Courseiva
NetworkmediumMultiple ChoiceObjective-mapped

350-601 Network Practice Question

In a Cisco ACI fabric, a tenant has multiple bridge domains with different subnets. The administrator wants to allow traffic between two EPGs in the same tenant but different bridge domains. Which ACI construct is required to enable communication?

⚠ Common exam trap

Cisco often tests the misconception that EPGs in the same tenant can communicate without a contract, but in ACI, all inter-EPG traffic (even within the same tenant) requires a contract unless the EPGs are in the same bridge domain and have unicast routing enabled.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Contracts with filters and subjects

In Cisco ACI, EPGs in different bridge domains are isolated by default. To enable communication between them, a contract must be applied that defines the allowed traffic. Contracts use filters and subjects to specify permitted protocols and ports, and are the only native ACI mechanism for inter-EPG communication across bridge domains within the same tenant.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Contracts with filters and subjects

    Why this is correct

    Contracts specify allowed traffic between EPGs.

  • Shared L3Out

    Why it's wrong here

    L3Out is for external connectivity.

  • VRF route leaking

    Why it's wrong here

    VRF route leaking is used for inter-VRF, not between EPGs in same VRF.

  • VMM domain integration

    Why it's wrong here

    VMM domain integrates with hypervisor, not for inter-EPG communication.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.