350-601 Network Practice Question
Exhibit
vrf context TenantA ip route 0.0.0.0/0 10.1.1.1 evn vni 5001 l2 vni 5002 l2 rd 1.1.1.1:1 route-target import 65000:5001 route-target export 65000:5001 ! interface nve1 source-interface loopback0 member vni 5001 associate-vrf member vni 5002 associate-vrf
Refer to the exhibit. A network administrator configured VXLAN EVPN as above. The VTEP can communicate with neighbors on VNI 5001, but cannot reach the default gateway for VNI 5002. What is the problem?
⚠ Common exam trap
Cisco often tests the distinction between Layer 2 VNI (which needs VLAN association and ingress-replication) and Layer 3 VNI (which needs route-target configuration), and the trap here is that candidates assume a missing VLAN or ingress-replication is the root cause, when the real issue is the missing route-target for the Layer 3 VNI under the VRF.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route-target for VNI 5002 is missing.
The VXLAN EVPN configuration for VNI 5002 is missing the route-target import/export statements under the VRF TenantA address-family l2vpn evpn. Without the route-target, the VTEP cannot import EVPN type-2 and type-3 routes for VNI 5002, preventing it from learning the default gateway's MAC/IP or the IMET route needed for BUM traffic. This explains why the VTEP can communicate on VNI 5001 (which has route-targets) but not reach the gateway on VNI 5002.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The default route in VRF TenantA is not exported.
Why it's wrong here
The default route is present, but without an export route-target for VNI 5002, it cannot be advertised via EVPN.
- ✓
The route-target for VNI 5002 is missing.
Why this is correct
The configuration lacks a separate RD and route-target for VNI 5002, preventing EVPN route exchange for that VNI.
- ✗
The VNI 5002 does not have an associated VLAN.
Why it's wrong here
The VNI is associated with a VRF using 'associate-vrf', which is correct for Layer 3 VNI; no VLAN needed.
- ✗
The NVE interface does not have ingress-replication configured.
Why it's wrong here
Ingress replication is for BUM traffic, not for unicast routing to the default gateway.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 350-601 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.