I85PREP
⌘ K
Cisco 300-540 SPCNI study materials
Cisco 300-540 SPCNI study resources

Cisco 300-540 SPCNI practice questions

One question at a time. Build your Cisco 300-540 SPCNI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Provider-cloud virtualized architecture and orchestration

Within the ETSI NFV MANO architectural framework, which component is directly responsible for the lifecycle management of an individual VNF instance, including instantiation, scaling, and termination?

  1. NFV Orchestrator (NFVO)
  2. Virtualised Infrastructure Manager (VIM)
  3. VNF Manager (VNFM) Correct answer.
  4. Element Management System (EMS)

Explanation

In the conceptual ETSI NFV model, a VNFM handles relevant lifecycle management of a VNF instance. NFVO and VIM have network-service/resource-orchestration and infrastructure-management roles respectively. Exact onboarding and descriptor responsibility can be divided across the architecture; these roles should not be treated as three identical managers.

Question 2Provider-cloud virtualized architecture and orchestration

A service provider wants to migrate a stateful firewall VNF from a virtual machine deployment to a containerized form factor without changing its core function. Which term best describes the new packaging?

  1. PNF
  2. CNF Correct answer.
  3. VNF descriptor
  4. Hypervisor appliance

Explanation

A CNF (Cloud-native Network Function or Containerized Network Function) is a network function packaged as one or more containers and orchestrated by a platform such as Kubernetes. VNFs are typically VM-based; PNFs are physical appliances; a VNF descriptor is metadata, not a deployment form.

Question 3Provider-cloud virtualized architecture and orchestration

Which Cisco product provides model-driven service orchestration across multi-vendor physical and virtual devices using YANG service models and NETCONF transactions?

  1. Cisco Crosswork Health Insights
  2. Cisco Network Services Orchestrator (NSO) Correct answer.
  3. Cisco DNA Center
  4. Cisco Prime Infrastructure

Explanation

Cisco NSO uses YANG service models layered over device YANG models and uses NETCONF (or CLI NEDs) to push configuration with transactional semantics including rollback. It is purpose-built for multi-vendor service orchestration in service provider networks.

Question 4Provider-cloud virtualized architecture and orchestration

An OpenStack-based VIM is selected for a service provider NFVI. Which OpenStack project most directly maps to the VIM compute virtualization function in the ETSI MANO model?

  1. Neutron
  2. Nova Correct answer.
  3. Heat
  4. Keystone

Explanation

Nova is OpenStack's compute service, responsible for provisioning and managing virtual machines on hypervisors. As part of an OpenStack VIM, Nova handles the compute resource management exposed northbound to the VNFM and NFVO.

Question 5Provider-cloud virtualized architecture and orchestration

Why is Kubernetes commonly used as the orchestrator for CNFs in modern service provider clouds?

  1. It provides built-in MPLS label switching for transport networks.
  2. It natively manages container scheduling, scaling, self-healing, and declarative deployments. Correct answer.
  3. It replaces BGP as the control plane between data centers.
  4. It is the only platform certified for ETSI NFV-SOL001 descriptors.

Explanation

Kubernetes orchestrates containerized workloads with declarative manifests, controllers, and a reconciliation loop for scheduling, autoscaling, and self-healing. CNFs benefit from these primitives directly, which is why it is the de facto CNF orchestrator.

Question 6Provider-cloud availability, recovery and convergence

A Nexus 9300 switch has two power supplies installed. One fails while the other continues to supply sufficient power. What is the expected behavior?

  1. The switch disables all supervisor functions until the failed unit is replaced.
  2. The switch reboots automatically to rebalance power across supplies.
  3. The switch continues to operate normally and logs a power supply failure alarm. Correct answer.
  4. The switch immediately shuts down all ports to protect the chassis.

Explanation

Nexus platforms support redundant power supplies; if one fails and the remaining supply can carry the load, traffic forwarding continues uninterrupted and the system raises an environmental alarm. The failed unit can be replaced online.

Question 7Provider-cloud virtualized architecture and orchestration

Which Cisco platform delivers closed-loop automation for service provider networks by combining intent-based provisioning, real-time telemetry, and remediation workflows?

