I85PREP
⌘ K
JNCIE-Cloud study materials
JNCIE-Cloud study resources

JNCIE-Cloud practice questions

One question at a time. Build your JNCIE-Cloud understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Fundamentals

In a Juniper cloud reference architecture, which component is responsible for applying security policy to traffic that flows between workloads inside the same virtual network?

  1. A load balancer distributing flows across backend pools
  2. A perimeter firewall appliance attached to the internet gateway
  3. A distributed firewall enforced at the virtual NIC or hypervisor layer Correct answer.
  4. A DNS resolver that filters queries by domain reputation

Explanation

East-west traffic between workloads in one virtual network never traverses the internet gateway, so perimeter appliances cannot inspect it. Enforcement must happen close to the workload, typically through security groups, distributed firewall rules, or a vSRX in the traffic path.

Question 2Cloud Fundamentals

A design team wants overlay networking that decouples workload addressing from the underlying cloud provider network. Which technology directly provides this capability?

  1. VLAN tagging on the provider's physical fabric
  2. BGP route reflection inside the provider backbone
  3. VXLAN encapsulation with an EVPN control plane Correct answer.
  4. NAT44 translation at the provider edge

Explanation

VXLAN builds a Layer 2 or Layer 3 overlay in UDP tunnels, and EVPN distributes the associated MAC and IP reachability information. This lets the operator choose addressing independent of the provider underlay.

Question 3Cloud Fundamentals

Which statement accurately describes the difference between a security group and a stateless network ACL in a public cloud?

  1. Security groups are stateless and evaluated per subnet; network ACLs are stateful and evaluated per instance
  2. Both are stateful and evaluated only at the internet gateway
  3. Security groups are stateful and evaluated per instance; network ACLs are stateless and evaluated per subnet Correct answer.
  4. Both are stateless and applied only to outbound traffic

Explanation

Security groups track connection state, so return traffic for an allowed flow is permitted automatically. Network ACLs evaluate each packet independently and apply at the subnet boundary, which means both directions need explicit rules.

Question 4Cloud Fundamentals

An operator deploys a vSRX in a public cloud and wants traffic from the internet to reach protected workloads through the vSRX. Which capability must the provider support to make this work without changing workload addresses?

  1. Source/destination check disabling and next-hop or user-defined routing Correct answer.
  2. Multicast routing across the provider backbone
  3. Layer 2 trunking of provider VLANs into the tenant network
  4. Provider-managed anycast DNS

Explanation

Cloud fabrics often drop packets whose source or destination does not match the instance's assigned address, so source/destination check must be disabled on the vSRX interface. User-defined or next-hop routes then steer workload traffic to the vSRX as the gateway.

Question 5Cloud Fundamentals

Which benefit does a hub-and-spoke transit architecture provide in a multi-VPC or multi-VNet deployment?

  1. It centralizes shared services and inspection while keeping spokes isolated from one another Correct answer.
  2. It guarantees that all spokes share a single broadcast domain
  3. It removes the need for route tables inside each spoke
  4. It eliminates the need for any inter-VPC peering or gateway attachments

Explanation

A hub hosts shared services such as inspection, DNS, and connectivity to on-premises networks, while spokes attach to the hub. Spoke-to-spoke traffic can then be inspected or blocked centrally, and spokes remain isolated by default.

Question 6Cloud Fundamentals

What is the primary purpose of a cloud provider's identity and access management policy attached to a role assumed by a workload?

  1. To provide Layer 2 adjacency between workloads
  2. To grant temporary, scoped credentials to the workload without embedding long-lived keys Correct answer.
  3. To encrypt data at rest in object storage
  4. To assign public IP addresses to the workload

Explanation

Role assumption returns short-lived credentials whose permissions come from the attached policy. This avoids storing static access keys on instances, reducing the blast radius of a compromise.

Question 7Cloud Fundamentals

A Juniper engineer must choose between a routed (Layer 3) underlay and a bridged underlay for a cloud data center fabric. Which consideration most strongly favors the routed design?

  1. It requires fewer IP addresses per rack
  2. It scales through equal-cost multipath and avoids spanning-tree dependence Correct answer.
  3. It supports larger Layer 2 failure domains
  4. It removes the need for any routing protocol

Explanation

A Layer 3 underlay uses ECMP across many links, giving predictable convergence and avoiding the loop-prevention limits of spanning tree. It also contains failures to smaller domains than a large bridged fabric.

