Cisco CCNP Enterprise 350-401 ENCOR Device Virtualization and Overlay Concepts Practice Test

 

Topic 04 covers device virtualization, virtual switching, LISP and VXLAN concepts for Cisco ENCOR v1.2. These original scenarios distinguish compute abstractions, shared-host failure boundaries, identity-to-location mapping and overlay encapsulation. Select one answer unless Choose TWO. or Choose THREE. is stated. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Every option has a scenario-specific explanation.

Question 1

A branch lab server boots a virtualization layer directly from its local disks. No general-purpose host operating system is installed beneath that layer, and several virtual routers run as guests. Which description best fits the virtualization layer?

1. It is a container runtime because multiple workloads share the server.
2. It is a VRF because each guest can have independent routes.
3. It is a virtual switch because it connects the guest interfaces.
4. It is a Type 2 hypervisor because it presents virtual hardware to guests.
5. A Type 1 hypervisor running directly on the server hardware.

Correct Answer: E

 

Correct Answer

Answer E is correct because a bare-metal hypervisor executes on the physical system rather than depending on a separate host operating system.

Incorrect Answers

Answer A is incorrect because virtual machines with guest operating systems are not established as containers merely because several workloads share hardware.

Answer B is incorrect because a VRF separates routing tables on a network device; it is not the compute virtualization layer described.

Answer C is incorrect because virtual switching is a networking function inside a virtualization platform, not the layer that schedules guest CPU and memory on the hardware.

Answer D is incorrect because both hypervisor types present virtualized resources; dependence on a host operating system is the distinguishing Type 2 characteristic.

 

Question 2

An engineer installs virtualization software as an application on a Windows laptop and then runs an IOS XE lab VM inside it. If Windows fails or is shut down, the VM also stops. Which conclusion is correct?

1. A Type 2 hypervisor running on the host operating system.
2. The arrangement is a VRF because the guest has an independent IP address.
3. The guest must be using hardware switching because the laptop has a NIC.
4. The guest is a container because its availability follows Windows.
5. The virtualization software is Type 1 because the guest sees virtual CPUs.

Correct Answer: A

 

Correct Answer

Answer A is correct because the host OS is an explicit layer below the virtualization application, so the guest inherits that host dependency.

Incorrect Answers

Answer B is incorrect because an independent guest address is ordinary VM networking and does not create a VRF by itself.

Answer C is incorrect because the physical NIC does not determine whether the hypervisor is Type 1 or Type 2.

Answer D is incorrect because dependency on a host does not make a virtual machine a container; the stem explicitly identifies a VM.

Answer E is incorrect because virtual CPUs do not distinguish the two types; Type 1 does not require a general-purpose host OS beneath it.

 

Question 3

Two identical physical servers host the same network appliance VM. Server A uses a bare-metal hypervisor. Server B uses a desktop hypervisor installed on a general-purpose operating system. Which TWO failure dependencies distinguish the arrangements? Choose TWO.

1. Both arrangements still depend on their underlying physical server for CPU, memory, power, and hardware availability.
2. Server A automatically protects every guest from a shared storage failure.
3. A host-OS failure on Server B can stop the desktop hypervisor and its VM.
4. Server B cannot present virtual NICs because its hypervisor is Type 2.
5. Server A is immune to physical power loss because a Type 1 hypervisor is bare metal.

Correct Answers: A, C

 

Correct Answers

Answer A is correct because virtualization abstracts hardware but does not eliminate the failure of the physical host executing the workloads.

Answer C is correct because the Type 2 stack depends on the general-purpose host operating system that supports the virtualization application.

Incorrect Answers

Answer B is incorrect because hypervisor type alone does not supply independent storage or application redundancy.

Answer D is incorrect because Type 2 products can present virtual hardware, including virtual NICs.

Answer E is incorrect because bare metal removes the host-OS layer; it does not provide power independence.

 

Question 4

A training team needs engineers to run the same small virtual network lab on their existing Windows and macOS laptops with minimal changes to the corporate boot process. Production-grade host consolidation is not the goal. Which approach best fits the stated constraint?