  1. Cisco Crosswork Network Automation Correct answer.
  2. Cisco vManage
  3. Cisco UCS Director
  4. Cisco NX-OS Bash

Explanation

Cisco Crosswork Network Automation is the SP-focused automation suite that integrates assurance, optimization, planning, and orchestration components, leveraging streaming telemetry and model-driven APIs for closed-loop operations.

Question 8Provider-cloud virtualized architecture and orchestration

When designing service chaining in an NFV environment, which technique is commonly used to steer traffic between VNFs without requiring each VNF to participate in routing decisions?

  1. OSPFv3 multi-area design
  2. Network Service Header (NSH) with SFC Correct answer.
  3. Static routes on each VNF
  4. Spanning Tree Protocol

Explanation

Service Function Chaining (SFC) with the Network Service Header (NSH) defined in RFC 8300 encodes the service path in metadata so a Service Function Forwarder steers traffic through the chain without each VNF needing to compute the next hop.

Question 9Provider-cloud virtualized architecture and orchestration

Which Cisco platform brings SD-WAN capabilities to service providers offering managed connectivity services to enterprises across multiple transports?

  1. Cisco Catalyst SD-WAN (Viptela-based) Correct answer.
  2. Cisco IOS XR ABF
  3. Cisco NX-OS VXLAN EVPN
  4. Cisco UCS HyperFlex

Explanation

Cisco Catalyst SD-WAN (formerly Viptela SD-WAN) is the platform SPs use to deliver overlay SD-WAN services across MPLS, internet, LTE/5G, and other transports with centralized vManage control.

Question 10Provider-cloud virtualized architecture and orchestration

In Kubernetes-based CNF deployments, which CNI plugin is widely used in service provider environments because it leverages BGP to advertise pod prefixes into the underlay?

  1. Flannel VXLAN
  2. Calico Correct answer.
  3. kube-proxy
  4. macvlan-only

Explanation

Calico can use BGP to advertise pod CIDRs to top-of-rack or upstream routers, enabling native L3 reachability between pods and the SP underlay without overlay encapsulation overhead.

Question 11Provider-cloud virtualized architecture and orchestration

What is the primary purpose of the NFVI in the ETSI NFV reference architecture?

  1. Provide the totality of hardware and software resources used to host and connect VNFs. Correct answer.
  2. Define the YANG data models used by VNFs.
  3. Authenticate API calls from external OSS/BSS.
  4. Run BGP route reflectors for the provider core.

Explanation

NFVI (Network Functions Virtualisation Infrastructure) is the layer of compute, storage, networking hardware, and the virtualization layer (hypervisor or container runtime) that hosts and interconnects VNFs and CNFs.

Question 12Provider-cloud availability, recovery and convergence

An engineer observes that a Nexus 9300 switch reports a 'power supply' alarm but traffic continues to flow. Which conclusion is most accurate?

  1. The alarm means the fan tray has failed and cooling has stopped.
  2. The switch is about to drop all traffic and must be rebooted immediately.
  3. Redundant power is maintaining operation and the failed supply should be replaced. Correct answer.
  4. The alarm indicates a supervisor failure requiring a full chassis replacement.

Explanation

A power supply alarm with continued forwarding indicates the redundant supply is carrying the load, which is the designed behavior. The correct action is to replace the failed supply, ideally online, without rebooting the switch.

Question 13Provider-cloud virtualized architecture and orchestration

An operator wants to push a new L3VPN service definition across thousands of PE routers atomically, with rollback if any device fails. Which NSO concept supports this requirement?

  1. NETCONF best-effort dispatch
  2. Service-model commit with transactional semantics Correct answer.
  3. SNMP set-request with v2c
  4. TFTP staging

Explanation

Cisco NSO models services in YANG and applies changes transactionally: NSO computes the device-level diff, sends it to all devices in a single transaction, and rolls back automatically if any device fails to commit. This atomicity is core to NSO's value.

Question 14Provider-cloud availability, recovery and convergence

A Nexus 9500 chassis is being planned with dual supervisors. What is the primary benefit of this configuration?

  1. Increased data-plane forwarding throughput beyond a single line card.
  2. Control-plane redundancy so that a supervisor failure does not take down the chassis. Correct answer.
  3. Automatic conversion of the chassis into a fabric extender.
  4. Support for Fibre Channel zoning across the fabric.

