming, improving bandwidth utilization.

Why this answer

EVPN uses BGP to advertise MAC addresses and IP prefixes, enabling per-flow load balancing across multiple equal-cost paths via its all-active multi-homing capability. In contrast, traditional VPLS relies on a single active forwarder per site (using Spanning Tree Protocol or VPLS Multihoming), which prevents active-active load balancing and wastes bandwidth.

Exam trap

Cisco often tests the misconception that EVPN simplifies BGP configuration or eliminates MPLS, when in fact EVPN requires more BGP knobs and still relies on an MPLS or VXLAN transport layer.

Practice this question →

189

MCQeasy

A mid-size organization is upgrading its data center network to support server virtualization. They have deployed two Nexus 9300 switches as access switches for their server racks. The servers are configured with VLAN tagging and connect to the switches using trunks. The network administrator needs to ensure that the switches can provide default gateway services to the servers to reduce latency. They have configured interface VLAN interfaces and HSRP for redundancy. After implementation, the servers can communicate within the same VLAN but fail to reach the default gateway. The network administrator checks the switch configuration and finds that "ip routing" is not enabled globally. What is the most likely impact of this missing configuration?

A.The switches will not forward traffic between VLANs.

B.The servers will not receive DHCP addresses.

C.HSRP will not elect an active router.

D.The VLAN interfaces will not come up.

AnswerA

ip routing is required for inter-VLAN forwarding.

Why this answer

Without the 'ip routing' command enabled globally, the Nexus 9300 switches operate as Layer 2 devices only. This means they can forward frames within the same VLAN (since that relies on MAC address learning and switching), but they cannot perform IP routing between VLANs or route traffic to the configured SVI (VLAN interface) default gateway. The servers can communicate within the same VLAN because that is purely Layer 2 switching, but any attempt to reach the default gateway (which requires Layer 3 forwarding) fails because the switch does not have IP routing enabled.

Exam trap

Cisco often tests the misconception that HSRP or SVI functionality requires global IP routing to be enabled, when in fact HSRP can operate and SVIs can come up without 'ip routing', but inter-VLAN routing and default gateway reachability will fail.

How to eliminate wrong answers

Option B is wrong because DHCP address assignment relies on DHCP snooping, IP helper-address, or a DHCP server; the absence of 'ip routing' does not prevent a switch from relaying DHCP requests or a server from obtaining an IP address via broadcast within the same VLAN. Option C is wrong because HSRP operates at Layer 3 using the SVI IP address and does not require global IP routing to be enabled; HSRP can still elect an active router and maintain virtual IP/MAC addresses as long as the SVI is up and the HSRP configuration is correct. Option D is wrong because VLAN interfaces (SVIs) come up as long as the VLAN exists and at least one port in that VLAN is up; the 'ip routing' command does not affect the operational state of an SVI.

Practice this question →

190

MCQmedium

A Nexus 9000 switch is configured with VPC. The VPC keepalive link fails. What is the effect on the VPC domain?

A.Both switches suspend the VPC VLANs.

B.Both switches continue to forward traffic normally.

C.The secondary switch suspends its VPC member ports.

D.The primary switch becomes orphan.

AnswerC

To avoid split-brain, the secondary switch suspends its VPC member ports while keepalive is down.

Why this answer

In a VPC domain, the keepalive link is used to monitor the liveness of the peer switch, but it does not carry data traffic. When the keepalive link fails, the secondary switch cannot confirm the primary is alive, so it suspends its VPC member ports to prevent a dual-active scenario. The primary switch remains active and continues forwarding traffic normally because it assumes the secondary has failed.

Exam trap

Cisco often tests the misconception that a keepalive link failure causes both switches to stop forwarding or that the primary becomes orphan, but the correct behavior is that only the secondary suspends its VPC member ports to maintain a single active forwarding path.

How to eliminate wrong answers

Option A is wrong because both switches do not suspend VPC VLANs; only the secondary suspends its VPC member ports to avoid a split-brain condition. Option B is wrong because both switches do not continue forwarding traffic normally; the secondary suspends its VPC ports, disrupting traffic on that side. Option D is wrong because the primary switch does not become orphan; it remains active and continues to forward traffic, while the secondary suspends its ports.

Practice this question →

191

MCQeasy

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets for transport over the IP network?

A.VTEP

B.VXLAN Gateway

C.VXLAN Tunnel

D.VNI

AnswerA

VTEP is the tunnel endpoint that does encapsulation.

Why this answer

The VXLAN Tunnel Endpoint (VTEP) is the component responsible for performing encapsulation and decapsulation of Ethernet frames into UDP packets for transport over the IP network. It sits at the edge of the VXLAN overlay and maps tenant traffic to VXLAN segments by adding a VXLAN header (including the VNI) and an outer UDP/IP header. This process allows Layer 2 frames to traverse a Layer 3 underlay network.

