- A
Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel.
Correct. PBF can redirect traffic to the firewall even for local traffic, ensuring inspection.
- B
Configure a gateway on the firewall and use static routes on the leaf to forward traffic to the firewall.
Why wrong: Incorrect. Static routes would not redirect locally bridged traffic between VMs on the same leaf.
- C
Use EVPN symmetric IRB and ensure the firewall is attached as a Layer 2 extension.
Why wrong: Incorrect. Symmetric IRB still allows local bridging; the firewall would not be in the path for same-leaf traffic.
- D
Enable 'split-horizon' on the leaf switches to prevent direct forwarding.
Why wrong: Incorrect. Split-horizon is used to prevent loops in VXLAN, not to force traffic through a firewall.
Quick Answer
The answer is to implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. This architectural change is necessary because EVPN integrated routing and bridging (IRB) with asymmetric IRB allows local switching on the same leaf, bypassing the firewall entirely; PBF overrides the local forwarding decision by matching traffic and steering it into a VXLAN tunnel to the service leaf, ensuring mandatory inspection even for same-leaf flows. On the Cisco SPCOR 350-501 exam, this scenario tests your understanding of service insertion in EVPN-VXLAN fabrics, where the trap is assuming symmetric IRB or static routes solve the problem—they do not, as symmetric IRB still permits local bridging and static routes lack the dynamic policy control needed. Remember the key: PBF forces traffic into a tunnel, while split-horizon prevents loops, not service insertion. Memory tip: “PBF for Pushing Bypassed Flows.”
350-501 Architecture Practice Question
This 350-501 practice question tests your understanding of architecture. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A service provider is deploying EVPN-VXLAN in its data center to provide Layer 2 and Layer 3 overlay services. The underlay uses an eBGP-based CLOS fabric with spine and leaf switches. The leaf switches act as VTEPs and run EVPN for MAC/VXLAN advertisement. One of the tenants, a financial customer, requires that their traffic between two leaf-connected servers is always forwarded through a firewall for inspection, even when the servers are on the same leaf. The firewall is connected to a service leaf. The architect proposes using EVPN integrated routing and bridging (IRB) with asymmetric IRB. However, traffic between two VMs on the same leaf is bypassing the firewall. Which architectural change ensures that all inter-VM traffic within the same leaf goes through the firewall?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"always"Why it matters: Absolute qualifier. An answer using 'always' is only correct if there are genuinely no exceptions — absolute statements are often wrong in networking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel.
Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. This forces traffic to the firewall even for local traffic. Split-horizon prevents loops, not service insertion; static routes are not scalable; symmetric IRB still allows local bridging.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel.
Why this is correct
Correct. PBF can redirect traffic to the firewall even for local traffic, ensuring inspection.
Clue confirmation
The clue word "always" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Configure a gateway on the firewall and use static routes on the leaf to forward traffic to the firewall.
Why it's wrong here
Incorrect. Static routes would not redirect locally bridged traffic between VMs on the same leaf.
- ✗
Use EVPN symmetric IRB and ensure the firewall is attached as a Layer 2 extension.
Why it's wrong here
Incorrect. Symmetric IRB still allows local bridging; the firewall would not be in the path for same-leaf traffic.
- ✗
Enable 'split-horizon' on the leaf switches to prevent direct forwarding.
Why it's wrong here
Incorrect. Split-horizon is used to prevent loops in VXLAN, not to force traffic through a firewall.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
- Use explanations to understand the rule behind the answer.
TExam Day Tips
- Underline the problem statement mentally.
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 350-501 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which 350-501 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
- →
Architecture — study guide chapter
Learn the concepts, then practise the questions
- →
Architecture practice questions
Targeted practice on this topic area only
- →
All 350-501 questions
500 questions across all exam domains
- →
Cisco SPCOR / CCNP Service Provider Core 350-501 study guide
Full concept coverage aligned to exam objectives
- →
350-501 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 350-501 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Architecture practice questions
Practise 350-501 questions linked to Architecture.
Networking practice questions
Practise 350-501 questions linked to Networking.
MPLS and Segment Routing practice questions
Practise 350-501 questions linked to MPLS and Segment Routing.
Automation and Quality of Service practice questions
Practise 350-501 questions linked to Automation and Quality of Service.
Services practice questions
Practise 350-501 questions linked to Services.
Automation and Assurance practice questions
Practise 350-501 questions linked to Automation and Assurance.
350-501 fundamentals practice questions
Practise 350-501 questions linked to 350-501 fundamentals.
350-501 scenario practice questions
Practise 350-501 questions linked to 350-501 scenario.
350-501 troubleshooting practice questions
Practise 350-501 questions linked to 350-501 troubleshooting.
Practice this exam
Start a free 350-501 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 350-501 question test?
Architecture — This question tests Architecture — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. — Implement a VXLAN tunnel from each leaf to the firewall and use policy-based forwarding (PBF) on the leaf to redirect inter-VM traffic to the firewall via the tunnel. This forces traffic to the firewall even for local traffic. Split-horizon prevents loops, not service insertion; static routes are not scalable; symmetric IRB still allows local bridging.
What should I do if I get this 350-501 question wrong?
Identify which 350-501 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Are there clue words in this question I should notice?
Yes — watch for: "always". Absolute qualifier. An answer using 'always' is only correct if there are genuinely no exceptions — absolute statements are often wrong in networking.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This 350-501 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-501 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.