Explanation

Dual supervisors provide control-plane redundancy; if the active supervisor fails, the standby takes over and the chassis continues operating. Forwarding throughput is determined by line cards, not by supervisor count.

Question 15Provider-cloud virtualized architecture and orchestration

Which statement correctly describes the difference between the control plane and the data plane on a Nexus switch?

  1. Both planes run exclusively on the supervisor CPU with no hardware involvement.
  2. The control plane forwards packets in hardware, while the data plane runs routing protocols on the CPU.
  3. The control plane runs routing and management protocols on the CPU, while the data plane forwards packets in hardware. Correct answer.
  4. The data plane handles only management traffic such as SSH and SNMP.

Explanation

On Nexus platforms, control-plane protocols such as OSPF, BGP, and STP run on the supervisor CPU, which programs the hardware forwarding tables used by the data plane ASICs. Separating these planes allows high-throughput forwarding independent of protocol processing.

Question 16Provider-cloud virtualized architecture and orchestration

Which OpenStack project provides tenant Layer 2 and Layer 3 networking, including connectivity to external networks for VNFs hosted on the VIM?

  1. Cinder
  2. Glance
  3. Neutron Correct answer.
  4. Swift

Explanation

Neutron is the OpenStack networking service that provides tenant L2 segments, virtual routers, floating IPs, and external connectivity. VNFs in an OpenStack-based VIM rely on Neutron for north-south and east-west networking.

Question 17Cloud interconnect, routing and data-center connectivity

A Nexus 9000 switch must forward traffic between two VXLAN segments while enforcing policy defined centrally. Which architecture element performs the VXLAN encapsulation and decapsulation?

  1. The leaf switch VTEP function in hardware. Correct answer.
  2. The out-of-band management switch.
  3. The Nexus Dashboard telemetry engine.
  4. The APIC controller data path.

Explanation

In a VXLAN fabric, leaf switches act as VTEPs and perform encapsulation and decapsulation in hardware ASICs, while the controller distributes policy. The controller and management components do not sit in the data path.

Question 18Cloud interconnect, routing and data-center connectivity

Which connectivity service does AWS Direct Connect provide to a service provider customer connecting on-premises networks to AWS?

  1. Public-internet best-effort path to S3 only
  2. Private, dedicated Layer 2 cross-connect to AWS with VLAN-based VIFs Correct answer.
  3. MPLS L3VPN PE-CE peering as a primary product
  4. An IPsec tunnel terminated at a CloudFront edge

Explanation

AWS Direct Connect provides the relevant private dedicated or hosted connectivity arrangement among these choices, with supported virtual-interface and cloud-routing requirements. It does not automatically encrypt all application traffic or guarantee one fixed physical cross-connect layout in every hosted model. Actual path, resiliency and security still require design.

Question 19Cloud interconnect, routing and data-center connectivity

Which Microsoft Azure connectivity service is the equivalent peer to AWS Direct Connect for private connections from a service provider customer to Azure?

  1. Azure VPN Gateway
  2. Azure ExpressRoute Correct answer.
  3. Azure Front Door
  4. Azure Bastion

Explanation

Azure ExpressRoute provides private, high-bandwidth connections between on-premises and Azure regions. SPs commonly partner with Microsoft as ExpressRoute providers to deliver this service to their enterprise customers.

Question 20Provider-cloud virtualized architecture and orchestration

Which consideration most affects the choice between a Nexus 9300 and a Nexus 9500 for a spine role requiring future bandwidth growth?

  1. The 9300 provides native Fibre Channel ports for SAN expansion.
  2. The 9500 chassis allows adding higher-speed line cards as bandwidth demand grows. Correct answer.
  3. The 9500 lacks redundant supervisors, limiting its scalability.
  4. The 9300 supports more line card slots than the 9500.

Explanation

A modular chassis such as the 9500 can accept new line cards with higher interface speeds as demand increases, protecting the investment. Fixed switches have a set port count and speed determined at purchase.

Question 21NFVI service assurance, telemetry and optimization

On a Cisco Nexus switch, which command saves the running configuration so it persists across a reload?