1. Use a VLAN-only design because VLANs emulate guest CPU and memory.
2. Use a Type 2 hypervisor on the existing laptops.
3. Replace the lab VMs with VRFs on the corporate access switches.
4. Require a Catalyst SD-Access fabric so the VMs can run.
5. Reimage every laptop with a bare-metal hypervisor before each class.

Correct Answer: B

 

Correct Answer

Answer B is correct because the requirement favors virtualization that runs on an existing desktop operating system without replacing the laptop boot environment.

Incorrect Answers

Answer A is incorrect because VLANs provide Layer 2 segmentation, not compute virtualization.

Answer C is incorrect because VRFs do not provide portable guest operating systems or the network-appliance images required by the lab.

Answer D is incorrect because the lab requirement is local compute virtualization and does not depend on a campus fabric.

Answer E is incorrect because that changes the boot environment and conflicts with the portability and minimal-disruption requirement.

 

Question 5

A security team places two untrusted test VMs on the same physical virtualization host. Each VM has a separate virtual NIC and separate guest operating system. Which statement is most accurate about isolation?

1. Separate guest operating systems guarantee independent power and memory hardware.
2. Running VMs on one host is equivalent to placing them in different data centers.
3. The VMs are logically separate but still share host-level failure dependencies.
4. Different virtual NIC MAC addresses prove the hypervisor cannot affect both guests.
5. A separate IP subnet makes the VMs physically isolated from one another.

Correct Answer: C

 

Correct Answer

Answer C is correct because separate guests reduce direct sharing at the guest layer while the hypervisor, physical hardware, and possibly virtual switching remain common dependencies.

Incorrect Answers

Answer A is incorrect because both guests still execute on the same physical host and therefore share physical dependencies.

Answer B is incorrect because the shared host creates a common failure domain absent from truly independent sites.

Answer D is incorrect because unique guest interface identities do not remove the shared virtualization layer.

Answer E is incorrect because logical network separation is not the same as separate physical compute hosts.

 

Question 6

A VM configuration assigns four vCPUs and 8 GB of virtual memory. The physical host has a different CPU model and 128 GB of RAM. Which interpretation is correct?

1. The guest memory setting changes the host to 8 GB of physical RAM.
2. The guest is presented virtual hardware that the hypervisor maps onto physical resources.
3. The guest owns four dedicated physical CPU sockets because four vCPUs are configured.
4. The VM can use only hardware whose model names exactly match the guest-visible devices.
5. The VM is a VRF because its resource map differs from the host.

Correct Answer: B

 

Correct Answer

Answer B is correct because vCPU and virtual memory are guest-visible abstractions scheduled from the host resources.

Incorrect Answers

Answer A is incorrect because the setting allocates or limits virtual memory for one guest; it does not redefine installed host memory.

Answer C is incorrect because vCPU count does not by itself prove exclusive physical sockets or cores.

Answer D is incorrect because virtualization intentionally abstracts many physical device details from the guest.

Answer E is incorrect because resource virtualization and routing-table virtualization are different mechanisms.

 

Question 7

Four network-service VMs share a host with eight physical CPU cores. During a load test, all four guests report high CPU ready time while the physical host is saturated. Which cause is most consistent with the evidence?

1. The guests are contending for shared physical CPU scheduling capacity.
2. Each VM must have lost its IP default gateway.
3. The host needs a larger VLAN ID range to schedule more CPU.
4. Every guest requires a unique physical server because vCPUs cannot share cores.
5. The virtual switch is necessarily dropping packets because vCPUs are busy.

Correct Answer: A

 

Correct Answer

Answer A is correct because high host saturation with multiple busy VMs supports contention for the finite physical execution resources beneath their vCPUs.

Incorrect Answers

Answer B is incorrect because a gateway fault would not explain host CPU saturation and CPU scheduling delay.

Answer C is incorrect because VLAN identifiers do not provide compute cycles. It does not satisfy the stem’s governing point: Use host and guest performance evidence to distinguish compute contention from unrelated network causes.