Exam trap

Cisco often tests the distinction between the VTEP (the endpoint that performs encapsulation) and the VXLAN Tunnel (the logical path), causing candidates to mistakenly select 'VXLAN Tunnel' because they associate tunnels with encapsulation.

How to eliminate wrong answers

Option B (VXLAN Gateway) is wrong because a VXLAN Gateway is used to interconnect a VXLAN overlay with a traditional VLAN or another overlay, not to perform the primary encapsulation/decapsulation of frames into UDP packets. Option C (VXLAN Tunnel) is wrong because a VXLAN Tunnel is the logical path between two VTEPs, not a component that performs encapsulation; it is the result of the VTEPs creating the tunnel. Option D (VNI) is wrong because the VXLAN Network Identifier (VNI) is a 24-bit segment identifier in the VXLAN header that distinguishes tenant traffic, but it does not perform encapsulation or decapsulation.

Practice this question →

192

Multi-Selecthard

In a vPC environment, which two conditions must be identical on both vPC peer switches to ensure proper consistency? (Choose two.)

Select 2 answers

A.VLAN configuration on the member ports

B.System priority

C.Port channel mode (active/passive)

D.STP port type (edge, network, normal)

E.Peer-keepalive IP address

AnswersA, D

Allowed VLANs must match.

Why this answer

In a vPC environment, the VLAN configuration on member ports must be identical on both peer switches to ensure that traffic is forwarded consistently across the vPC. If VLANs are pruned or allowed differently on the member ports, the vPC can become inconsistent, leading to traffic drops or loops. This is a key consistency check enforced by Cisco NX-OS to maintain a stable vPC domain.

Exam trap

Cisco often tests the misconception that all vPC parameters must match, but only specific ones (like VLAN configuration and STP port type) are required to be identical for consistency, while others like system priority or peer-keepalive IP are intentionally different.

Practice this question →

193

MCQeasy

A network engineer is troubleshooting VXLAN connectivity between two VTEPs. The source VTEP is configured with `nve1` and member VNI 10000. The `show nve peers` command shows the remote VTEP IP but the status is 'Init'. What is a likely cause?

A.The multicast group is not reachable.

B.The remote VTEP is not configured with the same VNI.

C.The MTU is too low.

D.The VRF is mismatched between the VTEPs.

AnswerA

VXLAN relies on multicast for BUM traffic; if the multicast group is unreachable, the peer remains in 'Init'.

Why this answer

The 'Init' status in the output of 'show nve peers' indicates that the VXLAN tunnel endpoint (VTEP) has learned the remote VTEP IP address (likely via BGP EVPN or static configuration) but is unable to complete the tunnel establishment. In VXLAN multicast mode, the underlay multicast group is used for BUM traffic and for VTEP discovery. If the multicast group is not reachable (e.g., due to missing PIM configuration, incorrect RP, or firewall filtering), the source VTEP cannot receive the multicast join or data from the remote VTEP, leaving the peer stuck in 'Init' state.

Exam trap

Cisco often tests the distinction between control-plane and data-plane issues; the trap here is that candidates assume 'Init' means a configuration mismatch (like VNI or VRF) rather than an underlay multicast reachability problem, because they overlook that VXLAN multicast mode requires a functional underlay multicast tree for peer establishment.

How to eliminate wrong answers

Option B is wrong because a VNI mismatch would typically cause the remote VTEP to not advertise that VNI in BGP EVPN, resulting in the peer not being learned at all, or the VNI not being operational, but the peer status would not show 'Init' for a learned peer. Option C is wrong because an MTU issue would cause packet fragmentation or drops after the tunnel is established, not prevent the peer from leaving the 'Init' state; the 'Init' state is a control-plane issue, not a data-plane MTU problem. Option D is wrong because a VRF mismatch would affect traffic forwarding and route import/export in BGP EVPN, but the peer status is independent of VRF configuration; the VTEP peer can still be established even with mismatched VRFs, though traffic may not be forwarded correctly.

Practice this question →

194

MCQhard

An administrator is deploying a new application in a Cisco ACI fabric. The application requires multicast traffic between end hosts. Which configuration is necessary for multicast in ACI?

A.Enable PIM on the leaf switches.

B.Configure a multicast group in the EPG.

C.Create a multicast policy in the bridge domain.

D.Use IGMP snooping only.

AnswerC

A multicast policy in the bridge domain enables multicast forwarding.

Why this answer

In Cisco ACI, multicast forwarding is enabled at the bridge domain level using a multicast policy. This policy configures the necessary IGMP snooping and multicast group membership for the fabric, allowing end hosts to receive multicast traffic without requiring PIM on the leaf switches. Option C is correct because the bridge domain multicast policy is the required configuration for multicast in ACI.

Exam trap

Cisco often tests the misconception that PIM must be enabled for multicast in ACI, but the fabric's overlay uses head-end replication and IGMP snooping at the bridge domain level instead.