Question 8Cloud Fundamentals

Which Juniper product family is purpose-built to provide a cloud-native, containerized firewall for Kubernetes environments?

  1. cSRX Correct answer.
  2. PTX Series
  3. EX Series
  4. MX Series

Explanation

cSRX is the containerized variant of the SRX firewall, packaged to run in container platforms and orchestrated alongside Kubernetes workloads. The other families are routers or switches rather than containerized firewalls.

Question 9Cloud Fundamentals

A workload in a private subnet needs to download packages from the internet without receiving inbound connections. Which design achieves this?

  1. A route to a peering connection with the provider's management network
  2. A NAT gateway in a public subnet with a default route from the private subnet Correct answer.
  3. A public IP address attached directly to the workload
  4. An inbound security group rule permitting all traffic

Explanation

A NAT gateway performs source translation so private instances can initiate outbound sessions while remaining unreachable from the internet. The private subnet's route table sends the default route to the NAT gateway.

Question 10Cloud Fundamentals

Which statement best describes the role of a route table in a cloud virtual network?

  1. It assigns MAC addresses to virtual NICs
  2. It determines the next hop for traffic leaving a subnet Correct answer.
  3. It stores security group rules for each instance
  4. It maps domain names to IP addresses

Explanation

A route table contains destination prefixes and next-hop targets such as an internet gateway, NAT gateway, peering, or virtual appliance. Subnets are associated with a route table that governs egress from that subnet.

Question 11Cloud Fundamentals

A team deploys two vSRX instances in different availability zones and wants automatic failover of the default route for workloads. Which mechanism is most appropriate in a native cloud environment?

  1. Use spanning tree to block one instance's interface
  2. Rely on BGP multihoming to the provider backbone
  3. Configure VRRP across the two instances on the same subnet
  4. Rely on the provider's automatic route health check and API-driven route replacement Correct answer.

Explanation

Cloud fabrics generally do not pass multicast, so VRRP hellos cannot traverse the provider network between zones. Instead, health checks combined with API calls or automation update the route table so the next hop points to the healthy instance.

Question 12Cloud Fundamentals

Which practice most directly reduces the risk of a compromised workload using its cloud credentials to delete production storage?

  1. Attaching a broad administrative policy to the instance role
  2. Scoping the role policy to the specific resources and actions required Correct answer.
  3. Disabling logging on the storage service
  4. Storing long-lived access keys in the instance user data

Explanation

Least-privilege policies limit the actions and resources a compromised credential can reach. Scoping to specific buckets and required verbs means destructive operations outside that scope are denied.

Question 13Cloud Fundamentals

What does a cloud provider's shared responsibility model assign to the customer?

  1. Maintenance of the provider's backbone routers
  2. Procurement of the physical servers hosting workloads
  3. Configuration of identity, network controls, and guest operating systems Correct answer.
  4. Physical security of the data center and hypervisor patching

Explanation

The provider secures the physical facilities, hardware, and virtualization layer, while the customer secures what it puts in the cloud. That includes IAM configuration, network controls, patching of guest operating systems, and data protection.

Question 14Cloud Fundamentals

Which characteristic distinguishes a private cloud deployment model from a public cloud deployment model?

  1. Resources are always located on the customer's own premises
  2. Resources never use virtualization
  3. Resources are dedicated to a single organization and not shared with other tenants Correct answer.
  4. Resources cannot be automated through APIs

Explanation

The defining trait of a private cloud is dedicated, single-tenant infrastructure, whether operated on-premises or by a third party. Location and automation are independent of the deployment model.

Question 15Cloud Fundamentals

An application must survive the loss of an entire cloud region. Which design element is essential?

  1. A larger instance type in the primary region
  2. Replication of state and independent serving capacity in a second region Correct answer.
  3. A single region with multiple subnets in one availability zone
  4. A content delivery network caching static assets only

Explanation

Regional failure requires that data and compute exist independently in another region, with a mechanism to shift traffic. Multiple zones within one region protect against zone failure but not region failure.

