I85PREP
⌘ K
CCNP Enterprise study materials
CCNP Enterprise study resources

CCNP Enterprise practice questions

One question at a time. Build your CCNP Enterprise understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Architecture

In a two-tier campus LAN design, which layer combines the roles normally performed by the core and distribution layers?

  1. A standalone data center spine
  2. A collapsed core layer Correct answer.
  3. An out-of-band management layer
  4. A dedicated access layer

Explanation

A two-tier design merges the core and distribution functions into a single collapsed core layer, usually implemented as a pair of switches, while access switches connect endpoints below it. It is common in smaller campuses where a full three-tier hierarchy adds cost without benefit. The access layer stays separate and provides endpoint connectivity and PoE.

Question 2Architecture

Which first-hop redundancy protocol is Cisco proprietary, uses an active/standby model, and assigns the virtual MAC address 0000.0c07.acXX?

  1. HSRP Correct answer.
  2. LACP
  3. GLBP
  4. VRRP

Explanation

HSRP is a Cisco-developed first-hop redundancy protocol in which one router is active and another stands by, both sharing a virtual IP and the well-known HSRP virtual MAC 0000.0c07.acXX. VRRP provides similar functionality but is an open standard with a different virtual MAC range. GLBP adds load sharing, and LACP is a link-aggregation protocol.

Question 3Architecture

In a Cisco SD-WAN deployment, which component authenticates WAN Edge routers and orchestrates the initial control connections between them and the controllers?

  1. vManage
  2. vEdge Cloud
  3. vBond Correct answer.
  4. vSmart

Explanation

The vBond orchestrator validates device identity and tells each WAN Edge which vSmart controllers and vManage instance to connect to, after which the overlay tunnels are built. vManage is the management plane and vSmart is the control plane that distributes OMP routing and policy. Separating these roles lets the overlay bootstrap securely before any policy is delivered.

Question 4Architecture

On a Cisco AireOS or Catalyst 9800 wireless deployment, which AP mode tunnels client data traffic back to the wireless controller by default?

  1. Sniffer mode
  2. FlexConnect mode
  3. Monitor mode
  4. Local mode Correct answer.

Explanation

In local mode the AP forms a CAPWAP data tunnel to the controller, so client traffic is switched at the controller interface rather than at the AP. Monitor and sniffer modes are dedicated to wireless intrusion detection and packet capture, and FlexConnect can switch traffic locally at the branch.

Question 5Architecture

In a Cisco SD-Access fabric, which node role provides the Layer 3 handoff between the fabric and external networks such as the data center or the internet?

  1. Edge node
  2. Border node Correct answer.
  3. Control plane node
  4. Intermediate node

Explanation

Border nodes connect the fabric site to external domains and perform VXLAN-to-VRF or VXLAN-to-VLAN handoff, often with a fusion router for route leaking between VRFs. Edge nodes attach endpoints, while control plane nodes host the LISP map server and map resolver. Intermediate nodes extend the underlay between fabric sites.

Question 6Architecture

Which IEEE standard specifies PoE+ with a minimum of 30 W available at the power sourcing equipment?

  1. 802.3at Correct answer.
  2. 802.3az
  3. 802.3af
  4. 802.3bt

Explanation

IEEE 802.3at, known as PoE+, raises the PSE budget to 30 W per port at the source (25.5 W at the powered device), compared with 15.4 W for 802.3af. 802.3bt (Type 3/4) goes further, supporting up to 60 W or 90 W at the source. 802.3az is Energy Efficient Ethernet and has nothing to do with power delivery.

Question 7Architecture

Where should a QoS trust boundary be established in a typical Cisco campus design?

  1. Only on the core switches
  2. Only on the WAN edge router
  3. At the access switch closest to the endpoint Correct answer.
  4. On every user PC network interface

Explanation

The trust boundary is placed as close to the traffic source as practical, normally the access switch port, so markings can be classified once and honored end to end. Untrusted endpoints should have their markings reset or re-marked at that point. Placing the boundary deeper into the network wastes forwarding effort and risks spoofed markings entering the core.