Answer D is incorrect because virtualization can schedule multiple vCPUs on shared cores; the issue is capacity under this workload, not an inherent prohibition.

Answer E is incorrect because packet loss is not established; the direct evidence concerns compute scheduling.

 

Question 8

A VM is live-migrated to another host. Its virtual NIC retains the same MAC address and the intended network preserves the same Layer 2 segment at the destination. Which TWO observations are reasonable? Choose TWO.

1. The surrounding network still must provide reachability to the guest at its new physical attachment point.
2. The physical NIC MAC address of the destination host must become the guest MAC address.
3. The move proves that all application sessions will survive any host failure.
4. The guest can retain its network identity across the move because the virtual NIC identity is preserved.
5. Live migration automatically changes the guest IP address to the destination host address.

Correct Answers: A, D

 

Correct Answers

Answer A is correct because preserving a virtual identity does not eliminate the need for the network to deliver traffic to the destination host.

Answer D is correct because the VM-facing interface can maintain the same address identity when the migration system and destination network support it.

Incorrect Answers

Answer B is incorrect because the guest virtual NIC can retain its own identity independently of the host uplink MAC.

Answer C is incorrect because planned migration capability does not establish state continuity for arbitrary failures or applications.

Answer E is incorrect because host placement and guest IP identity are separate; the stem explicitly preserves the intended guest network.

 

Question 9

Six routing VMs run on one physical server. The server power supply fails completely. No clustering or live-restart mechanism is configured. Which outcome should the architect expect?

1. All six VMs become unavailable because they share the failed physical host.
2. Each VM continues because virtual power is independent of physical power.
3. The virtual switch moves the VMs to another server automatically.
4. The VMs become Type 2 guests until the server recovers.
5. Only the VM with the highest CPU utilization fails.

Correct Answer: A

 

Correct Answer

Answer A is correct because separate guests do not provide host-level redundancy when every workload depends on the same powered server.

Incorrect Answers

Answer B is incorrect because virtual power state is an abstraction and still depends on the host hardware.

Answer C is incorrect because a virtual switch forwards guest traffic; it does not perform workload migration by itself.

Answer D is incorrect because hypervisor type does not change as a recovery response to host power loss.

Answer E is incorrect because a physical host power failure removes the execution platform for all resident guests regardless of their utilization.

 

Question 10

An administrator wants to patch the guest operating system inside a virtual network appliance but not change the hypervisor configuration or other VMs. Which management boundary should be targeted?

1. The physical switch connected to the host.
2. The VRF containing the appliance interface.
3. Every VM on the host, because guests cannot be administered independently.
4. The hypervisor kernel only, because every guest patch is a hypervisor patch.
5. The guest operating system inside that VM.

Correct Answer: E

 

Correct Answer

Answer E is correct because guest OS maintenance is logically separate from the hypervisor that manages the host and from unrelated guests.

Incorrect Answers

Answer A is incorrect because an external switch does not patch the guest operating system.

Answer B is incorrect because a VRF controls routing context, not guest operating-system software.

Answer C is incorrect because virtual machines are separately managed workloads even though they share a host.

Answer D is incorrect because the guest and hypervisor are distinct software layers.

 

Question 11

Two VMs on the same host attach to the same virtual switch and VLAN. Their traffic stays between those VMs and no external policy requires physical inspection. Which path can carry the frames?

1. The frames must exit the host and traverse the physical access switch before returning.
2. The hypervisor must route the frames through a default gateway because all VM traffic is Layer 3.
3. The host must advertise the VM routes with BGP for the frames to move.
4. The host virtual switch can switch the frames internally without sending them onto a physical uplink.
5. The frames must be encapsulated in GRE before the virtual switch can forward them.

Correct Answer: D

 

Correct Answer

Answer D is correct because co-resident endpoints on the same virtual Layer 2 domain can exchange frames through the software switching function.

Incorrect Answers

Answer A is incorrect because an external hop is not inherently required for same-host switching when the virtual switch provides the common segment.

