350-401 Virtualization Practice Question
An organization is migrating from a traditional three-tier architecture to a leaf-spine fabric using VXLAN EVPN. The design requires that virtual machines can move between racks without IP address changes. Which technology must be enabled at the leaf switches to support this mobility?
⚠ Common exam trap
Cisco often tests the distinction between Layer 2 extension technologies (VXLAN EVPN) and Layer 3 VPNs (MPLS L3VPN), leading candidates to mistakenly choose MPLS L3VPN because it also uses BGP, but it cannot support Layer 2 mobility without IP changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN with EVPN control plane.
VXLAN with EVPN control plane (B) is correct because it provides a Layer 2 overlay network that extends VLANs across the leaf-spine fabric, enabling virtual machine mobility without IP address changes. EVPN uses BGP to distribute MAC and IP address information, allowing the leaf switches to learn and forward traffic to VMs regardless of their physical location, which is essential for seamless VM migration between racks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Overlay Transport Virtualization (OTV).
Why it's wrong here
OTV is a Layer 2 extension technology designed specifically for Data Center Interconnect (DCI), using a MAC-routing control plane and an overlay over IP to interconnect multiple sites, not to provide internal fabric mobility. It relies on an IS-IS control plane and operates independently of VXLAN/EVPN, making it unsuitable as an in-fabric overlay for a three-tier network being modernized. Because it was built for stretched Layer 2 across geographically separated data centers, it does not offer the integrated underlay/overlay fabric scalability required for VM mobility within a single site.
- ✓
VXLAN with EVPN control plane.
Why this is correct
VXLAN with EVPN is the correct solution because it combines a Layer 2 data-plane overlay (VXLAN over UDP) with a modern BGP-based control plane (EVPN) that advertises MAC and IP reachability per VNI. This enables stretched Layer 2 forwarding across an IP underlay, allowing VMs to retain their IP and MAC addresses while migrating between switches, with EVPN providing MAC learning, ARP suppression, and multi-homing capabilities. It is purpose-built for constructing flexible, scalable network fabrics for internal mobility and is the standard approach for legacy-to-fabric migration scenarios.
- ✗
VRF-Lite with route redistribution.
Why it's wrong here
VRF-Lite is a Layer 3 VPN technique that creates multiple virtual routing tables on a single physical router or switch, with routing and forwarding isolated per VRF. Re-distribution between VRFs, whether via BGP, RIP, or policy-based routing, operates only on IP prefixes and layer 3 information; it never processes or forwards Ethernet frames, MAC addresses, or ARP broadcasts. Consequently, VRF-Lite cannot extend Layer 2 connectivity across an IP network, so a VM's Layer 2 identity and broadcast domain would not be preserved, making it fundamentally incompatible with VM mobility requirements.
- ✗
MPLS L3VPN with BGP.
Why it's wrong here
MPLS L3VPN with BGP is a Layer 3 service in which customer IP prefixes are exchanged between PE routers via MP-BGP and forwarded over an MPLS label-switched core using IP lookups and label imposition/removal. It handles only IP packets and routes, not Ethernet frames, MAC addresses, ARP, or Layer 2 broadcast/unknown unicast traffic, so it cannot provide an extended Layer 2 segment for VM mobility. Even though MPLS can carry internal labels, the L3VPN model intentionally terminates customer L2 at the PE and routes at Layer 3, making it an unsuitable choice for keeping a VM in the same subnet across fabric endpoints.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Architecture Fundamentals
Key term
Fabric Fundamentals
Fabric Fundamentals is the set of core concepts behind a network fabric, where switches and routers form a single logical system that simplifies traffic forwarding and automation.
Key term
Two-Tier vs Three-Tier Architecture
Two-Tier and Three-Tier Architecture are network design models that separate network functions into layers to improve performance, security, and manageability, with the two-tier model having a collapsed core and distribution layer, and the three-tier model adding a separate core layer.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.