Question 8Architecture

Which Cisco technology lets several physical access switches be managed as one logical switch using dedicated stacking cables and a single control plane?

  1. VSS
  2. StackWise Correct answer.
  3. vPC
  4. HSRP

Explanation

StackWise uses dedicated stacking cables and a shared control plane so the member switches appear as one device with one management address and a distributed data plane. VSS achieves a similar logical chassis on larger chassis or fixed platforms but uses a Virtual Switch Link over Ethernet ports. vPC is a data center multichassis technology and HSRP is a gateway redundancy protocol.

Question 9Architecture

In Cisco SD-Access, which protocol does the control plane node use to hold the endpoint identifier-to-routing locator database?

  1. BGP EVPN
  2. OSPF
  3. LISP Correct answer.
  4. VXLAN

Explanation

SD-Access separates control and data planes: LISP provides the control plane map server and map resolver functions that store EID-to-RLOC registrations from fabric edge nodes. VXLAN is used only to encapsulate the data plane between fabric nodes. The underlay is typically a routed protocol such as IS-IS or OSPF and does not hold endpoint mappings.

Question 10Architecture

Which encapsulation carries the original Ethernet frame between fabric nodes in a Cisco SD-Access data plane?

  1. VXLAN Correct answer.
  2. GRE
  3. CAPWAP
  4. LISP

Explanation

Fabric edge and border nodes encapsulate the original frame in VXLAN with a fabric VNI, using the LISP-learned RLOC as the outer destination. LISP supplies the mapping information but is not the data plane encapsulation. GRE and CAPWAP serve other purposes, such as tunnels and wireless control.

Question 11Architecture

Which protocol runs over secure tunnels between Cisco SD-WAN WAN Edge routers and the vSmart controllers to exchange routes, TLOCs, and policies?

  1. BGP
  2. LISP
  3. OMP Correct answer.
  4. OSPF

Explanation

The Overlay Management Protocol carries the overlay routing information, including TLOC attributes and centralized policy, between WAN Edges and vSmart controllers. BGP and OSPF may be used at the service side or in the underlay but do not carry overlay TLOC information. OMP runs inside DTLS/TLS control connections, giving the overlay a single, policy-aware routing protocol.

Question 12Architecture

Which characteristic distinguishes a spine-leaf (Clos) data center fabric from a traditional three-tier campus design?

  1. Every leaf connects to every spine for equal-cost paths Correct answer.
  2. Spanning Tree Protocol blocks half of the redundant uplinks
  3. Every leaf switch peers directly with every other leaf switch
  4. All switches are interconnected in a single ring topology

Explanation

In a Clos fabric each leaf has a link to every spine, so traffic between any two leaves has multiple equal-cost paths and can be load-shared with routing protocols instead of being blocked by STP. This east-west scaling is why spine-leaf replaced hierarchical designs in the data center. Adding a spine adds uniform bandwidth without redesigning the topology.

Question 13Architecture

When an access point is configured for FlexConnect local switching, where is client data traffic forwarded onto the network?

  1. At the AP, onto a local VLAN Correct answer.
  2. At the DMZ anchor controller
  3. At the SD-Access fabric border node
  4. At the wireless LAN controller

Explanation

With local switching the AP bridges client frames directly onto a locally defined VLAN, so user traffic never crosses the CAPWAP tunnel to the controller. Control traffic such as authentication and roaming still goes to the controller. This reduces WAN bandwidth and latency for branch deployments.

Question 14Architecture

Which OSPF area type blocks external Type 5 LSAs while still allowing the area border router to inject a default route into the area?

  1. Stub Correct answer.
  2. NSSA
  3. Totally stubby
  4. Normal

Explanation

A stub area does not accept Type 5 external LSAs or Type 4 summary ASBR LSAs, and the ABR advertises a default route so internal routers can still reach external destinations. A not-so-sorry stub area also carries external information but in Type 7 LSAs. A totally stubby area goes further by blocking Type 3 summaries as well.

