Cisco Certified Network Associate (CCNA) 200-301 Practice Test 66
Question 650
An SDN controller shows an approved ACL policy for a switch group, but one group was omitted from deployment and retained older forwarding rules. Which check best confirms the discrepancy has been repaired?
- Confirm controller deployment status for every targeted device and inspect each affected device's installed ACL/forwarding policy against the approved intent.
- Open the controller's policy design screen and assume a saved policy must already be running everywhere.
- Check only that the controller management IP answers ICMP echo from an administrator's laptop.
- Disconnect the controller temporarily and infer that all past policy pushes succeeded if other switches still forward traffic.
Explanation
Correct Answer
A:Intent stored centrally is not proof that each intended switch received or installed it. Correlating per-device push success with the actual programmed ACL state catches omissions and deployment failures; traffic tests on representative relevant flows can add end-to-end confirmation.
Incorrect Answers
B:A saved intent object describes desired policy, not confirmed device application. The original fault explicitly occurred after a missed deployment to a device group.
C:Management-plane reachability to the controller does not reveal whether a particular switch group successfully installed a matching ACL. The failing control is configuration distribution.
D:Many devices forward existing traffic when their controller is unavailable, which says little about whether their ACL configuration was updated before the outage. Forwarding independence is not deployment verification.
Question 651
Two virtual-network endpoints use an IP overlay tunnel between leaf switches. The inner tenant packets are correctly tagged for virtual segment 5001, but the outer tunnel destination 192.0.2.44 has no IP route in the underlay. Which prerequisite must be restored before the overlay can carry traffic?
- Change every inner tenant IP address to 192.0.2.44 so the underlay no longer needs a route.
- Use a DNS AAAA record for the tunnel endpoint even though the outer destination is IPv4.
- Provide underlay IP reachability to 192.0.2.44 so encapsulated packets can reach the remote tunnel endpoint.
- Enable a new wireless SSID with the same numeric value as the overlay segment ID.
Explanation
Correct Answer
C:An overlay constructs a logical forwarding network by encapsulating tenant traffic inside outer packets addressed to tunnel endpoints. Those outer packets still depend on a functioning routed or otherwise reachable underlay. If the sending leaf has no route to 192.0.2.44, the encapsulated traffic cannot arrive at the remote leaf regardless of the inner segment identifier. Verify the underlay route, next-hop resolution and reachability to that outer destination before investigating the tenant virtual network. After restoring the underlay, check the overlay tunnel identifiers and inner packet mappings separately. An overlay cannot bypass a missing physical or Layer 3 path merely because it is virtual.
Incorrect Answers
A:Tenant addresses belong to the logical overlay and are not intended to replace the underlay transport destination. Reassigning every tenant to one tunnel endpoint IPv4 address would destroy addressing and isolation rather than create underlay reachability. Restore a route for the outer endpoint while leaving inner tenant addresses intact.
B:A DNS AAAA record resolves a hostname to an IPv6 address; the missing route concerns the literal IPv4 outer endpoint 192.0.2.44. No name resolution is necessary for the router to see that destination lacks an underlay path. Correct routing or connected reachability, not an unrelated DNS record.
D:A wireless SSID identifies a WLAN to wireless clients; the overlay segment ID represents a logical virtualization context. Giving an SSID the same number as the segment identifier does not create an IP route to the remote tunnel endpoint. The underlay and overlay layers require distinct operational validation.
Question 652
A campus fabric transports two isolated tenant segments over the same routed IP core. The underlay provides reachability between edge tunnel endpoints, while the tenants require separate logical segments. Which design supplies that tenant separation?
- Use only a default route in the underlay and place both tenants into the same undifferentiated Layer 2 broadcast domain.
- Encapsulate tenant frames in an overlay with distinct virtual segment identifiers between reachable tunnel endpoints.
- Assign every tenant the same overlay identifier and rely on different DNS hostnames for isolation.
- Replace all virtual network encapsulation with an SNMP monitoring community name.
Explanation
Correct Answer
B:An overlay represents logical connectivity independent of the physical routing topology. The underlay moves outer IP packets between tunnel endpoints; a segment identifier such as a VNI identifies the intended virtual network and prevents unrelated tenants sharing one broadcast domain.
