Question bank
ACE: L7 Expert
40 ACE: L7 Expert questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Arista L7 Security
10 questions in this domain
- Question 1Single Choice
What distinguishes policy-based segmentation from VLAN-based segmentation in Arista CloudVision?
- APolicy-based segmentation ties policies to logical groups independent of physical topology, while VLAN-based segmentation is tied to VLANs and subnets.Correct answer
- BPolicy-based segmentation requires per-device ACL configuration, while VLAN-based segmentation is automated.
- CPolicy-based segmentation uses MAC addresses for filtering, while VLAN-based segmentation uses IP addresses.
- DPolicy-based segmentation only works with overlay networks like VXLAN, while VLAN-based segmentation works on native Ethernet.
Why this is the answer
CloudVision segmentation uses logical policy groups, not VLANs, enabling micro-segmentation within the same broadcast domain.
- Question 2Multiple Select
What are two key characteristics of Arista CloudVision's default behavior when segmentation is first enabled? (Choose two.)
- AAll inter-VLAN traffic is allowed until a deny rule overrides it when using RBACLs.Correct answer
- BAll traffic is blocked until explicit allow policies are defined.
- CZone-based segmentation applies a default-deny posture.
- DCloudVision uses a permissive default model for policy groups, not a default-deny.Correct answer
Why this is the answer
CloudVision's RBACL defaults to allow; only zone-based segmentation uses default-deny. Policy groups are permissive.
- Question 3Interactive
Examine the command output. Which Arista MACsec feature is being verified?
- AThe MKA session details showing the CAK-ID and SAK version.Correct answer
- BThe encryption status showing whether MACsec is active.
- CThe cipher suite negotiation result between two peers.
- DThe replay window configuration and packet drop count.
Why this is the answer
The `show mac security mka` command displays MKA session information including CAK-ID and SAK version.
- Question 4Single Choice
What type of frames are allowed on an Arista switch port before 802.1X authentication succeeds?
- AOnly EAPoL and control plane frames like CDP/LLDP are allowed.Correct answer
- BAll data frames are allowed but with limited bandwidth.
- COnly DHCP and ARP frames are permitted.
- DAll Ethernet frames are allowed until the supplicant fails authentication.
Why this is the answer
The uncontrolled port only allows EAPoL for authentication and CDP/LLDP; all other traffic is dropped until authorization.
- Question 5Multiple Select
Which two capabilities are detection-oriented features in Arista's threat detection and mitigation framework? (Choose two.)
- ABehavioral Analytics using machine learning on network metadata.Correct answer
- BGuardian automated response actions.
- CEncrypted Traffic Analysis via TLS fingerprinting.Correct answer
- DDynamic ACL enforcement on switches.
Why this is the answer
Behavioral Analytics and Encrypted Traffic Analysis are detection features; Guardian and dynamic ACLs are mitigation features.
- Question 6Interactive
Study the policy snippet. What does this configuration enforce?
- AAny user with the tag 'employee' can access the 'finance' application if their device is compliant and during working hours.Correct answer
- BAll traffic from 'employee' to 'finance' is allowed without further checks.
- COnly users with 'admin' role can access the finance application during working hours.
- DThe rule denies access to the finance application for all users.
Why this is the answer
The policy allows employee tag to access finance app only if device is compliant and time is working hours, enforcing least privilege.
- Question 7Single Choice
What is the difference between static and dynamic MACsec key management in Arista EOS?
- AStatic uses a pre-shared CAK configured on both ends, while dynamic derives the CAK from EAP authentication via RADIUS.Correct answer
- BStatic uses certificates, while dynamic uses a shared secret.
- CStatic requires a RADIUS server, while dynamic can work without one.
- DStatic keys are automatically rotated, while dynamic keys must be manually rotated.
Why this is the answer
Static MACsec uses manually configured CAK; dynamic uses RADIUS to derive CAK via EAP, enabling centralized management.
- Question 8Multiple Select
Which two statements are true about MACsec replay protection in Arista switches? (Choose two.)
- AThe default replay window is 0, which enforces strict packet ordering.Correct answer
- BECMP environments require a larger replay window to prevent packet drops due to out-of-order delivery.Correct answer
- CA larger replay window always increases security.