Question 15Architecture

Why is a full mesh or route reflector required among iBGP speakers in the same autonomous system?

  1. BGP next-hop reachability is lost inside the AS
  2. iBGP split horizon blocks relaying to other iBGP peers Correct answer.
  3. iBGP peers must be fully meshed to exchange keepalives
  4. eBGP peers refuse to advertise routes learned over iBGP

Explanation

A router does not advertise a route learned from one iBGP peer to another iBGP peer, because the AS path loop check would fail inside a single AS. Full mesh peering or a route reflector (with cluster IDs to prevent loops) provides the needed propagation. eBGP-learned routes are still advertised to all iBGP peers.

Question 16Architecture

Which statement accurately describes VRRP as a first-hop redundancy option?

  1. It is an open standard that uses virtual MAC 0000.5e00.01xx Correct answer.
  2. It is a Cisco-proprietary first-hop redundancy protocol
  3. It load-balances traffic across up to four gateways in one group
  4. It requires preemption to be disabled in all deployments

Explanation

VRRP is defined by the IETF and uses a master/backup election with the shared virtual MAC range 0000.5e00.01xx, which makes it suitable for multivendor environments. HSRP is the Cisco-proprietary equivalent with a different virtual MAC. Preemption is configurable and is not required to be disabled.

Question 17Architecture

Which Cisco DNA Center application continuously analyzes telemetry to detect anomalies and provide remediation guidance for the network?

  1. Device discovery
  2. Template Editor
  3. Network Assurance Correct answer.
  4. Software image management

Explanation

Network Assurance ingests streaming telemetry and uses analytics to baseline normal behavior, detect anomalies, and suggest or apply fixes. The other capabilities are part of the design and provisioning workflow rather than ongoing health monitoring. Assurance is what turns DNA Center from a provisioning tool into an operational platform.

Question 18Architecture

In Cisco TrustSec, what does the Security Group Tag applied to a packet identify?

  1. The serial number of the source device
  2. The DSCP value of the packet
  3. The destination VLAN of the packet
  4. The security group of the source Correct answer.

Explanation

The SGT classifies traffic by the security group of the source, and SGACLs on enforcement devices then permit or deny based on source and destination group pairs. Because policy is expressed in group terms rather than addresses, rules stay stable as subnets change. The tag is carried inline or through SXP propagation between devices.

Question 19Architecture

In a DMVPN Phase 3 design, what does the hub return to a spoke that asks for a direct path to another spoke?

  1. A full copy of the hub routing table to the requesting spoke
  2. A VRF route target for the spoke VPN
  3. An NHRP resolution reply for a direct tunnel Correct answer.
  4. A TLOC list identifying all other spoke endpoints

Explanation

Phase 3 uses NHRP shortcut switching: the hub answers the resolution request with the target spoke's NBMA address and a flag allowing the originator to build a direct tunnel, even when the hub is not the next hop. This keeps spoke-to-spoke traffic off the hub while preserving a simple hub-and-spoke tunnel configuration. Phase 1 and 2 differ in whether the spoke may bypass the hub for data.

Question 20Architecture

Which Cisco SD-WAN overlay topology allows traffic only between the hub sites and the spoke sites, with no direct spoke-to-spoke paths?

  1. Full mesh
  2. Hub-and-spoke Correct answer.
  3. Partial mesh
  4. Point-to-point

Explanation

In a hub-and-spoke overlay, spoke-to-spoke traffic is forwarded through a hub, which centralizes policy and often security inspection at the cost of extra latency. Full mesh and partial mesh topologies allow direct spoke-to-spoke paths. Topology is controlled per VPN by OMP route and TLOC policy rather than by physical links.

Question 21Architecture

Which queuing mechanism gives strict priority to one class while still guaranteeing bandwidth to other classes?

