I85PREP
⌘ K
CCIE Enterprise study materials
CCIE Enterprise study resources

CCIE Enterprise practice questions

One question at a time. Build your CCIE Enterprise understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Infrastructure

What is the default OSPF hello interval on a broadcast network segment with default timers?

  1. 10 seconds Correct answer.
  2. 30 seconds
  3. 40 seconds
  4. 5 seconds

Explanation

OSPF uses a 10-second hello interval and a 40-second dead interval on broadcast and point-to-point interfaces carrying the default network type. The 30-second interval applies to non-broadcast multi-access networks such as Frame Relay or X.25. Timers must match between neighbors or the adjacency will not form.

Question 2Network Infrastructure

In RSTP, which port state both learns MAC addresses and forwards user frames?

  1. Forwarding Correct answer.
  2. Disabled
  3. Discarding
  4. Learning

Explanation

RSTP defines three operational states: discarding, learning, and forwarding. Only the forwarding state both populates the MAC address table and passes user traffic. The learning state builds the table but still drops user frames.

Question 3Network Infrastructure

Which two components make up the classic EIGRP composite metric by default?

  1. Bandwidth and delay Correct answer.
  2. MTU and hop count
  3. Delay and reliability
  4. Bandwidth and load

Explanation

The classic EIGRP metric is computed from bandwidth and delay by default, because the K1 and K3 coefficients are 1 while K2, K4, and K5 are 0. Load and reliability can be included only by changing the K values on every router. MTU is carried in the update but is never part of the metric calculation.

Question 4Network Infrastructure

Which BGP path attribute is well-known and mandatory?

  1. COMMUNITY
  2. MED
  3. LOCAL_PREF
  4. AS_PATH Correct answer.

Explanation

Well-known mandatory attributes must be recognized by every BGP speaker and must appear in every update; AS_PATH, NEXT_HOP, and ORIGIN are the three. LOCAL_PREF is well-known discretionary, while MED and COMMUNITY are optional attributes.

Question 5Network Infrastructure

How are frames belonging to the 802.1Q native VLAN transmitted on a trunk port?

  1. Tagged with VLAN 1
  2. Untagged Correct answer.
  3. Tagged with VLAN 0
  4. Dropped at the trunk

Explanation

The native VLAN is the one VLAN whose frames cross an 802.1Q trunk without a tag, which preserves compatibility with devices that do not understand tagging. Frames from every other VLAN carry a four-byte tag. A native VLAN mismatch between two ends of a trunk causes traffic to be placed in different VLANs and is logged by CDP.

Question 6Network Infrastructure

Which IPv6 address identifies all nodes on the local link?

  1. ff02::1 Correct answer.
  2. ff02::2
  3. ff02::5
  4. ff02::9

Explanation

The all-nodes multicast address for the link-local scope is ff02::1, and every IPv6 interface joins it. The address ff02::2 is the all-routers group, ff02::5 is all OSPF routers, and ff02::9 is all RIPng routers.

Question 7Network Infrastructure

A virtual MAC address in the form 0000.0c07.acXX identifies which first-hop redundancy protocol?

  1. GLBP
  2. VRRPv2
  3. HSRP version 1 Correct answer.
  4. HSRP version 2

Explanation

HSRP version 1 uses the Cisco-assigned MAC range 0000.0c07.acXX, where XX is the group number in hex. HSRP version 2 uses 0000.0c9f.fXXX, which supports larger group numbers. VRRP uses 0000.5e00.01XX and GLBP uses 0007.b400.XXYY.

Question 8Network Infrastructure

What is the effect of configuring an interface as trusted for DHCP snooping?

  1. It turns the port into a relay agent
  2. It allows DHCP server replies Correct answer.
  3. It enables option 82 insertion
  4. It blocks all DHCP messages

Explanation

DHCP snooping drops server-sourced messages such as OFFER and ACK on untrusted ports, so any port facing a legitimate DHCP server or an uplink toward one must be trusted. Trust has no effect on client-to-server messages such as DISCOVER and REQUEST. Option 82 insertion is a separate interface command.

Question 9Network Infrastructure

In an OSPF stub area, how does the ABR provide reachability to external destinations?

  1. It uses a type 7 LSA translation
  2. It floods type 5 LSAs into the area
  3. It redistributes a static default
  4. It injects a default route as a type 3 LSA Correct answer.

Explanation

Stub areas block type 5 external LSAs, so the ABR instead originates a summary (type 3) default route into the area. Internal routers then forward unknown destinations to the ABR. Type 7 LSAs exist only in NSSAs, and the ABR cannot inject a type 5 LSA into a stub area.

