Network practice questions

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

Trap 1: MTU mismatch on the underlay network

MTU mismatch would cause packet drops but not the absence of VNI from 'show nve vni'.

Trap 2: Anycast gateway is not configured on the leaf

Anycast gateway is used for first-hop redundancy; its absence does not affect VNI visibility on the NVE.

Trap 3: BGP EVPN peers are not established

BGP EVPN peers not established would affect route exchange, but the VNI would still appear in 'show nve vni' if configured.

A
MTU mismatch on the underlay network
Why wrong: MTU mismatch would cause packet drops but not the absence of VNI from 'show nve vni'.
B
Anycast gateway is not configured on the leaf
Why wrong: Anycast gateway is used for first-hop redundancy; its absence does not affect VNI visibility on the NVE.
C
BGP EVPN peers are not established
Why wrong: BGP EVPN peers not established would affect route exchange, but the VNI would still appear in 'show nve vni' if configured.
D
The VLAN-to-VNI mapping is missing under the VLAN configuration
The VNI must be mapped to a VLAN using 'vn-segment vlan-id' under the VLAN configuration; without it, the VNI does not appear in the NVE interface.

Question 2hardmultiple choice

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

Trap 1: Context (default)

Context scope restricts contract application to EPGs within the same bridge domain; cross-bridge-domain traffic would be denied regardless of contract.

Trap 2: Application-profile

Application-profile is not a valid contract scope in ACI.

Trap 3: Global

Global scope would allow contracts to apply across VRFs, which is too permissive and not typically recommended.

A
Context (default)
Why wrong: Context scope restricts contract application to EPGs within the same bridge domain; cross-bridge-domain traffic would be denied regardless of contract.
B
Application-profile
Why wrong: Application-profile is not a valid contract scope in ACI.
C
Global
Why wrong: Global scope would allow contracts to apply across VRFs, which is too permissive and not typically recommended.
D
VRF
VRF scope allows contracts to apply across bridge domains within the same VRF; without a contract, traffic is denied, and with a contract, permitted.

Review the full OSPF breakdown →

Question 3easymultiple choice

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

Trap 1: Set OSPF priority to 255 on the interface

Priority 255 increases the chance of becoming DR.

Trap 2: Change the OSPF network type to point-to-point

Point-to-point network type eliminates DR election, but it changes the behavior for all routers; the question asks specifically to prevent this switch from becoming DR.

Trap 3: Configure the interface as passive under OSPF

Passive interface suppresses OSPF hellos, so no adjacency is formed; it does not prevent DR election if hellos are sent.

A
Set OSPF priority to 255 on the interface
Why wrong: Priority 255 increases the chance of becoming DR.
B
Set OSPF priority to 0 on the interface
Priority 0 means the router will never become DR or BDR.
C
Change the OSPF network type to point-to-point
Why wrong: Point-to-point network type eliminates DR election, but it changes the behavior for all routers; the question asks specifically to prevent this switch from becoming DR.
D
Configure the interface as passive under OSPF
Why wrong: Passive interface suppresses OSPF hellos, so no adjacency is formed; it does not prevent DR election if hellos are sent.

Question 4hardmultiple choice

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

Trap 1: Upgrade both switches simultaneously using ISSU

Issuing ISSU on both at the same time can cause vPC inconsistencies and potential traffic loss; it is not recommended.

Trap 2: Reload both switches to a previous version, then upgrade

Reloading to a previous version adds unnecessary disruption; the goal is to upgrade with minimal impact.

Trap 3: Upgrade the primary vPC peer first, then the secondary

Upgrading primary first can cause role instability; best practice is to upgrade secondary first.