  1. Low Latency Queuing Correct answer.
  2. First-in, first-out queuing
  3. Class-Based Weighted Fair Queuing alone
  4. Weighted Random Early Detection

Explanation

LLQ adds a priority queue in front of CBWFQ, so latency-sensitive traffic such as voice is served first up to a policed rate while the remaining classes keep their guaranteed bandwidth shares. CBWFQ by itself gives bandwidth guarantees but no strict priority. WRED is a congestion-avoidance drop mechanism applied within a queue, not a scheduler.

Question 22Architecture

What is the purpose of the cluster ID in a BGP route reflector design?

  1. It identifies the cluster and blocks loops among clients Correct answer.
  2. It defines the AS path prepend length on reflected routes
  3. It sets local preference for reflected routes
  4. It determines the MED advertised to eBGP peers

Explanation

A route reflector stamps a cluster ID and cluster list on reflected routes; a reflector that sees its own cluster ID in the cluster list discards the route, preventing loops when multiple reflectors serve the same clients. By default the cluster ID is the router ID of the reflector. Route reflectors also use the originator ID to prevent other loops.

Question 23Architecture

In Cisco SD-WAN, what does a TLOC represent?

  1. A BGP community used for path selection
  2. The MAC address of the physical WAN interface
  3. A system IP, color, and encapsulation tuple Correct answer.
  4. The administrative distance of an OMP route

Explanation

A Transport LOCator is the combination of a WAN Edge's system IP, the color assigned to the WAN transport, and the encapsulation type, and it identifies a tunnel endpoint for OMP. Colors let policy select transports such as business internet versus MPLS. TLOC attributes such as delay and loss then drive application-aware routing decisions.

Question 24Architecture

How is the Security Group Tag carried in the SD-Access VXLAN data plane?

  1. In the outer IP DSCP field of the packet
  2. In the IP identification field of the outer header
  3. In the VXLAN-GPO header as a group policy ID Correct answer.
  4. In the 802.1Q tag of the original frame

Explanation

SD-Access uses VXLAN with the Group Policy Option extension, which adds a Group Policy ID field that carries the source SGT between fabric nodes so the destination can enforce SGACLs. Standard VXLAN has no field for this, which is why GPO is required. Inline tagging with CMD or SXP can carry the tag outside the fabric where GPO is not available.

Question 25Architecture

Which PIM mode builds a shared distribution tree rooted at a rendezvous point and can later switch receivers to a shortest-path tree?

  1. PIM source-specific multicast
  2. PIM sparse mode Correct answer.
  3. PIM dense mode
  4. PIM bidirectional

Explanation

PIM sparse mode uses an explicit join model where receivers join an RP-rooted shared tree, and the last-hop router can then join the source-specific shortest-path tree for optimal delivery. Dense mode floods and prunes instead of using an RP. PIM bidirectional keeps traffic on the shared tree permanently and never builds a source-specific shortest-path tree.

Question 26Architecture

In a three-tier campus network design, which function belongs to the distribution layer?

  1. Forwarding packets between distribution blocks at the highest speed
  2. Aggregating access-layer switches and applying policy between VLANs Correct answer.
  3. Connecting endpoint devices such as PCs and IP phones to the network
  4. Providing Power over Ethernet to access points and IP phones

Explanation

In a three-tier design the distribution layer aggregates access switches, terminates VLANs, and enforces routing, QoS, and security policy between them. The core layer provides high-speed transport between distribution blocks, while the access layer connects endpoints and supplies PoE.

Question 27Architecture

In a Cisco SD-Access fabric, which node role connects the fabric to external networks such as the WAN or the Internet?

  1. Control plane node
  2. Fabric wireless controller
  3. Fabric edge node
  4. Border node Correct answer.

Explanation

Border nodes sit at the fabric edge toward external networks and perform VXLAN-to-VXLAN or VXLAN-to-legacy handoff. Fabric edge nodes attach endpoints, and control plane nodes hold the LISP mapping database.

Question 28Architecture

Which statement describes the CAPWAP tunnels that a lightweight access point establishes with a wireless LAN controller?