Question 16Cloud Fundamentals

Which protocol is commonly used to extend an on-premises Layer 3 network into a cloud VPC over a provider's dedicated interconnect?

  1. BGP over a private virtual interface Correct answer.
  2. DHCP relay over the internet gateway
  3. LLDP over a virtual NIC
  4. RSTP over a trunk

Explanation

Dedicated interconnect services typically present a private virtual interface on which the customer peers BGP with the provider. BGP then exchanges the on-premises and cloud prefixes, enabling Layer 3 extension.

Question 17Cloud Fundamentals

What is the effect of enabling jumbo frames on the underlay of a cloud data center fabric?

  1. It eliminates the need for MTU negotiation end to end
  2. It increases the number of available VLANs
  3. It reduces per-packet header overhead and CPU interrupts for large flows Correct answer.
  4. It guarantees lossless transport for storage traffic

Explanation

Larger MTUs carry more payload per packet, lowering header overhead and interrupt rates for bulk transfers. Every device in the path must support the same MTU, and lossless behavior requires additional mechanisms such as PFC.

Question 18Cloud Fundamentals

Which statement about overlay and underlay in a cloud data center is correct?

  1. The underlay must learn tenant MAC addresses to forward overlay frames
  2. The overlay replaces the need for any routing in the underlay
  3. The underlay carries encapsulated overlay traffic and must provide stable IP reachability between tunnel endpoints Correct answer.
  4. The overlay must run on a dedicated physical network separate from the underlay

Explanation

The underlay provides routable IP connectivity between tunnel endpoints, and the overlay encapsulates tenant traffic inside those tunnels. The underlay does not need to know tenant addresses, which is a key scaling benefit.

Question 19Cloud Fundamentals

A security team wants to inspect traffic between two spoke VPCs without routing it through the internet. Which approach accomplishes this?

  1. Disable route tables on both spokes
  2. Peer the spokes directly and inspect on each host
  3. Route spoke-to-spoke traffic through a central inspection VPC using a transit gateway or hub Correct answer.
  4. Attach public IP addresses to both spokes

Explanation

Direct spoke peering would bypass centralized inspection. Steering traffic through a hub that hosts firewalls keeps the path private while allowing policy enforcement before traffic reaches the destination spoke.

Question 20Cloud Fundamentals

Which Juniper offering provides centralized management and orchestration of SRX firewalls deployed across branch and cloud locations?

  1. Junos Telemetry Interface
  2. Junos Space Security Director Correct answer.
  3. Junos PyEZ
  4. Junos OS Evolved

Explanation

Security Director is the management application for policy, logging, and orchestration across many SRX devices. The other options are an operating system, a Python library, and a telemetry framework.

Question 21Cloud Fundamentals

Which consideration makes a stateful firewall challenging to scale horizontally in a cloud environment?

  1. Firewalls cannot process encrypted traffic
  2. Cloud route tables cannot point to multiple next hops
  3. Security groups cannot be applied to firewall instances
  4. Flow state must be shared or synchronized so return traffic reaches the same instance Correct answer.

Explanation

A stateful device must see both directions of a flow, so asymmetric routing across scaled instances breaks sessions. Solutions include flow hashing, state synchronization, or a load balancer that maintains flow affinity.

Question 22Cloud Fundamentals

Which metric best indicates whether a cloud interconnect is delivering the expected performance for latency-sensitive traffic?

  1. Count of available IP addresses in the subnet
  2. Number of security group rules configured
  3. Number of IAM roles attached to instances
  4. Round-trip latency and packet loss measured across the interconnect Correct answer.

Explanation

Latency and loss directly reflect the experience of latency-sensitive applications across the interconnect. Configuration counts such as rules, addresses, or roles do not measure transport quality.

Question 23Cloud Fundamentals

An engineer must segment tenant traffic on a shared cloud fabric so that each tenant has isolated Layer 3 reachability. Which approach is most appropriate?

  1. Use VXLAN network identifiers with per-tenant VRFs in the overlay Correct answer.
  2. Apply a single shared route table to all tenants
  3. Assign each tenant a unique VLAN on a shared trunk
  4. Use one security group for all tenants

Explanation

VXLAN network identifiers separate tenant traffic in the overlay, and per-tenant VRFs keep routing tables distinct. Together they provide isolation without relying on provider Layer 2 domains.