How to eliminate wrong answers

Option A is wrong because PIM is not required in ACI; the fabric uses a head-end replication model with IGMP snooping and a multicast policy, not traditional PIM routing. Option B is wrong because multicast groups are not configured in the EPG; the EPG defines endpoint groups and contracts, while multicast group membership is managed via the bridge domain multicast policy. Option D is wrong because IGMP snooping alone is insufficient; ACI requires the multicast policy in the bridge domain to enable the fabric's multicast forwarding behavior, including head-end replication.

Practice this question →

195

MCQhard

In an ACI fabric, a contract between two EPGs uses a filter that permits TCP port 443. The provider EPG is configured with a VMM domain integration. Which statement about the contract's effect is true?

A.Both directions are allowed for TCP 443.

B.Traffic from the provider EPG to the consumer EPG on TCP 443 is allowed.

C.Traffic from the consumer EPG to the provider EPG on TCP 443 is allowed.

D.The VMM domain overrides the contract and permits all traffic.

AnswerC

This is correct. The contract with a filter for TCP 443 permits traffic from the consumer EPG to the provider EPG.

Why this answer

In Cisco ACI, contracts define unidirectional communication from the consumer EPG to the provider EPG. The filter permitting TCP port 443 allows traffic from the consumer to the provider. The VMM domain integration does not alter this contract behavior; it only manages virtual machine connectivity.

Therefore, only traffic from the consumer EPG to the provider EPG on TCP 443 is permitted.

Exam trap

Cisco often tests the misconception that contracts allow traffic from provider to consumer, leading candidates to incorrectly select option B, when in fact ACI contracts are unidirectional from consumer to provider unless a reverse filter is explicitly configured.

How to eliminate wrong answers

Option A is wrong because ACI contracts are unidirectional by default; a filter permitting TCP 443 only allows traffic in the direction from provider to consumer, not both directions, unless a separate reverse filter is configured. Option C is wrong because the consumer EPG cannot initiate TCP 443 traffic to the provider EPG under this contract; the provider is the source of allowed traffic. Option D is wrong because a VMM domain integration does not override contract rules; it integrates with hypervisors for policy enforcement but still respects the contract's directionality and filters.

Practice this question →

196

MCQhard

A large enterprise data center is deploying a new application using Cisco ACI with a multi-pod design. The application requires low-latency communication between servers in different pods. The network team has configured the ACI fabric with two pods, each connected via inter-pod network (IPN) switches. After deployment, the application experiences intermittent latency spikes and packet loss. The APIC health scores remain high but the latency issue persists. The team has verified the underlay IP connectivity and MTU settings. What is the most likely cause of the latency issues?

A.The application servers are using different VLANs that are not stretched between pods.

B.The CoS settings for the application traffic are not properly mapped to the appropriate queue on the IPN switches.

C.The IPN switches are using a shared link aggregation group that is causing traffic congestion.

D.The inter-pod network is not configured with enough bandwidth due to oversubscription.

AnswerB

Improper CoS mapping leads to sporadic drops.

Why this answer

In a Cisco ACI multi-pod design, the IPN switches must properly trust and map the CoS values from the ACI fabric to the appropriate egress queues. If the CoS markings are not correctly configured on the IPN switches, application traffic can experience buffer drops and latency spikes even when the underlay has sufficient bandwidth and the APIC health scores are high. This is a common misconfiguration because the IPN switches are Layer 3 devices that require explicit QoS policies to preserve the ACI fabric's priority handling.

Exam trap

Cisco often tests the misconception that underlay connectivity and MTU settings are sufficient for multi-pod performance, when in fact the IPN switches require explicit QoS configuration to preserve ACI's priority handling across pods.

How to eliminate wrong answers

Option A is wrong because VLANs are not stretched between pods in ACI multi-pod; inter-pod traffic uses Layer 3 routing via the IPN, so different VLANs per pod do not cause latency or packet loss. Option C is wrong because a shared link aggregation group (LAG) on IPN switches would not inherently cause congestion; LAGs are used for bandwidth aggregation and redundancy, and the issue is about queue drops, not link bundling. Option D is wrong because oversubscription of the inter-pod network would manifest as consistent congestion and high APIC health degradation, not intermittent latency spikes with high health scores; the problem is QoS misconfiguration, not bandwidth shortage.

Practice this question →

197

MCQeasy

Which NX-OS command displays the current VLAN configuration on a Nexus switch?

A.show vlan

B.show running-config vlan

C.show vlan brief

D.show interface vlan

AnswerA

Correct command.

Why this answer

The 'show vlan' command on NX-OS displays the current VLAN configuration, including VLAN IDs, names, status, and ports assigned to each VLAN. This command is the standard way to view VLAN information in Cisco NX-OS, similar to IOS, and it shows both default and user-created VLANs.

Exam trap

Cisco often tests the distinction between 'show vlan' (which shows VLAN membership and status) and 'show running-config vlan' (which shows the configuration commands), leading candidates to mistakenly choose the latter when asked for the current VLAN configuration.