  1. write memory
  2. copy running-config startup-config Correct answer.
  3. commit
  4. checkpoint

Explanation

On NX-OS the persistent configuration is the startup-config, and the supported way to overwrite it with the current running state is copy running-config startup-config. The write memory command is an IOS habit and is not the NX-OS method.

Question 22Cloud interconnect, routing and data-center connectivity

What is the primary security purpose of RPKI in interdomain BGP routing?

  1. Encrypt BGP messages on the wire between peers.
  2. Cryptographically validate that the originating AS for a prefix is authorized. Correct answer.
  3. Replace BGP with a centralized SDN controller.
  4. Authenticate end-users connecting to the SP edge.

Explanation

RPKI (Resource Public Key Infrastructure) uses Route Origin Authorizations (ROAs) signed by resource holders so that relying party software can validate that the origin AS for a prefix is authorized. This mitigates accidental and malicious origin hijacks.

Question 23Cloud interconnect, routing and data-center connectivity

Which BGP attribute or mechanism is most directly used by an SP to prefer one peering exit point over another for a given destination?

  1. Local Preference Correct answer.
  2. Origin code
  3. Aggregator
  4. Cluster List

Explanation

Local Preference is the standard BGP attribute SPs use internally to prefer one exit point (peering or transit) over another for outbound traffic. Higher Local Pref wins, and it is propagated within the AS via iBGP.

Question 24Cloud interconnect, routing and data-center connectivity

What is the primary purpose of an Internet Exchange Point (IXP) for a service provider?

  1. Provide a tier-1 transit purchase agreement.
  2. Offer a shared L2 fabric where multiple ASes can peer with each other directly. Correct answer.
  3. Replace the SP's MPLS core.
  4. Authenticate prefixes via cryptographic signatures.

Explanation

An IXP is a shared Layer 2 fabric where many ASes connect to peer with each other through bilateral or multilateral peering, lowering transit cost and improving latency by keeping traffic local where possible.

Question 25Cloud interconnect, routing and data-center connectivity

An SP wants to extend an MPLS L3VPN from a customer site directly into an AWS VPC over Direct Connect. Which design pattern is commonly used?

  1. AWS-side translation of MPLS labels into VLANs by AWS.
  2. Use a colocation router that runs MPLS to the SP and BGP over a Direct Connect VIF into the customer VPC. Correct answer.
  3. Run MPLS LDP directly between the customer VPC and the SP P routers.
  4. Use SNMPv2c trap forwarding.

Explanation

AWS does not run MPLS, so a typical design uses an SP-managed router in a colocation that participates in the SP MPLS L3VPN and peers via eBGP over a Direct Connect Private VIF into the customer's VPC, stitching VPN reachability without exposing MPLS to AWS.

Question 26Cloud interconnect, routing and data-center connectivity

Which mechanism does Google Cloud use as its private connectivity offering analogous to AWS Direct Connect and Azure ExpressRoute?

  1. Cloud DNS
  2. Cloud Interconnect (Dedicated or Partner) Correct answer.
  3. Cloud Run
  4. Cloud Armor

Explanation

Google Cloud Interconnect, in Dedicated and Partner flavors, is the private connectivity product peers use to connect on-premises networks privately to Google Cloud, equivalent to AWS Direct Connect and Azure ExpressRoute.

Question 27NFVI service assurance, telemetry and optimization

Which protocol does NX-OS use by default to synchronize the system clock with an external time source?

  1. SNTP only
  2. PTP
  3. CDP
  4. NTP Correct answer.

Explanation

NX-OS uses NTP to synchronize the clock with external servers, which keeps timestamps in syslog and other features consistent across devices. Accurate time is important for correlating events and for certificate validity.

Question 28Provider-cloud infrastructure and management security

A network engineer wants to authenticate switch administrators against a central server using TACACS+. Which two components must be configured on the Nexus device to enable this?

  1. A RADIUS key and a local user account only
  2. A Kerberos realm and an SSH key pair
  3. TACACS+ server group and a AAA authentication login method list referencing it Correct answer.
  4. An LDAP server group and a default role

Explanation

TACACS+ authentication requires defining the server host and key, grouping servers into a server group, and creating an AAA authentication login method list that references that group, then applying it to the login lines.