Question 24Cloud Fundamentals

What is the purpose of a virtual interface in a dedicated cloud interconnect deployment?

  1. It defines the VLAN and peering context used to exchange routes with the provider Correct answer.
  2. It encrypts all traffic with IPsec automatically
  3. It provides a Layer 2 bridge between two VPCs
  4. It assigns public IP addresses to workloads

Explanation

A virtual interface carries a VLAN tag and a BGP peering session between the customer and the provider edge. Multiple virtual interfaces can share one physical connection to separate private, public, or transit contexts.

Question 25Cloud Fundamentals

Which statement correctly describes how ECMP affects traffic in a routed cloud fabric?

  1. It guarantees in-order delivery for every flow
  2. It eliminates the need for a routing protocol
  3. It requires all links to have different costs
  4. It forwards flows across multiple equal-cost next hops, improving utilization and resilience Correct answer.

Explanation

ECMP installs multiple equal-cost next hops and hashes flows across them, which increases usable bandwidth and provides resilience when a link fails. Per-flow hashing keeps a single flow on one path, though not all fabrics guarantee strict ordering.

Question 26Cloud Fundamentals

In a Juniper-based cloud data center design, which cloud service model places the greatest operational responsibility on the customer for patching the guest operating system and the applications running on it?

  1. Functions as a Service, where the provider manages the runtime and the customer supplies event handlers
  2. Platform as a Service, where the provider manages the runtime and the customer only deploys code
  3. Infrastructure as a Service, where the customer manages the guest OS and everything above it Correct answer.
  4. Software as a Service, where the customer manages only identity and data access

Explanation

In the IaaS model the provider supplies compute, storage, and networking virtualization, while the customer retains responsibility for the guest operating system, middleware, and application patching. PaaS, SaaS, and FaaS each move the runtime and OS layer to the provider, leaving the customer with progressively less to patch. This division of labor is the practical expression of the shared responsibility model in cloud deployments.

Question 27Cloud Fundamentals

A design team is placing a vSRX cluster in a public cloud to inspect traffic between workloads. The provider exposes multiple availability zones within one region, and each zone has its own independent power and network infrastructure. Which placement decision best supports the stated goal of surviving a single zone failure while still inspecting east-west traffic?

  1. Deploy the cluster members across two availability zones and design the traffic path so flows can be rehashed to the surviving member Correct answer.
  2. Deploy both cluster members in the same availability zone to keep inspection latency low
  3. Deploy a single vSRX instance and rely on provider snapshot restore to recover after a zone outage
  4. Deploy the cluster members in two separate regions and force all intra-region traffic through the inter-region link

Explanation

Availability zones are engineered so that a failure in one does not affect the others, so spreading cluster members across zones removes a single point of failure. The traffic path must also be designed so that flows can be redirected or rehashed to the surviving member when a zone is lost. Keeping both members in one zone or relying on a single instance leaves the inspection path vulnerable to that zone's failure.

Question 28Cloud Fundamentals

An engineer must connect many spoke VPCs to a shared services VPC in a hub-and-spoke cloud topology. Each spoke must reach the hub, spokes must not reach each other directly, and the design should minimize the number of peering connections and route table entries to maintain. Which approach best meets these constraints?

  1. Use a transit hub VPC with a centralized routing appliance that peers with each spoke and enforces spoke-to-spoke policy Correct answer.
  2. Create a full mesh of VPC peering connections between every pair of spokes
  3. Attach every spoke to the same shared VPC by placing all workloads in a single flat subnet
  4. Rely on the provider's default internet gateway to carry inter-spoke traffic

Explanation

A transit hub concentrates connectivity so each spoke needs only one attachment, which keeps the peering and route table count roughly linear rather than quadratic. Centralizing routing in the hub also gives a single policy enforcement point where spoke-to-spoke traffic can be denied or inspected. A full mesh grows connection and route complexity with the square of the spoke count and provides no central policy point.

Question 29Cloud Infrastructure (NFV and SDN)

In an NFV architecture, which functional block is responsible for creating and deleting network services by orchestrating VNF lifecycle operations across the infrastructure?