Question 10Network Infrastructure

A router compares two BGP paths that have equal weight. One path has LOCAL_PREF 200 and the other has LOCAL_PREF 150, and all other attributes are equal. Which path is selected?

  1. The path with the shorter AS_PATH
  2. The path with LOCAL_PREF 200 Correct answer.
  3. The path with the lower MED
  4. The path with the lowest originator ID

Explanation

After weight, the BGP best-path algorithm compares LOCAL_PREF and prefers the higher value, so the 200 path wins before any other attribute is examined. AS_PATH length and MED are only considered if LOCAL_PREF is equal. Originator ID is compared much later in the decision process.

Question 11Network Infrastructure

Which MPLS label value is the implicit null label, which signals the penultimate hop to pop the label?

  1. Label 3 Correct answer.
  2. Label 2
  3. Label 1
  4. Label 0

Explanation

Label 3 is the implicit null label, advertised by a router that can process the packet without a label, which triggers penultimate hop popping. Label 0 is the explicit IPv4 null label, where the label is retained but set to 0 until the packet is forwarded. Labels 1 and 2 are reserved for router alert and IPv6 explicit null respectively.

Question 12Network Infrastructure

How many bits long is the VXLAN VNI field?

  1. 32 bits
  2. 24 bits Correct answer.
  3. 12 bits
  4. 16 bits

Explanation

The VXLAN header carries a 24-bit VNI, which supports roughly 16 million segments compared with the 4096 available with 802.1Q's 12-bit VLAN ID. The outer UDP destination port is typically 4789 and the VTEP source address identifies the tunnel endpoint. The VNI is inserted by the egress VTEP and removed by the ingress VTEP.

Question 13Network Infrastructure

Which PIM mode uses a flood-and-prune mechanism and builds a source-based distribution tree without an RP?

  1. PIM sparse mode
  2. PIM bidir
  3. PIM dense mode Correct answer.
  4. PIM SSM

Explanation

PIM dense mode assumes every subnet wants the group, floods traffic down the tree, and prunes branches that send explicit or implicit prunes, producing a shortest-path tree rooted at the source. Sparse mode and bidirectional mode both rely on a rendezvous point. SSM requires an explicit (S,G) join from the receiver.

Question 14Network Infrastructure

In LLQ, what happens to priority-class traffic that exceeds the configured priority bandwidth during congestion?

  1. It is dropped by the policer Correct answer.
  2. It is forwarded with best-effort DSCP
  3. It is re-marked to AF11
  4. It is queued in the class-default queue

Explanation

The LLQ priority queue is serviced first and is protected by a policer that limits it to the configured rate, so excess priority traffic is dropped rather than queued. This prevents voice or video from starving the other classes. Excess traffic is not re-marked or moved to another queue.

Question 15Network Infrastructure

In Cisco SD-WAN, which protocol carries routing, TLOC, and policy information between the controllers and the WAN Edge routers?

  1. OMP Correct answer.
  2. LISP
  3. OSPF
  4. BGP

Explanation

The Overlay Management Protocol runs inside the secure DTLS or TLS control connections and distributes routes, TLOC (transport location) attributes, and centralized policy. BGP and OSPF may run on the LAN side and are redistributed into OMP. LISP is the control plane protocol used in SD-Access, not in SD-WAN.

Question 16Network Infrastructure

In a Cisco SD-Access fabric, which protocol provides the control-plane mapping from an endpoint to its fabric edge node?

  1. BGP-EVPN
  2. VXLAN
  3. LISP Correct answer.
  4. IS-IS

Explanation

SD-Access uses LISP for the control plane, with fabric edges registering endpoint EID-to-RLOC mappings to the control plane node. VXLAN-GPO encapsulates the data plane, and the underlay is typically an IS-IS or OSPF/BGP routed network. TrustSec SGT tags carried in the VXLAN-GPO header enforce policy.

Question 17Network Infrastructure

How does a BGP route reflector prevent routing loops between its clients?

  1. It increments the AS_PATH attribute on each reflection
  2. It appends the cluster ID to the cluster list Correct answer.
  3. It resets the LOCAL_PREF attribute to zero
  4. It rewrites the NEXT_HOP attribute

Explanation

The reflector adds its cluster ID to the CLUSTER_LIST attribute when reflecting a route and discards any route whose CLUSTER_LIST already contains its own cluster ID. The ORIGINATOR_ID attribute additionally identifies the original advertising router. AS_PATH is not modified when reflecting within the same AS.

