Free Practice Questions for the Nokia Certified Data Center Fabric Professional 4A0-D03 Exam (2026 Updated)

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In active-standby, or single-active, Layer 2 EVPN multi-homing, only one PE is active for the Ethernet Segment and MAC-VRF at a time. Leaf1 and Leaf2 participate in DF election, and the elected DF becomes the active forwarding PE for that service attachment. Because this is not all-active multi-homing, the non-DF must not forward traffic to the host for the protected service. This prevents duplicate frames, incorrect MAC learning, and loops on the access side. The DF accepts traffic from the host and forwards BUM traffic received from remote PEs toward the host-facing segment. Option D is false because it claims that the non-DF can forward unicast traffic from remote PEs to the host. In single-active operation, remote peers must direct traffic to the active PE, and the standby PE remains ready to take over only after DF state changes. This is the operational distinction from all-active multi-homing, where more than one PE may be used for forwarding depending on the traffic type and aliasing behavior. Reference: single-active L2 EVPN multi-homing, DF role, non-DF forwarding suppression.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A distributed Layer 2 EVPN in SR Linux is implemented using MAC-VRF network instances, EVPN control-plane signaling, and VXLAN data-plane encapsulation. A common mistake is assuming that every PE must use the same EVI value for the same L2 service. In SR Linux, the important operational requirement is that the correct EVPN routes are imported and exported using matching route-target policy, not necessarily that every PE has the same locally configured EVI. Therefore, option A is false. The route distinguisher can be automatically generated using local values such as the autonomous system number and EVI, giving each PE's EVPN routes uniqueness in MP-BGP. A MAC-VRF is associated with VXLAN encapsulation for its data-plane service mapping, and route targets may need to be manually configured when leaf routers are in different autonomous systems because automatic derivation may not produce matching import/export policy across AS boundaries. The key separation is this: the RD gives uniqueness, the route target controls service membership, and the EVI is a local service identifier rather than a universal mandatory match in all designs. Reference: SR Linux distributed L2 EVPN configuration, EVI, RD auto-generation, route-target policy.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

An anycast-gateway IRB allows multiple PEs to present the same default-gateway IP address to hosts in the same subnet. This is the mechanism that enables distributed gateway behavior in EVPN fabrics. The same anycast gateway IP may be configured on equivalent IRB subinterfaces across remote PEs participating in the same IP-VRF, allowing hosts to use the nearest leaf as their default gateway without changing their gateway address. SR Linux also associates gateway MAC information with the IRB, including virtual gateway MAC behavior used inside the MAC-VRF forwarding table. Option C is false because the anycast gateway IP is not treated as a normal unique host route that appears in the IP-VRF route table alongside the subnet prefix. The subnet route is installed for the connected network, but the shared anycast gateway address is a gateway function, not a separately advertised host endpoint that should appear as ordinary routed host reachability. Treating the anycast IP as a regular host route would undermine the distributed gateway model and create ambiguous ownership across PEs. Reference: IRB anycast gateway, MAC-VRF/IP-VRF interconnection, distributed default-gateway operation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In an integrated gateway-based DCI design, the same physical or logical router performs both the data center gateway role and the WAN PE role. This is why option D is correct. The device terminates or participates in the data center-side EVPN service and also handles the WAN-side VPN transport, including route translation or re-advertisement where needed. This approach avoids exposing every data center leaf router to the WAN and avoids requiring route reflector reachability between data centers. It also avoids building VXLAN tunnels directly between all leaf routers in separate data centers. Those characteristics belong to gateway-less DCI, where the EVPN overlay stretches more directly across the WAN and the WAN must carry the underlay or overlay reachability required by the data center leaves. Integrated gateway design is more controlled: the gateway is the interworking point, which makes it suitable when the provider or operator wants a strong service boundary and centralized DCI policy enforcement. Reference: integrated gateway-based DCI, single-router gateway/WAN PE function, EVPN/VPN interworking.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