How to eliminate wrong answers

Option B is wrong because 'show running-config vlan' displays the VLAN configuration as it appears in the running configuration file, not a formatted VLAN table; it shows the actual CLI commands used to configure VLANs, not a summary of VLAN status and port assignments. Option C is wrong because 'show vlan brief' is not a valid NX-OS command; the correct command to see a brief VLAN summary is 'show vlan' or 'show vlan summary', and 'brief' is an optional keyword in some IOS versions but not a standalone command in NX-OS. Option D is wrong because 'show interface vlan' displays the Layer 3 interface status and configuration for SVI (Switch Virtual Interface) VLAN interfaces, not the VLAN database or port membership.

Practice this question →

198

MCQmedium

An engineer is troubleshooting a BGP EVPN session between a leaf and a spine. The 'show bgp l2vpn evpn summary' output shows the peer state as 'Active'. What does this indicate?

A.The session is in the process of being established.

B.The session is up and exchanging prefixes.

C.There is a configuration mismatch.

D.The TCP connection is not established.

AnswerD

Active means BGP is trying to establish a TCP connection.

Why this answer

In BGP EVPN, the 'Active' state indicates that the BGP speaker is actively trying to establish a TCP connection with the peer but has not yet completed the three-way handshake. This means the TCP session is not established, which is a prerequisite for BGP session establishment. The peer remains in 'Active' until the TCP connection is successfully formed.

Exam trap

The trap here is that candidates often confuse 'Active' with 'Connect' or think it means the session is actively exchanging routes, when in fact it indicates a TCP connection failure that must be resolved before BGP can proceed.

How to eliminate wrong answers

Option A is wrong because the 'Active' state specifically indicates that the TCP connection is not yet established, not that the session is in the process of being established (which would be 'Connect' or 'OpenSent' states). Option B is wrong because a session that is up and exchanging prefixes would be in the 'Established' state, not 'Active'. Option C is wrong because a configuration mismatch typically results in the session flapping or staying in 'Idle' state, not 'Active'; 'Active' is a TCP connection issue, not a configuration mismatch.

Practice this question →

199

MCQhard

In an ACI fabric, an EPG is configured with a contract that provides a service to another EPG. The contract has a filter for TCP port 80. Which component defines the directionality of the communication between the provider and consumer EPG?

A.The filter direction specified in the contract

B.The BD subnets

C.The provider and consumer labels in the contract

D.The subject of the contract

AnswerC

Correct: provider/consumer relationship defines direction.

Why this answer

In Cisco ACI, the provider and consumer labels in the contract define the directionality of communication. The provider EPG offers a service, and the consumer EPG initiates the request; the contract's provider/consumer relationship determines which EPG can start the conversation and in which direction the filter (e.g., TCP port 80) applies. This is fundamental to ACI's policy model, where the contract is unidirectional from consumer to provider by default.

Exam trap

Cisco often tests the misconception that the filter direction (e.g., 'both' or 'uni') controls which EPG initiates traffic, when in fact it is the provider and consumer labels that define the directionality of the communication.

How to eliminate wrong answers

Option A is wrong because the filter direction in a contract (e.g., 'both' or 'uni') only specifies whether the filter applies to one or both directions of traffic, but it does not define which EPG is the provider or consumer; the directionality of the communication is set by the provider/consumer labels. Option B is wrong because BD subnets define the IP addressing and gateway for endpoints within a bridge domain, not the directionality of inter-EPG communication governed by contracts. Option D is wrong because the subject of the contract groups filters and actions but does not establish the provider/consumer relationship; it is the contract itself that carries the provider and consumer labels.

Practice this question →

200

MCQhard

In a VXLAN EVPN fabric using BGP as the control plane, which BGP address family is used to exchange MAC/VTEP reachability information between VTEPs?

A.IPv4 unicast

B.IPv6 unicast

C.VPNv4 unicast

D.L2VPN EVPN

AnswerD

L2VPN EVPN is the correct address family for VXLAN EVPN.

Why this answer

In a VXLAN EVPN fabric, the L2VPN EVPN address family (AFI 25, SAFI 70) is used to exchange MAC/VTEP reachability information between VTEPs. This address family carries BGP EVPN routes (type-2 for MAC/IP advertisements) that include the MAC address, VNI, and VTEP IP, enabling the control plane to distribute host reachability without flooding.

Exam trap

Cisco often tests the distinction between VPNv4 unicast (used for MPLS L3VPN) and L2VPN EVPN (used for VXLAN EVPN), so the trap here is confusing the control-plane address family for Layer 3 VPNs with the one for Layer 2 EVPN overlays.

How to eliminate wrong answers

Option A is wrong because IPv4 unicast (AFI 1, SAFI 1) is used for exchanging IPv4 prefix reachability, not MAC/VTEP information. Option B is wrong because IPv6 unicast (AFI 2, SAFI 1) is used for IPv6 prefix reachability, not for MAC/VTEP advertisements. Option C is wrong because VPNv4 unicast (AFI 1, SAFI 128) is used for MPLS L3VPN prefix exchange, not for Layer 2 MAC/VTEP information in VXLAN EVPN.