A
Upgrade both switches simultaneously using ISSU
Why wrong: Issuing ISSU on both at the same time can cause vPC inconsistencies and potential traffic loss; it is not recommended.
B
Reload both switches to a previous version, then upgrade
Why wrong: Reloading to a previous version adds unnecessary disruption; the goal is to upgrade with minimal impact.
C
Upgrade the primary vPC peer first, then the secondary
Why wrong: Upgrading primary first can cause role instability; best practice is to upgrade secondary first.
D
Upgrade the secondary vPC peer first, then the primary
Upgrading secondary first ensures the primary remains operational; after secondary upgrade, it can take over if needed during primary upgrade.

Question 5mediummultiple choice

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

Trap 1: The contract is applied but not enforced due to a configuration…

If a contract is applied, it is enforced; absence of contract does not cause enforcement issue.

Trap 2: The VRF has a default route that bypasses contract enforcement

Default route does not bypass contract enforcement; contracts are applied at the leaf level regardless of routing.

Trap 3: A preferred group contract is applied to the VRF

Preferred group allows all EPGs in the VRF to communicate without explicit contracts; this would permit cross-BD traffic as well.

A
The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract
ACI allows intra-BD communication by default; contracts are needed for inter-BD or inter-VRF traffic.
B
The contract is applied but not enforced due to a configuration error
Why wrong: If a contract is applied, it is enforced; absence of contract does not cause enforcement issue.
C
The VRF has a default route that bypasses contract enforcement
Why wrong: Default route does not bypass contract enforcement; contracts are applied at the leaf level regardless of routing.
D
A preferred group contract is applied to the VRF
Why wrong: Preferred group allows all EPGs in the VRF to communicate without explicit contracts; this would permit cross-BD traffic as well.

Open the full BGP breakdown →

Question 6mediummulti select

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

Trap 1: VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

VXLAN uses MAC-in-UDP encapsulation, not MPLS.

Trap 2: VXLAN uses a 32-bit network identifier (VNI)

VXLAN VNI is 24 bits.

Trap 3: The control plane is responsible for actual data forwarding

The control plane distributes routes; data plane forwards packets.

A
The underlay network provides IP connectivity between VTEPs
Underlay routing (e.g., IS-IS, OSPF) enables VTEP-to-VTEP reachability.
B
BGP EVPN advertises MAC addresses and IP addresses as routes
EVPN Type-2 routes carry MAC/IP information.
C
VXLAN encapsulates Ethernet frames in IP packets using MPLS labels
Why wrong: VXLAN uses MAC-in-UDP encapsulation, not MPLS.
D
VXLAN uses a 32-bit network identifier (VNI)
Why wrong: VXLAN VNI is 24 bits.
E
The control plane is responsible for actual data forwarding
Why wrong: The control plane distributes routes; data plane forwards packets.

Question 7hardmulti select

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Trap 1: Both switches must use the same routing protocol

Routing protocols can differ; vPC does not mandate same routing protocol.

Trap 2: The peer-keepalive link must be carried over the peer-link

Peer-keepalive must be a separate L3 link, not over the peer-link.

A
Both switches must use the same routing protocol
Why wrong: Routing protocols can differ; vPC does not mandate same routing protocol.
B
The peer-keepalive link must be carried over the peer-link
Why wrong: Peer-keepalive must be a separate L3 link, not over the peer-link.
C
Both switches must run the same NX-OS software version
Same version ensures feature compatibility and stability.
D
A dedicated peer-link port-channel must be configured
The peer-link is a required port-channel for vPC control and data traffic.
E
The vPC domain ID must be identical on both switches
Domain ID must match for vPC to form.

Question 8easymultiple choice

Refer to the exhibit. An engineer is configuring a server-facing interface on a Nexus switch. The server is running VMware ESXi with multiple virtual machines in VLANs 10, 20, and 30. After applying the configuration, the ESXi host reports that it cannot communicate on VLAN 30. Which configuration change should be made?

Exhibit

show running-config interface ethernet 1/1
!
interface Ethernet1/1
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30
  spanning-tree port type edge trunk
  no shutdown

Trap 1: Remove the 'spanning-tree port type edge trunk' command

Edge trunk is appropriate for server-facing ports and does not cause communication failure.