  1. The VNF Manager (VNFM)
  2. The Element Management System (EMS)
  3. The NFV Orchestrator (NFVO) Correct answer.
  4. The Virtualized Infrastructure Manager (VIM)

Explanation

The NFV Orchestrator sits at the top of the MANO stack and is responsible for onboarding network services and coordinating end-to-end service lifecycle across multiple VNFMs and the VIM. It creates, scales and terminates network services rather than managing individual VNF instances.

Question 30Cloud Infrastructure (NFV and SDN)

Which statement best describes the role of the VIM in a JUNOS-based NFV deployment?

  1. It translates vendor-specific VNF descriptors into YANG models
  2. It provisions the physical underlay fabric and assigns VTEP addresses
  3. It hosts the VNFs and manages the virtualized compute, storage and network resources Correct answer.
  4. It performs protocol state machine validation for each VNF

Explanation

The Virtualized Infrastructure Manager controls and manages the NFVI, allocating virtual compute, storage and network resources to VNFs. In Juniper deployments it is typically OpenStack or VMware, not Junos itself.

Question 31Cloud Infrastructure (NFV and SDN)

What is the primary purpose of a VNF Descriptor (VNFD) in an NFV environment?

  1. To store the runtime logs generated by a VNF instance
  2. To describe the deployment requirements and lifecycle behaviour of a VNF Correct answer.
  3. To encode the physical cabling plan of the data centre
  4. To define the routing policy used by the underlay fabric

Explanation

A VNFD is a machine-readable template that defines a VNF's deployment requirements, including virtual resources, connectivity and lifecycle operations. MANO components use it to instantiate and manage the VNF consistently.

Question 32Cloud Infrastructure (NFV and SDN)

In an EVPN-VXLAN data centre fabric, which component is responsible for learning MAC addresses and advertising them to other leaf devices?

  1. The virtualized Infrastructure Manager
  2. The border leafs acting as gateways to the WAN
  3. The leaf switches acting as VTEPs Correct answer.
  4. The spine switches acting as route reflectors

Explanation

Leaf switches function as VXLAN Tunnel Endpoints, encapsulating tenant traffic and learning local MAC addresses, which they advertise through EVPN to the rest of the fabric. Spines typically provide IP underlay forwarding and route reflection rather than MAC learning.

Question 33Cloud Infrastructure (NFV and SDN)

Which Junos feature allows a single physical interface to carry traffic for multiple isolated tenants in an NFV host?

  1. Static NAT with port translation
  2. Bidirectional forwarding detection
  3. Class of service schedulers
  4. Virtual routing instances with VLAN tagging Correct answer.

Explanation

Virtual routing instances combined with VLAN tagging let one physical interface carry traffic for multiple tenants while maintaining routing isolation. Each tenant gets a separate routing instance mapped to a VLAN.

Question 34Cloud Infrastructure (NFV and SDN)

Which protocol is commonly used to distribute EVPN route types between leaf switches in a VXLAN fabric?

  1. IS-IS with traffic engineering extensions
  2. PIM-SM with anycast rendezvous points
  3. MP-BGP with the EVPN address family Correct answer.
  4. OSPFv2 with opaque LSAs

Explanation

EVPN uses MP-BGP with the EVPN address family to carry route types such as MAC/IP advertisement and inclusive multicast. This provides a control plane for VXLAN encapsulation.

Question 35Cloud Infrastructure (NFV and SDN)

In SDN, what does the term 'southbound interface' refer to?

  1. The API used by applications to query the controller
  2. The management connection between the orchestrator and the VIM
  3. The physical link between two spine switches
  4. The API used by the controller to program forwarding devices Correct answer.

Explanation

The southbound interface connects the SDN controller to the network devices it controls, carrying instructions such as OpenFlow or NETCONF/YANG. Northbound interfaces, by contrast, expose controller capabilities to applications.

Question 36Cloud Infrastructure (NFV and SDN)

Which statement accurately describes the difference between NFV and SDN?

  1. NFV virtualizes network functions while SDN separates the control plane from the forwarding plane Correct answer.
  2. NFV applies only to physical appliances while SDN applies only to virtual appliances
  3. NFV separates the control plane from the forwarding plane while SDN virtualizes network functions
  4. Both terms describe the same technology and are interchangeable

Explanation

NFV focuses on decoupling network functions from dedicated hardware by running them as software on virtualized infrastructure. SDN focuses on centralizing control and separating it from data-plane forwarding. They are complementary but distinct concepts.

