Question bank
ACE: L3 (Cloud Engineer: Level 3)
42 ACE: L3 (Cloud Engineer: Level 3) questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Advanced Troubleshooting and Operations
3 questions in this domain
- Question 1Single Choice
Which transport protocol is utilized by CloudVision for streaming telemetry?
- AgRPCCorrect answer
- BSNMP
- CNETCONF
- DHTTP
Why this is the answer
CloudVision Telemetry uses gRPC over TCP for streaming data from devices to the TWS.
- Question 2Multiple Select
Identify two stages that are part of a packet walk in an Arista EOS device.
- AIngress parserCorrect answer
- BCPU processing
- CACL lookupCorrect answer
- Dtcpdump capture
Why this is the answer
A packet walk examines ingress, forwarding, ACL, and egress stages in the ASIC pipeline, not CPU-bound activities.
- Question 3Interactive
What keyword is used in an EOS event-handler trigger to match a substring within a syslog message?
- Amatch
- BcontainsCorrect answer
- Cregex
- Dpattern
Why this is the answer
The `contains` keyword matches substrings, while `match` uses regular expression patterns.
Automation and Orchestration
8 questions in this domain
- Question 4Single Choice
What is the primary protocol used by Arista eAPI for communication?
- AJSON-RPCCorrect answer
- BSOAP
- CREST
- DgRPC
Why this is the answer
Arista eAPI uses JSON-RPC over HTTP/HTTPS for programmatic access to CLI commands.
- Question 5Multiple Select
Which two data formats does Arista eAPI support for command output?
- AJSONCorrect answer
- BXML
- CTextCorrect answer
- DYAML
Why this is the answer
eAPI supports 'json' and 'text' formats; JSON returns structured data, text returns raw CLI output.
- Question 6Interactive
In the following eAPI request snippet, what does the 'format' parameter specify?
- AThe output format of the command resultsCorrect answer
- BThe encoding of the request body
- CThe version of the API
- DThe authentication method
Why this is the answer
In eAPI, the 'format' parameter defines whether command output is returned as JSON or text.
- Question 7Single Choice
Which HTTP methods does RESTCONF use for configuration operations?
- AGET, POST, PUT, PATCH, DELETECorrect answer
- BGET, POST, UPDATE
- CGET, PUT, DELETE only
- DPOST, PATCH, DELETE
Why this is the answer
RESTCONF uses GET, POST, PUT, PATCH, and DELETE to manipulate YANG-modeled data.
- Question 8Multiple Select
Which two YANG model families are supported by Arista RESTCONF?
- AOpenConfigCorrect answer
- BIETF
- CNative EOS YANGCorrect answer
- DCisco YANG
Why this is the answer
RESTCONF on Arista supports both OpenConfig and native EOS YANG models.
- Question 9Interactive
Based on the following RESTCONF URI, what resource is being accessed?
- AThe description of Loopback0 interfaceCorrect answer
- BThe IPv4 address of Loopback0
- CAll interfaces on the device
- DThe operational status of Loopback0
Why this is the answer
The path /restconf/data/openconfig-interfaces:interfaces/interface=Loopback0/config/description retrieves the description of Loopback0.
- Question 10Single Choice
What is a configlet in CloudVision?
- AA reusable CLI configuration snippetCorrect answer
- BA network topology diagram
- CA hardware inventory report
- DA software image file
Why this is the answer
A configlet is a reusable snippet of CLI commands that can be applied to devices or containers.
- Question 11Multiple Select
Which two CloudVision components are used for change management?
- AWorkspacesCorrect answer
- BSnapshotsCorrect answer
- CConfiglets
- DContainers
Why this is the answer
Workspaces allow staging changes; snapshots provide rollback capability. Configlets and containers are provisioning, not change management.
Cloud Data Center Architecture
10 questions in this domain
- Question 12Single Choice
What is the primary function of the CloudVision Portal (CVP) in Arista's architecture?
- ACentralized orchestration and lifecycle managementCorrect answer
- BData plane forwarding
- CState replication for overlay services
- DTelemetry agent on switches
Why this is the answer
CVP is the centralized management plane responsible for orchestration, change control, and intent reconciliation.
- Question 13Multiple Select
Which of the following are valid layers of the Arista CloudVision platform architecture? (Select two.)
