100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 740
A controller-based campus automation workflow stages a security policy for 30 switches. Before changing live forwarding, engineers must compare the desired controller intent with existing device state and review the proposed change. Which control most directly reduces unintended drift?
- Deploy the desired policy without examining the current state or the changed scope
- Validate the controller’s proposed policy differences and approved deployment scope before the push
- Send the policy as a broadcast Ethernet frame to every host instead of device management
- Disable device configuration backups so differences cannot be detected after deployment
Explanation
Correct Answer
B:Comparing intended with actual state and approving the scope provides a guard against unintended policy propagation and configuration drift.
Incorrect Answers
A:Blind deployment ignores conflicts and scope errors, increasing the chance of an inconsistent or overly broad policy change.
C:A user-plane Ethernet broadcast does not reliably configure controller-managed switch policies or validate privilege boundaries.
D:Removing saved configurations undermines rollback and postchange comparison rather than providing a change-control safeguard.
Question 741
In a Cisco software-defined network, the fabric overlay uses VXLAN for tenant segments, but an engineer first needs to repair IP reachability between physical leaf and spine addresses. Which portion of the fabric carries that physical routed transport?
- The tenant VXLAN VNI overlay
- The application-facing northbound REST API
- A controller policy tag for client access
- The underlay network
Explanation
Correct Answer
D:The underlay is the real transport network, usually routed IP links, that delivers packets among fabric devices. Overlay encapsulations ride over that underlay, so they rely on functioning underlay reachability.
Incorrect Answers
A:A VNI identifies a logical virtual segment transported across the physical routed network; it does not itself provide the transport underlay IP paths.
B:A northbound API allows external intent requests but does not supply packet transport between physical fabric nodes.
C:Policy tags govern logical access attributes but do not replace IP reachability between physical fabric routers.
Question 742
Tenant A and tenant B share the same physical routed leaf-spine underlay while keeping distinct virtual segments identified by overlay identifiers. Which network layer provides these logical segments above the physical transport?
- The overlay network
- The underlay network alone, without any virtualization header
- The northbound controller API
- A serial console link to each switch
Explanation
Correct Answer
A:An overlay creates logical connectivity between endpoints using encapsulation and mappings above the physical routed underlay. Its virtual network properties can differ from the underlying link topology.
Incorrect Answers
B:An underlay only supplies physical IP reachability; it cannot by itself identify two tenant logical segments using an overlay identifier.
C:An API is a management/application interaction interface, not the data-plane virtual segment carrying tenant frames.
D:Console access is a management path and does not implement the required virtual tenant forwarding layer.
Question 743
A campus SDA deployment joins many edge and border devices into one centrally managed, policy-enforcing network that supports onboarding new wired and wireless attachments. What term describes the combined automated connectivity matrix?
- A single Layer 2 access VLAN on one floor
- One northbound REST API endpoint
- A physical Ethernet patch cord between two hosts
- The fabric
Explanation
Correct Answer
D:A network fabric is the integrated set of forwarding devices and control-managed paths/policies that provides consistent connectivity and segmentation across attached endpoints.
Incorrect Answers
A:One access VLAN is only a broadcast-domain subdivision and does not describe the broader managed multi-node policy matrix.
B:An API endpoint exposes operations to applications but is not the full topology of switching nodes and forwarding links.
C:A single cable is an individual connection, not an orchestrated switching fabric spanning many devices.
Question 744
A controller has accepted a network policy and must translate that intent into configuration or forwarding updates on managed switches. Which controller-to-device interface direction is involved?
- Northbound API calls from a management application into the controller
- A DNS query from an endpoint for a user-facing application
- Use a southbound API or control interface
- An end-user data-plane TCP flow across the switches
Explanation
Correct Answer
C:Southbound interfaces are used by a controller to communicate with and program managed network infrastructure; northbound interfaces face applications expressing intent.
Incorrect Answers
A:Northbound APIs express requests to the controller; delivery of resulting instructions to managed devices is the downstream/southbound role.
B:DNS hostname resolution is an application service and does not configure the network devices on the controller’s behalf.
D:User data packets traverse forwarding state and are not the controller programming channel for managed infrastructure.
Question 745
An external inventory application wants to request campus device health and policy state from Cisco Catalyst Center through its documented REST interface. Which direction describes that application-to-controller API?
- Use a northbound API
- A southbound controller-to-device configuration interface
- An Ethernet underlay transport link between two leaf switches
- An overlay VNI identifier inside a VXLAN header
Explanation
Correct Answer
A:Northbound or Intent APIs expose controller capabilities to external software through documented REST methods, separate from southbound device programming and packet transport.
