350-401 Virtualization Practice Question
A network engineer is deploying Cisco ACI in a data center. The requirement is to allow an external Layer 3 router to dynamically learn the endpoints that reside in a specific bridge domain (BD) and to advertise the BD's subnet to the external network. The external router is connected to a border leaf switch. Which Cisco ACI construct must be configured to meet this requirement?
⚠ Common exam trap
Many exam-takers confuse contracts or static path bindings with the routing protocol peering that only an L3Out provides for external Layer 3 connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An L3Out with an external EPG and OSPF or BGP peering to the external router.
The L3Out construct in Cisco ACI is designed for external Layer 3 connectivity. It includes an external EPG and supports routing protocols such as OSPF, BGP, or EIGRP. By configuring an L3Out on the border leaf, the fabric can peer with the external router, advertise the bridge domain subnet, and learn external routes. Contracts are for policy, not route exchange, and static path bindings are for Layer 2 connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A VRF with a contract that permits all traffic between the external router and the BD.
Why it's wrong here
A VRF provides isolated routing and a contract enforces policy, but neither dynamically advertises endpoint information or subnets to an external router. Contracts are used for security policy between EPGs, not for route exchange. They do not enable the border leaf to peer with an external router or redistribute BD subnets.
- ✗
A bridge domain with unicast routing enabled and a contract to the external EPG.
Why it's wrong here
Enabling unicast routing on a BD allows inter-subnet routing within the fabric, and a contract permits traffic, but this does not establish routing protocol peering with an external router. The external router would not learn the BD subnet dynamically. An L3Out is required to advertise the subnet and exchange routes.
- ✓
An L3Out with an external EPG and OSPF or BGP peering to the external router.
Why this is correct
An L3Out defines the Layer 3 connection to an external router. It includes an external EPG that represents the external network, and routing protocols like OSPF or BGP can be configured to exchange routes. The border leaf advertises the BD subnet and learns external routes, enabling dynamic endpoint reachability. This is the correct construct for external Layer 3 connectivity.
- ✗
An EPG with a static path binding to the external router's interface.
Why it's wrong here
A static path binding associates an EPG with a physical port or port channel, typically for hypervisor or bare-metal hosts. It does not provide Layer 3 peering or route exchange. While it can connect an external device, it lacks the routing protocol capabilities needed for dynamic subnet advertisement and endpoint learning.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
BGP Fundamentals and Path Selection
Key term
Spine-Leaf Architecture
Spine-Leaf architecture is a network topology where every lower-layer switch (leaf) connects to every upper-layer switch (spine) to provide predictable and scalable east-west traffic flow.
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.