Trap 2: Change the native VLAN to 30

Native VLAN is used for untagged traffic; not the issue here.

Trap 3: Configure the port as an access port in VLAN 30

The server expects trunk mode; changing to access would break other VLANs.

A
Remove the 'spanning-tree port type edge trunk' command
Why wrong: Edge trunk is appropriate for server-facing ports and does not cause communication failure.
B
Change the native VLAN to 30
Why wrong: Native VLAN is used for untagged traffic; not the issue here.
C
Create VLAN 30 in the global VLAN database
If VLAN 30 does not exist, the switch will not forward traffic for it even if allowed on the trunk.
D
Configure the port as an access port in VLAN 30
Why wrong: The server expects trunk mode; changing to access would break other VLANs.

Question 9mediummultiple choice

Refer to the exhibit. A VXLAN VNI (10030) is operationally down. What is the most likely cause?

Exhibit

show interface nve 1
nve1 is up
  Interface-Address: 10.1.1.1/24
  NVE Mode: L3VPN
  Source Interface: loopback0
  Number of VNIs: 3
  VNI 10010: UP
  VNI 10020: UP
  VNI 10030: DOWN
  
show nve vni 10030
VNI 10030 (L3VPN)
  Associated VLAN: none
  Operational State: DOWN
  mcast group: 239.1.1.1

Trap 1: The source interface loopback0 is not up

The exhibit shows NVE interface is up, so loopback0 is up.

Trap 2: The NVE mode should be L2VPN instead of L3VPN

L3VPN mode is valid; L2VPN would be for bridging; the mode does not cause the VNI to be down.

Trap 3: The multicast group 239.1.1.1 is not reachable

If multicast group were unreachable, the VNI might show up but traffic would not forward; the VNI state would still be UP.

A
The source interface loopback0 is not up
Why wrong: The exhibit shows NVE interface is up, so loopback0 is up.
B
The NVE mode should be L2VPN instead of L3VPN
Why wrong: L3VPN mode is valid; L2VPN would be for bridging; the mode does not cause the VNI to be down.
C
The VLAN associated with VNI 10030 is not configured or mapped
The VNI must be mapped to a VLAN using 'vn-segment vlan-id' under the VLAN configuration; missing mapping causes operational down.
D
The multicast group 239.1.1.1 is not reachable
Why wrong: If multicast group were unreachable, the VNI might show up but traffic would not forward; the VNI state would still be UP.

Question 10mediummultiple choice

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

Trap 1: Disable vPC on both switches and reconfigure the port channels.

Disabling vPC is not necessary; the issue is with keepalive.

Trap 2: Reconfigure the vPC domain with a lower priority on the secondary…

Priority affects role election, not keepalive failure behavior.

Trap 3: Increase the vPC peer-keepalive hold timeout to 5 seconds.

Increasing hold timeout delays failure detection.

A
Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.
A dedicated keepalive link ensures reliable communication and prevents split-brain.
B
Disable vPC on both switches and reconfigure the port channels.
Why wrong: Disabling vPC is not necessary; the issue is with keepalive.
C
Reconfigure the vPC domain with a lower priority on the secondary switch.
Why wrong: Priority affects role election, not keepalive failure behavior.
D
Increase the vPC peer-keepalive hold timeout to 5 seconds.
Why wrong: Increasing hold timeout delays failure detection.

Question 11hardmultiple choice

A data center design requires Layer 2 extension between two sites using OTV. The network engineer notices that MAC addresses from Site A are not learned at Site B. OTV adjacency is up, and both sites have the same overlay interface configured. Which configuration issue is most likely the cause?

Trap 1: The OTV control group is misconfigured on one side.

Control group misconfiguration would affect adjacency, not MAC learning.

Trap 2: The spanning tree root bridge is different at each site.

OTV encapsulates STP BPDUs; different root bridges do not prevent MAC learning.

Trap 3: The multicast group range for the overlay does not match.

