Question bank
ACE: L1 (Cloud Engineer: Level 1)
42 ACE: L1 (Cloud Engineer: Level 1) questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Arista CloudVision Platform
13 questions in this domain
- Question 1Single Choice
What is the default screen displayed after logging into the Arista CloudVision Portal?
- ADashboardCorrect answer
- BNetwork Topology
- CDevice Inventory
- DEvents & Audit
Why this is the answer
The dashboard is the first screen after login, providing a summary of network health and events.
- Question 2Multiple Select
Which two features are part of the CloudVision Portal navigation? (Choose two.)
- ADashboard widgetsCorrect answer
- BTopology viewCorrect answer
- CSNMP
- DCLI
Why this is the answer
Dashboard widgets and Topology view are key portal components; SNMP and CLI are not navigation features.
- Question 3Interactive
Based on the code snippet, which CloudVision view displays network connections derived from LLDP?
- ATopology viewCorrect answer
- BDevices view
- CEvents view
- DProvisioning view
Why this is the answer
The Topology view visualizes LLDP/CDP neighbors; it is not the Devices or Events list.
- Question 4Single Choice
What is the purpose of a configlet in CloudVision?
- AReusable, modular configuration snippets applied to managed devices for centralized configuration management.Correct answer
- BA pre-built virtual machine image used to deploy CloudVision nodes.
- CA log file that records all configuration changes made through CloudVision.
- DA network protocol used to push configurations from CloudVision to switches.
Why this is the answer
Configlets are modular configuration fragments applied to devices for central management.
- Question 5Multiple Select
Which two steps are part of the CloudVision device onboarding lifecycle? (Choose two.)
- ADHCP-based IP address assignmentCorrect answer
- BApplying configlets to the deviceCorrect answer
- CManual CLI configuration
- DSNMP-based polling
Why this is the answer
ZTP starts with DHCP and ends with applying configlets; CLI and SNMP are not core onboarding steps.
- Question 6Interactive
Given the DHCP option, which server does the switch contact during ZTP bootstrap?
- AA file server, such as TFTP or HTTP, hosting the bootfileCorrect answer
- BA DNS server resolving the switch hostname
- CAn NTP server providing time synchronization
- DA syslog server collecting switch logs
Why this is the answer
Option 67 specifies the bootfile URL usually pointing to a script or configuration server.
- Question 7Single Choice
Which role in CloudVision can approve pending tasks?
- AAdminCorrect answer
- BNetwork-Operator
- COperator
- DObserver
Why this is the answer
Only the Admin role can approve tasks; Operator and Network-Operator cannot.
- Question 8Multiple Select
Which two statements about CloudVision dashboard widgets are true? (Choose two.)
- AWidgets can be customized and rearranged to fit the operator's preferences.Correct answer
- BWidgets show only aggregated metrics for the entire network.
- CWidgets can display both aggregated network-wide data and per-device data.Correct answer
- DWidgets update instantly with no latency.
Why this is the answer
Widgets are customizable and show both aggregate and individual device data, but have small delay.
- Question 9Interactive
Refer to the image bundle definition; what does an image bundle contain?
- AAn image bundle: EOS images and optional extensions for device upgradesCorrect answer
- BA configlet: device configuration snippets managed in CloudVision
- CA container: hierarchical grouping of devices and their roles
- DA tag: metadata key/value pairs assigned to devices
Why this is the answer
Image bundles group EOS images and optionally extensions for device upgrades.
- Question 10Single Choice
What protocol does Arista streaming telemetry primarily use?
- AgNMI (gRPC Network Management Interface)Correct answer
- BNETCONF (Network Configuration Protocol)
- CSNMP (Simple Network Management Protocol)
- DSyslog over UDP
Why this is the answer
CVP uses gNMI (gRPC Network Management Interface) for streaming telemetry.
- Question 11Multiple Select
Which two factors can cause a device to be marked as 'Out of Compliance' in CVP? (Choose two.)
- AThe device is running an EOS version that does not match the intended version defined in CVP.Correct answer
- BThe device's actual running configuration differs from the intended configuration defined in CVP.Correct answer
- CThe device is temporarily unreachable from CVP.
- DThe device has an expired software license installed.
Why this is the answer
Non-compliance occurs when actual state (version or config) differs from intended state defined in CVP.
- Question 12Interactive
Examine the change control task attributes; what is the default state of a task that requires approval?