- DMACsec does not support replay protection on Arista switches.
Why this is the answer
Default window is 0; ECMP needs larger window to avoid drops. Larger window decreases security, not increases.
- Question 9Interactive
Review the lifecycle steps. What is the correct order of phases in Arista's threat detection lifecycle?
- AData Ingestion → Baseline & Anomaly Detection → Alert Correlation → Verification & Decision → Mitigation ActionCorrect answer
- BMitigation Action → Alert Correlation → Data Ingestion → Baseline → Verification
- CBaseline → Data Ingestion → Verification → Mitigation → Alert Correlation
- DAlert Correlation → Data Ingestion → Mitigation → Baseline → Verification
Why this is the answer
The lifecycle begins with data ingestion, then baseline detection, correlation, decision, and finally mitigation.
- Question 10Single Choice
In Arista's zero-trust network access, how is trust maintained after initial authentication?
- AThrough short-lived tokens and session-timeout revalidation, reassessing trust at each request.Correct answer
- BBy checking the user's IP address at the beginning of each hour.
- CBy requiring the user to re-enter their password every 30 seconds.
- DBy using static session keys that never expire.
Why this is the answer
Arista ZTNA uses short-lived tokens (e.g., OAuth 2.0) and periodic revalidation for continuous trust verification.
Automation and Programmability
12 questions in this domain
- Question 11Single Choice
In the AVD architecture, which layer is responsible for generating candidate device configurations?
- AInput Layer
- BProcessing Layer
- COutput LayerCorrect answer
- DValidation Layer
Why this is the answer
The Output Layer in AVD generates candidate configurations from processed design variables.
- Question 12Multiple Select
Which of the following are components of the AVD framework? (Select all that apply.)
- Aeos_designs roleCorrect answer
- Beos_device_configuration roleCorrect answer
- Ccvp_provision roleCorrect answer
- Deos_command module
Why this is the answer
AVD includes eos_designs, eos_device_configuration, and cvp_provision roles; eos_command is not part of AVD.
- Question 13Interactive
Examine the following YAML variable excerpt. Which variable is used to define an MLAG peer pair in AVD?
- Amlag_peerCorrect answer
- Bmlag_domain
- Cnode_terminus
- Dinterface_map
Why this is the answer
The variable 'mlag_peer' is used in AVD to define MLAG peer node names.
- Question 14Single Choice
Which Ansible module is idempotent and used for declarative configuration changes on Arista EOS?
- Aeos_command
- Beos_configCorrect answer
- Ceos_facts
- Deos_system
Why this is the answer
eos_config is the idempotent module for declarative config changes; eos_command is for operational commands.
- Question 15Multiple Select
Which statements are true when comparing eAPI and RESTCONF? (Select all that apply.)
- AeAPI uses JSON-RPC for command execution.Correct answer
- BRESTCONF uses YANG data models for configuration.Correct answer
- CBoth APIs support atomic transactions.
- DeAPI is a vendor-proprietary interface.Correct answer
Why this is the answer
eAPI is proprietary, JSON-RPC based; RESTCONF uses YANG and is standards-based. Atomic transactions are only in eAPI via runCmds.
- Question 16Interactive
Analyze the following eAPI JSON-RPC request. Which method is used to execute multiple commands with rollback on failure?
- ArunCmdsCorrect answer
- BrunCmdsWithIndex
- CexecCommand
- DconfigureSession
Why this is the answer
The 'runCmds' method in eAPI executes commands atomically when stopOnFailure is true (default).
- Question 17Single Choice
What is the primary function of CloudVision's Change Control feature?
- AAutomatically push configuration to all devices immediately.
- BProvide real-time streaming telemetry dashboards.
- COrchestrate sequences of tasks with approval gates and rollback.Correct answer
- DManage backup of device configurations to a remote server.
Why this is the answer
Change Control orders tasks, requires approval, and supports rollback for safe network changes.
- Question 18Multiple Select
Which of the following are valid CloudVision user roles? (Select all that apply.)
- ANetwork OperatorCorrect answer
- BNetwork AdministratorCorrect answer
- CSuper UserCorrect answer
- DSecurity Auditor
Why this is the answer
CVP has three default roles: Network Operator, Network Administrator, and Super User.