Question 18Network Infrastructure

In a DMVPN Phase 2 network, which protocol maps a spoke's tunnel IP address to its public NBMA address?

  1. mGRE
  2. IPsec
  3. BGP
  4. NHRP Correct answer.

Explanation

NHRP is the client-server resolution protocol in which spokes register their tunnel-to-NBMA bindings with the hub and query the hub for other spokes' addresses. mGRE provides the multipoint tunnel interface but performs no address resolution. IPsec protects the traffic but does not resolve NBMA addresses.

Question 19Network Infrastructure

A switch port configured with PortFast and BPDU Guard receives a BPDU. What happens?

  1. It reverts to normal spanning-tree operation
  2. It sends a topology change notification
  3. It becomes a root port
  4. It is placed in the err-disabled state Correct answer.

Explanation

BPDU Guard assumes an edge port should never see a BPDU, so receiving one is treated as a violation and the port is put into the err-disabled state. Recovery requires an administrator or an errdisable recovery timer. The port does not silently revert to normal spanning-tree operation.

Question 20Network Infrastructure

Which OSPF command option is required to advertise subnetted routes into OSPF during redistribution?

  1. match internal
  2. metric-type 1
  3. subnets Correct answer.
  4. tag

Explanation

Without the subnets keyword, only classful networks and subnets that are not further subnetted are redistributed, so many prefixes are silently dropped. Adding subnets causes each subnetted route to be advertised individually as a type 5 LSA, or type 7 in an NSSA. metric-type and tag modify attributes but do not affect which routes are selected.

Question 21Network Infrastructure

In a VXLAN EVPN fabric using MP-BGP, which EVPN route type carries MAC and IP address bindings for endpoints?

  1. Type 3
  2. Type 2 Correct answer.
  3. Type 1
  4. Type 5

Explanation

The EVPN type 2 route advertises a MAC address together with an optional IP address, which is how remote VTEPs learn endpoint reachability and build ARP suppression entries. Type 1 advertises Ethernet segment auto-discovery per ESI, type 3 advertises inclusive multicast membership, and type 5 advertises IP prefixes.

Question 22Network Infrastructure

Which LSA type does an ASBR generate inside an NSSA to carry redistributed external routes?

  1. Type 3
  2. Type 5
  3. Type 7 Correct answer.
  4. Type 4

Explanation

An NSSA allows external redistribution by using type 7 LSAs, which are flooded only within the NSSA and carry a forwarding address. The ABR translates type 7 LSAs into type 5 LSAs so other areas can learn the routes. Type 5 LSAs themselves are blocked at the NSSA boundary.

Question 23Network Infrastructure

Which well-known BGP community keeps a route in the local AS but blocks it from being advertised to any eBGP peer?

  1. no-advertise
  2. local-AS
  3. no-export Correct answer.
  4. internet

Explanation

The no-export community prevents the route from being advertised beyond the local autonomous system, or beyond the confederation for confederation members. The local-AS community is similar but restricts advertisement outside the local confederation sub-AS. Neither limits propagation to internal iBGP peers.

Question 24Network Infrastructure

In an MPLS Layer 3 VPN, which BGP extended community determines which VPNv4 routes a PE imports into a given VRF?

  1. The IGP metric
  2. The VPN label
  3. Route distinguishers
  4. Route targets Correct answer.

Explanation

Import and export route targets define the VRF membership of a VPNv4 route, and the PE imports a route only if its route target matches an import target of the VRF. The route distinguisher only makes otherwise-identical prefixes unique in the MP-BGP table. The VPN label is used for data-plane forwarding, not for import selection.

Question 25Network Infrastructure

When configuring an OSPF virtual link between two ABRs, which area must the virtual link traverse?

  1. The backbone area
  2. A stub area
  3. The transit area shared by both ABRs Correct answer.
  4. Any area reachable from both ABRs

Explanation

A virtual link is a point-to-point adjacency carried through a transit area, and both ABRs must have interfaces in that area and must have it configured with the same transit area ID. The transit area must not be a stub, because a virtual link cannot cross an area that blocks the LSAs the adjacency needs. The backbone area is the endpoint the link logically extends, not the area it crosses.

Question 26Network Infrastructure

Which pair of LACP modes allows two switches to form an EtherChannel bundle?

