350-401 Architecture Practice Question
A network architect is designing a data center network using Cisco ACI. The architect must ensure that traffic between endpoints in different EPGs is allowed only when a contract exists. Which Cisco ACI component is responsible for enforcing these contracts?
⚠ Common exam trap
The trap here is assuming the APIC enforces contracts because it manages policy, but actual enforcement is distributed to the leaf switches as PEPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy Enforcement Point (PEP)
In Cisco ACI, contracts define allowed communication between EPGs. The Policy Enforcement Point (PEP), implemented on leaf switches, enforces these contracts by applying the specified filters and actions. The APIC defines the policy, but enforcement occurs at the leaf. Spines and EPGs do not enforce contracts, making the PEP the correct component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Policy Enforcement Point (PEP)
Why this is correct
In Cisco ACI, the Policy Enforcement Point (PEP) is responsible for enforcing contracts between EPGs. The PEP is typically implemented in the leaf switches, where it applies filters and actions defined in the contract. This ensures that traffic is permitted or denied based on the contract, meeting the security requirement.
- ✗
Application Policy Infrastructure Controller (APIC)
Why it's wrong here
The APIC is the centralized controller that manages the ACI fabric and defines policies, including contracts. However, it does not enforce traffic directly; enforcement is delegated to the leaf switches acting as PEPs. The APIC provides the policy definition, but the actual enforcement occurs at the data plane.
- ✗
Spine switch
Why it's wrong here
Spine switches in ACI provide high-speed connectivity between leaf switches but do not enforce contracts. They forward traffic based on the fabric's routing and bridging, but policy enforcement is handled at the leaf level by the PEP. Spines are not involved in contract enforcement.
- ✗
Endpoint Group (EPG)
Why it's wrong here
An Endpoint Group (EPG) is a logical grouping of endpoints with similar policy requirements. It is the object to which contracts are applied, but it does not enforce them. Enforcement is performed by the leaf switches acting as PEPs. The EPG itself is a policy container, not an enforcement mechanism.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.