- Question 19Interactive
Examine the CloudVision API endpoint. What action does a POST to this endpoint perform?
- ACreate a new configlet.Correct answer
- BRetrieve device information.
- CTrigger a change control execution.
- DDelete a container assignment.
Why this is the answer
POST to /cvp/v1/configlets creates a new configlet in CloudVision.
- Question 20Single Choice
In a CI/CD pipeline for Arista, what is the primary purpose of running Ansible in check mode?
- APush configuration changes to the device.
- BValidate the playbook syntax and simulate changes.Correct answer
- CGather device facts for inventory.
- DDeploy configuration only to a subset of devices.
Why this is the answer
Check mode simulates changes and validates syntax without actually modifying the device configuration.
- Question 21Multiple Select
Which tools can be used for automated testing of Arista network configurations before deployment? (Select all that apply.)
- AAnsible check modeCorrect answer
- BCloudVision TestletsCorrect answer
- CBatfishCorrect answer
- Dping command
Why this is the answer
Check mode, Testlets, and Batfish are validation tools; ping is for connectivity only.
- Question 22Interactive
Consider this Ansible task snippet using eos_config. What does the 'parents' parameter specify?
- AThe parent configuration mode to enter before applying lines.Correct answer
- BThe parent device that will provide backup configurations.
- CThe parent role from which to inherit variables.
- DThe parent VLAN identifier for interface membership.
Why this is the answer
The 'parents' parameter specifies the CLI mode (e.g., interface Ethernet1) to enter before applying the lines.
Network Design for L7 Services
10 questions in this domain
- Question 23Single Choice
Which BGP EVPN route type is used to advertise MAC and IP addresses for service nodes in a VXLAN fabric?
- ART-2Correct answer
- BRT-5
- CRT-3
- DRT-1
Why this is the answer
RT-2 (MAC/IP advertisement) is used to advertise endpoint MAC and IP addresses, including those of service nodes.
- Question 24Multiple Select
Which two statements are true about Symmetric IRB for L7 service insertion?
- AUses both source and destination VNIsCorrect answer
- BCan cause traffic loops across leaf switches
- CPreferred over asymmetric IRB for stateful servicesCorrect answer
- DRequires Ethernet Segment multi-homing
Why this is the answer
Symmetric IRB uses both VNIs for routing and is preferred for stateful services to ensure symmetric flow.
- Question 25Interactive
Based on the provided VXLAN header snippet, which field encodes the service path identifier?
- AVNI 5000Correct answer
- BFlags (0x08)
- CReserved field
- DNSH Extension presence
Why this is the answer
The VNI acts as the service path identifier in EVPN service chaining, distinguishing between tenant and service VNIs.
- Question 26Single Choice
What is the recommended default health check interval and retry count for Arista L7 load balancers?
- A1 second, 1 retry
- B5 seconds, 3 retriesCorrect answer
- C10 seconds, 2 retries
- D30 seconds, 1 retry
Why this is the answer
Arista recommends a 5-second interval with 3 retries to balance failover speed and stability.
- Question 27Multiple Select
Which two encapsulation headers are required when using VXLAN-GPE for NSH service chaining?
- AVXLANCorrect answer
- BNSHCorrect answer
- CGRE
- DMPLS
Why this is the answer
VXLAN-GPE encapsulates NSH headers; GRE and MPLS are not part of this standard.
- Question 28Interactive
Based on the output, is the service insertion configuration symmetric or asymmetric?
- AAsymmetricCorrect answer
- BSymmetric
- CUnknown
- DPartially symmetric
Why this is the answer
The output shows 'symmetry: asymmetric', which indicates that return traffic may not traverse the same service leaf, breaking stateful inspection.
- Question 29Single Choice
Where are stateful L4-L7 appliances best placed in a leaf-spine fabric?
- AService leaf switchesCorrect answer
- BSpine switches
- CWorkload leaf switches
- DCore routers
Why this is the answer
Dedicated service leaves are recommended to handle symmetric hairpinning and avoid asymmetric routing through spines.
- Question 30Multiple Select
Which two service insertion models are commonly used for stateful firewalls in Arista EVPN fabrics?
