hardMultiple Choice
350-401 Practice Question: Is designing a data center network using Cisco ACI
A network engineer is designing a data center network using Cisco ACI. The design must support multiple tenants with isolated policies. The engineer needs to ensure that traffic between endpoints in different tenants is blocked by default. Which ACI construct provides this isolation?
⚠ Common exam trap
Cisco often tests the misconception that VRFs or Bridge Domains provide cross-tenant isolation, but the trap here is that VRFs and BDs are scoped within a single tenant and do not inherently block traffic between different tenants—only the Tenant construct enforces default isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tenant
In Cisco ACI, a Tenant is the top-level logical container that provides administrative and policy isolation. By default, endpoints in different tenants cannot communicate because each tenant has its own separate policy domain, and no contracts exist between them. This makes the Tenant the correct construct for ensuring traffic between different tenants is blocked by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tenant
Why this is correct
In Cisco ACI, a tenant is the top-level logical container that provides administrative, fault, and policy isolation. Endpoints, EPGs, VRFs, bridge domains, and contracts all reside within a tenant, and traffic between different tenants is blocked by default unless an explicit contract establishes a communication path. This is why tenant, not any sub-tenant construct, is the correct answer for the entity that isolates traffic between separate organizations or departments.
- ✗
VRF
Why it's wrong here
A VRF in ACI supplies Layer 3 routing table separation inside a single tenant, ensuring that IP address spaces do not overlap or route to each other. However, VRFs are always scoped to one tenant and do not act as a boundary between different tenants; two VRFs in different tenants remain fully isolated regardless of their names, and inter-tenant traffic requires tenant-level contracts. Therefore, VRF is a sub-tenant mechanism, not the inter-tenant isolation boundary sought by the question.
- ✗
Bridge Domain
Why it's wrong here
A bridge domain defines a Layer 2 forwarding domain, including subnets, flooding behavior, and multicast boundaries, all inside a single tenant. Bridge domains do not segment traffic between tenants and can even be interconnected across tenants through contracts or external Layer 3 connections. Because a bridge domain only controls Layer 2 broadcast and forwarding scope within a tenant, it is not the entity responsible for isolating traffic between tenants, making this option incorrect.
- ✗
Contract
Why it's wrong here
A contract is an ACI policy object that explicitly *permits* selected traffic between EPGs or between an EPG and an external network. In the default-deny ACI fabric, contracts are the only way to allow communication across any isolation boundary; they never provide default blocking, since blocking is the fabric's baseline behavior. Thus, rather than being an isolation mechanism that prevents inter-tenant traffic, a contract is the exception that allows it, so it cannot be the correct answer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.