  1. Auto on one side and desirable on the other switch
  2. Passive on both sides
  3. Active on one side and passive on the other Correct answer.
  4. On at both ends with no negotiation

Explanation

LACP forms a bundle whenever at least one member is in active mode, so active/passive and active/active both succeed while passive/passive never does. Active mode initiates the exchange of LACPDUs to bring the bundle up.

Question 27Network Infrastructure

On a non-root bridge in an STP topology, which port role is assigned to the port with the lowest cumulative path cost to the root bridge?

  1. Designated port
  2. Root port Correct answer.
  3. Blocked port
  4. Alternate port

Explanation

Every non-root bridge elects exactly one root port, which is the port with the lowest cumulative cost to the root, with ties broken by upstream bridge ID and port priority. The root port is the only port on that bridge that forwards toward the root.

Question 28Network Infrastructure

Which DSCP value corresponds to the expedited forwarding (EF) per-hop behavior?

  1. 46 Correct answer.
  2. 56
  3. 10
  4. 34

Explanation

EF is encoded as DSCP 46 (binary 101110), which corresponds to IP precedence 5 and is the standard marking for voice bearer traffic. It provides a low-latency, low-loss treatment in a DiffServ domain.

Question 29Network Infrastructure

What is the default administrative distance of routes learned from an external BGP peer on a Cisco router?

  1. 20 Correct answer.
  2. 110
  3. 90
  4. 200

Explanation

Cisco IOS assigns eBGP routes an administrative distance of 20, which makes them preferred over IGP-learned routes to the same prefix. iBGP routes receive 200, making them the least preferred source.

Question 30Network Infrastructure

A router's successor for 10.10.10.0/24 has a feasible distance of 2,000,000. A second path has a reported distance of 1,500,000 and a total metric of 2,800,000. How should this second path be classified?

  1. A feasible successor because its total metric is higher than the feasible distance
  2. A successor, because the router always prefers the path with the lowest reported distance
  3. Neither a successor nor a feasible successor, so it stays in the topology table as an unreachable path
  4. A feasible successor because its reported distance is below the current feasible distance Correct answer.

Explanation

The feasibility condition compares the neighbor's reported distance with the local feasible distance; a path qualifies as a feasible successor when its reported distance is strictly lower. The higher total metric only means it is a loop-free backup rather than the best path.

Question 31Network Infrastructure

An iBGP speaker learns a prefix from an eBGP peer and advertises it to an iBGP neighbor. What does the next-hop-self feature change?

  1. It sets the next hop of the advertised route to the local address used toward the iBGP peer Correct answer.
  2. It preserves the original eBGP next hop so that the iBGP peer can resolve it in its IGP
  3. It rewrites the origin attribute from IGP to incomplete for that neighbor
  4. It strips the next hop attribute so the iBGP peer resolves the prefix recursively

Explanation

By default an iBGP speaker leaves the eBGP-learned next hop unchanged, and that external address is frequently unreachable inside the AS. next-hop-self rewrites the attribute to the local address used toward the neighbor so the prefix resolves correctly.

Question 32Network Infrastructure

Two OSPF routers on the same broadcast segment have interface priorities of 0 and 1. Which router becomes the designated router?

  1. Both routers share the DR role until the next election cycle
  2. The router with priority 0, because a numerically lower priority is preferred in the election
  3. Neither router, because a DR requires at least two eligible routers on the segment
  4. The router with priority 1, since priority 0 is ineligible for election Correct answer.

Explanation

A priority of 0 makes an interface ineligible to become DR or BDR, so the priority-1 router wins even if its router ID is lower. The election is only suppressed when every router on the segment has priority 0.

Question 33Network Infrastructure

Which statement describes how GRE and IPsec are combined to protect traffic between two sites?

  1. GRE and IPsec run in parallel, and traffic is routed through one or the other
  2. IPsec encrypts the payload first, and GRE then encapsulates the encrypted packet
  3. GRE encrypts the payload itself, and IPsec only authenticates the outer IP header of the tunnel
  4. GRE encapsulates the payload first, and IPsec then protects the GRE packet Correct answer.

Explanation

In this design GRE carries multicast, routing protocols, and non-IP traffic, and the resulting GRE packet is then protected by IPsec so that the payload is encrypted and authenticated. The tunnel interface is typically protected with an IPsec profile applied as tunnel protection.

Question 34Network Infrastructure

What does IGMP snooping cause a Layer 2 switch to do with multicast frames?