Answer B is incorrect because same-subnet communication can remain Layer 2. It does not satisfy the stem’s governing point: Trace same-host virtual-switch forwarding before assuming a physical network hop.

Answer C is incorrect because local Layer 2 switching does not require BGP route advertisement.

Answer E is incorrect because GRE is not a requirement for local virtual-switch forwarding.

 

Question 12

A VM sends traffic to a server on a physical network outside the host. The VM is connected to a virtual switch that has one active physical uplink. Which TWO components are necessarily involved in moving the Ethernet frame off the host? Choose TWO.

1. A physical uplink used by the virtual switch.
2. A second guest VM acting as a router in every design.
3. A LISP map server for all Ethernet frames.
4. An IPsec security association for every physical uplink.
5. The VM-facing virtual switch port.

Correct Answers: A, E

 

Correct Answers

Answer A is correct because traffic leaving the host must be transmitted through an appropriate physical adapter or equivalent host uplink.

Answer E is correct because the guest frame enters the virtual switching function through its virtual interface attachment.

Incorrect Answers

Answer B is incorrect because off-host forwarding does not inherently require another guest unless the architecture explicitly inserts one.

Answer C is incorrect because ordinary virtual-switch egress does not require LISP. It does not satisfy the stem’s governing point: Follow the guest-to-virtual-switch-to-physical-uplink path for off-host traffic.

Answer D is incorrect because encryption may be designed separately but is not inherent to off-host virtual switching.

 

Question 13

Two groups of VMs use the same virtual switch. Port group RED is assigned VLAN 110 and port group BLUE is assigned VLAN 120. The physical uplink carries both VLANs to an external switch. Which statement is correct?

1. A shared virtual switch forces every VM into one VLAN.
2. The VLAN numbers create separate physical NICs automatically.
3. The external switch must treat both VLANs as untagged native traffic.
4. VLAN separation guarantees the VMs use different physical CPUs.
5. RED and BLUE can remain separate VLANs while sharing the virtual-switch uplink.

Correct Answer: E

 

Correct Answer

Answer E is correct because the virtual switch can classify guest ports into distinct VLANs and tag traffic as it traverses the shared uplink.

Incorrect Answers

Answer A is incorrect because port groups or equivalent virtual-port policies can carry different VLAN assignments on the same switching instance.

Answer B is incorrect because logical tagging does not create additional physical adapters.

Answer C is incorrect because a shared uplink can carry multiple tagged VLANs according to the configured trunking design.

Answer D is incorrect because network segmentation does not dictate compute placement. It does not satisfy the stem’s governing point: Virtual switching can provide VLAN segmentation independently of shared compute and uplink hardware.

 

Question 14

A VM is connected to a virtual switch port that has been administratively disconnected. The guest operating system still shows its virtual NIC device. Which outcome is most likely?

1. The guest retains the virtual NIC object but cannot use that disconnected virtual port to exchange network traffic.
2. The physical access switch automatically moves the VM to another host.
3. The guest can reach the network through the port because an IP address overrides the disconnect.
4. The guest must lose all virtual CPU resources because the port is disconnected.
5. The virtual NIC becomes a physical NIC until the port reconnects.

Correct Answer: A

 

Correct Answer

Answer A is correct because device presentation to the guest and connection state of its virtual switch port are separate conditions.

Incorrect Answers

Answer B is incorrect because external switching does not perform VM migration. It does not satisfy the stem’s governing point: Differentiate guest device presence from actual virtual-switch connectivity.

Answer C is incorrect because an IP configuration cannot transmit through an administratively disconnected virtual link.

Answer D is incorrect because network-port state does not determine compute allocation. It does not satisfy the stem’s governing point: Differentiate guest device presence from actual virtual-switch connectivity.

Answer E is incorrect because disconnection does not change the interface from virtual to physical.

 

Question 15

Two VMs are attached to the same virtual Layer 2 segment but use different IP subnets. No virtual router, external router, or Layer 3 switch interface exists for those subnets. Which conclusion is correct?