An IRB interface provides the logical L3 gateway function between a Layer 2 MAC-VRF and a Layer 3 IP-VRF on the same PE. It allows locally bridged hosts to route into the tenant IP-VRF while preserving EVPN control-plane signaling for MAC/IP reachability. The IRB subinterface must have at least one IP address because it acts as the routed gateway for the subnet, and it may also be configured with ACLs to apply traffic policy at the L3 boundary. Option B is false because it incorrectly generalizes the IRB relationship. In SR Linux EVPN service modeling, an IRB subinterface connects a MAC-VRF to an IP-VRF in a controlled one-to-one service attachment context; the design is not that both IP-VRFs and MAC-VRFs arbitrarily contain multiple IRB interfaces for the same relationship. A MAC-VRF has its IRB gateway association into the IP-VRF, and the IP-VRF may connect to multiple MAC-VRFs through distinct IRB contexts, but the statement as written is not the correct rule for IRB interface behavior. Reference: SR Linux IRB interface operation, MAC-VRF/IP-VRF interconnection, gateway IP and ACL support.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

Ethernet Auto-Discovery per EVI routes are EVPN route type 1 advertisements used in multi-homing at the service-instance level. A PE sends an AD per EVI route for each MAC-VRF associated with the Ethernet Segment. These routes allow remote PEs to understand that the advertising PE has reachability to a given EVI through the shared ES. They are also used for aliasing and fast convergence, because a remote PE can treat multiple attached PEs as valid paths for traffic toward the same multihomed segment. In VXLAN EVPN, the update can include data-plane information such as the VNI, and it carries route-target information so the route is imported into the correct MAC-VRF. Option B is false because the multi-homing type or redundancy mode is not carried in the AD per EVI update as stated. Redundancy behavior is associated with Ethernet Segment-level signaling and configuration, especially ES discovery and related route attributes, not with AD per EVI as the mechanism that declares the multi-homing type. Reference: EVPN RT-1 AD per EVI, MAC-VRF association, route target, VNI, aliasing.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A BGP route target is an extended community used to control which EVPN routes are imported into which MAC-VRF or IP-VRF. It is carried with EVPN updates and acts as the import/export policy tag for tenant service membership. The statement that it is a BGP extended community is correct. It is also correct that route targets support multi-tenant operation, because they allow different EVPN instances to carry potentially overlapping MAC or IP information while importing only the routes intended for that service. However, option D is false in the wording used here. The route target does not itself identify the EVPN instance in the control plane as a unique route identifier. That role is more closely associated with the route distinguisher and EVPN NLRI construction, while the route target determines import eligibility. A route target tells a receiving PE whether the route belongs in a local service instance, but it is not the unique identity of the EVPN route. This distinction is critical: route distinguishers make routes unique; route targets control route distribution and service membership. Reference: EVPN route targets, BGP extended communities, route import/export policy, RD versus RT function.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

A route distinguisher is used in MP-BGP VPN and EVPN address families to make otherwise overlapping tenant routes unique in the BGP control plane. In EVPN, different tenants or EVPN instances may legitimately use the same MAC or IP values. The route distinguisher makes the NLRI globally unique by prepending a unique value to the tenant route. It is typically unique per PE and per EVI, and it is carried in EVPN route advertisements. However, the route distinguisher does not control route import, export, or service membership. That role belongs to the route target, which is a BGP extended community used by receiving PEs to decide which EVPN instance should import the route. Therefore, option D is not part of the correct description of a route distinguisher. Saying that the RD identifies the EVPN instance in the control plane confuses RD uniqueness with route-target membership. The RD makes routes unique; the route target associates those routes with the appropriate MAC-VRF or IP-VRF import policy. Reference: EVPN route distinguisher, overlapping tenant addresses, route target separation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In a distributed Layer 2 EVPN service, the local leaf learns host reachability from frames received on access interfaces. When a host replies to an ARP request, the local leaf can learn the source MAC address from the Ethernet frame and install it in the MAC forwarding table. If the ARP payload contains an IP/MAC binding, the PE can also use that information for proxy ARP and EVPN MAC/IP advertisement. The local PE then advertises the learned endpoint reachability using EVPN route type 2 to its BGP EVPN peers or route reflector. The false statement is B. The ARP reply is not replicated to every leaf in the flooding list as a normal operation. EVPN's purpose is to reduce unnecessary flooding by distributing endpoint reachability through the control plane. BUM replication is used for broadcast, unknown unicast, and multicast traffic when needed, but a learned ARP reply does not require blind replication to all remote leaves. Instead, the leaf advertises the learned MAC/IP state through MP-BGP EVPN, allowing remote PEs to install accurate forwarding and proxy ARP state. Reference: distributed L2 EVPN operation, ARP learning, EVPN RT-2 advertisement.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In a decoupled gateway-based DCI design, the data center border leaf and the WAN PE are separate devices. Traffic between them can be identified using VLAN tags, allowing different data center EVPN services to be mapped to corresponding WAN VPN services. This architecture provides a clean operational boundary: the border leaf remains aligned with the data center EVPN/VXLAN fabric, while the WAN PE handles WAN VPN transport, QoS, security policy, and service interconnection. The separation gives a strong demarcation point for troubleshooting and administrative control. Option D is false because the WAN PE does not maintain an MP-BGP EVPN peering session with the data center route reflector. In the decoupled model, the route reflector remains part of the data center EVPN control plane, while the WAN PE exchanges routing or service information with the border leaf through the local handoff model. Direct WAN PE-to-data-center-RR peering would blur the separation that defines the decoupled design and would make the WAN PE part of the data center EVPN overlay control plane, which is not the intended architecture. Reference: decoupled gateway DCI, VLAN handoff, WAN VPN mapping, security/QoS demarcation, route-reflector separation.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics] :

