350-501 Networking Practice Question
In a VXLAN EVPN deployment, a host sends a broadcast ARP request. Which component in the fabric is responsible for replying on behalf of the target host to reduce flooding?
⚠ Common exam trap
Cisco often tests the misconception that the spine switch or the default gateway handles ARP suppression, when in fact it is the ingress VTEP that performs this function using its locally cached EVPN-learned MAC/IP entries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VTEP that has the target host's MAC address in its local table (ARP suppression)
In VXLAN EVPN, ARP suppression is a feature implemented on the ingress VTEP (the VTEP that receives the broadcast ARP request). The ingress VTEP maintains a local ARP/ND cache populated via EVPN Type-2 routes (MAC/IP advertisement routes). When a broadcast ARP request arrives, the ingress VTEP checks its local cache for the target IP; if found, it replies directly on behalf of the target host, suppressing the broadcast and preventing unnecessary flooding across the fabric. Option C correctly identifies this VTEP as the component responsible for the reply.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VTEP that receives the broadcast
Why it's wrong here
It would flood unless ARP suppression is configured.
- ✗
The spine switch
Why it's wrong here
Spine switches do not handle ARP replies.
- ✓
The VTEP that has the target host's MAC address in its local table (ARP suppression)
Why this is correct
ARP suppression allows VTEP to proxy-reply.
- ✗
The default gateway (anycast IP)
Why it's wrong here
Gateway role is for routing, not ARP suppression.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 350-501 question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-501 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-501 exam.