Question bank
ACE: L2 (Cloud Engineer: Level 2)
40 ACE: L2 (Cloud Engineer: Level 2) questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Automation and Orchestration
10 questions in this domain
- Question 1Single Choice
What is CloudVision (CVP) in the context of Arista networks?
- AA centralized network management and automation platformCorrect answer
- BA CLI tool for configuring individual switches
- CA routing protocol for data center fabrics
- DA packet capture and analysis software
Why this is the answer
CloudVision is a centralized management platform that abstracts device configurations into an intent-based model.
- Question 2Multiple Select
Which two northbound interfaces does CloudVision (CVP) expose for automation?
- AREST APICorrect answer
- BgNMICorrect answer
- CSNMP
- DNetFlow
Why this is the answer
CVP exposes REST API and gNMI among others; SNMP and NetFlow are legacy protocols not used for CVP integration.
- Question 3Interactive
Examine the following Python script that uses pyeapi to configure a VLAN. Identify the missing step before the configuration commands.
- AAuthentication and session creationCorrect answer
- BImporting the netmiko library
- COpening an SSH tunnel
- DStarting a web server
Why this is the answer
pyeapi requires authentication (e.g., using Node or connect methods) before sending config commands.
- Question 4Single Choice
What is the primary function of TerminAttr on an Arista switch?
- AStreaming state and receiving configuration push from CVPCorrect answer
- BPerforming packet forwarding lookups
- CManaging routing protocols
- DCollecting SNMP statistics
Why this is the answer
TerminAttr is the daemon that streams device state to CVP and accepts config pushes.
- Question 5Multiple Select
Which of the following are valid methods for Arista eAPI authentication?
- AHTTP Basic AuthenticationCorrect answer
- BToken-based authenticationCorrect answer
- COAuth 2.0
- DLDAP bind
Why this is the answer
eAPI supports HTTP Basic and token-based authentication; OAuth and LDAP bind are not used.
- Question 6Interactive
Analyze this Ansible task snippet. What is the purpose of the 'wait_for' parameter?
- APolls the device until a condition is met or timeout expiresCorrect answer
- BDelays execution for a fixed number of seconds
- CWaits for a user approval before continuing
- DSchedules the task to run later
Why this is the answer
The 'wait_for' parameter in eos_command polls the device output until the condition is satisfied or the timeout elapses.
- Question 7Single Choice
Which CloudVision endpoint should be used to apply a configuration change in a transactional manner?
- A/changeControlCorrect answer
- B/configlet
- C/inventory
- D/user
Why this is the answer
The /changeControl endpoint ensures transactional rollback and audit trail, unlike /configlet which only updates a snippet.
- Question 8Multiple Select
Which two tools are mentioned as primary for Arista network automation in the ACE-L2 exam?
- AAnsibleCorrect answer
- BPythonCorrect answer
- CNETCONF
- DRESTCONF
Why this is the answer
Ansible (declarative) and Python (imperative) are the foundational tools for Arista automation as per the document.
- Question 9Interactive
In this Terraform resource for Arista CloudVision, what does the 'configlet_id' attribute typically represent?
- AThe unique identifier of the configlet in CloudVisionCorrect answer
- BThe name of the configlet as shown in the UI
- CThe version number of the configlet
- DThe device group assigned to the configlet
Why this is the answer
The configlet_id is the unique identifier (UUID or string) that CloudVision assigns to each configlet.
- Question 10Single Choice
What is the main purpose of Ansible's idempotency in network automation?
- AIt ensures repeated runs do not cause configuration driftCorrect answer
- BIt increases the speed of playbook execution
- CIt allows parallel execution on multiple devices
- DIt eliminates the need for error handling
Why this is the answer
Idempotency means that applying the same configuration multiple times results in the same state, preventing drift.
Cloud Architecture and Design
6 questions in this domain
- Question 11Single Choice
Which layer in a leaf-spine architecture is responsible for connecting to servers and storage?
- ASpine layer
- BLeaf layerCorrect answer
- CCore layer
- DAccess layer
Why this is the answer
Leaf switches connect directly to servers, storage, and other endpoints, while spines provide inter-leaf connectivity.
- Question 12Multiple Select
Which two statements are true about leaf-spine architecture?
- AEach leaf connects to every spineCorrect answer
- BSpines interconnect to provide redundancy
- CECMP is used for load balancing across spinesCorrect answer
- DSpanning Tree Protocol is required
Why this is the answer
Leaf-spine uses a full mesh between leaves and spines, and ECMP distributes traffic. Spines do not connect to each other and STP is eliminated.
- Question 13Interactive
What does the command 'ip routing' enable on a leaf switch?
- ALayer 2 switching
- BIP forwardingCorrect answer
- CVXLAN encapsulation
- DSpanning tree
Why this is the answer
The 'ip routing' command enables Layer 3 forwarding (routing) of IP packets on the switch.
