Pass Your Cisco 350-401 Exam Easy!

Ensuring the IP underlay routes between VTEP addresses and accommodates VXLAN encapsulation overhead would not meet the need for vXLAN encapsulation with a tenant VNI between participating VTEPs.

Building a supported GRE tunnel between reachable tunnel endpoints and routing the intended overlay payload through it would not meet the need for vXLAN encapsulation with a tenant VNI between participating VTEPs.

Resolving the host EID through the LISP mapping system to its current routing locator (RLOC) would not meet the need for vXLAN encapsulation with a tenant VNI between participating VTEPs.

This test measures a different behavior: Inspect EID-to-RLOC mappings and confirm encapsulation targets the registered RLOC. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect outer UDP/4789 encapsulation and matching VNI on both VTEPs.

This test measures a different behavior: Test VTEP IP reachability with an MTU probe before relying on tenant frame forwarding. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect outer UDP/4789 encapsulation and matching VNI on both VTEPs.

This test measures a different behavior: Inspect tunnel source/destination underlay reachability and encapsulated packet counters. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect outer UDP/4789 encapsulation and matching VNI on both VTEPs.

That diagnosis is supported by a different symptom: Packets for a moved endpoint are sent toward a stale old site location. Here the recorded observation is: tenant frames reach the remote VTEP but are delivered to another overlay segment. The applicable cause is: the VNI mapping is inconsistent with the intended tenant overlay segment.

That diagnosis is supported by a different symptom: Tunnel interface is up administratively but multicast flows cannot cross because remote GRE endpoint is unreachable. Here the recorded observation is: tenant frames reach the remote VTEP but are delivered to another overlay segment. The applicable cause is: the VNI mapping is inconsistent with the intended tenant overlay segment.

That diagnosis is supported by a different symptom: Overlay traffic fails across racks even though local hosts communicate within each VTEP. Here the recorded observation is: tenant frames reach the remote VTEP but are delivered to another overlay segment. The applicable cause is: the VNI mapping is inconsistent with the intended tenant overlay segment.

That control reduces a separate risk: The GRE outer destination lacks routable underlay reachability. For the described design, the recurring risk arises from: the VNI mapping is inconsistent with the intended tenant overlay segment. The specific required safeguard is: audit VNI mappings and remote VTEP registration during tenant moves.

That control reduces a separate risk: The underlay cannot deliver outer IP/UDP VXLAN packets to the remote VTEP. For the described design, the recurring risk arises from: the VNI mapping is inconsistent with the intended tenant overlay segment. The specific required safeguard is: audit VNI mappings and remote VTEP registration during tenant moves.

That control reduces a separate risk: The remote map-cache still references the former EID-to-RLOC association. For the described design, the recurring risk arises from: the VNI mapping is inconsistent with the intended tenant overlay segment. The specific required safeguard is: audit VNI mappings and remote VTEP registration during tenant moves.

Using VXLAN encapsulation with a tenant VNI between participating VTEPs would not ensure the IP underlay routes between VTEP addresses and accommodates VXLAN encapsulation overhead.

Assigning supported map-server/map-resolver roles to the intended LISP control-plane system would not ensure the IP underlay routes between VTEP addresses and accommodates VXLAN encapsulation overhead.

Adjusting tunnel MTU and TCP MSS as supported, or provide an underlay MTU sufficient for encapsulation overhead would not ensure the IP underlay routes between VTEP addresses and accommodates VXLAN encapsulation overhead.

This test measures a different behavior: Inspect outer UDP/4789 encapsulation and matching VNI on both VTEPs. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test VTEP IP reachability with an MTU probe before relying on tenant frame forwarding.

This test measures a different behavior: Compare fragmentation-needed symptoms and large-packet PMTU tests through the tunnel. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test VTEP IP reachability with an MTU probe before relying on tenant frame forwarding.