Practice this question →

201

MCQmedium

In Cisco ACI, which component is responsible for translating EPG communication policies into concrete configuration on leaf switches?

A.Leaf switch

B.APIC controller

C.Spine switch

D.VMM domain

AnswerB

APIC translates the policy model into switch configurations.

Why this answer

The APIC controller is the centralized policy engine in Cisco ACI. It translates high-level EPG communication policies (contracts, filters, subjects) into the concrete switch configuration (e.g., OpFlex policy elements, VXLAN tunnel mappings, and hardware table entries) and pushes them to leaf switches via the OpFlex protocol. Without the APIC, leaf switches cannot autonomously interpret or apply these policies.

Exam trap

Cisco often tests the misconception that leaf switches are 'intelligent' enough to translate policies themselves, but in ACI the leaf is a stateless enforcement point that relies entirely on the APIC for policy translation and distribution.

How to eliminate wrong answers

Option A is wrong because leaf switches are the enforcement points that receive and apply the concrete configuration from the APIC, but they do not perform the translation from high-level policy to low-level configuration. Option C is wrong because spine switches in ACI handle only VXLAN-based fabric forwarding (e.g., MP-BGP EVPN control plane and underlay routing) and are not involved in translating EPG policies into leaf switch configuration. Option D is wrong because a VMM domain integrates ACI with hypervisors (e.g., VMware vSphere) to dynamically bind VMs to EPGs, but it does not translate EPG policies into leaf switch configuration; that translation is solely the APIC's responsibility.

Practice this question →

202

Multi-Selectmedium

Which two BGP features are commonly used in a Cisco Data Center spine-leaf fabric to achieve optimal ECMP load balancing? (Choose two.)

Select 2 answers

A.BGP add-path

B.BGP confederation

C.BGP multipath

D.BGP next-hop-self

E.BGP bestpath tie-break

AnswersA, C

Enables advertisement of multiple paths for load balancing.

Why this answer

BGP add-path (A) allows the advertisement of multiple paths for the same prefix to a peer, enabling the spine to install multiple equal-cost paths in its routing table for ECMP load balancing. BGP multipath (C) instructs the router to install multiple equal-cost BGP paths into the routing table, which is essential for distributing traffic across multiple spine links in a Clos fabric.

Exam trap

Cisco often tests the distinction between features that enable ECMP (add-path and multipath) versus features that affect path selection or IBGP topology (confederation, next-hop-self), leading candidates to confuse operational necessity with load-balancing capability.

Practice this question →

203

MCQhard

In Cisco ACI, when integrating with VMware vSphere via VMM domain, what is the purpose of the 'vCenter Domain' policy?

A.To replace the need for VXLAN overlay in the fabric

B.To automatically configure virtual switch port groups and EPGs based on VM attributes

C.To manage storage connectivity for VMware clusters

D.To enable virtual machine mobility (vMotion) across data centers

AnswerB

VMM domain automates network provisioning for VMs.

Why this answer

The 'vCenter Domain' policy in Cisco ACI integrates with VMware vSphere by automatically creating and mapping virtual switch port groups to EPGs based on VM attributes such as VM name, operating system, or custom tags. This eliminates manual port group configuration and ensures consistent policy enforcement as VMs are deployed or moved within the VMM domain.

Exam trap

Cisco often tests the misconception that the VMM domain replaces the overlay or handles storage/vMotion, when in fact it is purely about automating EPG-to-port group mapping based on VM attributes.

How to eliminate wrong answers

Option A is wrong because the VMM domain does not replace the VXLAN overlay; ACI uses VXLAN (with IS-IS for underlay) as its fabric encapsulation, and the VMM domain simply extends policy to the hypervisor. Option C is wrong because storage connectivity for VMware clusters is managed by separate storage policies (e.g., VSAN or NFS), not by the vCenter Domain policy. Option D is wrong because vMotion across data centers requires Layer 2 extension (e.g., OTV or VXLAN EVPN) and is not a function of the vCenter Domain policy, which operates within a single ACI fabric and vCenter instance.

Practice this question →

204

MCQhard

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

A.Context (default)

B.Application-profile

C.Global

D.VRF

AnswerD

VRF scope allows contracts to apply across bridge domains within the same VRF; without a contract, traffic is denied, and with a contract, permitted.

Why this answer

The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default.

This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Exam trap

Cisco often tests the misconception that 'context' is a separate scope option, when in fact the default contract scope is VRF (context), and the exam expects you to know that VRF is the correct term for the private L3 network boundary that enforces the deny-by-default inter-EPG behavior.