Multicast group range is for data traffic; mismatch would cause forwarding issues but not prevent MAC learning if adjacency is up.

A
The OTV control group is misconfigured on one side.
Why wrong: Control group misconfiguration would affect adjacency, not MAC learning.
B
The spanning tree root bridge is different at each site.
Why wrong: OTV encapsulates STP BPDUs; different root bridges do not prevent MAC learning.
C
The multicast group range for the overlay does not match.
Why wrong: Multicast group range is for data traffic; mismatch would cause forwarding issues but not prevent MAC learning if adjacency is up.
D
The site VLAN is not allowed on the OTV join interface.
The join interface must be a trunk that carries the site VLAN for OTV to forward traffic.

Study the full QoS explanation →

Question 12easymultiple choice

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

Trap 1: Tail drop with DSCP-based classification.

Tail drop can cause packet loss, which is unacceptable for iSCSI.

Trap 2: Weighted Round Robin (WRR) with three queues.

WRR does not provide lossless behavior.

Trap 3: Policing at the ingress and marking at the egress.

Policing drops packets, which can cause retransmissions.

A
Tail drop with DSCP-based classification.
Why wrong: Tail drop can cause packet loss, which is unacceptable for iSCSI.
B
Weighted Round Robin (WRR) with three queues.
Why wrong: WRR does not provide lossless behavior.
C
Priority Flow Control (PFC) with a no-drop queue for iSCSI.
PFC enables lossless Ethernet by pausing traffic when buffers are full.
D
Policing at the ingress and marking at the egress.
Why wrong: Policing drops packets, which can cause retransmissions.

Question 13mediummultiple choice

An organization is deploying a new leaf-spine fabric with Cisco ACI. The requirement is to allow inter-tenant communication between two EPGs in different tenants. Which configuration object is necessary to enable this communication?

Trap 1: A common VRF that spans both tenants.

VRF provides Layer 3 isolation; a shared VRF alone does not enable EPG communication.

Trap 2: A filter that permits the required traffic.

Filters are used within contracts; they do not enable inter-EPG communication by themselves.

Trap 3: A bridge domain that connects both EPGs.

Bridge domains are Layer 2 constructs within a tenant.

A
A common VRF that spans both tenants.
Why wrong: VRF provides Layer 3 isolation; a shared VRF alone does not enable EPG communication.
B
A filter that permits the required traffic.
Why wrong: Filters are used within contracts; they do not enable inter-EPG communication by themselves.
C
A bridge domain that connects both EPGs.
Why wrong: Bridge domains are Layer 2 constructs within a tenant.
D
A shared contract between the two EPGs.
Contracts define allowed communication; shared contracts work across tenants.

Read the full VPN explanation →

Question 14hardmulti select

Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?

Trap 1: Enable IGMP snooping on all VLANs extended over VXLAN.

IGMP snooping is not required for VXLAN EVPN; BUM traffic is handled differently.

Trap 2: Set the VXLAN destination UDP port to 8472.

Standard VXLAN uses UDP port 4789; 8472 is for other encapsulations.

Trap 3: Create an NVE interface with a loopback interface as the source.

The NVE source should be a loopback, but it's not a step unique to centralized anycast.

A
Enable the address-family l2vpn evpn under the BGP configuration.
BGP EVPN is required for route distribution.
B
Enable IGMP snooping on all VLANs extended over VXLAN.
Why wrong: IGMP snooping is not required for VXLAN EVPN; BUM traffic is handled differently.
C
Configure the same anycast gateway MAC and IP address on all VTEPs in the VLAN.
Centralized anycast gateway requires identical MAC and IP on all VTEPs.
D
Set the VXLAN destination UDP port to 8472.
Why wrong: Standard VXLAN uses UDP port 4789; 8472 is for other encapsulations.
E
Create an NVE interface with a loopback interface as the source.
Why wrong: The NVE source should be a loopback, but it's not a step unique to centralized anycast.