- AInline transparent (Layer 2 bridge)Correct answer
- BOut-of-path PBR with static routes
- CVXLAN service graphs (SITR)Correct answer
- DBump-in-the-wire without VXLAN
Why this is the answer
Inline transparent and VXLAN service graphs are both suited for stateful services; out-of-path PBR is typically for stateless.
- Question 31Interactive
Examine the configuration snippet. Which two mechanisms are used to isolate tenant traffic?
- AVRF TenantACorrect answer
- BVLAN 100Correct answer
- CAccess port mode
- DSwitchport mode trunk
Why this is the answer
VRF and VLAN together isolate traffic; access port mode is just the interface type.
- Question 32Single Choice
What is the primary difference between a VLAN and a network slice in the context of L7 services?
- AA network slice includes SLAs and service chainingCorrect answer
- BA network slice provides better Layer 2 isolation
- CA network slice always requires MPLS
- DA VLAN supports up to 16 million segments
Why this is the answer
A network slice encompasses end-to-end SLAs, QoS, and service function chains, unlike VLAN which only segments Layer 2.
Troubleshooting and Optimization
8 questions in this domain
- Question 33Single Choice
What type of data collection does CloudVision use to obtain network metrics?
- APull-based SNMP polling
- BPush-model streaming telemetryCorrect answer
- CPeriodic CLI scrapes
- DSyslog aggregation only
Why this is the answer
CloudVision uses a push-model architecture where devices stream telemetry via the Telemetry Agent, not pull-based methods.
- Question 34Multiple Select
Which flow export technologies are supported on Arista switches for L7 analysis?
- AsFlowCorrect answer
- BNetFlow v9
- CIPFIXCorrect answer
- DSNMP
Why this is the answer
Arista supports sFlow and IPFIX for flow export. NetFlow v9 is also supported but not mentioned? The document mentions sFlow and IPFIX explicitly.
- Question 35Interactive
Examine the following command and determine its purpose in VXLAN/EVPN tuning.
- AEnables inner IP hashing for VXLAN trafficCorrect answer
- BDisables jumbo frame support
- CReduces BGP keepalive timers
- DIncreases ARP cache size
Why this is the answer
The command 'load-balance vxlan inner-ip' optimizes ECMP hashing by using inner packet fields, preventing polarization.
- Question 36Single Choice
What does an 'UNREACHABLE' status in Ansible output signify?
- AThe task execution failed
- BThe device is unreachable via transportCorrect answer
- CThe playbook syntax is invalid
- DThe device user credentials are wrong
Why this is the answer
'UNREACHABLE' means Ansible cannot establish an SSH or eAPI connection to the device.
- Question 37Multiple Select
Which of the following are common causes of security policy conflicts in Arista networks?
- AIncorrect rule orderingCorrect answer
- BExcessive bandwidth usage
- CImplicit deny at zone boundariesCorrect answer
- DFrequent firmware upgrades
Why this is the answer
Rule ordering and implicit deny are common conflict sources; bandwidth and firmware upgrades are not direct causes.
- Question 38Interactive
Review the following tcpdump command and identify its purpose in L7 packet analysis.
- ACapture only HTTP traffic on port 80Correct answer
- BMonitor all ICMP packets
- CFilter for DNS queries only
- DCapture traffic from a specific host
Why this is the answer
The filter 'tcp port 80' captures only TCP traffic destined to HTTP, aiding in web application troubleshooting.
- Question 39Single Choice
What is the default ARP aging time on Arista VTEPs in an EVPN environment?
- A120 seconds
- B300 secondsCorrect answer
- C600 seconds
- D900 seconds
Why this is the answer
The document specifies the default ARP aging timeout as 300 seconds, matching the application ARP cache.
- Question 40Multiple Select
Which two tools are recommended for capturing packet-level data on Arista switches?
- AtcpdumpCorrect answer
- BWiresharkCorrect answer
- CNetFlow
- DSNMP
Why this is the answer
tcpdump runs directly on EOS bash; Wireshark is used for offline analysis. NetFlow and SNMP are not packet capture tools.
Frequently asked questions
Everything about the ACE: L7 Expert question bank and how to use it.