Incorrect Answers
A:Routing reachability of tunnel endpoints does not by itself distinguish tenant logical segments.
C:DNS labels do not enforce tunnel segment separation when the encapsulation identifier is shared.
D:SNMP is a management protocol; it does not carry an isolated data-plane overlay.
Question 653
An application wants to ask a centralized SDN controller for a new site segmentation intent using a supported HTTPS API. The controller subsequently translates approved intent into device-level configuration over its southbound interfaces. Which interface should the application call?
- A VXLAN encapsulation header on each data packet in the fabric.
- The southbound switch-programming protocol that the controller itself uses to reach managed devices.
- Only the IP underlay route table on every individual switch.
- The controller's documented northbound API exposed to applications and orchestration systems.
Explanation
Correct Answer
D:A northbound API provides the supported interface from applications or orchestrators into the controller, often over authenticated HTTPS with a documented data model and authorization scope. The application can submit desired segmentation policy and review acceptance or job status without programming each switch directly. The controller then maps accepted intent to southbound device protocols and configurations, subject to validation and synchronization. Test that the API call is authorized, that the controller reports an appropriate result, and that the resulting device state matches the intended policy. The distinction is directional: application-to-controller is northbound; controller-to-device is southbound. Neither interface alone guarantees end-to-end forwarding unless the underlying network is reachable.
Incorrect Answers
A:VXLAN encapsulates traffic for an overlay data plane; it does not, by itself, expose a controller application interface for submitting business intent. An application may request an overlay policy from a controller, but the VXLAN packet header carries data-plane identifiers rather than API requests to the controller. Choosing it confuses a forwarding mechanism with the management/control integration boundary.
B:Southbound interfaces are used by controllers to communicate with managed network elements, collect state or apply device-level configurations. Directly calling them from an intent application bypasses the abstraction in the scenario and may not be supported or authorized. The application should express desired site policy through the controller's northbound contract, leaving device-specific translation to the controller.
C:Underlay routing is necessary to deliver management or tunnel traffic between components, but it does not replace an application API. Reaching device loopbacks alone neither expresses segmentation intent nor guarantees the controller can validate and deploy the policy. A site application should not have to issue unique low-level routes on every switch when a supported intent controller API is available.
Question 654
A controller accepts an operator’s intended ACL policy and must install corresponding rules on managed switches. The application already talks to the controller using its northbound REST API. Which next interface serves the device-programming task?
- Send a user-facing incident-summary report to the northbound application and assume switch ACLs change automatically without southbound communication.
- Use the controller’s supported southbound device-facing interface or API to translate the policy into device configuration, then verify installation.
- Update the overlay VNI while leaving all ACL configuration untouched on the switches.
- Only test that the underlay loopback routes are reachable and ignore whether any security policy exists on devices.
Explanation
Correct Answer
B:Northbound APIs let applications express intent to the controller. Southbound interfaces reach managed network elements and enact device rules. Whether the concrete transport is NETCONF, RESTCONF, CLI, or vendor-specific depends on the platform; successful intent submission alone is not proof of installed switch policy.
Incorrect Answers
A:Reporting an intent and applying the resulting rules to devices are separate steps.
C:Overlay segment identity is not a substitute for applying the requested security access rules.
D:IP reachability enables controller/device communication but does not establish rule deployment.
Question 655
A campus overlay tunnel to remote VTEP 203.0.113.18 stays down. The local switch has a valid tunnel source IP, but its underlay routing table has no route to 203.0.113.18 and an underlay-only ping to the endpoint fails. The remote VTEP and overlay segment identifiers are confirmed correct. Which fault should be isolated first?
- The application used a northbound API instead of the controller's southbound device interface.
- Both VTEPs can reach each other but use different virtual-network identifiers.
- The controller intent was not pushed even though the underlay IP path is confirmed up.
- The routed underlay cannot deliver IP packets to the remote tunnel endpoint, so overlay encapsulated traffic has no working transport path.
