Question bank
ACE: L4 (Cloud Engineer: Level 4)
41 ACE: L4 (Cloud Engineer: Level 4) questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Advanced Troubleshooting and Optimization
3 questions in this domain
- Question 1Single Choice
Which method of packet capture on Arista EOS copies frames directly from the ASIC to a destination port with minimal performance impact?
- AOff-chip mirroring using tcpdump
- BOn-chip mirroring using monitor sessionCorrect answer
- CMirror-to-CPU via hardware capture profile
- DUsing show platform port-asic drop
Why this is the answer
On-chip mirroring (monitor session) uses ASIC to copy frames, minimizing CPU impact.
- Question 2Multiple Select
Which of the following are true about CoPP (Control Plane Protection) impact on debug traps when mirroring to CPU? (Select all that apply)
- ACoPP can drop debug packets before they reach the kernelCorrect answer
- BCoPP policer applies to all traffic mirrored to CPUCorrect answer
- CCoPP is not applied to hardware monitor sessionsCorrect answer
- DCoPP raises burst rates for debug sessions automatically
Why this is the answer
CoPP policer applies to CPU-bound traffic; high-rate debug packets may be dropped. Hardware monitor sessions bypass CoPP.
- Question 3Interactive
Review the following configuration snippet. What is the purpose of the filter access-group command in this monitor session?
- AIt allows the monitor session to copy only traffic matching the ACLCorrect answer
- BIt drops packets that match the ACL
- CIt defines the source interface for the mirror
- DIt changes the destination port for the mirror
Why this is the answer
The filter access-group under monitor session restricts mirrored traffic to packets matching the ACL.
Automation and Orchestration
9 questions in this domain
- Question 4Single Choice
Which of the following best describes the primary function of CloudVision Portal (CVP) in an Arista network?
- AIt acts as a centralized management and automation platform for the entire network fabric.Correct answer
- BIt replaces the need for device-level CLI commands entirely.
- CIt is a tool for monitoring but does not handle configuration changes.
- DIt manages individual device configurations but does not support intent-based networking.
Why this is the answer
CloudVision is a management and automation platform that provides a single point of control, enabling intent-based operations across the fabric. It does not replace CLI but abstracts it, and it does handle configuration changes and monitoring.
- Question 5Multiple Select
Which two components are part of the Arista Automation Framework? (Choose two.)
- AeAPI (JSON-RPC over HTTP/HTTPS)Correct answer
- BSNMP (Simple Network Management Protocol)
- CCloudVision eXchange (CVX)Correct answer
- DNETCONF over SSH
Why this is the answer
The Arista Automation Framework includes eAPI and CloudVision eXchange (CVX) for multi-cluster management. SNMP and NETCONF are not part of the Arista's specific automation framework as described in the playbook.
- Question 6Interactive
Examine the following Python snippet used to authenticate with CloudVision REST API. What critical step is missing for handling token expiry in a production script?
- AThe script does not check if the token has expired and does not implement a refresh mechanism.Correct answer
- BThe script uses HTTP instead of HTTPS.
- CThe script does not parse the JSON response.
- DThe script does not set the 'Content-Type' header.
Why this is the answer
In production, tokens expire; a robust script must check expiration and refresh automatically. The snippet shows a one-time authentication without any refresh logic. The other options are not present as issues in the snippet.
- Question 7Single Choice
What is the purpose of TerminAttr agent on Arista switches?
- AIt establishes a secure outbound gRPC connection to CloudVision for telemetry and configuration.Correct answer
- BIt is a CLI tool for manual switch configuration.
- CIt acts as an SNMP trap receiver.
- DIt performs routing protocol updates between switches.
Why this is the answer
TerminAttr is a daemon that establishes an outbound gRPC tunnel to CloudVision, enabling configuration pushes and telemetry streaming. It is not a CLI tool, not SNMP, and does not perform routing.
- Question 8Multiple Select
Which two statements about eAPI (Extended API) on Arista switches are correct? (Choose two.)
- AeAPI uses JSON-RPC over HTTP/HTTPS.Correct answer
- BeAPI supports both 'enable' and 'config' modes.Correct answer
- CeAPI uses SSH as the transport protocol.
- DeAPI is stateful and maintains session context.
Why this is the answer
eAPI is a JSON-RPC API over HTTP/HTTPS, supporting enable and config modes. It is stateless, not SSH-based, and does not maintain session context.
