Quick Answer

The correct order for VRF selection with policy-based routing steps is: create an extended access-list to match traffic, define a route-map with a match ip clause and the set vrf command, apply the route-map to the incoming interface, then the router evaluates the policy on received packets, and finally forwards the matched traffic into the specified VRF. This sequence is correct because policy-based routing (PBR) overrides the standard routing table lookup by first classifying traffic using an access-list, then using a route-map to dictate the next action—in this case, selecting a specific VRF for forwarding rather than a next-hop IP. On the ENCOR 350-401 exam, this drag-and-drop task tests your understanding of how PBR interacts with VRF-aware routing, often appearing as a scenario where you must isolate customer traffic into separate routing tables. A common trap is confusing the order of the route-map definition versus its application; remember that you must define the policy before you can apply it to an interface. A helpful memory tip is “Match first, set second, apply third”—the access-list matches, the route-map sets the VRF, and the interface applies the policy.