350-401 Virtualization Practice Question
A network engineer is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF) for a multi-tenant environment. The engineer wants to ensure that traffic from each tenant is isolated and that overlapping IP addresses can be used. Which command is used to create a VRF instance and enter VRF configuration mode?
⚠ Common exam trap
Watch out — candidates often confuse the legacy 'ip vrf' command with the modern 'vrf definition' command, as both create VRFs but only the latter is recommended on IOS-XE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vrf definition TENANT_A
The correct command to create a VRF instance on a Cisco IOS-XE router is 'vrf definition TENANT_A'. This command creates the VRF and enters VRF configuration mode, where route distinguishers and route targets can be configured. The 'ip vrf' command is legacy and not recommended on IOS-XE. The 'vrf forwarding' and 'ip vrf forwarding' commands are used on interfaces to assign them to an existing VRF, not to create one.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vrf forwarding TENANT_A
Why it's wrong here
The command 'vrf forwarding TENANT_A' is used in interface configuration mode to associate an interface with a VRF instance. It does not create a VRF; it assigns the interface to an existing VRF. If the VRF does not exist, this command will fail. The engineer first needs to create the VRF using 'vrf definition' before assigning interfaces. Thus, this command alone does not meet the requirement to create a VRF instance.
- ✓
vrf definition TENANT_A
Why this is correct
The global configuration command 'vrf definition TENANT_A' creates a VRF instance named TENANT_A and enters VRF configuration mode. This command is used on Cisco IOS-XE routers to define a VRF, which provides separate routing and forwarding tables for each tenant. Within VRF configuration mode, the engineer can configure route distinguishers (RD) and route targets (RT) to control route import and export. This command is essential for enabling VRF-lite or MPLS Layer 3 VPNs, allowing overlapping IP addresses across tenants.
- ✗
ip vrf forwarding TENANT_A
Why it's wrong here
The command 'ip vrf forwarding TENANT_A' is the legacy equivalent of 'vrf forwarding' for older IOS versions. It is used in interface configuration mode to assign an interface to a VRF. Like 'vrf forwarding', it does not create a VRF instance. On IOS-XE, the recommended command is 'vrf forwarding'. This command is not used to create a VRF, so it is incorrect for the given task.
- ✗
ip vrf TENANT_A
Why it's wrong here
The command 'ip vrf TENANT_A' is used on older Cisco IOS platforms to create a VRF instance. However, on Cisco IOS-XE, the preferred command is 'vrf definition'. The 'ip vrf' command is legacy and does not support IPv6 or some advanced features. While it may still work for IPv4-only VRFs, it is not the recommended command for modern IOS-XE routers. Therefore, it is not the best choice for this scenario.
Go deeper
Related to this question
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.