- Question 9Interactive
Consider the following Terraform configuration block. What does this configuration do in the context of Arista CloudVision integration?
- AIt creates a new configlet in CloudVision with the specified name and configuration.Correct answer
- BIt applies the configlet to a device device.
- CIt deletes an existing configlet from CloudVision.
- DIt retrieves the current state of a configlet.
Why this is the answer
The code defines a Terraform resource for an Arista CloudVision configlet. The 'config' parameter contains the CLI commands. This is a creation operation. Applying to a device would require a separate resource.
- Question 10Single Choice
What is the difference between Ansible and Terraform in terms of their automation paradigms?
- AAnsible is imperative (procedural), while Terraform is declarative (desired state).Correct answer
- BAnsible is declarative, while Terraform is imperative.
- CBoth are declarative, but Terraform uses YAML.
- DBoth are imperative, but Ansible uses HCL.
Why this is the answer
Ansible defines steps to achieve a state (imperative), while Terraform defines the end state and computes the steps (declarative). Ansible uses YAML, Terraform uses HCL.
- Question 11Multiple Select
Which two statements about Terraform state management are correct? (Choose two.)
- ATerraform maintains a state file that maps real-world resources to configuration.Correct answer
- BThe state file is optional and can be ignored if using 'terraform plan' only.
- CState files should be stored securely with locking to prevent concurrent modifications.Correct answer
- DTerraform automatically pushes state changes to all team members without a backend.
Why this is the answer
State is essential for Terraform; without it, drift cannot be detected. It must be stored remotely with locking (e.g., S3+DynamoDB). It is not optional and does not auto-share.
- Question 12Interactive
Examine the following Ansible playbook snippet. What is the primary issue with this playbook from a security perspective?
- AThe username and password are hardcoded in the playbook.Correct answer
- BThe playbook uses an insecure protocol (HTTP).
- CThe 'no_log: true' parameter is missing for debug purposes.
- DThe playbook does not specify a remote user.
Why this is the answer
The playbook hardcodes the password in plain text, which is a severe security risk. Credentials should come from vault, environment variables, or securely managed secrets.
Cloud Infrastructure Design
12 questions in this domain
- Question 13Single Choice
What encapsulation method does VXLAN use to carry Layer 2 frames over Layer 3 networks?
- AMAC-in-UDPCorrect answer
- BIP-in-IP
- CGRE
- DMPLS-in-UDP
Why this is the answer
VXLAN encapsulates the original Layer 2 frame inside a UDP packet using MAC-in-UDP encapsulation (MAC header + payload inside UDP).
- Question 14Multiple Select
Which two components are part of an EVPN control plane for VXLAN?
- ABGPCorrect answer
- BVXLAN Network Identifier (VNI)
- CMP-BGP with EVPN address familyCorrect answer
- DVLAN ID
Why this is the answer
EVPN uses BGP as the transport protocol and the MP-BGP EVPN address family to exchange MAC and IP reachability information.
- Question 15Interactive
In the provided code snippet for Arista EOS, which command sets the source interface for VXLAN traffic?
- Asource-interface Loopback0Correct answer
- Bvxlan source-interface Loopback0
- Cip local-interface Loopback0
- Dinterface vxlan1 source-interface Loopback0
Why this is the answer
In Arista EOS, the VTEP source interface is configured with 'source-interface Loopback0' under interface Vxlan1.
- Question 16Single Choice
How many logical networks does VXLAN support?
- A16 millionCorrect answer
- B4094
- C4 billion
- D65535
Why this is the answer
VXLAN uses a 24-bit VNI (VXLAN Network Identifier) allowing up to 16 million logical networks.
- Question 17Multiple Select
Which two EVPN route types are directly related to MAC and IP advertisement?
- AType 2 (MAC/IP Advertisement)Correct answer
- BType 5 (IP prefix advertisement)Correct answer
- CType 3 (Inclusive Multicast)
- DType 1 (Ethernet AD)
Why this is the answer
Type 2 advertises MAC and IP, Type 5 advertises IP prefixes. Type 3 builds multicast tunnels, Type 1 is for multihoming.
- Question 18Interactive
Given the EVPN route type in the code comment, which BGP NLRI type is responsible for distributing multicast membership?
- AType 3Correct answer
- BType 2
- CType 1
- DType 5
Why this is the answer
EVPN Type 3 (Inclusive Multicast Ethernet Tag) is used to build multicast tunnels or head-end replication lists for BUM traffic.