- APendingCorrect answer
- BApproved
- CIn Progress
- DRejected
Why this is the answer
Tasks requiring approval remain in 'Pending' state until an admin approves them.
- Question 13Single Choice
What is the function of the 'Devices' tab in CloudVision?
- AA list of all managed switches showing inventory details such as hostname, model, and EOS version.Correct answer
- BA network topology map with live traffic analytics.
- CA historical record of configuration changes and rollbacks.
- DA list of CloudVision servers and their health status.
Why this is the answer
The Devices tab lists all managed switches with details like hostname, model, and EOS version.
Cloud Network Design and Troubleshooting
4 questions in this domain
- Question 14Single Choice
What does VXLAN (Virtual Extensible LAN) encapsulate?
- ALayer 2 Ethernet frames into UDP/IP packetsCorrect answer
- BIP packets into MPLS labels
- CTCP segments into GRE tunnels
- DFibre Channel frames into FCIP packets
Why this is the answer
VXLAN encapsulates tenant Ethernet frames into UDP packets for transport across a Layer 3 underlay.
- Question 15Multiple Select
Which two components provide Layer 3 isolation for tenants in a multitenant network?
- AVRF (Virtual Routing and Forwarding)Correct answer
- BBGP EVPN (Ethernet Virtual Private Network)Correct answer
- CVLAN (Virtual Local Area Network)
- DVXLAN (Virtual Extensible LAN)
Why this is the answer
VRF provides separate routing tables per tenant, while BGP EVPN distributes tenant routes, enabling Layer 3 isolation.
- Question 16Interactive
Examine the configuration snippet. What is the purpose of this command?
- AIt maps a VLAN to VXLAN Network Identifier (VNI) 10000 for VXLAN encapsulation.Correct answer
- BIt assigns IP address 10000 to the VLAN interface.
- CIt enables VXLAN routing between VLAN 100 and an external BGP peer.
- DIt creates a new VXLAN tunnel interface named VNI 10000.
Why this is the answer
The command 'vxlan vni 10000' under a VLAN configuration maps that VLAN to VNI 10000 for VXLAN encapsulation.
- Question 17Single Choice
What problem does a leaf-spine architecture primarily solve in cloud data centers?
- AIt eliminates oversubscription and bottlenecks caused by traditional three-tier core-aggregation-access designs.Correct answer
- BIt reduces the physical space required for network cabling by using fewer switches.
- CIt provides a more secure perimeter by isolating each server in its own VLAN.
- DIt simplifies IP address management by using a single flat subnet for all hosts.
Why this is the answer
Leaf-spine removes the oversubscription and bottleneck issues present in traditional core-aggregation-access designs.
Cloud Networking Fundamentals
10 questions in this domain
- Question 18Single Choice
Which cloud service model gives complete control over the operating system and networking?
- AInfrastructure as a Service (IaaS)Correct answer
- BPlatform as a Service (PaaS)
- CSoftware as a Service (SaaS)
- DFunction as a Service (FaaS)
Why this is the answer
IaaS gives customers full control over the OS, applications, and virtual networking; the provider only manages physical hardware.
- Question 19Multiple Select
Which two responsibilities belong to the customer in an IaaS model?
- APatching the guest operating systemCorrect answer
- BConfiguring virtual firewallsCorrect answer
- CManaging physical server hardware
- DMaintaining the hypervisor
Why this is the answer
In IaaS, the customer patches the OS and configures virtual firewalls; the provider handles physical infrastructure.
- Question 20Interactive
Examine the VPC configuration snippet. What is missing for the web server to be reachable from the internet?
- AA public IPv4 address or Elastic IP address associated with the instance's network interfaceCorrect answer
- BA route table entry for 0.0.0.0/0 pointing to the internet gateway
- CAn internet gateway attached to the VPC
- DA security group rule allowing inbound HTTP traffic from 0.0.0.0/0
Why this is the answer
Even with a route to IGW, the instance needs a public or Elastic IP to be reachable from the internet.
- Question 21Single Choice
What is the maximum number of VLANs supported by the 802.1Q standard?
- A4,094Correct answer
- B4,096
- C1,024
- D65,536
Why this is the answer
802.1Q uses a 12-bit VLAN ID, permitting a maximum of 4096 VLANs (0-4095).
- Question 22Multiple Select
Which two statements about VXLAN are correct?
