Network practice questions

auto-recovery.

Why wrong: auto-recovery is used to bring up orphaned ports after a peer failure, not for synchronization.

peer-keepalive destination <ip>.

Why wrong: peer-keepalive destination is for Layer 3 liveness detection; it does not synchronize configuration.

role preempt.

Why wrong: role preempt determines which peer becomes primary, not synchronization.

EPG

Why wrong: EPG (Endpoint Group) is a policy component used to group endpoints and apply contracts, not a component that defines the network itself. The three components that define a tenant's network are Tenant, VRF, and Bridge Domain.

Contract

Why wrong: Contract defines policies for communication between EPGs, not the network definition.

MST supports only a single spanning-tree instance per switch.

Why wrong: MST supports multiple instances (up to 16).

MST BPDUs are sent with a destination MAC address of 01-80-C2-00-00-00.

Why wrong: MST uses the same BPDU MAC as RSTP (01-80-C2-00-00-00).

MTU mismatch on the underlay network

Why wrong: MTU mismatch would cause packet drops but not the absence of VNI from 'show nve vni'.

Anycast gateway is not configured on the leaf

Why wrong: Anycast gateway is used for first-hop redundancy; its absence does not affect VNI visibility on the NVE.

BGP EVPN peers are not established

Why wrong: BGP EVPN peers not established would affect route exchange, but the VNI would still appear in 'show nve vni' if configured.

Context (default)

Why wrong: Context scope restricts contract application to EPGs within the same bridge domain; cross-bridge-domain traffic would be denied regardless of contract.

Application-profile

Why wrong: Application-profile is not a valid contract scope in ACI.

Global

Why wrong: Global scope would allow contracts to apply across VRFs, which is too permissive and not typically recommended.

Set OSPF priority to 255 on the interface

Why wrong: Priority 255 increases the chance of becoming DR.

Change the OSPF network type to point-to-point

Why wrong: Point-to-point network type eliminates DR election, but it changes the behavior for all routers; the question asks specifically to prevent this switch from becoming DR.

Configure the interface as passive under OSPF

Why wrong: Passive interface suppresses OSPF hellos, so no adjacency is formed; it does not prevent DR election if hellos are sent.

Upgrade both switches simultaneously using ISSU

Why wrong: Issuing ISSU on both at the same time can cause vPC inconsistencies and potential traffic loss; it is not recommended.

Reload both switches to a previous version, then upgrade

Why wrong: Reloading to a previous version adds unnecessary disruption; the goal is to upgrade with minimal impact.

Upgrade the primary vPC peer first, then the secondary

Why wrong: Upgrading primary first can cause role instability; best practice is to upgrade secondary first.

The contract is applied but not enforced due to a configuration error

Why wrong: If a contract is applied, it is enforced; absence of contract does not cause enforcement issue.

The VRF has a default route that bypasses contract enforcement

Why wrong: Default route does not bypass contract enforcement; contracts are applied at the leaf level regardless of routing.

A preferred group contract is applied to the VRF

Why wrong: Preferred group allows all EPGs in the VRF to communicate without explicit contracts; this would permit cross-BD traffic as well.

VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

Why wrong: VXLAN uses MAC-in-UDP encapsulation, not MPLS.

VXLAN uses a 32-bit network identifier (VNI)

Why wrong: VXLAN VNI is 24 bits.

The control plane is responsible for actual data forwarding

Why wrong: The control plane distributes routes; data plane forwards packets.

Both switches must use the same routing protocol

Why wrong: Routing protocols can differ; vPC does not mandate same routing protocol.

The peer-keepalive link must be carried over the peer-link

Why wrong: Peer-keepalive must be a separate L3 link, not over the peer-link.

Remove the 'spanning-tree port type edge trunk' command

Why wrong: Edge trunk is appropriate for server-facing ports and does not cause communication failure.

Change the native VLAN to 30

Why wrong: Native VLAN is used for untagged traffic; not the issue here.