1. The VMs require VXLAN because two IP subnets cannot share one Layer 2 segment.
2. The virtual switch can bridge frames, but it does not by itself provide inter-subnet routing.
3. The VMs communicate because any shared VLAN implies a default gateway.
4. The virtual switch automatically routes because it knows both VM MAC addresses.
5. The hypervisor converts one subnet to the other with NAT by default.

Correct Answer: B

 

Correct Answer

Answer B is correct because Layer 2 switching and Layer 3 forwarding are separate functions; a routed gateway is needed for communication between the IP subnets.

Incorrect Answers

Answer A is incorrect because VXLAN is not required merely because endpoints have different IP subnets; the missing function is routing.

Answer C is incorrect because a VLAN does not create a Layer 3 gateway unless one is explicitly provided.

Answer D is incorrect because MAC learning supports Layer 2 forwarding and does not create an IP routing function.

Answer E is incorrect because no NAT behavior is established in the scenario.

 

Question 16

A LISP design assigns endpoint identity 10.20.30.40/32 while the xTR that currently serves the endpoint is reachable in the routed underlay at 192.0.2.10. Which mapping is represented?

1. Both addresses are VNIs because LISP uses numeric tunnel identifiers.
2. 192.0.2.10 is the EID because it appears in the underlay routing table.
3. 10.20.30.40 is the EID and 192.0.2.10 is an RLOC.
4. 10.20.30.40 must be the physical server management address.
5. The two addresses are required to be in the same IP prefix.

Correct Answer: C

 

Correct Answer

Answer C is correct because LISP separates endpoint identifiers from routing locators that identify where an endpoint is attached to the routing infrastructure.

Incorrect Answers

Answer A is incorrect because VNI is a VXLAN construct, not the EID/RLOC distinction described.

Answer B is incorrect because underlay routability is characteristic of the locator role rather than endpoint identity.

Answer D is incorrect because an EID represents endpoint identity and need not be a host-management address.

Answer E is incorrect because the purpose of the mapping is to separate identity from location; they do not need to share a subnet.

 

Question 17

An ingress LISP router needs to send traffic to an EID it has not previously contacted. Which TWO functions are conceptually distinct? Choose TWO.

1. Resolving which RLOC is associated with the destination EID.
2. Forwarding the encapsulated packet toward the selected RLOC across the underlay.
3. Using the map system as the permanent data-plane transit path for every packet.
4. Replacing all underlay routes with endpoint routes.
5. Changing the destination EID into a VLAN ID.

Correct Answers: A, B

 

Correct Answers

Answer A is correct because the mapping system supplies identity-to-location information used to choose a tunnel endpoint.

Answer B is correct because after resolution, ordinary underlay forwarding delivers the encapsulated packet to the locator.

Incorrect Answers

Answer C is incorrect because mapping resolution and user-packet forwarding are separate roles; data packets do not need to traverse the mapping system.

Answer D is incorrect because LISP relies on locator reachability in the underlay rather than requiring the underlay to carry every endpoint prefix.

Answer E is incorrect because LISP mapping does not turn an endpoint IP identity into a VLAN identifier.

 

Question 18

An ITR has no cached mapping for destination EID 10.44.8.8. Its underlay routing table can reach the mapping infrastructure and candidate locators. What should happen before the ITR can choose the appropriate LISP tunnel destination?

1. The ITR creates a BGP session with the endpoint.
2. The ITR assigns the destination a new VNI.
3. The ITR changes the EID to the underlay default gateway address.
4. The ITR obtains or resolves the EID-to-RLOC mapping.
5. The ITR elects an STP root for the EID subnet.

Correct Answer: D

 

Correct Answer

Answer D is correct because the mapping tells the ingress device which locator can receive traffic for the destination endpoint identity.

Incorrect Answers

Answer A is incorrect because the endpoint does not need to be a BGP peer for the ITR to learn its mapping.

Answer B is incorrect because VXLAN VNI assignment is not the LISP map-resolution step.

Answer C is incorrect because identity is retained while the packet is encapsulated toward a locator.