- AVXLAN encapsulates Ethernet frames in UDP packets, typically using destination port 4789.Correct answer
- BVXLAN uses a 24-bit VNI, supporting approximately 16 million logical networks.Correct answer
- CVXLAN operates only within a Layer 2 broadcast domain and cannot cross Layer 3 boundaries.
- DVXLAN uses a 12-bit VLAN ID, limiting it to 4094 segments.
Why this is the answer
VXLAN encapsulates Ethernet in UDP (port 4789) and uses a 24-bit VNI, allowing 16 million segments over a Layer 3 underlay.
- Question 23Interactive
Study the EVPN route output. Which route type is this?
- AType 2 (MAC/IP Advertisement Route)Correct answer
- BType 1 (Ethernet Auto-Discovery Route)
- CType 3 (Inclusive Multicast Ethernet Tag Route)
- DType 5 (IP Prefix Route)
Why this is the answer
Type-2 routes carry MAC and IP information for host reachability in EVPN.
- Question 24Single Choice
What is the primary role of a VTEP in a VXLAN fabric?
- AIt encapsulates and decapsulates VXLAN traffic at the tunnel endpointsCorrect answer
- BIt routes traffic between VXLAN VNIs using IP multicast
- CIt provides the physical underlay switching fabric for VXLAN traffic
- DIt authenticates end hosts before they join a VXLAN segment
Why this is the answer
A VTEP terminates VXLAN tunnels – it encapsulates outbound frames and decapsulates inbound frames.
- Question 25Multiple Select
Which two components are part of the underlay network in a VXLAN/EVPN fabric?
- ASpine switchesCorrect answer
- BBGP sessions for IP reachabilityCorrect answer
- CVXLAN VNI
- DEVPN routes
Why this is the answer
The underlay includes spine switches and BGP sessions for IP reachability; VNI and EVPN routes are overlay constructs.
- Question 26Interactive
In the Arista CloudVision screen, a configlet fails to apply due to conflict. What is the most likely cause?
- AAnother configlet is trying to set the same command or parameter to a different value.Correct answer
- BThe device is not connected to the CloudVision network.
- CThe configlet contains a typo in a command name.
- DThe user does not have write permissions on the device.
Why this is the answer
CloudVision flags conflicts when two configlets attempt to configure the same parameter differently.
- Question 27Single Choice
What feature of CloudVision allows automated rollback if a health check fails?
- AChange ControlCorrect answer
- BTelemetry
- CApplication Policy-Based Infrastructure (API)
- DZero Touch Provisioning
Why this is the answer
Change Control can execute rollback automatically if post-change health checks indicate a failure.
Network Automation and Programmability
8 questions in this domain
- Question 28Single Choice
Which command-line interface mode permits alteration of the currently running configuration on an Arista network switch?
- AGlobal configuration modeCorrect answer
- BPrivileged EXEC mode
- CInterface configuration mode
- DLine configuration mode
Why this is the answer
Global configuration mode is reached via the 'configure terminal' command and allows direct changes to the running configuration.
- Question 29Multiple Select
Which two authentication methods are supported by the CloudVision REST API for external access?
- ASession cookies obtained from a successful loginCorrect answer
- BService tokens issued to service accounts for non-interactive automationCorrect answer
- CBasic authentication with a username and password in the HTTP Authorization header
- DSSH key pairs used for cryptographic API authentication
Why this is the answer
The CloudVision REST API supports session cookies from login and service tokens; basic auth and SSH keys are not standard methods.
- Question 30Interactive
Based on the 'show vlan' output provided in the code block, how many VLANs are present in the database?
- A1
- B2
- C3Correct answer
- D4
Why this is the answer
The 'show vlan' output displays three VLANs: default VLAN 1 and custom VLANs 10 and 20.
- Question 31Single Choice
What is the primary purpose of a CloudVision configlet in network automation?
- AVersion-controlled EOS configuration snippets that enforce desired state across devices via CloudVisionCorrect answer
- BPhysical appliances used to aggregate and route network traffic between data centers
- CPython-based scripts that dynamically generate device configurations on demand
- DRouting protocols that enable CloudVision to discover neighboring Arista switches
Why this is the answer
Configlets are version-controlled EOS configuration snippets that enforce desired state across devices via CloudVision.
- Question 32Multiple Select
Which two automation tools are most commonly associated with managing Arista EOS devices?
- AAnsibleCorrect answer
- BTerraformCorrect answer
- CPuppet
- DChef
Why this is the answer
The playbook identifies Ansible and Terraform as the foundational automation tools for Arista devices.