- Question 14Single Choice
What is the minimum recommended number of spine switches for a highly available leaf-spine fabric?
- A1
- B2Correct answer
- C4
- D8
Why this is the answer
Arista recommends at least two spine switches to eliminate a single point of failure and provide redundancy.
- Question 15Multiple Select
Which two protocols can be used in the underlay of an Arista leaf-spine network?
- AeBGPCorrect answer
- BOSPFCorrect answer
- CVXLAN
- DEVPN
Why this is the answer
The underlay (physical network) uses IP routing protocols like eBGP (recommended) or OSPF. VXLAN and EVPN are overlay technologies.
- Question 16Interactive
Based on the command output, what feature allows load balancing across equal-cost paths?
- AECMPCorrect answer
- BSTP
- CMLAG
- DVXLAN
Why this is the answer
Equal-Cost Multi-Path (ECMP) enables load balancing across multiple equal-cost routes, which is central to leaf-spine design.
Cloud Networking Fundamentals
8 questions in this domain
- Question 17Single Choice
Which UDP port is standard for VXLAN encapsulation?
- A4789Correct answer
- B4788
- C179
- D5000
Why this is the answer
VXLAN uses UDP destination port 4789 for MAC-in-UDP encapsulation.
- Question 18Multiple Select
Which two EVPN route types are part of the EVPN specification?
- AType-2Correct answer
- BType-3Correct answer
- CType-6
- DType-0
Why this is the answer
EVPN includes Type-2 (MAC/IP) and Type-3 (IMET) routes, among others.
- Question 19Interactive
Based on the output, which route type is not shown and is used for ES auto-discovery?
- AType-1Correct answer
- BType-2
- CType-3
- DType-4
Why this is the answer
EVPN Type-1 route is used for Ethernet Segment auto-discovery.
- Question 20Single Choice
What does the acronym VNI represent in VXLAN?
- AVXLAN Network IdentifierCorrect answer
- BVLAN Network Identifier
- CVXLAN Node Identifier
- DVirtual Node Interface
Why this is the answer
VNI stands for VXLAN Network Identifier, a 24-bit field.
- Question 21Multiple Select
Select two correct statements regarding anycast VTEP in Arista EVPN.
- AIt uses a shared IP address across multiple leafs.Correct answer
- BIt uses a shared MAC address across leafs.
- CIt enables active-active redundancy.Correct answer
- DIt requires a multicast underlay.
Why this is the answer
Anycast VTEP uses a common IP but unique MAC per leaf, providing active-active redundancy.
- Question 22Interactive
Which address family is missing from this BGP configuration for EVPN support?
- Aaddress-family l2vpn evpnCorrect answer
- Baddress-family vpnv4
- Caddress-family ipv4
- Daddress-family rtfilter
Why this is the answer
EVPN requires the address-family l2vpn evpn under BGP configuration.
- Question 23Single Choice
What MTU size is recommended for the underlay to handle VXLAN encapsulation?
- A1500
- B9000Correct answer
- C1550
- D9216
Why this is the answer
Arista recommends an underlay MTU of 9000 bytes to account for VXLAN 50-byte overhead.
- Question 24Multiple Select
Select two elements that belong to the VXLAN overlay.
- AVTEPCorrect answer
- BVNICorrect answer
- COSPF
- DBGP
Why this is the answer
VTEP performs encapsulation, and VNI identifies the virtual network in the overlay.
Monitoring and Troubleshooting
8 questions in this domain
- Question 25Single Choice
Which protocol is used by Arista EOS to manage telemetry subscriptions?
- ASNMP
- BgNMICorrect answer
- CNETCONF
- DRESTCONF
Why this is the answer
gNMI (gRPC Network Management Interface) is the standard protocol used by Arista for telemetry subscriptions.
- Question 26Multiple Select
Which of the following are valid telemetry subscription modes in Arista EOS? (Select two.)
- AON_CHANGECorrect answer
- BSAMPLECorrect answer
- CPOLL
- DPUSH_ONLY
Why this is the answer
Arista EOS supports ON_CHANGE and SAMPLE subscription modes. POLL is not a valid telemetry mode; it is associated with SNMP.
- Question 27Interactive
Examine the command output below. What does it indicate about the telemetry agent status?
- AThe telemetry agent is connected and sending data.Correct answer
- BThe telemetry agent is not configured.
- CThe telemetry agent is disconnected but retrying.
- DThe telemetry agent has encountered a configuration error.
Why this is the answer
The 'show telemetry agent status' output displays 'State: Connected' and 'Streams Active: 5', indicating the agent is successfully connected and sending data.
- Question 28Single Choice
Which data type is best suited for monitoring interface byte counts over time?
- AGauge
- BCounterCorrect answer
- CHistogram
- DState
Why this is the answer
Counters are cumulative integers that increase monotonically, making them ideal for monitoring traffic volume over time.
- Question 29Multiple Select
Which of the following are advantages of streaming telemetry over SNMP? (Select two.)