This test measures a different behavior: Confirm ETR map registrations and ITR map requests are answered for a representative EID prefix. It does not establish the target outcome. For the documented fault, the direct acceptance test is: test VTEP IP reachability with an MTU probe before relying on tenant frame forwarding.

The needed correction is to add VLAN30 to the correct trunk allowed list on the relevant link while retaining approved existing VLANs.

Configuring the port as a static access port in the intended VLAN and disable DTP negotiation where supported would not add VLAN30 to the correct trunk allowed list on the relevant link while retaining approved existing VLANs.

Activating and verifying the VLAN in the local VLAN database after ensuring it is approved on the trunk would not add VLAN30 to the correct trunk allowed list on the relevant link while retaining approved existing VLANs.

This test measures a different behavior: Verify the operational mode remains access when a test device sends DTP frames. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check `show interfaces trunk` permits VLAN30 at both ends and test VLAN30 end-to-end.

This test measures a different behavior: Inspect DTP negotiation counters and confirm the operational mode becomes trunk while the opposite port remains dynamic auto. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check `show interfaces trunk` permits VLAN30 at both ends and test VLAN30 end-to-end.

This test measures a different behavior: Compare allowed, active and STP-forwarding VLAN sets in `show interfaces trunk` output. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check `show interfaces trunk` permits VLAN30 at both ends and test VLAN30 end-to-end.

That diagnosis is supported by a different symptom: An unauthorized switch negotiates a trunk and carries unintended tagged traffic from an endpoint port. Here the recorded observation is: vLAN10 and VLAN20 traverse the link but hosts in VLAN30 cannot reach their remote gateway. The applicable cause is: the trunk allowed VLAN filter omits VLAN30 despite the VLAN existing on both switches.

That diagnosis is supported by a different symptom: The VLAN appears in the allowed list but not in the active VLAN set. Here the recorded observation is: vLAN10 and VLAN20 traverse the link but hosts in VLAN30 cannot reach their remote gateway. The applicable cause is: the trunk allowed VLAN filter omits VLAN30 despite the VLAN existing on both switches.

That diagnosis is supported by a different symptom: The link remains an access link despite both sides being enabled for dynamic trunking. Here the recorded observation is: vLAN10 and VLAN20 traverse the link but hosts in VLAN30 cannot reach their remote gateway. The applicable cause is: the trunk allowed VLAN filter omits VLAN30 despite the VLAN existing on both switches.

That control reduces a separate risk: Dynamic trunk negotiation was left enabled on a workstation-facing interface. For the described design, the recurring risk arises from: the trunk allowed VLAN filter omits VLAN30 despite the VLAN existing on both switches. The specific required safeguard is: version-control trunk allowlists and compare both ends during VLAN additions.

That control reduces a separate risk: Both sides are passive in DTP dynamic auto; neither proposes trunking to the other. For the described design, the recurring risk arises from: the trunk allowed VLAN filter omits VLAN30 despite the VLAN existing on both switches. The specific required safeguard is: version-control trunk allowlists and compare both ends during VLAN additions.

That control reduces a separate risk: An inactive or missing VLAN in the switch VLAN database prevents forwarding on the trunk. For the described design, the recurring risk arises from: the trunk allowed VLAN filter omits VLAN30 despite the VLAN existing on both switches. The specific required safeguard is: version-control trunk allowlists and compare both ends during VLAN additions.

Configuring the port as a static access port in the intended VLAN and disable DTP negotiation where supported would not set a compatible explicit trunking mode on the intended switch-to-switch link and use correct VLAN/tagging settings.

Activating and verifying the VLAN in the local VLAN database after ensuring it is approved on the trunk would not set a compatible explicit trunking mode on the intended switch-to-switch link and use correct VLAN/tagging settings.

Setting the same authorized native VLAN on both ends of the trunk and avoid carrying unrelated user traffic untagged would not set a compatible explicit trunking mode on the intended switch-to-switch link and use correct VLAN/tagging settings.