- Question 33Interactive
Referring to the gNMI path in the code block, what type of data does this subscription retrieve?
- AOperational counters for interface Ethernet1Correct answer
- BConfiguration settings for interface Ethernet1
- CLLDP neighbor information for interface Ethernet1
- DRouting table entries for the default VRF
Why this is the answer
The path '/interfaces/interface[name=Ethernet1]/state/counters' targets operational counters for that interface.
- Question 34Single Choice
Which command is the correct way to save the running configuration to startup in Arista EOS?
- Acopy running-config startup-configCorrect answer
- Bwrite memory
- Ccopy startup-config running-config
- Dsave running-config
Why this is the answer
In Arista EOS, 'write' or 'copy running-config startup-config' saves the configuration; 'write memory' is a Cisco command.
- Question 35Multiple Select
Which of the following are valid categories of configlets in CloudVision?
- AStaticCorrect answer
- BDynamicCorrect answer
- CGeneratedCorrect answer
- DScheduled
Why this is the answer
CloudVision configlets are classified as static, dynamic, or generated based on how their content is defined.
Security and Compliance in the Cloud
7 questions in this domain
- Question 36Single Choice
What is the primary purpose of MACsec as defined by IEEE 802.1AE?
- ATo provide hop-by-hop encryption and integrity verification at Layer 2 for Ethernet framesCorrect answer
- BTo provide end-to-end encryption between applications over the internet
- CTo authenticate users before they can access the network
- DTo encrypt data at the application layer to protect cloud storage
Why this is the answer
MACsec (IEEE 802.1AE) provides hop-by-hop encryption and integrity verification at Layer 2, securing Ethernet frames.
- Question 37Multiple Select
Which of the following are core principles of cloud network security best practices? (Select all that apply)
- AImplementing least privilege access controlsCorrect answer
- BUsing micro-segmentation to isolate workloadsCorrect answer
- CEncrypting data in transit and at restCorrect answer
- DRelying solely on a perimeter firewall for defense
Why this is the answer
Least privilege, micro-segmentation, and encryption are core principles. Over-reliance on a perimeter firewall is not a best practice.
- Question 38Interactive
An engineer wants to verify MACsec session status on an Arista switch. Which command should be used?
- Ashow macsec statusCorrect answer
- Bshow macsec profile
- Cshow macsec counters
- Dshow macsec keychain
Why this is the answer
The command 'show macsec status' displays the operational state of MACsec on the device.
- Question 39Single Choice
What does the shared responsibility model in cloud security primarily entail?
- AThe cloud provider is responsible for securing all customer application code and data.
- BThe customer is responsible for the security of the underlying physical data centers.
- CThe customer is responsible for securing their data, identities, and network configurations.Correct answer
- DThe cloud provider assumes full responsibility for all security controls in the cloud.
Why this is the answer
In the shared responsibility model, the provider secures the infrastructure, while the customer secures their data, identities, and network.
- Question 40Multiple Select
Which of the following are valid types of ACLs supported by Arista EOS? (Select all that apply)
- AIPv4 ACLCorrect answer
- BIPv6 ACLCorrect answer
- CMAC ACLCorrect answer
- DDNS ACL
Why this is the answer
Arista EOS supports IPv4, IPv6, and MAC ACLs. DNS ACLs are not a standard ACL type.
- Question 41Interactive
An administrator needs to apply an ACL to an interface to filter inbound traffic. Which configuration is correct?
- Aip access-group BLOCK-SSH inCorrect answer
- Bip access-group BLOCK-SSH out
- Cip access-group BLOCK-SSH
- Dip access-list BLOCK-SSH in
Why this is the answer
The correct command is 'ip access-group <name> in' under interface configuration mode.
- Question 42Single Choice
What is the primary advantage of using streaming telemetry over SNMP polling in CloudVision?
- AIt continuously pushes state changes, reducing latency and eliminating polling interval gaps.Correct answer
- BIt reduces bandwidth usage by only sending data when a critical fault is detected.
- CIt eliminates the need for any configuration because it relies on standard UDP broadcasts.
- DIt is inherently more secure because it encrypts all data by default.
Why this is the answer
Streaming telemetry pushes state changes continuously, reducing latency and eliminating polling interval gaps.
Frequently asked questions
Everything about the ACE: L1 (Cloud Engineer: Level 1) question bank and how to use it.