- Question 19Single Choice
Which IP address does a VTEP use as source for VXLAN encapsulation?
- ALoopback addressCorrect answer
- BPhysical interface IP
- CVLAN SVI IP
- DManagement interface IP
Why this is the answer
The VTEP uses a loopback IP address (unique per switch) as the source and destination of VXLAN tunnels.
- Question 20Multiple Select
Which two statements are true about the relationship between underlay and overlay in VXLAN/EVPN?
- AThe underlay is unaware of VXLAN or EVPN.Correct answer
- BThe overlay provides tenant isolation.Correct answer
- CThe underlay must support VXLAN encapsulation.
- DThe overlay uses the same routing instance as the underlay.
Why this is the answer
The underlay is a simple IP network for VTEP reachability; the overlay (VXLAN/EVPN) is isolated and handles tenant segmentation.
- Question 21Interactive
In the provided code, which command configures an anycast gateway MAC address on an Arista leaf?
- Aip virtual-router addressCorrect answer
- Bip anycast-address
- Cgateway address
- Dvrf gateway
Why this is the answer
The 'ip virtual-router address' command (or 'ip virtual-router mac-address') configures the anycast gateway IP/MAC on Arista switches.
- Question 22Single Choice
Which EVPN feature allows a host to be dual-homed to two leaf switches without MLAG?
- AEVPN Multi-homing (EVPN-MH)Correct answer
- BMLAG
- CvPC
- DActive-Active gateway
Why this is the answer
EVPN Multi-homing uses ESI (Ethernet Segment Identifier) and DF election to allow a host to connect to two leaves without MLAG.
- Question 23Multiple Select
Which two types of traffic are considered BUM traffic in a VXLAN network?
- ABroadcastCorrect answer
- BUnknown unicastCorrect answer
- CKnown unicast
- DARP replies
Why this is the answer
BUM stands for Broadcast, Unknown Unicast, and Multicast traffic; these require special replication in VXLAN.
- Question 24Interactive
In the configuration output below, which VNI is reserved and must not be used for traffic?
- A0Correct answer
- B4096
- C16777215
- D5000
Why this is the answer
VNI 0 is reserved (used for underlay or special purposes) and should not be assigned to tenant networks.
Cloud Operations and Monitoring
8 questions in this domain
- Question 25Single Choice
What is the primary data encoding format used by CloudVision Telemetry?
- AGoogle Protocol BuffersCorrect answer
- BJSON
- CXML
- DBSON
Why this is the answer
CloudVision Telemetry uses Google Protocol Buffers (protobuf) for efficient, compact binary encoding.
- Question 26Multiple Select
Which two models are used by CloudVision for data collection?
- APush-based streamingCorrect answer
- BPull-based pollingCorrect answer
- COnly push-based
- DOnly pull-based
Why this is the answer
CloudVision supports both push-based streaming telemetry and traditional pull-based polling (SNMP).
- Question 27Interactive
Examine the following EOS CLI configuration. What does this command enable?
- ACloudVision Telemetry agentCorrect answer
- BSNMP polling agent
- CSyslog server
- DgNMI collector
Why this is the answer
The command 'management telemetry' enables the CloudVision Telemetry agent on the device.
- Question 28Single Choice
What is the name of Arista's in-memory real-time database that holds operational state?
- ANetDBCorrect answer
- BSysDB
- CConfigDB
- DTimeSeriesDB
Why this is the answer
NetDB (Network Database) is Arista's in-memory real-time database for operational and protocol state.
- Question 29Multiple Select
Which two of the following are types of telemetry streams in CloudVision?
- APeriodic streamingCorrect answer
- BEvent-driven streamingCorrect answer
- CPoll-based streaming
- DBatch streaming
Why this is the answer
CloudVision supports periodic (time-based) and event-driven (change-based) telemetry streams.
- Question 30Interactive
Refer to the code snippet. What protocol does CloudVision Telemetry use to transport data?
- ATCPCorrect answer
- BUDP
- CICMP
- DSCTP
Why this is the answer
CloudVision Telemetry sends data over TCP or secured TLS sessions.
- Question 31Single Choice
What is the primary advantage of streaming telemetry over SNMP polling?
- ALower latency visibilityCorrect answer
- BLower bandwidth usage
- CEasier configuration
- DNo need for authentication
Why this is the answer
Streaming telemetry provides near real-time data, reducing latency compared to periodic SNMP polling.