How to eliminate wrong answers

Option A (Context/default) is wrong because the default contract scope is actually 'context' (VRF), not a separate scope; the term 'Context' is ambiguous and not a distinct contract scope in ACI—the default behavior is VRF-level scoping, which already denies inter-EPG traffic without a contract. Option B (Application-profile) is wrong because contract scope at the application-profile level would restrict the contract to EPGs within the same application profile, but this does not address the requirement for bridge-domain-level isolation; it is too narrow and would not allow default intra-bridge domain traffic across different application profiles. Option C (Global) is wrong because a global contract scope makes the contract apply across all VRFs, which would permit traffic between EPGs in different VRFs (and thus different bridge domains) without explicit permission, violating the requirement that such traffic must be denied by default.

Practice this question →

205

MCQmedium

Refer to the exhibit. A network engineer notices that traffic for VNI 10000 is not being encapsulated. What is the most likely reason?

A.BGP EVPN is not configured.

B.VNI 10000 is not configured under the nve interface.

C.The VRF association is incorrect.

D.The source-interface is not reachable.

AnswerB

The show output clearly does not include member vni 10000.

Why this answer

VNI 10000 must be explicitly mapped to an NVE interface under the 'interface nve1' configuration using the 'member vni 10000' command. Without this mapping, the NVE interface does not know which VNI to encapsulate traffic for, even if the VNI exists in the network. Option B correctly identifies this missing configuration as the most likely cause.

Exam trap

Cisco often tests the distinction between control-plane (BGP EVPN) and data-plane (NVE interface) configurations, trapping candidates who assume that a VNI configured in the VRF or advertised via EVPN automatically enables encapsulation on the NVE interface.

How to eliminate wrong answers

Option A is wrong because BGP EVPN is the control plane protocol used to advertise VNI reachability, but traffic encapsulation itself is a data-plane function performed by the NVE interface; the absence of BGP EVPN would prevent route distribution but not directly block encapsulation if the VNI is already configured under NVE. Option C is wrong because VRF association is a Layer 3 construct that maps a VRF to a VNI for routing, but encapsulation failure for VNI 10000 specifically points to the NVE interface configuration, not the VRF mapping. Option D is wrong because if the source-interface were unreachable, no VNI traffic would be encapsulated at all, not just VNI 10000; the issue is isolated to a single VNI, indicating a configuration omission rather than a reachability problem.

Practice this question →

206

MCQmedium

Which ECMP load-balancing method is recommended for data center spine-leaf fabrics to ensure optimal traffic distribution?

A.Per-flow load balancing based on src-dst IP

B.Per-packet load balancing

C.Weighted load balancing

D.Per-flow load balancing based on src-dst MAC

AnswerA

This ensures packets of the same flow take the same path.

Why this answer

Per-flow load balancing based on src-dst IP ensures that all packets belonging to the same flow (identified by source and destination IP addresses) follow the same path, preventing packet reordering while still distributing different flows across multiple equal-cost paths. In spine-leaf fabrics, this method provides optimal traffic distribution because it leverages the IP header information that is consistently available across Layer 3 boundaries, aligning with the fabric's routing-based forwarding model.

Exam trap

Cisco often tests the misconception that per-packet load balancing is more granular and therefore better for distribution, but the trap is that it ignores the critical requirement of packet ordering for TCP performance, making per-flow the only viable choice for production data center fabrics.

How to eliminate wrong answers

Option B is wrong because per-packet load balancing sends individual packets of the same flow over different paths, causing severe packet reordering and performance degradation in TCP/IP networks. Option C is wrong because weighted load balancing is used when paths have unequal costs (e.g., with the 'bandwidth' parameter in OSPF or EIGRP), but ECMP in spine-leaf fabrics assumes equal-cost paths, making weighting unnecessary. Option D is wrong because per-flow load balancing based on src-dst MAC is only effective within a Layer 2 domain; in a routed spine-leaf fabric, MAC addresses change at each Layer 3 hop (due to next-hop MAC rewrite), making them unreliable for consistent flow identification across the fabric.

Practice this question →

207

MCQhard

An engineer is troubleshooting a BGP EVPN issue where leaf switches are not learning remote MAC addresses. The underlay is reachable and BGP sessions are established. What is a likely cause?

A.Missing 'address-family l2vpn evpn' under the BGP neighbor configuration

B.NVE interface not enabled

C.Incorrect VNI configuration

D.MTU mismatch on the underlay

AnswerA

This address family must be activated to exchange EVPN routes.

Why this answer

Even when the underlay is reachable and BGP sessions are established, the BGP EVPN control plane requires the 'address-family l2vpn evpn' to be explicitly activated under the BGP neighbor configuration. Without this, the leaf switch will not exchange EVPN routes (Type-2 MAC/IP advertisement routes) with its peers, so remote MAC addresses are never learned. This is a common misconfiguration because BGP sessions may appear up but are not carrying the necessary EVPN address family.

Exam trap

Cisco often tests the distinction between a BGP session being 'established' and the specific address family being activated, leading candidates to overlook the missing 'address-family l2vpn evpn' under the neighbor configuration.