  1. Control uses TCP 5246 and data uses TCP 5247.
  2. Both control and data traffic are carried over TCP port 5247.
  3. Control uses UDP 5246 and data uses UDP 5247. Correct answer.
  4. Both control and data traffic share UDP port 5246.

Explanation

A CAPWAP AP builds two tunnels to the WLC: a control tunnel on UDP 5246 and a data tunnel on UDP 5247. Control carries management and CAPWAP messages, while data carries client frames when centralized switching is used.

Question 29Architecture

Which QoS mechanism buffers excess traffic and delays it rather than dropping it, smoothing out bursts?

  1. Traffic shaping Correct answer.
  2. Weighted random early detection
  3. Policing
  4. Class-based marking

Explanation

Shaping queues and delays excess packets so they can be sent later, which smooths bursts at the cost of added delay. Policing instead drops or remarks traffic that exceeds the configured rate.

Question 30Architecture

In Cisco SD-WAN, which controller authenticates WAN Edge routers and helps them locate the other controllers?

  1. vSmart controller
  2. vManage
  3. vBond orchestrator Correct answer.
  4. WAN Edge router

Explanation

The vBond orchestrator is the first controller a WAN Edge contacts; it validates the device and returns the addresses of the vSmart controllers and vManage. vSmart distributes overlay routing and policy, and vManage provides management.

Question 31Architecture

Which protocol provides a programmatic, model-driven configuration interface that runs over SSH and uses YANG data models?

  1. NETCONF Correct answer.
  2. RESTCONF
  3. SNMPv3
  4. TACACS+

Explanation

NETCONF uses SSH as its transport and encodes configuration in YANG-modeled XML, making it model-driven and programmatic. RESTCONF offers similar model-driven operations but uses HTTPS instead of SSH.

Question 32Architecture

A chassis-based switch has dual supervisors running in SSO mode. Which feature keeps the data plane forwarding while the standby supervisor takes over?

  1. Graceful restart for OSPF
  2. EtherChannel load balancing
  3. Nonstop forwarding Correct answer.
  4. Bidirectional forwarding detection

Explanation

SSO synchronizes state between supervisors so the standby can take over without resetting line cards, and NSF keeps the forwarding plane active during the switchover. Together they preserve existing flows during a supervisor failure.

Question 33Architecture

What is the purpose of the anycast gateway in a Cisco SD-Access fabric?

  1. It assigns a unique default gateway address to each fabric edge node.
  2. It load-balances traffic across border nodes using a shared IP address.
  3. It gives all edge nodes the same gateway IP and MAC per subnet. Correct answer.
  4. It provides a shared loopback address for the control plane nodes.

Explanation

The anycast gateway assigns the same virtual IP and MAC address for a subnet to every fabric edge node, so a host keeps its default gateway wherever it roams. This supports seamless host mobility without changing gateway configuration.

Question 34Architecture

Which mechanism does Cisco SD-WAN use to measure per-tunnel latency, loss, and jitter for application-aware routing?

  1. OMP
  2. BFD Correct answer.
  3. NetFlow
  4. IP SLA

Explanation

Cisco SD-WAN enables BFD on each IPsec tunnel and uses the resulting latency, loss, and jitter measurements to drive application-aware routing decisions. OMP carries routing and policy information but does not measure path quality.

Question 35Virtualization

A router must keep two separate routing and forwarding tables so that two customers can use overlapping IPv4 address ranges on the same physical device. Which technology provides this separation?

  1. Generic Routing Encapsulation (GRE)
  2. Private VLANs
  3. VXLAN network identifiers
  4. Virtual Routing and Forwarding (VRF) Correct answer.

Explanation

A VRF creates an independent Layer 3 routing and forwarding table on a device, so identical prefixes can exist in different VRFs without conflict. Interfaces are assigned to a VRF, and only routes within that VRF are used for forwarding.

Question 36Virtualization

A VXLAN header carries a virtual network identifier (VNI). What is the size of that field and how many segments can it address?

  1. 32 bits, over 4 billion segments
  2. 16 bits, 65,536 segments
  3. 12 bits, 4096 segments
  4. 24 bits, about 16 million segments Correct answer.

