350-401 Architecture Practice Question
A network architect is designing a new branch office that must support a single physical link carrying traffic for multiple tenants while keeping each tenant's routing and forwarding isolated. The design requires that the branch device maintain separate routing tables and forwarding instances per tenant, all on the same physical interface using 802.1Q encapsulation. Which architecture component should be implemented on the branch router to meet these requirements?
⚠ Common exam trap
The trap here is assuming that any encapsulation or tunneling technology automatically provides separate routing tables, when only VRF creates distinct RIBs and FIBs on the device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual Routing and Forwarding (VRF) with 802.1Q subinterfaces
VRF is the Cisco IOS XE feature that creates separate routing and forwarding tables on one device. When paired with 802.1Q subinterfaces, each tenant's VLAN tag maps to a specific VRF, allowing a single physical link to carry isolated tenant traffic. This directly fulfills the requirement for per-tenant routing isolation on a shared branch link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Multiprotocol Label Switching (MPLS) L3VPN on the branch router
Why it's wrong here
MPLS L3VPN is a service provider technology for isolating customer traffic across a provider backbone. While it uses VRFs, the branch router in this scenario needs local VRF configuration with 802.1Q subinterfaces, not an MPLS L3VPN implementation on the branch itself.
- ✗
Policy-Based Routing (PBR) with route maps
Why it's wrong here
PBR can influence forwarding decisions based on packet attributes, but it does not create separate routing tables or forwarding instances. It cannot provide the per-tenant isolation of routing information that the design requires, so it fails to meet the stated architecture need.
- ✗
Generic Routing Encapsulation (GRE) tunnels per tenant
Why it's wrong here
GRE tunnels can carry tenant traffic over a shared medium, but they add encapsulation overhead and do not inherently create separate routing tables on the branch device. The scenario calls for local VRF-based isolation on one physical interface, not tunnel overlays.
- ✓
Virtual Routing and Forwarding (VRF) with 802.1Q subinterfaces
Why this is correct
VRF provides separate routing and forwarding tables on a single device, and combining it with 802.1Q subinterfaces allows traffic from multiple tenants to be tagged and mapped to distinct VRFs on the same physical link. This satisfies the isolation and shared-link requirements exactly as described.
Visual reference
Go deeper
Related to this question
Learn chapter
SDN Controllers and Cisco ACI
Key term
Virtual Routing and Forwarding
Virtual Routing and Forwarding (VRF) is a technology that allows a single physical router to operate like multiple independent routers by keeping separate routing tables and forwarding decisions for each instance.
Key term
VLAN Trunking
VLAN Trunking is a method to carry traffic for multiple VLANs over a single network link between switches or between a switch and a router.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.