How to eliminate wrong answers

Option B is wrong because the NVE interface is the data-plane tunnel endpoint; if it were not enabled, VXLAN traffic would not be forwarded, but the issue here is specifically about learning remote MAC addresses via the control plane, not data-plane forwarding. Option C is wrong because an incorrect VNI configuration would cause traffic to be mapped to the wrong VXLAN segment or dropped, but it would not prevent the BGP control plane from learning remote MAC addresses if the EVPN address family is properly configured. Option D is wrong because an MTU mismatch on the underlay would cause packet fragmentation or drops for large data-plane packets, but it does not affect the BGP control-plane exchange of EVPN routes, which uses smaller TCP segments.

Practice this question →

208

MCQmedium

In a vPC setup, what is the purpose of the vPC peer-keepalive link?

A.To detect the failure of a vPC peer

B.To exchange routing protocol updates

C.To synchronize MAC address tables

D.To forward data traffic between vPC peers

AnswerA

Keepalive is a heartbeat mechanism.

Why this answer

The vPC peer-keepalive link is a dedicated Layer 3 link used exclusively to monitor the health of the vPC peer. Its primary purpose is to detect a peer failure (e.g., a supervisor crash or complete switch failure) so that the remaining peer can take appropriate actions, such as disabling its own vPC member ports to prevent loops. This is distinct from the vPC peer-link, which carries control and data traffic between peers.

Exam trap

Cisco often tests the distinction between the vPC peer-link (which carries data and control traffic) and the peer-keepalive link (which is only for liveness detection), leading candidates to mistakenly assign data-forwarding or synchronization roles to the keepalive link.

How to eliminate wrong answers

Option B is wrong because routing protocol updates are exchanged over the vPC peer-link (Layer 2 trunk) or via a separate Layer 3 link, not over the peer-keepalive link which only carries keepalive messages (UDP packets). Option C is wrong because MAC address table synchronization occurs over the vPC peer-link using Cisco Fabric Services (CFS), not over the peer-keepalive link. Option D is wrong because the peer-keepalive link never forwards data traffic; it is a control-plane link that only sends periodic keepalive messages (default 1-second interval) to verify peer liveness.

Practice this question →

209

MCQeasy

A data center switch has multiple access ports configured with spanning-tree portfast. A new server is connected to one of these ports and immediately causes a network loop. What is the most likely cause?

A.The portfast feature is disabled by default on the switch.

B.The server sends BPDUs.

C.The port is not configured with BPDUguard.

D.The switch is running MSTP instead of PVST+.

AnswerC

Without BPDUguard, the port stays up when a BPDU is received, potentially causing a loop.

Why this answer

Spanning Tree Protocol (STP) PortFast immediately transitions a port to the forwarding state, bypassing the listening and learning phases. However, PortFast alone does not protect against loops if a rogue device (like a server) inadvertently connects two switch ports or sends BPDUs. BPDUguard must be explicitly configured on the port to disable it upon receiving any BPDU, preventing a loop.

Without BPDUguard, the switch will process the BPDU and may re-enter STP convergence, potentially causing a loop if the server is misconfigured or bridging traffic.

Exam trap

Cisco often tests the misconception that PortFast alone prevents loops, but the trap here is that PortFast only speeds up initial convergence; without BPDUguard, a PortFast port can still participate in STP and cause a loop if it receives a BPDU.

How to eliminate wrong answers

Option A is wrong because PortFast is not disabled by default on a switch; it is a per-port feature that must be explicitly enabled with the 'spanning-tree portfast' interface command. Option B is wrong because the server sending BPDUs is the trigger for the loop, not the cause of the loop itself—the root cause is the lack of BPDUguard to protect the PortFast port from those BPDUs. Option D is wrong because MSTP (Multiple Spanning Tree Protocol) and PVST+ (Per-VLAN Spanning Tree Plus) both support PortFast and BPDUguard; the protocol variant does not inherently cause loops when PortFast is enabled without BPDUguard.

Practice this question →

210

MCQmedium

An engineer is designing a Layer 3 network for a data center using OSPF. The core switches are connected to aggregation switches. To optimize convergence, which OSPF network type should be used on the links between core and aggregation?

A.broadcast

B.non-broadcast

C.point-to-multipoint

D.point-to-point

AnswerD

Eliminates DR election, reduces convergence time.

Why this answer

In a data center spine-leaf architecture, the links between core (spine) and aggregation (leaf) switches are typically point-to-point Layer 3 links. Configuring OSPF network type point-to-point (option D) on these interfaces eliminates the need for DR/BDR election, reduces hello and dead timers (default 10s/40s vs 30s/120s for broadcast), and allows faster convergence because OSPF immediately forms a neighbor adjacency without waiting for election delays.

Exam trap

Cisco often tests the misconception that broadcast is the default and therefore best for Ethernet links, but in a data center spine-leaf design, point-to-point is preferred because it eliminates DR/BDR election overhead and provides faster convergence.