- ACloudVision Portal (CVP)Correct answer
- BCloudVision eXchange (CVX)Correct answer
- CCloudVision Firewall (CVF)
- DCloudVision Load Balancer (CVL)
Why this is the answer
The three layers are CVP, CVX, and CVA. CVF and CVL are not part of CloudVision.
- Question 14Interactive
Refer to the following configuration snippet. What protocol does TerminAttr use to stream state data to CloudVision?
- AgRPC over TLSCorrect answer
- BSNMP
- CHTTP
- DFTP
Why this is the answer
TerminAttr uses gRPC (port 9910) over TLS to stream state changes in near-real-time.
- Question 15Single Choice
In a Spine-Leaf architecture, how are loops prevented?
- ALayer 3 ECMPCorrect answer
- BSpanning Tree Protocol
- CTRILL
- DSTP with RSTP
Why this is the answer
Spine-Leaf uses Layer 3 ECMP to distribute traffic across multiple paths, eliminating the need for STP.
- Question 16Multiple Select
Which of the following are characteristics of a Spine-Leaf topology? (Select two.)
- AEvery leaf connects to every spineCorrect answer
- BSpines can interconnect with each other
- CLeaves never connect directly to other leavesCorrect answer
- DLeaf switches are always L2 only
Why this is the answer
Spine-Leaf is a full-mesh between leaf and spine; spines do not interconnect, and leaves do not connect to other leaves.
- Question 17Interactive
Analyze the following underlay configuration. Which routing protocol is being used for the underlay?
- AEBGP unnumberedCorrect answer
- BOSPF
- CIS-IS
- DRIP
Why this is the answer
The snippet shows BGP with IPv4 unnumbered configuration, which is EBGP unnumbered (RFC 5549).
- Question 18Single Choice
What is the purpose of the CloudVision eXchange (CVX) component?
- AState replication and advanced overlay service insertionCorrect answer
- BPrimary UI and API gateway
- CData plane packet forwarding
- DTelemetry collection from switches
Why this is the answer
CVX acts as a service insertion and state replication bus, enabling features like VXLAN routing and LB integration.
- Question 19Multiple Select
Which of the following statements about VXLAN are correct? (Select two.)
- AVXLAN encapsulates Ethernet frames in UDP packetsCorrect answer
- BVXLAN extends Layer 2 over Layer 3 networksCorrect answer
- CVXLAN uses TCP as the transport protocol
- DVXLAN is a replacement for VLAN without any encapsulation overhead
Why this is the answer
VXLAN uses UDP encapsulation to extend L2 over L3; it is not TCP-based and adds 50 bytes overhead.
- Question 20Interactive
Examine the BGP configuration. Which address-family is used for EVPN in this multi-site setup?
- Al2vpn evpnCorrect answer
- Bipv4 unicast
- Cipv6 unicast
- Dvpnv4
Why this is the answer
EVPN routes are exchanged under the 'address-family l2vpn evpn' in BGP.
- Question 21Single Choice
In EVPN, which route type is used to advertise a MAC/IP binding?
- AType 2Correct answer
- BType 1
- CType 3
- DType 5
Why this is the answer
EVPN Type 2 routes (MAC/IP advertisement) carry both MAC address and optional IP prefix.
Cloud Network Services and Security
7 questions in this domain
- Question 22Single Choice
What is the purpose of a VXLAN Network Identifier (VNI) in multi-tenancy?
- ATo encrypt traffic between VTEPs
- BTo provide a unique tenant identifier for logical isolationCorrect answer
- CTo route traffic between spine switches
- DTo identify the physical port of a server
Why this is the answer
The VNI (VXLAN Network Identifier) is a 24-bit segment ID that uniquely identifies a tenant overlay network, enabling isolation and overlapping addresses.
- Question 23Multiple Select
Which of the following are components of Arista's service chaining? (Select all that apply.)
- AService Function Forwarder (SFF)Correct answer
- BService Node (SN)Correct answer
- CPolicy Controller (CloudVision)Correct answer
- DRoute Reflector (RR)
Why this is the answer
The SFF (leaf switch) forwards traffic between service nodes, SN is the actual service appliance, and CloudVision orchestrates the policies. A route reflector is not a direct component.
- Question 24Interactive
What is the result of the following command on an Arista switch?
- AAll traffic is blocked on interface Ethernet1
- BTraffic from 10.0.0.0/8 is permitted, all other traffic is deniedCorrect answer
- COnly TCP traffic on port 80 is permitted
- DThe interface is shut down
Why this is the answer
The ACL permits traffic from source 10.0.0.0/8 and implicitly denies all other traffic due to the implicit deny all at the end of every ACL.
