The answer is policy-based routing (PBR). This is the correct choice because PBR enables transparent VNF insertion by overriding the routing table for selected traffic based on match criteria like source/destination IP or protocol, forwarding packets to the virtualized firewall without altering the original IP headers or addressing scheme. On the ENCOR 350-401 exam, this question tests your understanding of service chaining methods that preserve existing IP topology—a common trap is confusing PBR with NAT or VRF-lite, which change addressing or require separate routing tables. Remember that PBR acts as a traffic redirection override, not a routing replacement. A useful memory tip: think of PBR as a "detour sign" for specific packets—it keeps the original destination address intact while forcing the traffic through the VNF, just like a highway detour that doesn’t change your final destination.
350-401 Network Function Virtualization Practice Question
This 350-401 practice question tests your understanding of network function virtualization. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A service provider wants to deploy a virtualized firewall as a VNF in a service chain. The VNF must be inserted transparently into the traffic path without requiring changes to the existing IP addressing. Which service chaining method should the architect choose?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement policy-based routing (PBR) to redirect traffic to the VNF.
Policy-based routing (PBR) allows the architect to redirect traffic to the VNF based on match criteria such as source/destination IP or protocol, without altering the existing IP addressing scheme. This enables transparent insertion of the VNF into the service chain, as PBR overrides the routing table for selected traffic and forwards it to the virtualized firewall, while the original IP headers remain unchanged.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use static routing to point traffic to the VNF.
Why it's wrong here
Static routing requires IP address changes and may not be transparent.
✓
Implement policy-based routing (PBR) to redirect traffic to the VNF.
Why this is correct
PBR allows traffic to be redirected based on policies without changing IP addressing.
Related concept
Read the scenario before looking for a memorised answer.
✗
Deploy the VNF in inline mode with proxy ARP.
Why it's wrong here
Proxy ARP can cause transparency issues and is not a standard service chaining method.
✗
Use VRF-lite to separate traffic and route through the VNF.
Why it's wrong here
VRF-lite does not inherently provide transparent insertion without IP changes.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that inline mode with proxy ARP is the simplest transparent insertion method, but candidates overlook that proxy ARP modifies Layer 2 behavior and can break transparency, whereas PBR operates at Layer 3 without altering IP addressing.
Detailed technical explanation
How to think about this question
PBR uses route maps with match and set clauses to define traffic selection and next-hop forwarding, operating at the interface level before the routing table lookup. In NFV service chaining, PBR can be applied on the ingress interface of a router or switch to steer traffic to the VNF, while the VNF processes the packets and returns them to the network device for normal forwarding. A real-world scenario is inserting a virtual firewall into a data center traffic flow without renumbering subnets, where PBR ensures only specific traffic (e.g., HTTP) is inspected, while other traffic bypasses the VNF.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 350-401 question in full detail.
Network Function Virtualization — This question tests Network Function Virtualization — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Implement policy-based routing (PBR) to redirect traffic to the VNF. — Policy-based routing (PBR) allows the architect to redirect traffic to the VNF based on match criteria such as source/destination IP or protocol, without altering the existing IP addressing scheme. This enables transparent insertion of the VNF into the service chain, as PBR overrides the routing table for selected traffic and forwards it to the virtualized firewall, while the original IP headers remain unchanged.
What should I do if I get this 350-401 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.