Answer E is incorrect because spanning-tree root election is unrelated to LISP map resolution.

 

Question 19

A packet sourced from an EID reaches the LISP ingress tunnel router. The destination EID has a valid mapping to remote RLOC 198.51.100.7. Which action is expected on the LISP data path?

1. Encrypt the payload automatically because LISP encapsulation is encryption.
2. Send the user packet through the mapping server as an application proxy.
3. Rewrite the original endpoint destination to the RLOC permanently.
4. Encapsulate the original packet with an outer header addressed toward the remote RLOC.
5. Convert the packet to an Ethernet broadcast on every underlay interface.

Correct Answer: D

 

Correct Answer

Answer D is correct because the ingress tunnel router uses the locator as the outer destination so the underlay can carry the packet while preserving the endpoint packet inside.

Incorrect Answers

Answer A is incorrect because encapsulation and encryption are distinct; LISP by itself should not be treated as an encryption guarantee.

Answer B is incorrect because the mapping system supports resolution and is not normally the user-data transit path.

Answer C is incorrect because encapsulation adds locator addressing outside the original packet rather than replacing endpoint identity for the receiving endpoint.

Answer E is incorrect because LISP uses routed locator reachability rather than flooding all underlay links.

 

Question 20

An endpoint moves from a site served by RLOC 192.0.2.20 to a site served by RLOC 198.51.100.20. The design keeps the endpoint EID unchanged and updates the mapping system. Which THREE statements are consistent with the LISP model? Choose THREE.

1. The old RLOC becomes the endpoint MAC address after the move.
2. The mapping system must carry every application packet to maintain mobility.
3. The endpoint EID must be renumbered to match the new RLOC subnet.
4. Ingress devices need current mapping information to select the new locator.
5. The routed underlay must be able to reach the new RLOC.
6. The endpoint can retain its identity while its locator mapping changes.

Correct Answers: D, E, F

 

Correct Answers

Answer D is correct because stale mappings could continue sending encapsulated traffic to the previous attachment point.

Answer E is correct because the outer packet still depends on ordinary locator reachability after the mapping points to the new site.

Answer F is correct because identity/location separation is specifically useful when attachment changes without renumbering the endpoint identity.

Incorrect Answers

Answer A is incorrect because an IP locator is not transformed into the endpoint Layer 2 identifier.

Answer B is incorrect because the data path can use encapsulation directly between xTRs after mapping resolution.

Answer C is incorrect because the model separates these namespaces, so a move does not inherently require EID renumbering.

 

Question 21

A VXLAN frame arrives at a device that removes the VXLAN/UDP/IP outer headers and forwards the original Ethernet frame into the local segment. Which device role is performing that function?

1. An NTP stratum server.
2. A LISP map resolver only.
3. A VRF route distinguisher.
4. An STP root bridge by definition.
5. A VXLAN tunnel endpoint (VTEP).

Correct Answer: E

 

Correct Answer

Answer E is correct because a VTEP encapsulates local frames into VXLAN and decapsulates received VXLAN traffic for local delivery.

Incorrect Answers

Answer A is incorrect because time synchronization does not terminate VXLAN encapsulation. It does not satisfy the stem’s governing point: Identify the VTEP as the VXLAN encapsulation/decapsulation edge.

Answer B is incorrect because mapping services are conceptually different from VXLAN encapsulation and decapsulation.

Answer C is incorrect because a route distinguisher is not a packet-processing device.

Answer D is incorrect because spanning-tree role does not define VXLAN tunnel termination.

 

Question 22

Two tenant segments both use VLAN 30 in different parts of a data center. VXLAN assigns one tenant VNI 50030 and the other VNI 60030. Which statement is correct?

1. Using different VNIs forces the tenants onto separate physical switches.
2. The VNI must always equal the local VLAN ID, so one tenant configuration is invalid.
3. The VNI is an encryption key for the VXLAN payload.
4. The VNI is the underlay OSPF area number.
5. The VNI identifies the VXLAN overlay segment and can distinguish tenant contexts independently of the local VLAN number.