Question 15mediummultiple choice

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

Exhibit

Refer to the exhibit.

! Nexus 9000 switch
interface Ethernet1/1
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30
  spanning-tree port type edge trunk
  no shutdown

! Switchport statistics
Ethernet1/1 is up, line protocol is up
  Hardware: 1000/10000 Ethernet, address: xxxx.xxxx.xxxx
  Description: Server connection
  MTU 1500 bytes
  Port mode is trunk
  Trunk encapsulation is 802.1Q
  Trunk allowed vlans: 10,20,30
  Trunk native vlan: 1
  Vlans allowed on trunk: 10,20,30
  Vlans active and untagged: 1
  Vlans active and tagged: 10,20,30

interface port-channel1
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30
  spanning-tree port type edge trunk
  no shutdown

Trap 1: The spanning-tree port type edge trunk is causing BPDU guard to…

Port type edge trunk enables PortFast but does not block traffic on untagged VLAN.

Trap 2: The port is in err-disabled state due to a loop.

The port is up and line protocol is up.

Trap 3: The port is administratively down.

The no shutdown command is present.

A
The spanning-tree port type edge trunk is causing BPDU guard to block the port.
Why wrong: Port type edge trunk enables PortFast but does not block traffic on untagged VLAN.
B
The port is in err-disabled state due to a loop.
Why wrong: The port is up and line protocol is up.
C
VLAN 1 is not allowed on the trunk, so untagged frames are dropped.
Untagged frames are placed in native VLAN 1, but VLAN 1 is not in the allowed list.
D
The port is administratively down.
Why wrong: The no shutdown command is present.

Question 16hardmultiple choice

You are a network engineer at a financial institution. The company has two data centers: DC1 and DC2, connected via a dark fiber link. Each data center has a pair of Nexus 7000 switches in a vPC configuration. The dark fiber link connects to a port on each Nexus 7000 pair using a Layer 2 port-channel. The requirement is to extend VLAN 100 between the two data centers for a critical application that requires a stretched Layer 2 domain. The current configuration has the port-channel on both sides set to mode 'active' with LACP. VLAN 100 is allowed on the trunk. The application servers report intermittent connectivity issues, with some packets being dropped. Upon inspection, you notice that the MAC address table on the Nexus 7000 in DC1 shows the MAC address of the server in DC2 on the dark fiber port-channel interface, but also on a local access port connected to a different server in the same VLAN. What is the most likely cause of the intermittent connectivity?

Trap 1: The dark fiber link is experiencing high latency, causing MAC…

High latency would not cause the same MAC to appear on two different interfaces.

Trap 2: LACP is misconfigured on one side, causing the port-channel to…

If LACP were misconfigured, the port-channel would not be up.

Trap 3: There is an asymmetric routing issue between the data centers.

Asymmetric routing is Layer 3; the issue is Layer 2.

A
The dark fiber link is experiencing high latency, causing MAC address timeouts.
Why wrong: High latency would not cause the same MAC to appear on two different interfaces.
B
LACP is misconfigured on one side, causing the port-channel to operate as individual links.
Why wrong: If LACP were misconfigured, the port-channel would not be up.
C
There is an asymmetric routing issue between the data centers.
Why wrong: Asymmetric routing is Layer 3; the issue is Layer 2.
D
Spanning Tree Protocol is not blocking one of the redundant paths, creating a loop.
A loop causes MAC flapping and intermittent connectivity.

Question 17mediumdrag order

Arrange the steps to configure a vPC domain on a pair of Cisco Nexus switches.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediumdrag order

Arrange the steps to create a service profile template in Cisco UCS Manager.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 19mediummatching

Match each Cisco data center technology to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Converged network for Fibre Channel and Ethernet

Network virtualization overlay for scaling Layer 2 networks

Layer 2 extension across Layer 3 boundaries

Location/identifier separation for routing scalability

Label switching for traffic engineering and VPNs

Question 20mediummatching