How to eliminate wrong answers

Option A is wrong because broadcast network type requires a Designated Router (DR) and Backup Designated Router (BDR) election, which adds unnecessary convergence delay and overhead on point-to-point links between core and aggregation switches. Option B is wrong because non-broadcast network type is used for NBMA environments (e.g., Frame Relay) where neighbors must be manually configured and DR/BDR election still occurs, making it unsuitable for direct point-to-point Ethernet links. Option C is wrong because point-to-multipoint is designed for hub-and-spoke topologies where a single interface connects to multiple neighbors, not for the direct point-to-point links between core and aggregation switches.

Practice this question →

211

MCQmedium

Which NX-OS command is used to display the consistency status of Virtual Port Channel (vPC) parameters across both vPC peers?

A.show vpc peer-keepalive

B.show vpc brief

C.show running-config vpc

D.show vpc consistency-parameters

AnswerD

This command shows consistency checks for vPC.

Why this answer

The 'show vpc consistency-parameters' command is specifically designed to verify that all required VPC configuration parameters (such as allowed VLANs, STP settings, and port-channel modes) are identical on both VPC peers. Inconsistent parameters can cause VPC traffic disruption or failover issues, and this command provides a detailed per-interface or global consistency check.

Exam trap

Cisco often tests the distinction between 'show vpc brief' (which shows operational status) and 'show vpc consistency-parameters' (which shows configuration alignment), leading candidates to mistakenly choose the former when asked about parameter consistency.

How to eliminate wrong answers

Option A is wrong because 'show vpc peer-keepalive' only displays the status of the peer-keepalive link (e.g., UDP heartbeat), not the consistency of VPC configuration parameters. Option B is wrong because 'show vpc brief' shows a summary of VPC status, role, and peer-link state, but does not compare parameter consistency between peers. Option C is wrong because 'show running-config vpc' displays the local VPC configuration only, and does not compare or validate consistency against the peer's configuration.

Practice this question →

212

MCQeasy

Refer to the exhibit. A network engineer has configured a port-channel for OSPF adjacency. What additional configuration is required for the port-channel to operate correctly?

A.Set the OSPF priority.

B.No additional configuration needed.

C.Enable OSPF on the port-channel with `ip router ospf process`.

D.Configure the channel-group mode on member interfaces.

AnswerD

Member interfaces must be assigned to the port-channel using `channel-group`.

Why this answer

For a port-channel to form an OSPF adjacency, the member interfaces must be configured with a channel-group mode (e.g., 'channel-group 1 mode active') to bundle them into a logical port-channel interface. Without this, the interfaces remain individual Layer 2 or Layer 3 links, and OSPF cannot establish adjacency over the port-channel as a single logical link.

Exam trap

Cisco often tests the misconception that creating the port-channel interface alone is sufficient, when in fact the member interfaces must be explicitly assigned to the port-channel using the channel-group command.

How to eliminate wrong answers

Option A is wrong because OSPF priority is used for Designated Router (DR) and Backup Designated Router (BDR) election on multiaccess networks, not for enabling or operating a port-channel. Option B is wrong because additional configuration is indeed required: the member interfaces must be assigned to the port-channel using the channel-group command; simply creating the port-channel interface does not bundle the physical links. Option C is wrong because 'ip router ospf process' is used to enable OSPF on an interface, but the port-channel interface itself must first exist and be properly formed; the missing step is bundling the member interfaces, not enabling OSPF on the port-channel.

Practice this question →

213

MCQmedium

An engineer needs to automate a repetitive configuration task on a Nexus switch. Which method is most suitable for programmatic access?

A.FTP file transfer

B.NX-API

C.CLI scripting with Tcl

D.SNMP v3

AnswerB

NX-API allows JSON/XML-based API calls for configuration and monitoring.

Why this answer

NX-API provides a RESTful interface that allows programmatic access to Nexus switches using HTTP/HTTPS methods (GET, POST, DELETE) with JSON or XML payloads. This makes it the most suitable method for automating repetitive configuration tasks because it supports modern scripting languages (Python, Ansible) and enables idempotent, structured configuration changes without requiring interactive CLI sessions.

Exam trap

Cisco often tests the distinction between monitoring protocols (SNMP) and programmatic configuration interfaces (NX-API), leading candidates to mistakenly choose SNMP v3 because it supports secure access, even though it cannot perform configuration changes.

How to eliminate wrong answers

Option A is wrong because FTP is a file transfer protocol used for bulk image or configuration file transfers, not for programmatic, real-time configuration automation; it lacks the structured API calls needed for granular task automation. Option C is wrong because CLI scripting with Tcl runs within the switch's CLI environment and is not a programmatic access method—it is an interactive scripting tool that does not expose a RESTful API for external automation frameworks. Option D is wrong because SNMP v3 is designed for monitoring and retrieving MIB objects, not for making configuration changes; it is read-heavy and lacks the transactional, idempotent write capabilities required for automating configuration tasks.

Practice this question →