350-401 Infrastructure Practice Question
A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The engineer wants to ensure that the VXLAN traffic is encapsulated and forwarded correctly over the underlay network. Which statement describes the VXLAN encapsulation and forwarding process?
⚠ Common exam trap
Candidates often confuse the overlay and underlay forwarding tables, or assuming VXLAN uses GRE encapsulation instead of UDP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN encapsulates Layer 2 frames in UDP packets with a destination port of 4789, and the VTEP performs a lookup in the underlay routing table to forward the encapsulated packet to the remote VTEP.
VXLAN encapsulates original Layer 2 frames into UDP packets, with the outer UDP destination port typically 4789. The VTEP adds an outer IP header and forwards the packet based on the underlay network's routing table. This allows the overlay Layer 2 network to span across a Layer 3 underlay. The encapsulation process preserves the original frame, and the underlay routing ensures the packet reaches the remote VTEP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VXLAN encapsulates Layer 2 frames in UDP packets with a destination port of 4789, and the VTEP uses the overlay routing table to forward the encapsulated packet to the remote VTEP.
Why it's wrong here
The VTEP uses the underlay routing table to forward the encapsulated packet, not the overlay routing table. The overlay is the virtual network where Layer 2 frames are forwarded based on MAC addresses; the underlay provides IP connectivity between VTEPs. Using the overlay routing table for encapsulation forwarding would not work because the outer IP header must be routed in the underlay.
- ✗
VXLAN encapsulates Layer 3 packets in UDP packets with a destination port of 4789, and the VTEP performs a lookup in the underlay routing table to forward the encapsulated packet to the remote VTEP.
Why it's wrong here
VXLAN encapsulates Layer 2 frames, not Layer 3 packets. The original Ethernet frame is encapsulated, preserving the Layer 2 header. Encapsulating Layer 3 packets would be akin to IP-in-UDP, which is not VXLAN. This misunderstanding could lead to incorrect configuration and failure to transport Layer 2 traffic.
- ✗
VXLAN encapsulates Layer 2 frames in GRE tunnels, and the VTEP uses the underlay routing table to forward the encapsulated packet to the remote VTEP.
Why it's wrong here
VXLAN does not use GRE encapsulation; it uses MAC-in-UDP encapsulation. GRE is used by other overlay technologies such as NVGRE or traditional GRE tunnels, but VXLAN specifically uses UDP. Using GRE would not be compatible with standard VXLAN implementations and would not interoperate with other VTEPs.
- ✓
VXLAN encapsulates Layer 2 frames in UDP packets with a destination port of 4789, and the VTEP performs a lookup in the underlay routing table to forward the encapsulated packet to the remote VTEP.
Why this is correct
VXLAN uses MAC-in-UDP encapsulation, with the outer UDP destination port typically set to 4789 (IANA-assigned). The VTEP encapsulates the original Layer 2 frame, adds an outer IP header with the source and destination VTEP addresses, and forwards the packet based on the underlay routing table. This allows Layer 2 segments to be stretched over a Layer 3 underlay.
Go deeper
Related to this question
Learn chapter
SDN Controllers and Cisco ACI
Key term
Cisco Virtual Topology System
Cisco Virtual Topology System is a software-defined networking solution that creates and manages virtual network overlays across physical and virtual infrastructure for enterprise networks.
Key term
Network Visibility
Network visibility is the ability to see, monitor, and understand all traffic and devices on a network to ensure security, performance, and troubleshooting.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.