4A0-D03 Exam Dumps - Nokia Certified Data Center Fabric Professional Questions and Answers

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In active-standby, or single-active, Layer 2 EVPN multi-homing, only one PE is active for the Ethernet Segment and MAC-VRF at a time. Leaf1 and Leaf2 participate in DF election, and the elected DF becomes the active forwarding PE for that service attachment. Because this is not all-active multi-homing, the non-DF must not forward traffic to the host for the protected service. This prevents duplicate frames, incorrect MAC learning, and loops on the access side. The DF accepts traffic from the host and forwards BUM traffic received from remote PEs toward the host-facing segment. Option D is false because it claims that the non-DF can forward unicast traffic from remote PEs to the host. In single-active operation, remote peers must direct traffic to the active PE, and the standby PE remains ready to take over only after DF state changes. This is the operational distinction from all-active multi-homing, where more than one PE may be used for forwarding depending on the traffic type and aliasing behavior. Reference: single-active L2 EVPN multi-homing, DF role, non-DF forwarding suppression.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

VXLAN provides a Layer 2 overlay over a Layer 3 underlay by encapsulating Ethernet frames in UDP/IP. This allows tenant bridge domains to span a routed IP fabric without requiring the underlay itself to behave like one large Layer 2 network. VXLAN uses a 24-bit VXLAN Network Identifier, which supports approximately 16 million logical overlays, far exceeding the scale of traditional 12-bit VLAN IDs. Because the VXLAN underlay is IP-routed, traffic can benefit from ECMP across equal-cost paths, improving fabric utilization and resiliency. The false statement is B. VXLAN was not originally developed specifically to support EVPN. VXLAN began as a data-plane overlay encapsulation technology, while EVPN later became the preferred control plane for distributing MAC, MAC/IP, multicast, and prefix reachability in VXLAN-based fabrics. In modern data center design, EVPN and VXLAN are commonly paired: VXLAN supplies the encapsulation and VNI-based segmentation, while EVPN supplies scalable control-plane learning and signaling. Reference: VXLAN data plane, EVPN control plane, ECMP underlay, VNI-based tenant isolation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In asymmetric EVPN IRB, the ingress PE performs routing from the source subnet into the destination subnet, then forwards the packet across the VXLAN overlay using the destination MAC-VRF/VNI. The egress PE does not perform another IP-VRF lookup for that packet; it performs Layer 2 forwarding in the destination MAC-VRF. In this scenario, Host-2 sends traffic toward Host-1. After the ingress routing decision, the traffic arrives at Leaf-2 in the context of the destination MAC-VRF, mac-vrf-1. Leaf-2 then performs a MAC lookup in mac-vrf-1 and forwards the frame to Host-1. Option D is therefore correct. Option A reverses the forwarding direction and misidentifies the leaf action. Option B incorrectly sends mac-vrf-2 traffic toward the IP-VRF on Leaf-2, even though Leaf-2 is acting as the egress PE for Host-1. Option C is also incorrect because the egress forwarding action is based on the MAC table in the destination MAC-VRF, not an IP-VRF ARP lookup at that stage. Reference: asymmetric L3 EVPN IRB data-plane operation, ingress routing and egress MAC forwarding.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In a decoupled gateway-based DCI design, the data center border leaf and the WAN PE are separate devices. Traffic between them can be identified using VLAN tags, allowing different data center EVPN services to be mapped to corresponding WAN VPN services. This architecture provides a clean operational boundary: the border leaf remains aligned with the data center EVPN/VXLAN fabric, while the WAN PE handles WAN VPN transport, QoS, security policy, and service interconnection. The separation gives a strong demarcation point for troubleshooting and administrative control. Option D is false because the WAN PE does not maintain an MP-BGP EVPN peering session with the data center route reflector. In the decoupled model, the route reflector remains part of the data center EVPN control plane, while the WAN PE exchanges routing or service information with the border leaf through the local handoff model. Direct WAN PE-to-data-center-RR peering would blur the separation that defines the decoupled design and would make the WAN PE part of the data center EVPN overlay control plane, which is not the intended architecture. Reference: decoupled gateway DCI, VLAN handoff, WAN VPN mapping, security/QoS demarcation, route-reflector separation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