- Question 25Single Choice
What is the primary function of Control Plane Policing (CoPP) on an Arista switch?
- AIt filters all data plane traffic
- BIt rate-limits traffic destined to the CPUCorrect answer
- CIt encrypts management traffic
- DIt blocks BGP updates
Why this is the answer
CoPP applies QoS policers to control-plane traffic, limiting the rate of packets like BGP, OSPF, SSH, and thus protecting the CPU from overload.
- Question 26Multiple Select
Which of the following are tag-based attributes in Arista MSS-G micro-segmentation? (Select all that apply.)
- AEnvironment (e.g., Prod, Dev)Correct answer
- BTier (e.g., Web, App, DB)Correct answer
- CMAC address
- DApplication nameCorrect answer
Why this is the answer
MSS-G uses tags like Environment, Tier, and Application to group workloads. MAC address is a low-level identifier, not a high-level tag.
- Question 27Interactive
What is the purpose of the 'set ip next-hop verify-availability' command in a PBF policy?
- AIt enables load balancing across multiple next-hops
- BIt tracks the reachability of the next-hop and disables the policy if unreachableCorrect answer
- CIt verifies the ACL before applying the policy
- DIt enables logging for the policy
Why this is the answer
The verify-availability option uses a tracking object (e.g., static route track) to monitor the next-hop. If the next-hop becomes unreachable, the PBF policy is deactivated, reverting to normal routing.
- Question 28Single Choice
Which protocol is used by Arista EVPN to advertise MAC and IP addresses across the fabric?
- AIPv4 Unicast
- BIPv6 Unicast
- CL2VPN EVPNCorrect answer
- DVPNv4 Unicast
Why this is the answer
EVPN uses the BGP L2VPN EVPN address family to advertise type-2 (MAC/IP) and type-3 (IMET) routes for VXLAN overlays.
Overlay Networking with EVPN/VXLAN
14 questions in this domain
- Question 29Single Choice
Which EVPN route type is used to advertise MAC and IP host information?
- AType-1 (Ethernet Auto-Discovery)
- BType-2 (MAC/IP Advertisement)Correct answer
- CType-3 (Inclusive Multicast Ethernet Tag)
- DType-4 (Ethernet Segment)
Why this is the answer
Type-2 MAC/IP Advertisement Route is designed for host MAC and IP reachability, allowing optimized forwarding and ARP suppression.
- Question 30Multiple Select
Which two components are essential for symmetric Integrated Routing and Bridging (IRB) in EVPN/VXLAN?
- AL3 VNICorrect answer
- BType-5 (IP Prefix) routesCorrect answer
- CType-2 (MAC/IP) routes only
- DIngress replication underlay
Why this is the answer
Symmetric IRB uses a dedicated L3 VNI and Type-5 routes to perform routing on both ingress and egress VTEPs, enabling optimal east-west traffic.
- Question 31Interactive
Based on the configuration, what is the purpose of the 'rd auto' command?
- AAutomatically generates a unique Route Distinguisher using switch IP and VNICorrect answer
- BSets the RD to the BGP AS number
- CDisables the RD and uses MAC address instead
- DAssigns a random RD per VLAN
Why this is the answer
The 'rd auto' command in Arista EOS automatically derives the Route Distinguisher from the switch's router-id and the VNI, ensuring uniqueness per EVPN instance.
- Question 32Single Choice
Which EVPN route type is responsible for Designated Forwarder (DF) election in active-active multihoming?
- AType-1 (Ethernet Auto-Discovery)
- BType-2 (MAC/IP Advertisement)
- CType-4 (Ethernet Segment)Correct answer
- DType-5 (IP Prefix Advertisement)
Why this is the answer
Type-4 Ethernet Segment Route is exchanged between leaf nodes attached to the same ES and used for Designated Forwarder election per VLAN.
- Question 33Multiple Select
Which two statements about VXLAN bridging are true?
- AIt extends VLANs across multiple leaf switches by encapsulating Ethernet frames in UDPCorrect answer
- BIt requires spanning-tree protocol (STP) to prevent loops
- CIt uses EVPN Type-2 routes to learn remote MAC addressesCorrect answer
- DIt replaces the underlay routing for all traffic
Why this is the answer
VXLAN bridging encapsulates Ethernet frames in UDP to extend VLANs, and uses EVPN control plane (Type-2 routes) for MAC learning. STP is not required; the control plane prevents loops.