Question 29Cloud interconnect, routing and data-center connectivity

Which BGP filtering best practice helps an SP block accidental customer or peer leaks of unauthorized prefixes?

  1. Accept only the default route from every customer.
  2. Use prefix-list and AS-path filters together with RPKI origin validation per peer. Correct answer.
  3. Disable inbound filtering on transit peers to maximize reachability.
  4. Apply route maps only on the global routing table at the IGP layer.

Explanation

Robust SP BGP hygiene combines explicit prefix-lists (or IRR-derived as-sets), AS-path filters to prevent leaks of upstream prefixes, and RPKI origin validation. MANRS and RFC 7454 codify these practices.

Question 30Cloud interconnect, routing and data-center connectivity

MANRS provides voluntary actions for network operators. Which set of actions are part of MANRS for Network Operators?

  1. Filtering, anti-spoofing, coordination, and global validation (RPKI). Correct answer.
  2. Mandating BGPsec deployment globally before any peering.
  3. Disabling all BGP communities and removing RPKI.
  4. Eliminating prefix-lists in favor of route-server defaults.

Explanation

The MANRS Network Operators program defines four actions: prefix filtering, anti-spoofing (BCP38), coordination (current contact info), and global validation through IRR/RPKI publication. These complement, not replace, existing BGP best practices.

Question 31NFVI service assurance, telemetry and optimization

Which command displays the current running configuration of a Nexus switch?

  1. show config
  2. show running-config Correct answer.
  3. show nvram:startup-config
  4. show startup-config

Explanation

show running-config prints the active configuration held in memory, which is what the device currently uses. The startup configuration is shown separately and is only loaded at boot.

Question 32Cloud interconnect, routing and data-center connectivity

An enterprise customer needs connectivity to multiple cloud providers from one SP edge. Which design pattern is most efficient?

  1. Build a private MPLS link to each SaaS application.
  2. Use a multi-cloud transit design: customer connects once to the SP, SP peers with each cloud over Direct Connect / ExpressRoute / Cloud Interconnect. Correct answer.
  3. Use a single internet IPsec tunnel to AWS and ignore the other clouds.
  4. Provision separate physical fiber to every cloud region from the customer site.

Explanation

A multi-cloud transit design lets the SP act as a hub: the customer has a single attachment to the SP, and the SP holds private peerings with each hyperscaler. This minimizes customer cross-connects, simplifies routing, and centralizes policy.

Question 33Cloud interconnect, routing and data-center connectivity

When a customer creates an AWS Direct Connect Private VIF, which routing protocol is used between the customer router and AWS?

  1. OSPFv3
  2. Static routes only
  3. eBGP Correct answer.
  4. ISIS

Explanation

AWS Direct Connect uses eBGP between the customer router and AWS, with AWS providing private ASNs for VIFs (or accepting customer-owned ASNs). Customers advertise their on-premises prefixes and receive VPC prefixes from AWS over eBGP.

Question 34NFVI service assurance, telemetry and optimization

A Nexus switch must send syslog messages to a remote collector. Which command specifies the destination server?

  1. syslog host <ip>
  2. snmp-server host <ip>
  3. logging host <ip>
  4. logging server <ip> Correct answer.

Explanation

The logging server command defines a remote syslog destination on NX-OS, and the logging level can be tuned per destination. This forwards events such as link state changes and authentication failures to the collector.

Question 35Cloud interconnect, routing and data-center connectivity

Which Azure ExpressRoute peering type is used to access Azure private VNets via the customer's WAN?

  1. Microsoft peering
  2. Public peering (deprecated)
  3. Private peering Correct answer.
  4. Transit gateway peering

Explanation

ExpressRoute Private Peering provides private connectivity to Azure VNets through Virtual Network Gateways. Microsoft Peering is for Azure public services like Microsoft 365 and Azure PaaS public endpoints.

Question 36Provider-cloud availability, recovery and convergence

Which technique allows multiple geographically distributed servers to share a single IP address, with the network routing each client to the topologically closest server?

