- A
EPG
Why wrong: EPG (Endpoint Group) is a policy component used to group endpoints and apply contracts, not a component that defines the network itself. The three components that define a tenant's network are Tenant, VRF, and Bridge Domain.
- B
Bridge Domain
Correct. Bridge Domain defines a Layer 2 forwarding domain with a unique MAC table and optional subnets.
- C
Contract
Why wrong: Contract defines policies for communication between EPGs, not the network definition.
- D
VRF
Correct. VRF (Private Network) provides Layer 3 isolation and routing context.
- E
Tenant
Correct. Tenant is the top-level container that owns the network resources.
Question 282 of 1,000
350-601 Network Practice Question
This 350-601 practice question tests your understanding of network. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which three components are part of the Cisco ACI policy model for defining a tenant's network? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bridge Domain
In the Cisco ACI policy model, a tenant's network is defined by a hierarchical construct that includes the Tenant itself as the top-level container, the VRF (also called a Private Network) which provides Layer 3 isolation and routing context, and the Bridge Domain which represents a Layer 2 forwarding domain with a unique MAC address table and optional subnet(s). These three components work together to create a complete network segment within a tenant, while EPGs and Contracts are used for policy and connectivity rather than defining the network itself.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EPG
Why it's wrong here
EPG (Endpoint Group) is a policy component used to group endpoints and apply contracts, not a component that defines the network itself. The three components that define a tenant's network are Tenant, VRF, and Bridge Domain.
- ✓
Bridge Domain
Why this is correct
Correct. Bridge Domain defines a Layer 2 forwarding domain with a unique MAC table and optional subnets.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Contract
Why it's wrong here
Contract defines policies for communication between EPGs, not the network definition.
- ✓
VRF
Why this is correct
Correct. VRF (Private Network) provides Layer 3 isolation and routing context.
Related concept
Read the scenario before looking for a memorised answer.
- ✓
Tenant
Why this is correct
Correct. Tenant is the top-level container that owns the network resources.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between network-defining components (Tenant, VRF, Bridge Domain) and policy-defining components (EPG, Contract), so the trap here is that candidates mistakenly include EPG or Contract because they are essential for tenant communication, but they are not part of the network definition itself.
Detailed technical explanation
How to think about this question
Under the hood, the Bridge Domain in ACI maps to a VLAN or VXLAN segment and can be configured with a subnet that is advertised into the VRF via the routing information base (RIB). The VRF (Private Network) enforces Layer 3 isolation by maintaining separate routing tables and forwarding instances, and it can span multiple Bridge Domains, allowing inter-Bridge Domain routing within the same tenant. In a real-world multi-tenant data center, each tenant gets its own VRF and one or more Bridge Domains to separate production and development networks while sharing the same physical fabric.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Network — study guide chapter
Learn the concepts, then practise the questions
- →
Network practice questions
Targeted practice on this topic area only
- →
All 350-601 questions
1,000 questions across all exam domains
- →
Cisco DCCOR / CCNP Data Center Core 350-601 study guide
Full concept coverage aligned to exam objectives
- →
350-601 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 350-601 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Security practice questions
Practise 350-601 questions linked to Security.
Network practice questions
Practise 350-601 questions linked to Network.
Storage Network practice questions
Practise 350-601 questions linked to Storage Network.
Automation practice questions
Practise 350-601 questions linked to Automation.
Compute practice questions
Practise 350-601 questions linked to Compute.
350-601 fundamentals practice questions
Practise 350-601 questions linked to 350-601 fundamentals.
350-601 scenario practice questions
Practise 350-601 questions linked to 350-601 scenario.
350-601 troubleshooting practice questions
Practise 350-601 questions linked to 350-601 troubleshooting.
Practice this exam
Start a free 350-601 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 350-601 question test?
Network — This question tests Network — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Bridge Domain — In the Cisco ACI policy model, a tenant's network is defined by a hierarchical construct that includes the Tenant itself as the top-level container, the VRF (also called a Private Network) which provides Layer 3 isolation and routing context, and the Bridge Domain which represents a Layer 2 forwarding domain with a unique MAC address table and optional subnet(s). These three components work together to create a complete network segment within a tenant, while EPGs and Contracts are used for policy and connectivity rather than defining the network itself.
What should I do if I get this 350-601 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More 350-601 practice questions
- In Cisco ACI, which component is responsible for translating EPG communication policies into concrete configuration on l…
- An engineer is configuring OSPF on a Cisco Nexus switch in a data center. The network consists of multiple point-to-poin…
- An engineer is configuring BGP EVPN for VXLAN in a spine-leaf fabric. The leaf switches must advertise host IP-to-MAC ma…
- Which VLAN range is reserved by default on Cisco Nexus switches?
- In VXLAN overlay networks, which mechanism is used to forward broadcast, unknown unicast, and multicast (BUM) traffic wh…
- Which command is used to verify the OSPF neighbor state in NX-OS?
Last reviewed: Jul 4, 2026
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.