350-401 Virtualization Practice Question
A network engineer is configuring Cisco ACI to extend a Layer 2 bridge domain to an external Layer 2 network. The engineer must ensure that the ACI fabric can forward traffic between the bridge domain and the external network without routing. Which ACI construct should be configured to achieve this?
⚠ Common exam trap
Many exam-takers confuse L2Out with L3Out; L2Out is for Layer 2 extension, while L3Out is for Layer 3 routing to external networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Layer 2 Outside (L2Out)
To extend a Layer 2 bridge domain to an external Layer 2 network in Cisco ACI, the correct construct is a Layer 2 Outside (L2Out). L2Out maps the bridge domain to an external VLAN and allows Layer 2 traffic to traverse between the fabric and the external switch without routing. Other constructs like L3Out, Tenant, or VRF do not provide this Layer 2 extension capability. Therefore, L2Out is the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Layer 3 Outside (L3Out)
Why it's wrong here
A Layer 3 Outside (L3Out) is used to connect the ACI fabric to an external Layer 3 network, providing routing between the fabric and external routers. It does not extend Layer 2 bridge domains; instead, it performs Layer 3 routing. The requirement is to extend Layer 2, so L3Out is not the correct construct. L3Out would be used if the external network needed to be reached via routing, but here the goal is to bridge Layer 2 traffic.
- ✗
Tenant
Why it's wrong here
A tenant is a logical container for ACI policies, including bridge domains, VRFs, and application profiles. It does not itself provide Layer 2 extension to external networks. While the bridge domain and L2Out would be configured within a tenant, the tenant alone does not achieve the required connectivity. Therefore, it is not the correct construct for extending Layer 2 to an external network.
- ✗
VRF
Why it's wrong here
A VRF in ACI provides Layer 3 isolation and routing. It is used in conjunction with bridge domains to enable inter-subnet routing. However, it does not extend Layer 2 connectivity to external networks. The requirement is to forward traffic at Layer 2 without routing, so VRF is not the appropriate construct. VRF would be used if routing between subnets or to external networks via L3Out was needed, but not for pure Layer 2 extension.
- ✓
Layer 2 Outside (L2Out)
Why this is correct
A Layer 2 Outside (L2Out) is specifically designed to extend a Layer 2 bridge domain to an external Layer 2 network. It allows the ACI fabric to connect to external switches and forward Layer 2 traffic without routing. This is achieved by mapping the bridge domain to an external VLAN on the L2Out. Thus, L2Out is the correct construct for extending a Layer 2 bridge domain to an external Layer 2 network.
Visual reference
Go deeper
Related to this question
Learn chapter
SDN Controllers and Cisco ACI
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
Key term
Virtual Routing and Forwarding
Virtual Routing and Forwarding (VRF) is a technology that allows a single physical router to operate like multiple independent routers by keeping separate routing tables and forwarding decisions for each instance.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.