  1. Drop them unless the switch has an IPv4 address configured in that VLAN
  2. Forward them only to ports where a receiver has joined the group Correct answer.
  3. Convert them into unicast frames addressed to the group MAC address
  4. Flood them to every port in the VLAN regardless of group membership

Explanation

IGMP snooping builds a per-group forwarding table from observed membership reports, so multicast frames are sent only toward ports that lead to interested receivers. This keeps multicast traffic from behaving like broadcast at Layer 2.

Question 35Network Infrastructure

In an MPLS network that relies only on the IGP for reachability, which protocol distributes label bindings for IGP-learned prefixes between adjacent routers?

  1. BGP
  2. PIM
  3. RSVP-TE
  4. LDP Correct answer.

Explanation

LDP exchanges label bindings for prefixes learned from the IGP and is the default label distribution protocol in an MPLS core. It populates the LIB and LFIB with local and remote label mappings.

Question 36Network Infrastructure

What is the purpose of the anycast gateway in a Cisco SD-Access fabric?

  1. It assigns fabric edge nodes to a single control plane node for address resolution
  2. It lets every fabric edge node use the same virtual IP and MAC for a subnet's default gateway Correct answer.
  3. It provides one centralized default gateway at the fabric border for every virtual network in the fabric
  4. It replaces the need for VXLAN encapsulation between fabric edge nodes

Explanation

The default gateway is distributed in an SD-Access fabric: each fabric edge node is configured with the same anycast virtual IP and MAC for a subnet, so a roaming host keeps its gateway and traffic is not tromboned to one device.

Question 37Network Infrastructure

Which statement describes VRF-lite on a single physical router?

  1. It keeps separate routing and forwarding tables, with overlapping addresses allowed Correct answer.
  2. It merges all interfaces into the global routing table and filters traffic between them with ACLs
  3. It uses a separate routing protocol process per interface but one shared routing table
  4. It requires MPLS LDP sessions between the virtual routing instances

Explanation

VRF-lite creates multiple independent routing and forwarding tables on one device so that overlapping prefixes can exist on different interfaces. It provides VPN-like isolation locally without requiring MPLS label distribution.

Question 38Network Infrastructure

Two switches have identical MST region names and revision numbers but different VLAN-to-instance mappings. What is the result?

  1. They form one region, but only the VLANs common to both mappings remain active
  2. They belong to different MST regions, each with its own CIST root Correct answer.
  3. They form one region only after the mappings are synchronized by the CIST root
  4. They form one region, and VLANs missing from one mapping fall into instance 0

Explanation

MST region membership requires an identical region name, revision number, and VLAN-to-instance mapping on every switch. If any of the three differs, the switches are in different regions and each region computes its own CIST root and internal spanning tree.

Question 39Network Infrastructure

In an MPLS Layer 3 VPN, how many labels does a packet typically carry between the ingress PE and the egress PE?

  1. Two, a transport label and a VPN label Correct answer.
  2. Three, an LDP label, an RSVP label, and a VPN label
  3. None, because VPNv4 routes are forwarded by IP lookup only
  4. One, the VPN label assigned by the egress PE

Explanation

The ingress PE pushes a VPN label chosen by the egress PE for the destination VRF and, beneath it in the stack order the transport label learned through LDP or RSVP. Provider routers swap only the transport label, and the VPN label is used by the egress PE after the transport label is popped or removed by penultimate hop popping.

Question 40Network Infrastructure

An ABR is configured with area 1 range 10.1.0.0 255.255.0.0, and area 1 contains the subnets 10.1.1.0/24 through 10.1.4.0/24. What does the ABR advertise into area 0 by default?

  1. Nothing, because area 1 must be the backbone area for summarization to work
  2. A single type 3 LSA for 10.1.0.0/16, with the component routes suppressed Correct answer.
  3. A single type 7 LSA for 10.1.0.0/16 that is translated at the ABR
  4. Four separate type 3 LSAs, one per subnet, plus a summary type 5 LSA for the range

Explanation

The area range command makes the ABR advertise one summarized type 3 LSA for the range into other areas and suppresses the type 3 LSAs for the component networks by default. Type 7 LSAs carry redistributed externals in an NSSA and are unrelated to inter-area summarization.

Question 41Software Defined Infrastructure

Which protocol does the SD-Access fabric control plane node use to build and maintain the endpoint-to-location database?

  1. BGP
  2. LISP Correct answer.
  3. VXLAN
  4. OSPF

Explanation

The control plane node runs LISP as a map-server and map-resolver, storing EID-to-RLOC mappings. Fabric edge nodes register the endpoints they learn into that database. OSPF and BGP are underlay routing protocols, and VXLAN is the data plane encapsulation.