Incorrect Answers
B:Southbound channels manage the devices below the controller, not expose the higher-level API to an external management application.
C:The physical transport carries packets in the fabric, but it is not the application-facing intent API.
D:A VNI denotes a virtual segment in encapsulated data traffic, not the interface by which the application requests controller information.
Question 746
An SDN system determines which path and policy should be used for client traffic, while ASICs ultimately forward data frames. Which logical plane is responsible for the route and policy decision?
- Select data plane because hardware ASICs decide OSPF policy across the fabric
- Select management plane because alarms generate route calculations
- Use the control plane
- Select an application northbound REST API as if it directly forwards each packet
Explanation
Correct Answer
C:The control plane creates or selects forwarding information and policy.
Incorrect Answers
A:Data plane executes programmed forwarding decisions; control logic establishes route/policy decisions.
B:Management telemetry and configuration operations are distinct from the control plane’s routing decisions.
D:An API expresses or retrieves controller intent and is not the logical routing/policy decision plane itself.
Question 747
An SDN switch has been programmed with a rule matching a tenant VLAN and destination MAC. A packet arrives and hardware forwards it out the matched port without consulting the central controller for that packet. Which plane performs this packet-level operation?
- The northbound application API, which submits administrative network intent
- The southbound controller interface used to install device tables
- The device-local data plane using the programmed forwarding entries
- The controller management dashboard, which renders performance statistics
Explanation
Correct Answer
C:The switch data plane performs the packet lookup and forwards according to installed local state while control traffic remains separate.
Incorrect Answers
A:Northbound APIs enable applications to request policy; they are not the switch hardware path for each user Ethernet frame.
B:The southbound interface carries controller programming and operational exchanges but does not itself switch every tenant data packet.
D:A management GUI displays network state, but rendering a dashboard is not forwarding the user packet through a physical port.
Question 748
An NOC uses telemetry, configuration inventory, alarms and software images to administer the network; these tasks do not forward customer packets. Which logical plane hosts these management operations?
- Select the data plane because it maintains a forwarding table
- Use the management plane
- Select the control plane because it computes best routes
- Select the physical layer because it transmits bits over cables
Explanation
Correct Answer
B:Management functions configure, observe and maintain the network.
Incorrect Answers
A:The data plane forwards packets; telemetry, alarms, inventory and image administration belong to management functions.
C:The control plane handles topology/routing decisions, not the full operational telemetry and software-image administration suite.
D:Physical transport is neither the NOC inventory nor the management software platform.
Question 749
A network architect separates tenant packet transport from the control connection between a central controller and managed switches. Which traffic should be carried on the authenticated southbound control channel rather than the tenant data plane?
- Bulk user application packets headed to a remote host
- Controller policy and configuration updates destined for the managed switches
- A tenant IPv4 broadcast flooded inside a user VLAN
- A server TCP response delivered over an existing tenant forwarding route
Explanation
Correct Answer
B:Southbound communication carries the controller’s device-facing programming and operational messages. Using a protected, authenticated channel keeps those messages separate from tenant payload forwarding.
Incorrect Answers
A:Application packets belong to the user data plane; they should not be mistaken for messages that configure forwarding policies on managed devices.
C:A VLAN broadcast is a data-plane frame within that tenant network. It is not a controller configuration message even when the fabric was controller-provisioned.
D:An ordinary server response follows the data-plane route installed on the switches, not the controller’s southbound configuration link.
Question 750
A fabric uses a routed IP underlay and an overlay that identifies isolated tenant segments. A controller needs to map a tenant virtual network to a network identifier used by the encapsulation, rather than change a physical link IP. Which concept identifies that overlay segment?
- An access-port PoE electrical class
- A VLAN-native untagged frame with no tenant encapsulation identifier
- A VXLAN Network Identifier (VNI) associated with the overlay virtual segment
- An interface duplex setting that chooses the Ethernet collision-domain mode
Explanation
Correct Answer
C:The VXLAN VNI names a logical overlay segment independently of the routed IP underlay used to carry the encapsulated traffic.
Incorrect Answers
A:PoE power classes control endpoint electrical delivery and do not identify an encapsulated multi-tenant overlay segment.
B:An untagged local Ethernet frame alone has no VXLAN network identifier for transport across the routed fabric.
D:Ethernet duplex controls physical MAC operation and cannot supply a tenant-wide virtual network identifier in an overlay header.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