Configure the port as an access port in VLAN 30

Why wrong: The server expects trunk mode; changing to access would break other VLANs.

The source interface loopback0 is not up

Why wrong: The exhibit shows NVE interface is up, so loopback0 is up.

The NVE mode should be L2VPN instead of L3VPN

Why wrong: L3VPN mode is valid; L2VPN would be for bridging; the mode does not cause the VNI to be down.

The multicast group 239.1.1.1 is not reachable

Why wrong: If multicast group were unreachable, the VNI might show up but traffic would not forward; the VNI state would still be UP.

Disable vPC on both switches and reconfigure the port channels.

Why wrong: Disabling vPC is not necessary; the issue is with keepalive.

Reconfigure the vPC domain with a lower priority on the secondary switch.

Why wrong: Priority affects role election, not keepalive failure behavior.

Increase the vPC peer-keepalive hold timeout to 5 seconds.

Why wrong: Increasing hold timeout delays failure detection.

The OTV control group is misconfigured on one side.

Why wrong: Control group misconfiguration would affect adjacency, not MAC learning.

The spanning tree root bridge is different at each site.

Why wrong: OTV encapsulates STP BPDUs; different root bridges do not prevent MAC learning.

The multicast group range for the overlay does not match.

Why wrong: Multicast group range is for data traffic; mismatch would cause forwarding issues but not prevent MAC learning if adjacency is up.

Tail drop with DSCP-based classification.

Why wrong: Tail drop can cause packet loss, which is unacceptable for iSCSI.

Weighted Round Robin (WRR) with three queues.

Why wrong: WRR does not provide lossless behavior.

Policing at the ingress and marking at the egress.

Why wrong: Policing drops packets, which can cause retransmissions.

A common VRF that spans both tenants.

Why wrong: VRF provides Layer 3 isolation; a shared VRF alone does not enable EPG communication.

A filter that permits the required traffic.

Why wrong: Filters are used within contracts; they do not enable inter-EPG communication by themselves.

A bridge domain that connects both EPGs.

Why wrong: Bridge domains are Layer 2 constructs within a tenant.

Enable IGMP snooping on all VLANs extended over VXLAN.

Why wrong: IGMP snooping is not required for VXLAN EVPN; BUM traffic is handled differently.

Set the VXLAN destination UDP port to 8472.

Why wrong: Standard VXLAN uses UDP port 4789; 8472 is for other encapsulations.

Create an NVE interface with a loopback interface as the source.

Why wrong: The NVE source should be a loopback, but it's not a step unique to centralized anycast.

The spanning-tree port type edge trunk is causing BPDU guard to block the port.

Why wrong: Port type edge trunk enables PortFast but does not block traffic on untagged VLAN.

The port is in err-disabled state due to a loop.

Why wrong: The port is up and line protocol is up.

The port is administratively down.

Why wrong: The no shutdown command is present.

The dark fiber link is experiencing high latency, causing MAC address timeouts.

Why wrong: High latency would not cause the same MAC to appear on two different interfaces.

LACP is misconfigured on one side, causing the port-channel to operate as individual links.

Why wrong: If LACP were misconfigured, the port-channel would not be up.

There is an asymmetric routing issue between the data centers.

Why wrong: Asymmetric routing is Layer 3; the issue is Layer 2.

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure peer-link, Step 4: Configure keepalive link, Step 5: Add member ports

Why wrong: This order is incorrect because the keepalive link must be configured before the peer-link to ensure proper monitoring and failure detection.

Step 1: Create vPC domain, Step 2: Enable feature vPC, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports

Why wrong: This order is incorrect because the vPC feature must be enabled before the domain can be created; otherwise, the domain configuration will fail.

Step 1: Enable feature vPC, Step 2: Configure keepalive link, Step 3: Create vPC domain, Step 4: Configure peer-link, Step 5: Add member ports

Why wrong: This order is incorrect because the vPC domain must be created before configuring the keepalive link, as the keepalive link is associated with the domain.