Correct Answer: E

 

Correct Answer

Answer E is correct because the VXLAN Network Identifier provides overlay segmentation beyond the locally significant VLAN identifier.

Incorrect Answers

Answer A is incorrect because logical overlay segmentation can coexist on shared physical infrastructure.

Answer B is incorrect because VXLAN does not require numerical equality between a VNI and a local VLAN.

Answer C is incorrect because the identifier labels an overlay segment; it is not a cryptographic key.

Answer D is incorrect because overlay segment identity and underlay routing areas are separate constructs.

 

Question 23

Two Ethernet endpoints must remain in the same Layer 2 segment while their VTEPs are connected only by a routed IP fabric. Which TWO properties make VXLAN relevant? Choose TWO.

1. The original Ethernet frame can be carried inside a UDP/IP overlay packet across the routed underlay.
2. The VXLAN header replaces the need for any underlay IP reachability.
3. The remote VTEP can decapsulate the frame back into the intended overlay segment.
4. The underlay must run spanning tree end to end between both endpoints.
5. VXLAN automatically encrypts the frame against every underlay observer.

Correct Answers: A, C

 

Correct Answers

Answer A is correct because VXLAN encapsulates Layer 2 frames for transport through an IP network.

Answer C is correct because the receiving tunnel endpoint restores local Layer 2 delivery according to the VNI.

Incorrect Answers

Answer B is incorrect because the outer packet still requires IP routing between VTEPs.

Answer D is incorrect because the routed underlay can transport the overlay without extending the endpoint VLAN through every physical hop.

Answer E is incorrect because standard VXLAN encapsulation is not itself an encryption guarantee.

 

Question 24

A 1500-byte inner Ethernet/IP payload already fills the physical path MTU. The design adds VXLAN encapsulation but leaves the underlay MTU unchanged. Which risk should the engineer evaluate?

1. The underlay routing table is bypassed for oversized packets.
2. The encapsulation guarantees fragmentation is impossible on every platform.
3. The VNI becomes invalid whenever the packet is 1500 bytes.
4. VXLAN removes the inner Ethernet header and always produces a smaller packet.
5. The extra outer headers can make the encapsulated packet exceed the underlay MTU.

Correct Answer: E

 

Correct Answer

Answer E is correct because encapsulation adds bytes, so a path sized only for the original packet may require a larger MTU or smaller inner payload.

Incorrect Answers

Answer A is incorrect because size does not change the requirement for outer IP routing.

Answer B is incorrect because fragmentation and MTU behavior depend on the network; the design should not assume away the added overhead.

Answer C is incorrect because VNI validity is unrelated to the size of a specific payload.

Answer D is incorrect because VXLAN carries the inner frame and adds outer headers rather than shrinking it.

 

Question 25

A compliance review notes that two tenants are separated by different VXLAN VNIs. The reviewer asks whether that fact alone protects the payload from someone who can capture packets on an underlay link. Which conclusion is correct?

1. A different VNI automatically creates an IPsec tunnel between VTEPs.
2. Tenant segmentation is impossible unless every endpoint uses a different physical cable.
3. The 24-bit VNI is a cryptographic key, so payload confidentiality is guaranteed.
4. The underlay cannot see any outer headers because VXLAN removes them before transmission.
5. Different VNIs provide segmentation context but do not by themselves encrypt the VXLAN payload.

Correct Answer: E

 

Correct Answer

Answer E is correct because overlay separation controls membership and forwarding; confidentiality requires an appropriate security mechanism beyond plain VXLAN encapsulation.

Incorrect Answers

Answer A is incorrect because no automatic IPsec behavior is established by VXLAN segmentation alone.

Answer B is incorrect because logical overlays are specifically designed to segment shared infrastructure.

Answer C is incorrect because an identifier is not an encryption key. It does not satisfy the stem’s governing point: Do not infer encryption from overlay segmentation.

Answer D is incorrect because the underlay forwards the outer IP/UDP/VXLAN packet. It does not satisfy the stem’s governing point: Do not infer encryption from overlay segmentation.