- A
The VRF is not configured with a route distinguisher.
Why wrong: Incorrect because a route distinguisher is required for VPNv4 routes, but the question states the routes are not being advertised; the RD might be missing, but that would cause a different error. However, the most common missing step is the BGP VRF configuration.
- B
The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.
Correct because without this, the VRF routes are not injected into BGP VPNv4.
- C
The route-target import/export values are incorrect.
Why wrong: Incorrect because route-targets affect route import/export on other PEs, not the advertisement from this PE.
- D
The interface in the VRF is not configured with the ipv4 address.
Why wrong: Incorrect because the interface has an IP address, otherwise the VRF would not have any routes to advertise.
Quick Answer
The missing configuration is the explicit activation of address-family ipv4 unicast vrf CUSTOMER_B under BGP with a redistribute command. This is required because in MPLS L3VPN on Cisco IOS-XR, VRF routes reside in the local routing table but are not automatically converted into VPNv4 prefixes for advertisement to the route reflector; the BGP process must be told to import those routes via redistribution. On the ENCOR 350-401 exam, this tests your understanding that a working VPNv4 session alone does not guarantee route propagation—a common trap is assuming VRF configuration is enough. Remember the sequence: VRF defines the routing table, BGP VPNv4 session provides the transport, but redistribution bridges the two. A useful memory tip is “VRF routes stay local until BGP is told to redistribute,” or think of it as needing to explicitly “invite” the VRF routes into the BGP conversation.
350-401 VRF and Path Isolation Practice Question
This 350-401 practice question tests your understanding of vrf and path isolation. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An engineer is configuring MPLS L3VPN on a Cisco IOS-XR router. The VRF CUSTOMER_B is configured with route-target import 100:1 and export 100:1. The engineer notices that the VRF routes are not being advertised to the route reflector. The BGP session to the route reflector is established and the VPNv4 address family is activated. What is the missing configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.
Option B is correct because in MPLS L3VPN on Cisco IOS-XR, simply configuring the VRF and establishing the BGP VPNv4 session is insufficient. The engineer must explicitly configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and use the redistribute command (e.g., redistribute connected or redistribute static) to inject the VRF routes into BGP for advertisement to the route reflector. Without this, the VRF routes remain in the local routing table but are never converted into VPNv4 prefixes.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VRF is not configured with a route distinguisher.
Why it's wrong here
Incorrect because a route distinguisher is required for VPNv4 routes, but the question states the routes are not being advertised; the RD might be missing, but that would cause a different error. However, the most common missing step is the BGP VRF configuration.
- ✓
The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.
Why this is correct
Correct because without this, the VRF routes are not injected into BGP VPNv4.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
The route-target import/export values are incorrect.
Why it's wrong here
Incorrect because route-targets affect route import/export on other PEs, not the advertisement from this PE.
- ✗
The interface in the VRF is not configured with the ipv4 address.
Why it's wrong here
Incorrect because the interface has an IP address, otherwise the VRF would not have any routes to advertise.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that configuring the VRF and establishing the BGP VPNv4 session is enough, but the trap is that candidates overlook the mandatory redistribution step under the VRF-specific BGP address family, which is required to inject routes into the VPNv4 table.
Detailed technical explanation
How to think about this question
In MPLS L3VPN, the VRF routes must be explicitly associated with the BGP VPNv4 address family via the address-family ipv4 unicast vrf <vrf-name> configuration block, where the redistribute command (or network command) is used to inject routes into BGP. This is because BGP does not automatically import VRF routes; the redistribution triggers the conversion of IPv4 unicast routes into VPNv4 routes with the appropriate route distinguisher and route-target extended communities. A common real-world scenario is when a PE router has VRF routes from OSPF or EIGRP but fails to advertise them to the route reflector because the redistribute command is missing under the VRF address family.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 350-401 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
VRF and Path Isolation — study guide chapter
Learn the concepts, then practise the questions
- →
VRF and Path Isolation practice questions
Targeted practice on this topic area only
- →
All 350-401 questions
2,015 questions across all exam domains
- →
ENCOR 350-401 study guide
Full concept coverage aligned to exam objectives
- →
350-401 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 350-401 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Architecture practice questions
Practise 350-401 questions linked to Architecture.
Enterprise Network Design practice questions
Practise 350-401 questions linked to Enterprise Network Design.
SD-Access Architecture practice questions
Practise 350-401 questions linked to SD-Access Architecture.
SD-WAN Architecture practice questions
Practise 350-401 questions linked to SD-WAN Architecture.
QoS Architecture practice questions
Practise 350-401 questions linked to QoS Architecture.
Virtualization practice questions
Practise 350-401 questions linked to Virtualization.
Network Function Virtualization practice questions
Practise 350-401 questions linked to Network Function Virtualization.
Virtual Machines and Hypervisors practice questions
Practise 350-401 questions linked to Virtual Machines and Hypervisors.
VRF and Path Isolation practice questions
Practise 350-401 questions linked to VRF and Path Isolation.
Infrastructure practice questions
Practise 350-401 questions linked to Infrastructure.
OSPF practice questions
Practise 350-401 questions linked to OSPF.
BGP practice questions
Practise 350-401 questions linked to BGP.
Practice this exam
Start a free 350-401 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 350-401 question test?
VRF and Path Isolation — This question tests VRF and Path Isolation — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes. — Option B is correct because in MPLS L3VPN on Cisco IOS-XR, simply configuring the VRF and establishing the BGP VPNv4 session is insufficient. The engineer must explicitly configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and use the redistribute command (e.g., redistribute connected or redistribute static) to inject the VRF routes into BGP for advertisement to the route reflector. Without this, the VRF routes remain in the local routing table but are never converted into VPNv4 prefixes.
What should I do if I get this 350-401 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more ways this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?
medium- A.The route-target import/export values are mismatched with the route reflector's configuration.
- ✓ B.The VRF is not activated under BGP using the address-family ipv4 vrf CUSTOMER_A command.
- C.The CE router is not configured with a default route pointing to the PE.
- D.The PE router needs the mpls ip command on the interface facing the CE router.
Why B: The CE router can ping the PE's VRF interface IP, confirming Layer 2 and VRF interface configuration are correct. However, the CE cannot reach remote VPNv4 routes, which indicates that the PE is not advertising or installing those routes into the VRF. The most likely cause is that the VRF CUSTOMER_A has not been activated under BGP using the 'address-family ipv4 vrf CUSTOMER_A' command, which is required to exchange IPv4 routes between the PE and CE within the VRF context and to redistribute them into MP-BGP for VPNv4 propagation.
Keep practising
More 350-401 practice questions
- Drag and drop the steps to configure an extended access control list (ACL) on a Cisco router in the correct order.
- Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco router in the correct order.
- Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.
- Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.
- Drag and drop the steps to configure port security on a Cisco switch in the correct order.
- Drag and drop the steps for the Spanning Tree Protocol (STP) convergence process in the correct order.
Last reviewed: Jun 24, 2026
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.