Explanation

The VXLAN header is 8 bytes and contains a 24-bit VNI, which allows roughly 16.7 million unique segments. This removes the 4096-segment ceiling imposed by the 12-bit 802.1Q VLAN ID.

Question 37Virtualization

Which statement describes a characteristic of a GRE tunnel?

  1. It encrypts the payload by default
  2. It supports only unicast IPv4 payloads
  3. It can carry multicast and broadcast traffic between sites Correct answer.
  4. It requires an IPsec profile before the tunnel comes up

Explanation

GRE is a stateless tunneling protocol that can encapsulate many protocol types and preserves multicast and broadcast, which allows routing protocols to run across it. Confidentiality is not provided unless IPsec is added to the tunnel.

Question 38Virtualization

In a DMVPN Phase 2 network, what is the function of NHRP?

  1. It encrypts traffic between spoke routers
  2. It maps tunnel addresses to NBMA next-hop addresses Correct answer.
  3. It assigns tunnel IP addresses to spokes from the hub
  4. It advertises routes between the hub and spokes

Explanation

NHRP lets a spoke resolve the tunnel address of a peer into the peer's public NBMA address, so a direct mGRE tunnel can be built without transiting the hub. Spokes register their mappings with the next hop server on the hub.

Question 39Virtualization

What is the role of the fabric edge node in a Cisco SD-Access fabric?

  1. It connects wired and wireless endpoints and encapsulates their traffic into VXLAN Correct answer.
  2. It holds the LISP map database for all fabric endpoints
  3. It provides the Layer 3 handoff to external networks
  4. It authenticates endpoints against the identity store

Explanation

Fabric edge nodes are the first-hop devices for endpoints: they register host addresses with the control plane, encapsulate user traffic in VXLAN, and enforce group-based policy. They sit at the boundary between the access layer and the fabric overlay.

Question 40Virtualization

Which Cisco SD-WAN component authenticates devices and tells them which controllers to connect to?

  1. WAN Edge router
  2. vManage
  3. vBond orchestrator Correct answer.
  4. vSmart controller

Explanation

vBond is the component with a publicly reachable address; devices authenticate to it first, and it responds with the vManage and vSmart information the device needs. This orchestration step is what makes controller discovery automatic.

Question 41Virtualization

Which statement about an 802.1Q trunk between two switches is true?

  1. It carries only the native VLAN, and all frames are untagged
  2. It carries multiple VLANs, tagging frames with a VLAN ID except on the native VLAN Correct answer.
  3. It requires every frame, including native VLAN frames, to carry a tag
  4. It permits only one VLAN per physical port

Explanation

802.1Q inserts a 4-byte tag containing the 12-bit VLAN ID so a single link can carry many VLANs. Frames belonging to the native VLAN are normally transmitted untagged, and both ends must agree on that VLAN ID.

Question 42Virtualization

Which statement correctly describes VRF-lite?

  1. It uses a single global routing table that all VRFs share
  2. It provides per-VRF routing and forwarding on a device without MPLS Correct answer.
  3. It requires MPLS label distribution between PE routers
  4. It allows overlapping addresses only if the VRFs sit on different physical routers

Explanation

VRF-lite is the deployment of multiple VRFs on a device using separate interfaces or subinterfaces, with no MPLS signaling between devices. Each VRF keeps its own routing table, allowing overlapping address space on the same router.

Question 43Virtualization

What is the purpose of a Layer 2 VXLAN gateway?

  1. It provides DHCP relay for encapsulated clients
  2. It routes packets between two VRFs on the same switch
  3. It maps a VLAN to a VNI so hosts on a legacy VLAN can reach hosts on a VXLAN segment Correct answer.
  4. It terminates IPsec tunnels from remote branches

Explanation

A Layer 2 gateway bridges a traditional 802.1Q VLAN to a VXLAN VNI, allowing a non-VXLAN switch to participate in an overlay segment. It performs local bridging and learns MAC addresses on both sides of the mapping.