The exhibit describes an EVPN IRB environment where MAC-VRF100 and IP-VRF-100 exchange host reachability through local learning and EVPN advertisements. Leaf-1 can advertise EVPN route type 2 updates containing host MAC/IP information for MAC-VRF100. This is the normal mechanism used to distribute endpoint bindings learned from local hosts. If IP-VRF-100 is not configured for prefix advertisement, Leaf-1 will not generate EVPN route type 5 updates for that IP-VRF, so option A is consistent. The ARP cache in the IP-VRF is normally required for local subnet host resolution; remote host reachability can be learned through EVPN rather than requiring every remote ARP entry to be learned by local data-plane ARP. Option B is false because ARP/GARP snooping is not performed by the IRB interface in the manner stated. ARP/GARP learning for proxy ARP and MAC/IP advertisement is associated with the MAC-VRF bridge-domain behavior and the local access side, not with the IRB subinterface indiscriminately snooping all ARP/GARP messages as described. Reference: EVPN IRB operation, RT-2 host MAC/IP advertisement, RT-5 behavior, ARP/GARP learning scope.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In many SR Linux data center fabrics, eBGP is used in the underlay because it gives simple hop-by-hop routing, fast convergence, and clean autonomous-system separation between leaf and spine nodes. The EVPN overlay, however, is a separate MP-BGP control plane used to distribute EVPN NLRI. The overlay route-reflector session does not have to reuse the leaf's underlay autonomous system number. In practice, an overlay BGP group may use a distinct local AS or configuration model separate from the underlay AS design. Therefore, option B is false. The route reflector's cluster ID is configured on the route reflector itself to prevent reflection loops and identify the RR cluster. Redundant route reflectors can be deployed for resiliency, and clients may receive duplicate paths or duplicate updates from multiple RRs; the BGP decision process and route reflection rules handle this. The key design distinction is that underlay eBGP provides IP reachability between loopbacks, while overlay MP-BGP EVPN carries tenant service reachability. Mixing these roles leads to incorrect AS planning. Reference: SR Linux EVPN MP-BGP route reflectors, eBGP underlay, overlay BGP sessions.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

An IRB interface is the logical connection point between a Layer 2 MAC-VRF and a Layer 3 IP-VRF. It provides the routed gateway function for hosts in the bridge domain while allowing traffic to move into the routed VRF for inter-subnet forwarding. The correct statement is that when an IRB sub-interface has multiple IP addresses, one can be designated as the primary. This is important because the primary address is used for normal gateway or subnet behavior when more than one address is present on the same routed interface context. Option A is inaccurate because the question is about an IRB sub-interface, not a generic subinterface selection between bridge or routed access modes. Option B is not the defining multi-homing model; EVPN multi-homing is implemented through Ethernet Segment association and MAC-VRF attachment behavior, not by adding multiple IRB subinterfaces for multi-homing. Option D is also wrong because the IRB is the shared logical link between the MAC-VRF and IP-VRF; the design does not require separate IRB subinterfaces on each side as independent constructs. Reference: SR Linux IRB configuration, MAC-VRF to IP-VRF interconnection, primary IP addressing.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A distributed Layer 2 EVPN in SR Linux is implemented using MAC-VRF network instances, EVPN control-plane signaling, and VXLAN data-plane encapsulation. A common mistake is assuming that every PE must use the same EVI value for the same L2 service. In SR Linux, the important operational requirement is that the correct EVPN routes are imported and exported using matching route-target policy, not necessarily that every PE has the same locally configured EVI. Therefore, option A is false. The route distinguisher can be automatically generated using local values such as the autonomous system number and EVI, giving each PE's EVPN routes uniqueness in MP-BGP. A MAC-VRF is associated with VXLAN encapsulation for its data-plane service mapping, and route targets may need to be manually configured when leaf routers are in different autonomous systems because automatic derivation may not produce matching import/export policy across AS boundaries. The key separation is this: the RD gives uniqueness, the route target controls service membership, and the EVI is a local service identifier rather than a universal mandatory match in all designs. Reference: SR Linux distributed L2 EVPN configuration, EVI, RD auto-generation, route-target policy.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

Asymmetric routing relies heavily on host MAC/IP information because the ingress PE performs routing into the destination subnet and then sends the frame across the overlay using the destination MAC-VRF/VNI. This means PEs require enough ARP and MAC/IP binding information to forward traffic toward remote hosts correctly. If a host has multiple IP addresses on the same interface, separate EVPN route type 2 advertisements may be needed to communicate each IP-to-MAC binding. The ingress and egress PEs participate in MAC and IP forwarding across the end-to-end service path, but the forwarding responsibilities differ by direction and stage. The false statement is option C. The statement says all MAC-VRFs connected to the L3 EVPN network must exist on each PE, but that is not the correct requirement in this question's verified answer set. In practical EVPN designs, the exact MAC-VRF placement depends on whether the service is implemented as asymmetric, symmetric, interface-less, or interface-ful routing. Here, the course answer marks the universal MAC-VRF requirement as false. Reference: asymmetric L3 EVPN routing, RT-2 MAC/IP advertisements, ARP and MAC forwarding behavior.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

The route target is the extended community consistently associated with EVPN updates to control route import and export between EVPN instances. In SR Linux EVPN services, route targets determine which MAC-VRF or IP-VRF should import a received EVPN route. This is essential for tenant separation because multiple tenants may use overlapping MAC or IP address spaces while sharing the same physical fabric and BGP control plane. The AFI/SAFI is not an extended community; it identifies the BGP address family and subsequent address family used to carry EVPN NLRI. The EVPN route type is also not an extended community; it is part of the EVPN NLRI structure and identifies whether the route is RT-1, RT-2, RT-3, RT-4, RT-5, and so on. The VXLAN network ID may be carried or inferred through service and encapsulation-specific attributes, but it is not universally present as the required extended community in every EVPN update. The route target is the mandatory policy element that enables receiving PEs to place EVPN routes into the correct service context. Reference: EVPN extended communities, route-target import/export policy, tenant service identification.

================