Question 42Software Defined Infrastructure

Which encapsulation is used by the SD-Access data plane to carry traffic between fabric edge nodes?

  1. IPsec
  2. LISP
  3. GRE
  4. VXLAN Correct answer.

Explanation

Fabric edge and border nodes encapsulate user traffic in VXLAN, adding a VXLAN network identifier for the virtual network and a group policy ID for the SGT. The underlay simply routes the outer IP packets between loopbacks.

Question 43Software Defined Infrastructure

Which SD-Access fabric role provides the Layer 3 handoff between the fabric and external networks such as a fusion router or the Internet?

  1. Control plane node
  2. Border node Correct answer.
  3. Fabric edge node
  4. Fabric wireless controller

Explanation

Border nodes sit at the fabric perimeter and connect the fabric's virtual networks to external routing domains through LISP, VRF-lite, or SD-Access transit handoffs. Edge nodes connect endpoints, and the control plane node only maintains the mapping database.

Question 44Software Defined Infrastructure

Which SD-WAN component distributes OMP routes and policies across the overlay?

  1. vBond
  2. vEdge
  3. vManage
  4. vSmart Correct answer.

Explanation

The vSmart controller is the overlay control plane. It receives OMP updates from edge devices and advertises the best routes and policies back out to the edges. vBond handles orchestration and vManage handles management.

Question 45Software Defined Infrastructure

What is the primary function of the vBond orchestrator in a Cisco SD-WAN deployment?

  1. Forwards data traffic between branch sites
  2. Authenticates devices and orchestrates bring-up Correct answer.
  3. Stores templates and pushes configuration to edges
  4. Distributes OMP routes between overlay sites

Explanation

vBond validates device certificates and tells each device how to reach vManage and vSmart, acting as the entry point to the overlay. It does not store configuration or forward user traffic. It may also assist with NAT traversal during bring-up.

Question 46Software Defined Infrastructure

What characterizes the anycast gateway used in an SD-Access fabric?

  1. Identical gateway IP and MAC on every edge node Correct answer.
  2. A gateway address configured only on the border node
  3. A DHCP relay configured on each fabric site
  4. A loopback used for LISP map registration

Explanation

Every fabric edge node is configured with the same virtual gateway IP and virtual MAC for a given subnet, so a roaming host keeps its default gateway without changing its ARP entry. The edge node closest to the host answers as the gateway. LISP is then used to reach hosts attached elsewhere.

Question 47Software Defined Infrastructure

Which protocols does Cisco DNA Center use as its southbound interface to configure managed network devices?

  1. NETCONF and RESTCONF with YANG models Correct answer.
  2. NetFlow and IPFIX
  3. TACACS+ and RADIUS
  4. SNMPv3 and syslog

Explanation

DNA Center automates device configuration with model-driven interfaces: NETCONF and RESTCONF carrying YANG-modeled data. SNMP and syslog are used for discovery, assurance, and telemetry, not for pushing configuration.

Question 48Software Defined Infrastructure

How does Cisco SD-WAN keep traffic from different tenants or departments separate in the overlay?

  1. 802.1Q tags inserted in the outer IP header
  2. LISP instance IDs assigned per segment
  3. VRF-lite with per-interface subinterfaces
  4. Separate VPNs with unique VPN IDs Correct answer.

Explanation

SD-WAN uses VPNs, each identified by a VPN ID, to segment the overlay logically. OMP advertises routes per VPN, so a prefix in one VPN is never installed in another unless a policy deliberately leaks it.

Question 49Software Defined Infrastructure

Which function is performed by an SD-Access fabric edge node?

  1. Maintains the fabric-wide endpoint database
  2. Registers local endpoints with the control plane Correct answer.
  3. Performs the handoff to external Layer 3 networks
  4. Hosts the fabric-enabled wireless controller

Explanation

Edge nodes learn endpoints on their access ports and send LISP map-register messages to the control plane node. They also act as the anycast gateway and encapsulate traffic in VXLAN toward the destination's location.

Question 50Software Defined Infrastructure

Which field carries the source group tag inline when traffic traverses the SD-Access fabric?

  1. VXLAN-GPE
  2. VXLAN-GPO Correct answer.
  3. IPsec ESP with the tag in the SPI
  4. GRE with a 16-bit key field

Explanation

VXLAN with the Group Policy Option adds a Group Policy ID field that carries the 16-bit SGT along with the virtual network identifier. This lets downstream fabric nodes enforce group-based policy without reclassifying the packet.