- APush-based data delivery reduces polling overhead.Correct answer
- BHigher polling frequency due to pull model.
- CSupports sub-second update intervals.Correct answer
- DUses UDP for guaranteed delivery.
Why this is the answer
Streaming telemetry pushes data, reducing device CPU load, and supports sub-second updates. SNMP uses UDP and is pull-based.
- Question 30Interactive
Evaluate the following telemetry configuration. Which mode and path are being subscribed to?
- ASample mode subscribing to /interfaces/interface/state/countersCorrect answer
- BOn-change mode subscribing to /interfaces/interface/state/counters
- CSample mode subscribing to /system/memory/state
- DOn-change mode subscribing to /system/memory/state
Why this is the answer
The configuration shows 'mode sample sample-interval 30' and the path '/interfaces/interface/state/counters', matching a sample-based subscription for interface counters.
- Question 31Single Choice
What is the primary function of CloudVision's Advanced Event Streaming (AES)?
- ATo stream real-time operational state changes from EOS devicesCorrect answer
- BTo perform periodic SNMP polling of all devices
- CTo store long-term historical data in a relational database
- DTo replace the need for any device-level CLI access
Why this is the answer
AES streams real-time state changes (e.g., interface flapping, BGP neighbor changes) from devices to CloudVision, enabling low-latency monitoring.
- Question 32Multiple Select
Which of the following are features of CloudVision monitoring? (Select two.)
- ACustom dashboards with telemetry widgetsCorrect answer
- BDevice-level CLI configuration backup
- CEvent correlation and alerting based on thresholdsCorrect answer
- DReal-time packet capture on all front-panel ports
Why this is the answer
CloudVision provides custom dashboards and threshold-based alerting with event correlation. Packet capture is not a native CloudVision feature; it is done via SPAN or tcpdump.
Security and Segmentation
8 questions in this domain
- Question 33Single Choice
What is the maximum number of VLANs allowed in 802.1Q?
- A4096
- B4094Correct answer
- C16 million
- D65535
Why this is the answer
IEEE 802.1Q defines a 12-bit VLAN ID field, allowing a maximum of 4094 usable VLANs (0 and 4095 are reserved).
- Question 34Multiple Select
Which of the following are characteristics of VXLAN? (Select two)
- AEncapsulates Ethernet frames in UDP packetsCorrect answer
- BUses a 24-bit VNI for network identificationCorrect answer
- CUses a 12-bit VLAN ID
- DAlways requires multicast in the underlay
Why this is the answer
VXLAN encapsulates Ethernet in UDP and uses a 24-bit VNI. It can use multicast or BGP EVPN for control plane; multicast is not always required.
- Question 35Interactive
Refer to the configuration. What is the VNI assigned to VLAN 10?
- A10
- B10010Correct answer
- C4789
- D0
Why this is the answer
The command 'vlan-to-vni vlan 10 vni 10010' maps VLAN 10 to VNI 10010.
- Question 36Single Choice
What is the role of BGP EVPN in VXLAN?
- AData plane encryption
- BControl plane for distributing MAC/IP routesCorrect answer
- CUnderlay routing protocol
- DFirewall integration
Why this is the answer
BGP EVPN acts as the control plane for VXLAN, exchanging MAC and IP routes between VTEPs to enable host-based learning.
- Question 37Multiple Select
Which two statements about MACsec are true? (Select two)
- AEncrypts the Ethernet payload using AES-GCMCorrect answer
- BOperates at Layer 3
- CRequires 802.1X to function
- DProvides hop-by-hop encryption at Layer 2Correct answer
Why this is the answer
MACsec (802.1AE) provides hop-by-hop encryption at Layer 2 using AES-GCM. It can use PSK or dynamic keys via 802.1X, but is not dependent on 802.1X.
- Question 38Interactive
Based on the configuration, which 802.1X role is this interface configured as?
- ASupplicant
- BAuthenticatorCorrect answer
- CAuthentication server
- DNone
Why this is the answer
The command 'dot1x pae authenticator' configures the interface as a 802.1X authenticator.
- Question 39Single Choice
What does MKA stand for in the context of MACsec?
- AMAC Key Authentication
- BMedia Access Control Security Key Agreement
- CMACsec Key AgreementCorrect answer
- DMulti-Key Authentication
Why this is the answer
MKA stands for MACsec Key Agreement, the protocol used for key derivation and management in MACsec.
- Question 40Multiple Select
Which three are core principles of Zero Trust? (Select three)
- ANever trust, always verifyCorrect answer
- BLeast privilegeCorrect answer
- CAssume breachCorrect answer
- DImplicit trust for internal networks
Why this is the answer
Zero Trust is built on never trust always verify, least privilege, assume breach, and micro-segmentation. Implicit trust is the opposite.
Frequently asked questions
Everything about the ACE: L2 (Cloud Engineer: Level 2) question bank and how to use it.