Question 37Cloud Infrastructure (NFV and SDN)

A service provider wants to instantiate a chain of firewall, NAT and load-balancer VNFs so that traffic traverses them in a fixed order. Which MANO capability provides this?

  1. Per-VNF autoscaling policies
  2. The VIM's hypervisor scheduler
  3. The EMS alarm correlation engine
  4. Service function chaining defined in the network service descriptor Correct answer.

Explanation

Service function chaining is expressed in the network service descriptor, which defines the forwarding graph that orders VNFs and virtual links. The orchestrator uses this graph to instantiate the chain.

Question 38Cloud Infrastructure (NFV and SDN)

You are deploying a VNF that requires low-latency east-west traffic between two virtual machines on different hosts. Which feature should be enabled on the fabric to support this?

  1. MACsec on the uplinks only
  2. VXLAN routing at the leaf with distributed anycast gateway Correct answer.
  3. IGMP snooping on the spine switches
  4. Static route redistribution into OSPF

Explanation

A distributed anycast gateway at the leaf allows hosts on different VTEPs to route through their local leaf, avoiding tromboning traffic to a central gateway. This reduces latency for east-west flows.

Question 39Cloud Infrastructure (NFV and SDN)

A VNF instance is being migrated between compute hosts using live migration. Which requirement must the underlay fabric satisfy to keep the guest's IP address reachable throughout the move?

  1. The virtual network must be stretched so the guest's MAC and IP remain valid on both hosts Correct answer.
  2. The spine must act as a default gateway for the guest
  3. The VIM must renegotiate the guest's DHCP lease
  4. The guest must change its IP address during migration

Explanation

Live migration requires the layer-2 domain to span both source and destination hosts so the guest's addressing and sessions remain valid. VXLAN-based stretched networks are commonly used for this.

Question 40Cloud Infrastructure (NFV and SDN)

Which Junos configuration construct is used to map a tenant's VLAN to a VXLAN VNI on a leaf VTEP?

  1. A class-of-service classifier on the access port
  2. A firewall filter applied to the loopback
  3. A policy-options statement matching BGP communities
  4. A virtual switch instance binding the VLAN to a VNI Correct answer.

Explanation

On Junos, a virtual switch instance maps a VLAN to a VNI and associates it with the EVPN instance, enabling VXLAN encapsulation for that tenant. This is the standard EVPN-VXLAN tenant configuration.

Question 41Cloud Infrastructure (NFV and SDN)

An operator wants the SDN controller to push configuration changes to Junos devices using a model-driven approach. Which combination should be used?

  1. FTP with configuration archives
  2. SNMP with MIB-II
  3. Syslog with structured messages
  4. NETCONF with YANG data models Correct answer.

Explanation

NETCONF provides a programmatic transport for configuration, and YANG defines the data models that describe device configuration and state. Together they enable model-driven automation from a controller.

Question 42Cloud Infrastructure (NFV and SDN)

What is the purpose of an underlay IGP such as OSPF or IS-IS in an EVPN-VXLAN fabric?

  1. To advertise tenant MAC addresses between leaf switches
  2. To distribute VXLAN VNI assignments
  3. To synchronize tenant routing tables across the fabric
  4. To provide loopback reachability that enables VTEP-to-VTEP tunnels Correct answer.

Explanation

The underlay IGP provides IP reachability between VTEP loopback addresses so VXLAN tunnels can be established. Tenant MAC and IP reachability is handled separately by the EVPN overlay.

Question 43Cloud Infrastructure (NFV and SDN)

A network service requires that a firewall VNF automatically scale out when throughput exceeds a threshold. Which MANO element evaluates the scaling policy and triggers the action?

  1. The VIM using hardware temperature sensors
  2. The EMS using syslog severity levels
  3. The VNFM using VNFD-defined scaling rules Correct answer.
  4. The SDN controller using OpenFlow flow statistics

Explanation

Scaling policies are defined in the VNFD and evaluated by the VNFM, which instructs the VIM to allocate resources for additional instances. This keeps lifecycle decisions within the MANO framework.