- Question 32Multiple Select
Which two severity levels in syslog are considered most critical?
- AEmergency (0)Correct answer
- BAlert (1)Correct answer
- CCritical (2)
- DError (3)
Why this is the answer
Emergency (0) and Alert (1) are the two highest severity levels in syslog.
Security and Compliance
9 questions in this domain
- Question 33Single Choice
What is the core tenet of Zero Trust networking according to Arista's security model?
- ATrust but verify
- BNever trust, always verifyCorrect answer
- CAlways trust, verify occasionally
- DTrust based on location
Why this is the answer
Zero Trust's core tenet is 'never trust, always verify,' requiring continuous authentication, authorization, and encryption for every request, regardless of network location.
- Question 34Multiple Select
Which of the following are key components of a Zero Trust Architecture as defined by NIST SP 800-207? (Select all that apply.)
- APolicy Engine (PE)Correct answer
- BPolicy Administrator (PA)Correct answer
- CPolicy Enforcement Point (PEP)Correct answer
- DPolicy Decision Point (PDP)
Why this is the answer
NIST SP 800-207 defines three core components: Policy Engine, Policy Administrator, and Policy Enforcement Point. PDP is part of the Policy Engine but not a separate core component.
- Question 35Interactive
Examine the Arista EOS configuration snippet. Which feature is being configured to secure hop-by-hop Layer 2 traffic?
- AIPsec
- BMACsecCorrect answer
- CSSL/TLS
- DWireGuard
Why this is the answer
The command 'macsec' under interface configuration enables MACsec (802.1AE) for Layer 2 encryption. The presence of 'cipher gcm-aes-256' confirms the protocol.
- Question 36Single Choice
What is the main purpose of microsegmentation in a Zero Trust environment?
- ATo reduce the number of VLANs needed
- BTo prevent lateral movement by dividing the network into logical security zonesCorrect answer
- CTo increase broadcast traffic efficiency
- DTo replace firewalls entirely
Why this is the answer
Microsegmentation divides the network into logical zones based on workload or sensitivity, allowing fine-grained policies that prevent attackers from moving laterally after a breach.
- Question 37Multiple Select
Which Arista components map to the Zero Trust roles of Policy Administrator (PA) and Policy Enforcement Point (PEP)? (Select two answers.)
- ACloudVisionCorrect answer
- BArista EOS switchCorrect answer
- CFirewall
- DRADIUS server
Why this is the answer
CloudVision acts as both Policy Engine and Policy Administrator. Arista EOS switches serve as Policy Enforcement Points (PEPs).
- Question 38Interactive
Look at the ACL configuration. Which type of traffic is explicitly permitted by this Access Control List?
- AHTTP (TCP/80)
- BHTTPS (TCP/443)Correct answer
- CSSH (TCP/22)
- DDNS (UDP/53)
Why this is the answer
The ACL entry 'permit tcp any any eq 443' allows HTTPS traffic on TCP port 443. The '500-600' range is not defined; only port 443 is explicitly permitted.
- Question 39Single Choice
What is the primary standard that defines MACsec (Media Access Control Security)?
- AIEEE 802.1AECorrect answer
- BIEEE 802.1X
- CIEEE 802.11i
- DIEEE 802.3af
Why this is the answer
MACsec is defined by IEEE 802.1AE, which specifies Layer 2 encryption for Ethernet links. 802.1X is used for network access control.
- Question 40Multiple Select
Which of the following are valid MACsec cipher suites supported on Arista switches? (Select two answers.)
- AGCM-AES-128Correct answer
- BGCM-AES-256Correct answer
- CAES-CBC-256
- DDES-56
Why this is the answer
MACsec supports GCM-AES-128 and GCM-AES-256 cipher suites. Arista 7280R series support hardware offload for both.
- Question 41Interactive
Review the output of a MACsec status command. What does the 'encrypt' field indicate?
- AMACsec is disabled
- BMACsec is enabled and encrypting trafficCorrect answer
- CMACsec is in key negotiation phase
- DError: cipher mismatch
Why this is the answer
The field 'Encrypt: Yes' and 'SAK: Valid' indicate that MACsec is actively encrypting traffic on the link.
Frequently asked questions
Everything about the ACE: L4 (Cloud Engineer: Level 4) question bank and how to use it.