Question 44Virtualization

Which EVPN route type advertises a host MAC address together with its IP address in a VXLAN EVPN fabric?

  1. Type 5, IP prefix
  2. Type 2, MAC/IP advertisement Correct answer.
  3. Type 1, Ethernet auto-discovery
  4. Type 3, inclusive multicast Ethernet tag

Explanation

Type 2 routes carry MAC and optionally IP information for a host, which is how remote VTEPs learn where an endpoint lives. They are the foundation of both bridging and ARP suppression in an EVPN overlay.

Question 45Virtualization

Which pair correctly describes the two address spaces used by LISP?

  1. EIDs must be globally routable addresses assigned to xTRs
  2. EIDs identify endpoints and RLOCs identify the routable addresses of tunnel routers Correct answer.
  3. EIDs are assigned to xTR loopbacks and RLOCs are assigned to hosts
  4. RLOCs identify endpoints and EIDs identify routing locators

Explanation

In LISP the endpoint identifier is the address of the host and stays stable, while the routing locator is the routable address of the tunnel router that currently serves that host. Separating the two allows endpoint addressing to be independent of the underlay topology.

Question 46Virtualization

What function does the control plane node perform in a Cisco SD-Access fabric?

  1. It hosts the LISP map database that resolves endpoint identifiers to routing locators Correct answer.
  2. It adds the VXLAN encapsulation to endpoint traffic
  3. It assigns IP addresses to endpoints through DHCP
  4. It forwards all data-plane traffic between fabric edge nodes

Explanation

The control plane node runs LISP map-server and map-resolver functions, holding the EID-to-RLOC mappings for fabric endpoints. Edge nodes query it to learn where a destination host is attached.

Question 47Virtualization

Which statement describes the Overlay Management Protocol in Cisco SD-WAN?

  1. It synchronizes configuration between vManage and vBond
  2. It is the data-plane encapsulation used between WAN Edge routers
  3. It runs between vSmart and WAN Edge routers, carrying routes, TLOCs, and policies Correct answer.
  4. It is a link-state IGP that replaces OSPF in the underlay

Explanation

OMP is the control-plane protocol of the SD-WAN overlay, running over a DTLS or TLS session between vSmart controllers and WAN Edge devices. It distributes overlay routes, TLOC information, and centralized policy.

Question 48Virtualization

Which combination uniquely identifies a TLOC in Cisco SD-WAN?

  1. System IP address and device serial number
  2. Public IP address and UDP port number
  3. Site ID and VPN identifier
  4. System IP address, color, and encapsulation Correct answer.

Explanation

A TLOC is the identifier of a WAN Edge attachment point and is composed of the system IP, the color assigned to the transport, and the encapsulation type. The color is what allows policy and application-aware routing to prefer one transport over another.

Question 49Virtualization

Which EVPN route type is used to advertise Layer 3 prefixes in a VXLAN EVPN fabric and allows summarization?

  1. Type 2, MAC/IP advertisement
  2. Type 3, inclusive multicast Ethernet tag
  3. Type 5, IP prefix route Correct answer.
  4. Type 1, Ethernet auto-discovery

Explanation

Type 5 routes carry an IP prefix and its length, which makes them suitable for summarizing many host routes into a single advertisement. This is a common way to reduce control-plane scale in large Layer 3 fabrics.

Question 50Virtualization

In a VXLAN deployment with no EVPN control plane, how is broadcast, unknown unicast, and multicast traffic handled?

  1. It is converted to unicast and sent only to the default gateway
  2. It is flooded only within the originating VTEP
  3. It is replicated to other VTEPs by underlay multicast or by a static ingress-replication list Correct answer.
  4. It is dropped until the destination MAC address is learned

Explanation

Without a control plane, VXLAN relies on flood-and-learn: BUM frames are replicated to every VTEP that hosts the segment, using either a multicast group in the underlay or a manually configured ingress-replication peer list. MAC addresses are then learned from returning traffic.