  1. Anycast Correct answer.
  2. Multicast PIM-SM
  3. Unicast NAT
  4. Broadcast

Explanation

Anycast advertises relevant reachability from multiple locations so routing selects an eligible path under its metrics and policy. That is topological/policy selection rather than a guarantee of geographic proximity, lowest actual latency or preserved state for every connection. Application state and failover behavior need their own analysis.

Question 37NFVI service assurance, telemetry and optimization

A Nexus 9000 is being prepared for an NX-OS upgrade. Which best practice reduces risk before running install all?

  1. Delete the startup configuration
  2. Create a checkpoint and verify the target images are present in bootflash Correct answer.
  3. Disable all vPC peer links permanently
  4. Remove the management IP address

Explanation

Creating a checkpoint provides a rollback point if the new image misbehaves, and confirming the target images are in local storage ensures the installer can proceed. These steps reduce recovery time and avoid a failed upgrade.

Question 38NFVI service assurance, telemetry and optimization

Which command verifies the configured NTP associations and their synchronization state on a Nexus switch?

  1. show clock detail
  2. show time-source
  3. show ntp peers Correct answer.
  4. show ntp status

Explanation

show ntp peers lists the configured NTP peers and their synchronization state, which confirms whether the device is tracking a valid time source. This helps diagnose clock drift affecting logs and certificates.

Question 39Provider-cloud infrastructure and management security

A login attempt via TACACS+ fails even though the server is reachable, and local authentication succeeds. Which configuration issue is most likely?

  1. The AAA authentication login method list does not reference the TACACS+ server group Correct answer.
  2. The console baud rate is misconfigured
  3. The vPC domain ID is duplicated
  4. The syslog server is unreachable

Explanation

If the method list applied to login does not include the TACACS+ group, the device never consults the server and falls back to other methods. Verifying the method list and its application to the login lines resolves this.

Question 40Provider-cloud availability, recovery and convergence

Bidirectional Forwarding Detection (BFD) primarily improves which aspect of an SP network?

  1. Sub-second detection of forwarding-plane liveness failures between two routers. Correct answer.
  2. Increased BGP scaling by reducing the prefix table size.
  3. Encryption of OSPF LSAs.
  4. MPLS label allocation efficiency.

Explanation

BFD provides a lightweight, fast hello/echo mechanism to detect forwarding-plane liveness failures between adjacent routers in milliseconds. Routing and MPLS protocols (OSPF, ISIS, BGP, RSVP-TE) register with BFD for sub-second convergence.

Question 41Provider-cloud availability, recovery and convergence

Which Cisco IOS XR high-availability feature allows the data plane to keep forwarding while the control plane fails over from active to standby route processor?

  1. Nonstop Forwarding with Stateful Switchover (NSF/SSO) Correct answer.
  2. MPLS LDP graceful restart only
  3. BGP route flap damping
  4. OSPF stub area

Explanation

NSF/SSO keeps the data plane forwarding using preserved forwarding state while the standby route processor takes over the control plane after a switchover. Routing protocols use graceful restart helpers so peers do not tear down sessions, masking the failover.

Question 42Cloud interconnect, routing and data-center connectivity

A design requires a single physical link to carry traffic for VLANs 10, 20, and 30 between two Nexus switches. Which port configuration accomplishes this?

  1. Configure private VLAN promiscuous mode on the port
  2. Create a port channel and assign each VLAN to a separate member link
  3. Configure the port as an access port in VLAN 10 only
  4. Configure the port as a trunk and allow VLANs 10, 20, and 30 Correct answer.

Explanation

A trunk port tags frames with an 802.1Q VLAN ID so multiple VLANs share one physical link. Allowing only the required VLANs on the trunk also limits unnecessary flooded traffic.

Question 43Cloud interconnect, routing and data-center connectivity

Which statement describes the native VLAN behavior on an 802.1Q trunk between Nexus switches?

  1. The native VLAN must always be VLAN 1 on Nexus platforms
  2. The native VLAN is blocked from passing over the trunk
  3. Frames on the native VLAN are double-tagged for priority
  4. Frames on the native VLAN are sent untagged across the trunk Correct answer.

Explanation

802.1Q defines one VLAN whose frames traverse the trunk without a tag, called the native VLAN. Both ends of the trunk should agree on it to avoid VLAN mismatches and bridging errors.