Explanation
Correct Answer
D:An overlay depends on an underlying routed IP network to carry its encapsulated packets between tunnel endpoints. Without a route to remote VTEP 203.0.113.18, the local device cannot forward the outer IP packet, and a failed underlay-only ping corroborates that dependency. Restore the underlay next hop and bidirectional IP connectivity, then separately test overlay tunnel state and tenant forwarding. This fault isolation tests transport dependency; the related verification item asks which underlay observations establish recovery.
Incorrect Answers
A:Northbound and southbound API roles matter in a controller-based architecture, but no API call or intent-programming error is documented. The question gives a direct routing-table deficiency and failed underlay-only ping to the known remote endpoint. That transport failure can stop overlay packets before any upper-layer API question becomes relevant. Diagnose IP forwarding and next-hop reachability first; examine controller integrations later if the tunnel still fails after the underlay path is operational.
B:A segment-identifier or VNID mismatch can cause traffic to land in the wrong logical network even when the outer tunnel endpoints communicate. Here the tunnel endpoint itself is unreachable by ordinary underlay IP routing and ping, while the IDs have been verified. There is no valid transport on which a segment mismatch could manifest as described. Correct the missing underlay path and confirm tunnel endpoint reachability before examining overlay network membership or encapsulated-packet classification.
C:An absent controller policy might explain a tunnel that is not created on a device, but the scenario confirms the local source and remote endpoint identifiers. More importantly, a direct underlay route lookup and ping fail, which is sufficient to explain why transport cannot reach the far VTEP. A controller replay cannot compensate for a missing IP path. Check the local RIB, next-hop resolution, adjacent links, and remote endpoint routing before attributing the outage to uninstalled intent.
Question 656
Two overlay endpoints can ping each other across the IP underlay. A packet capture shows tenant-A traffic leaving VTEP1 with VNI 10020, while tenant-A is configured as VNI 10010 at VTEP2. Which finding best explains the misplaced traffic?
- The only failure must be absence of an outer IP route between VTEPs.
- The overlay uses mismatched tenant virtual segment identifiers across endpoints despite reachable outer IP tunnel destinations.
- A northbound API call was sent with an incorrect HTTP authentication header, so the packet’s captured VNI is irrelevant.
- OSPF elected a DR on the point-to-point underlay, forcing all tenants into the same VNI.
Explanation
Correct Answer
B:The IP underlay is functional because the tunnel endpoints reach each other. VXLAN-style tenant mapping requires consistent virtual network identifiers on both ends. A mismatched VNI can isolate or misclassify inner tenant frames even when the encapsulated outer packet is routable.
Incorrect Answers
A:The successful reachability test rules out that explanation for the stated symptom.
C:No API error is observed; the wire capture directly shows an incorrect segment ID.
D:OSPF election behavior does not rewrite overlay tenant identifiers into the wrong segment.
Question 657
An orchestration application must submit an intent request to a network controller. Instead it sends a JSON REST POST to a device-facing southbound protocol endpoint and receives a 405 Method Not Allowed. What is the primary integration error?
- The application targeted the southbound device-programming interface rather than the documented northbound application API/method for intent submission.
- The overlay VNI must be incorrect because every REST 405 response indicates an Ethernet encapsulation mismatch.
- The controller accepted the northbound intent and all device rules were confirmed installed before responding 405.
- An OSPF router refused to establish adjacency because its dead timer changed, causing the HTTP application to use the southbound endpoint.
Explanation
Correct Answer
A:Northbound APIs expose controller functions to applications. Southbound interfaces are for the controller’s interaction with its managed devices and may implement different protocols and allowed methods. A 405 response means the selected method is unsupported for that resource, not that the network forwarding plane failed.
Incorrect Answers
B:HTTP method handling belongs to the API endpoint, not tunnel segmentation.
C:That contradicts the failed request to the wrong endpoint.
D:Routing neighbor behavior does not determine which controller API the caller selected.
Question 658
A controller responds 202 Accepted to a valid access-policy intent. A subsequent device readback finds no new ACL entries, and controller logs show its device-facing southbound session failed authentication. Which diagnosis fits both observations?