In an integrated gateway-based data center interconnect design, the gateway must interwork between the data center EVPN/VXLAN domain and the WAN VPN transport domain. For Layer 3 VPN connectivity on a Nokia 7750 SR integrated gateway, the base BGP instance must support the relevant VPN address families, such as VPN-IPv4 and EVPN, because the gateway participates in control-plane exchange between the data center and WAN sides. The VPRN must also be associated with the WAN transport, normally through MPLS tunnel binding, and the VRF target must match the corresponding VPRN on the remote gateway so that VPN routes are imported and exported correctly. A routed VXLAN interface, however, is an SR Linux IP-VRF/VXLAN construct used for symmetric L3 EVPN forwarding inside a VXLAN-based data center fabric. In this question, dcgw10 is acting as the integrated WAN gateway for L3VPN connectivity, so a routed VXLAN interface is not the required configuration item on the VPRN instance. Reference: integrated gateway DCI, VPRN over MPLS, EVPN-to-VPN interworking.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

The exhibit describes an EVPN IRB environment where MAC-VRF100 and IP-VRF-100 exchange host reachability through local learning and EVPN advertisements. Leaf-1 can advertise EVPN route type 2 updates containing host MAC/IP information for MAC-VRF100. This is the normal mechanism used to distribute endpoint bindings learned from local hosts. If IP-VRF-100 is not configured for prefix advertisement, Leaf-1 will not generate EVPN route type 5 updates for that IP-VRF, so option A is consistent. The ARP cache in the IP-VRF is normally required for local subnet host resolution; remote host reachability can be learned through EVPN rather than requiring every remote ARP entry to be learned by local data-plane ARP. Option B is false because ARP/GARP snooping is not performed by the IRB interface in the manner stated. ARP/GARP learning for proxy ARP and MAC/IP advertisement is associated with the MAC-VRF bridge-domain behavior and the local access side, not with the IRB subinterface indiscriminately snooping all ARP/GARP messages as described. Reference: EVPN IRB operation, RT-2 host MAC/IP advertisement, RT-5 behavior, ARP/GARP learning scope.

================

Comprehensive and Detailed 150 to 250 words of Explanation From [SR Linux EVPN and Data Center Interconnect/Course Guide/topics]:

In an all-active Layer 2 EVPN multi-homing design, the host is normally dual-attached through a LAG to multiple leaf routers that share the same Ethernet Segment Identifier. Leaf1 and Leaf2 both participate in the Ethernet Segment and may receive traffic from the host. For BUM traffic sourced by the host, the host-side hashing can send frames toward either attached leaf. For BUM traffic sent from the EVPN overlay toward the multi-homed segment, DF election controls which PE forwards that replicated traffic toward the local Ethernet Segment to prevent duplicate delivery. The false statement is option B. A remote leaf such as Leaf3 does not simply enable ECMP on the MAC-VRF to load-balance traffic between Leaf1 and Leaf2. EVPN all-active forwarding uses Ethernet Segment discovery, Ethernet A-D routes, aliasing, and split-horizon procedures to determine valid next-hops and prevent loops. ECMP alone is an underlay or routing-table behavior; it is not the MAC-VRF mechanism that authorizes multi-homed L2 forwarding across an Ethernet Segment. Reference: all-active L2 EVPN multi-homing, Ethernet Segment association, DF election, aliasing.

================