- Question 34Interactive
In this configuration, what is the purpose of the 'vxlan vlan 100 vni 10100' command?
- AIt maps VLAN 100 to VNI 10100 for VXLAN encapsulationCorrect answer
- BIt creates a Layer 3 routing interface for VLAN 100
- CIt enables multicast replication for VLAN 100
- DIt assigns an IP gateway to VLAN 100
Why this is the answer
The 'vxlan vlan <vlan> vni <vni>' command under the VXLAN interface maps a local VLAN to a specific VXLAN Network Identifier (VNI) for overlay encapsulation.
- Question 35Single Choice
What is the role of a VTEP in VXLAN?
- AIt encapsulates and decapsulates VXLAN framesCorrect answer
- BIt performs routing between VRFs
- CIt acts as a BGP route reflector
- DIt provides DHCP services
Why this is the answer
A VTEP is responsible for VXLAN encapsulation and decapsulation, enabling overlay communication over the underlay network.
- Question 36Multiple Select
Which two EVPN route types are used for L2 extension across multi-pod deployments?
- AType-2 (MAC/IP Advertisement)Correct answer
- BType-3 (Inclusive Multicast Ethernet Tag)Correct answer
- CType-5 (IP Prefix Advertisement)
- DType-1 (Ethernet Auto-Discovery) only
Why this is the answer
Type-2 routes advertise MAC/IP for host reachability, and Type-3 routes build the BUM forwarding domain. Both are required for L2 extension across pods.
- Question 37Interactive
What does 'ip virtual-router mac-address 00:1c:73:00:00:01' accomplish in this configuration?
- AIt assigns a common MAC to all leaf gateways for anycast behaviorCorrect answer
- BIt sets the physical MAC of the SVI
- CIt enables VRRP for gateway redundancy
- DIt defines the VTEP source MAC
Why this is the answer
The 'ip virtual-router mac-address' sets a shared virtual MAC for the anycast gateway, ensuring seamless host mobility across leaf switches.
- Question 38Single Choice
What is the main benefit of ARP suppression on a VTEP?
- AIt reduces broadcast flooding by allowing the VTEP to proxy-replyCorrect answer
- BIt eliminates the need for BGP EVPN
- CIt increases ARP request retransmission rate
- DIt enables VLAN pruning on trunk ports
Why this is the answer
ARP suppression uses EVPN-learned mappings to respond to ARP requests locally, significantly reducing broadcast traffic over the VXLAN fabric.
- Question 39Multiple Select
Which two factors are essential for MAC mobility in EVPN?
- ASequence number in Type-2 routesCorrect answer
- BVTEP announcement of new location with higher sequenceCorrect answer
- CFlooding MAC table to all VTEPs
- DUse of Type-5 routes for MAC moves
Why this is the answer
MAC mobility is achieved by incrementing the sequence number in Type-2 routes. The new VTEP advertises a higher sequence, triggering all other VTEPs to update their MAC forwarding entries.
- Question 40Interactive
In the given output, what does the 'seq' field indicate?
- AIt tracks MAC mobility moves for that MAC addressCorrect answer
- BIt indicates the BGP path sequence
- CIt shows the VNI label value
- DIt is the route distinguisher for the route
Why this is the answer
The sequence number in an EVPN Type-2 route is used for MAC mobility. A higher sequence number indicates a more recent location of the MAC, allowing VTEPs to update their forwarding tables.
- Question 41Single Choice
What is the default UDP destination port for VXLAN on Arista switches?
- A4789Correct answer
- B8472
- C443
- D5000
Why this is the answer
Arista EOS uses UDP destination port 4789 for VXLAN encapsulation, as specified by RFC 7348. Port 8472 is used by other vendors.
- Question 42Multiple Select
Which two statements about Type-5 (IP Prefix) routes are correct?
- AThey advertise IP prefixes without MAC address learningCorrect answer
- BThey are required for inter-subnet routing in symmetric IRBCorrect answer
- CThey are used only in Layer 2 extensions
- DThey carry MAC addresses in the NLRI
Why this is the answer
Type-5 routes advertise IP prefixes (subnets) and are essential for Layer 3 routing across the overlay, especially in symmetric IRB. They do not include MAC information.
Frequently asked questions
Everything about the ACE: L3 (Cloud Engineer: Level 3) question bank and how to use it.