Question 44Cloud interconnect, routing and data-center connectivity

What is the purpose of the switchport trunk allowed vlan command on a Nexus trunk interface?

  1. It restricts which VLANs may traverse the trunk Correct answer.
  2. It enables VTP pruning for the interface
  3. It maps VLANs to QoS classes
  4. It sets the native VLAN for untagged frames

Explanation

The allowed VLAN list acts as a filter that determines which VLANs are permitted on the trunk. VLANs not in the list are not forwarded, which reduces unnecessary flooded traffic and tightens the Layer 2 boundary.

Question 45Provider-cloud availability, recovery and convergence

Which capability allows a Cisco IOS XR router to upgrade its software version with minimal traffic impact while continuing to forward packets?

  1. ISSU (In-Service Software Upgrade) Correct answer.
  2. show install rollback only
  3. configure terminal commit pending
  4. kron job scheduler

Explanation

ISSU coordinates a controlled software upgrade across components (and route processors) so the router continues to forward packets, leveraging NSF/SSO and protocol graceful restart. It minimizes maintenance-window impact for SPs.

Question 46Provider-cloud availability, recovery and convergence

Cisco's Virtual PortChannel (vPC) on Nexus and Multi-chassis EtherChannel (MEC) on IOS XR both serve which design purpose?

  1. Allow a downstream device to bundle uplinks to two physically separate upstream chassis as a single logical EtherChannel. Correct answer.
  2. Enable BGP route reflection.
  3. Replace OSPF with ISIS.
  4. Provide IPsec encryption between data centers.

Explanation

vPC (Nexus) and MEC (IOS XR / Catalyst variants) let a downstream device bundle links into two upstream chassis appearing as one logical peer, eliminating STP-blocked links and providing dual-chassis active-active redundancy at L2.

Question 47Cloud interconnect, routing and data-center connectivity

A trunk between two Nexus switches is configured with allowed VLANs 10-20 on one side and 10-30 on the other. What is the effect on VLAN 25 traffic?

  1. VLAN 25 traffic passes because the union of allowed lists is used
  2. VLAN 25 traffic is remapped to VLAN 20
  3. VLAN 25 traffic is dropped because it is not allowed on both ends Correct answer.
  4. VLAN 25 traffic is blocked only in one direction

Explanation

Allowed VLAN lists are enforced locally on each trunk end; traffic must be permitted on both sides to traverse the link. Because VLAN 25 is missing from one side, frames are dropped at that interface.

Question 48Cloud interconnect, routing and data-center connectivity

Which command verifies the operational trunking status and native VLAN of interface Ethernet1/1 on a Nexus switch?

  1. show interface Ethernet1/1 switchport Correct answer.
  2. show interface Ethernet1/1 trunk
  3. show cdp neighbors detail
  4. show vlan brief

Explanation

show interface switchport reports administrative and operational mode, trunking status, native VLAN, and allowed VLANs for the interface. It is the standard verification command for trunk parameters.

Question 49Provider-cloud availability, recovery and convergence

An SP needs sub-second IGP convergence after a fiber cut on a long-haul link. Which combination of features most directly drives that goal?

  1. BFD plus IS-IS fast hellos and incremental SPF tuned timers. Correct answer.
  2. Increase IS-IS hello timer to 30 seconds.
  3. Disable LFA fast-reroute to reduce computation.
  4. Set BGP keepalives to 5 minutes.

Explanation

Sub-second IGP convergence usually combines BFD for fast liveness, fast IS-IS or OSPF hellos, optimized SPF timers, and Loop-Free Alternate or TI-LFA fast-reroute so the network detects, recomputes, and switches paths in milliseconds.

Question 50Cloud interconnect, routing and data-center connectivity

Which statement about private VLANs on Nexus switches is accurate?

  1. Community ports can communicate with each other but not with isolated ports Correct answer.
  2. Promiscuous ports cannot communicate with any secondary VLAN
  3. Isolated ports can communicate with each other within the same primary VLAN
  4. Private VLANs require all ports to be trunk ports

Explanation

In a private VLAN, community ports share Layer 2 connectivity with each other, while isolated ports can reach only the promiscuous port. This provides granular isolation within a single primary VLAN.