350-401 Virtualization Practice Question
A network engineer is deploying a Cisco Catalyst 9300 switch stack that will host several isolated tenant environments. Each tenant must have its own separate routing table and its own independent instance of a dynamic routing protocol on the same physical switch, while sharing the same physical uplinks to the core. Which technology should the engineer implement to meet these requirements?
⚠ Common exam trap
Test-takers frequently confuse Layer 2 isolation features such as private VLANs with true Layer 3 routing table separation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual Routing and Forwarding (VRF)
VRF is the Cisco IOS/IOS-XE feature that partitions a single physical router or switch into multiple logically separate Layer 3 routing domains. Each VRF maintains its own routing and forwarding table and can run its own routing protocol process, which is exactly what is needed when several tenants must share hardware and uplinks while remaining logically isolated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Virtual Routing and Forwarding (VRF)
Why this is correct
VRF creates multiple independent Layer 3 routing and forwarding tables on a single physical device, so each tenant gets its own RIB/FIB and can run a separate routing protocol instance. This directly satisfies the requirement of isolated routing tables plus independent protocol instances sharing the same physical uplinks and hardware.
- ✗
Virtual Switching System (VSS)
Why it's wrong here
VSS combines two physical chassis into one logical switch to provide high availability and simplified management, not tenant isolation. It does not create separate per-tenant routing tables or allow multiple independent routing protocol instances; all interfaces participate in the same shared control plane, so it cannot meet the isolation requirement described.
- ✗
Private VLAN (PVLAN) configuration
Why it's wrong here
Private VLANs provide Layer 2 port isolation within a single subnet, restricting which hosts can talk to each other. They do not provide separate Layer 3 routing tables or per-tenant routing protocol processes, so they cannot satisfy the requirement for isolated routing domains on the same switch.
- ✗
VLAN access map on the uplink
Why it's wrong here
A VLAN access map filters or redirects traffic within a VLAN but operates at Layer 2 and does not create separate routing tables. It cannot host independent dynamic routing protocol instances per tenant, so it fails to deliver the logical routing separation the scenario requires.
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.