nerdexam
Cisco

350-401 · Question #461

Refer to the exhibit. An engineer attempts to create a configuration to allow the Blue VRF to leak into the global routing table, but the configuration does not function as expected. Which action reso

The correct answer is A. Change the access-list destination mask to a wildcard.. To correctly match a network for route leaking from a VRF into the global routing table using an access-list, the access-list's destination mask must be specified as a wildcard mask.

Submitted by neha2k· Mar 6, 2026Routing

Question

Refer to the exhibit. An engineer attempts to create a configuration to allow the Blue VRF to leak into the global routing table, but the configuration does not function as expected. Which action resolves this issue?

Exhibits

350-401 question #461 exhibit 1
350-401 question #461 exhibit 2

Options

  • AChange the access-list destination mask to a wildcard.
  • BChange the source network that Is specified in access-list 101.
  • CChange the route-map configuration to VRF_BLUE.
  • DChange the access-list number in the route map

How the community answered

(27 responses)
  • A
    59% (16)
  • B
    11% (3)
  • C
    7% (2)
  • D
    22% (6)

Why each option

To correctly match a network for route leaking from a VRF into the global routing table using an access-list, the access-list's destination mask must be specified as a wildcard mask.

AChange the access-list destination mask to a wildcard.Correct

Standard access lists, when used with `match ip address` in a route-map for prefix matching, interpret the second operand as a wildcard mask. Changing the mask from `255.255.255.0` to `0.0.0.255` will allow `access-list 101` to correctly match routes for the `192.168.1.0/24` network, enabling the route leak.

BChange the source network that Is specified in access-list 101.

The source network `192.168.1.0` is correct if that is the network intended to be leaked, but the issue lies with how the access-list mask is interpreted by the route-map for matching prefixes.

CChange the route-map configuration to VRF_BLUE.

The route-map name `VRF_BLUE_TO_GLOBAL` is functional; changing it to `VRF_BLUE` does not address the access-list matching problem.

DChange the access-list number in the route map

The access-list number `101` is referenced correctly within the route-map `match ip address 101` command; changing the number without a corresponding change in the access-list definition would break the configuration further.

Concept tested: Route-map access-list wildcard mask matching

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/configuration/xe-3s/iri-xe-3s-book/iri-xe-3s-iproute-cfg.html

Topics

#VRF routing#Route Map configuration#ACL wildcard masks#Route leaking

Community Discussion

No community discussion yet for this question.

Full 350-401 Practice