Question 44Cloud Infrastructure (NFV and SDN)

Which statement about EVPN route type 2 is correct in a VXLAN fabric?

  1. It advertises an inclusive multicast tree for BUM traffic
  2. It advertises an Ethernet segment for multihoming
  3. It advertises a MAC and optionally an IP address for a host Correct answer.
  4. It advertises an IP prefix for external connectivity

Explanation

EVPN route type 2 is the MAC/IP advertisement route, carrying a host's MAC address and optionally its IP address. This enables efficient layer-2 and layer-3 forwarding in the overlay.

Question 45Cloud Infrastructure (NFV and SDN)

In a multi-homed EVPN deployment, what does an Ethernet Segment Identifier (ESI) represent?

  1. A BGP community used for route filtering
  2. A VNI assigned to a tenant VLAN
  3. A logical identifier shared by links connecting a host to multiple leaf switches Correct answer.
  4. A unique identifier for each VXLAN tunnel endpoint

Explanation

The ESI identifies a set of Ethernet links that connect a multihomed device to two or more leaf switches, enabling all-active forwarding and fast failover. It is advertised in EVPN route type 4.

Question 46Cloud Infrastructure (NFV and SDN)

Which mechanism allows a VNF to receive traffic destined to a virtual IP that is shared between two active VNF instances?

  1. Policy-based routing to a backup path
  2. VLAN translation at the access port
  3. Static NAT with a single backend
  4. Anycast service addressing with ECMP in the fabric Correct answer.

Explanation

Anycast service addressing lets multiple VNF instances advertise the same virtual IP, and the fabric uses ECMP to distribute flows across them. This provides scale-out and redundancy for the service.

Question 47Cloud Infrastructure (NFV and SDN)

What is the effect of enabling proxy ARP on a leaf VTEP in an EVPN-VXLAN fabric?

  1. The leaf answers ARP requests for remote hosts, reducing BUM flooding Correct answer.
  2. The leaf disables MAC learning on the access port
  3. The leaf forwards all ARP requests to the spine for resolution
  4. The leaf converts ARP requests into IPv6 neighbor solicitations

Explanation

Proxy ARP on the VTEP lets the leaf respond to ARP requests on behalf of remote hosts known through EVPN, suppressing unnecessary BUM flooding across the overlay. This improves scale and reduces broadcast traffic.

Question 48Cloud Infrastructure (NFV and SDN)

An operator notices that VXLAN-encapsulated frames exceed the underlay MTU and are being dropped. What is the most appropriate remediation?

  1. Enable MACsec on the VTEP uplinks
  2. Reduce the VNI range configured on the leaf
  3. Increase the underlay MTU to accommodate the VXLAN header overhead Correct answer.
  4. Disable EVPN route type 5 advertisements

Explanation

VXLAN adds 50 bytes of overhead (outer headers plus the VXLAN header), so the underlay MTU must be raised to carry the encapsulated frames without fragmentation or drops. Adjusting the VNI range or disabling route types does not address MTU.

Question 49Cloud Infrastructure (NFV and SDN)

Which statement best explains why a distributed anycast gateway improves first-hop redundancy in an EVPN-VXLAN fabric?

  1. Each leaf uses a unique gateway IP, eliminating ARP conflicts
  2. The gateway is centralized on the spine, simplifying configuration
  3. The gateway relies on VRRP to elect a master per VLAN
  4. Every leaf uses the same gateway MAC and IP, so hosts keep their gateway after migration Correct answer.

Explanation

With a distributed anycast gateway, all leafs share the same virtual gateway MAC and IP, so a host's default gateway remains valid regardless of which leaf it attaches to. This removes the need for VRRP-style master election and supports seamless mobility.

Question 50Cloud Infrastructure (NFV and SDN)

A VNF manager must ensure that a stateful firewall VNF keeps its session table when a compute host fails. Which design choice best meets this requirement?

  1. Deploy the VNF in an active-standby pair with state synchronization Correct answer.
  2. Rely on the VIM to restart the VNF on another host
  3. Enable MACsec between the VNF and the leaf
  4. Configure ECMP across three active instances

Explanation

Stateful failover requires the session state to be replicated to a standby instance so that traffic can continue without re-establishing sessions. An active-standby pair with state synchronization provides this.