- The northbound application sent an invalid JSON payload, so the controller could not accept the request at all.
- The policy request was accepted by the controller but never installed on the switches because southbound device authentication failed.
- An overlay VNI mismatch is the only possible cause of the missing physical ACL entries.
- All access policy was installed, because any HTTP 202 response guarantees successful execution on every network device.
Explanation
Correct Answer
B:An API acceptance code can confirm queuing or intent receipt, not successful device programming. Verify the southbound session and observed switch configuration before reporting network policy active. The failure lies between controller intent processing and device application.
Incorrect Answers
A:The controller did accept the intent; the observed failure is downstream.
C:VNI mapping concerns logical segment forwarding, not failed southbound authentication to install rules.
D:202 Accepted does not guarantee later asynchronous completion or proof of device state.
Question 659
The missing underlay route to remote VTEP 203.0.113.18 has been restored. Before reopening tenant traffic, the change manager wants evidence that the routed transport required by the overlay is usable. Which test directly proves the underlay prerequisite?
- A controller dashboard shows the last desired overlay configuration was submitted successfully.
- An anomaly-detection model's incident classification has been acknowledged by an operator.
- The underlay routing table has a valid resolved next hop toward 203.0.113.18 and an underlay-sourced reachability test to that endpoint succeeds.
- Terraform plan reports zero changes to a different cloud virtual network.
Explanation
Correct Answer
C:A valid underlay route toward 203.0.113.18 must resolve through an operational next hop and outgoing interface. A directed test using the appropriate underlay source then confirms that packets can reach the remote endpoint and return. Together those observations establish the basic transport dependency for encapsulated overlay traffic. This is distinct from identifying the original missing-route fault: the acceptance test requires fresh route and reachability evidence after the correction, before overlay tenant forwarding is validated.
Incorrect Answers
A:A controller submission may indicate that intended overlay configuration was accepted or queued, but it does not prove that the underlying IP forwarding path to a tunnel endpoint exists. The original failure was a missing route and failed underlay-only ping. An intent acknowledgement could succeed even when physical routing remains broken. The acceptance test must inspect the current underlay RIB and actual endpoint connectivity, then evaluate overlay traffic in a subsequent stage.
B:Acknowledging an operational alert changes an incident-management state; it does not repair or validate packet forwarding. An ML or monitoring classifier could correctly identify a fault or produce a false positive, but neither outcome proves that the local switch can reach the remote VTEP. The deployment needs a route with an actual resolved next hop and successful transport traffic. Keep anomaly alerts as supporting telemetry rather than using their acknowledgement as a network connectivity test.
D:Terraform infrastructure state can help compare declared and actual resources, but a no-change result for another cloud network says nothing about the on-premises routed path to this VTEP. The route could still be missing even when a cloud plan is clean. The exact failing transport endpoint and its forwarding-table next hop must be tested from the affected device. Only after underlay connectivity is demonstrated should the team inspect overlay configuration, VNIDs and application-level behavior.
Question 660
Following a tenant overlay repair, two edge endpoints remain reachable at the IP layer and both are configured for tenant 20. Before the repair VTEP1 sent VNI 10020 but VTEP2 expected 10010. Which observation proves that this tenant-mapping fault is corrected?
- Both endpoints associate tenant 20 with the same approved VNI, and captures of actual tenant frames show that VNI across the reachable tunnel while cross-tenant isolation holds.
- Ping the two outer tunnel endpoint addresses only, without examining inner tenant frames or the VNI.
- Read a controller northbound API version number without observing device tunnel state.
- Confirm that a separate OSPF adjacency is FULL while VTEP2 still maps tenant 20 to the wrong VNI.
Explanation
Correct Answer
A:Underlay reachability alone was already healthy. The acceptance evidence must include matching VNI mapping and actual encapsulated tenant frames in the correct logical segment; checking that unrelated tenants remain isolated rules out an accidental shared overlay.
Incorrect Answers
B:That test succeeded before the repair and cannot establish corrected logical segmentation.
C:An API version does not prove the VNI applied on either VTEP.
D:Routing is orthogonal to the stated overlay identifier mismatch.