4A0-D01 Nokia Data Center Fabric Fundamentals Exam Questions and Answers

Comprehensive and Detailed Explanation with Exact Extracts:

Exhibit Analysis:

The output shows real-time ICMP packet captures (echo requests/replies) with detailed metadata (interface, source/destination IP, protocol, size, TTL).

The command tools system traffic-monitor protocol icmp confirms this is a tcpdump-like utility (packet capture tool), not a log file.

Mechanism for Packet Capture:

Capture-filter ACL is required to copy data-plane packets (like ICMP between hosts) to the CPM for analysis by traffic-monitor.

Extract from Nokia SR Linux Troubleshooting Guide:

"traffic-monitor is a CPM-based packet capture tool. To capture data-plane traffic (e.g., host-to-host ICMP), a capture-filter ACL must be applied to interfaces to copy packets to the CPM."

Extract from Nokia SR Linux ACL Configuration Guide:

"Unlike cpm-filter (for control-plane protection), capture-filter ACLs are designed to mirror user traffic to the CPM for debugging via traffic-monitor."

Why Other Options Are False:

A: Generic "ACL filter" is ambiguous. Only capture-filter ACLs copy data-plane traffic to the CPM for traffic-monitor.

C: cpm-filter policer rate-limits control-plane traffic (e.g., ICMP to the router), not host-to-host ICMP. It does not enable packet capture.

D: cpm-filter handles control-plane traffic destined for the router (e.g., ICMP to router IPs), not transit traffic. It does not support traffic-monitor.

Comprehensive and Detailed Explanation with Exact Extracts:

Option B is FALSE:

The system-cpu-policer is a software-based policer running on the CPM CPU, not hardware-based.

Extract from Nokia SR Linux QoS Guide (Section: Control Plane Policing):

"The system-cpu-policer is enforced in software on the CPM. In contrast, distributed-policers are hardware-based and execute on line cards."

Other Options are TRUE:

A: Hierarchical policing (e.g., per-protocol child policers under an aggregate) is supported.

Extract: "Hierarchical policers allow aggregate rate-limiting plus per-protocol sub-policers (e.g., for BGP, OSPF)."

C: The system-cpu-policer polices the aggregate traffic reaching the CPM.

Extract: "system-cpu-policer applies to the sum of all traffic forwarded from line cards to the CPM."

D: CPM-filter entries can combine both policers:

distributed-policer (line card hardware) for early per-card rate-limiting.

system-cpu-policer (CPM software) for final aggregate policing.

Extract: "CPM-filter entries may reference both a distributed-policer (for per-line card enforcement) and a system-cpu-policer (for CPM-wide aggregation)."

Comprehensive and Detailed Explanation with Exact Extracts:

Option B (CPM-filter ACL) is CORRECT:

The CPM-filter ACL is explicitly designed to match control-plane traffic and copy it to the CPM (Control/Management Plane). It is instantiated in hardware on all line cards.

Extract from Nokia SR Linux Security Guide (Section: Control Plane Protection):

"The cpm-filter ACL is instantiated on every line card to identify packets destined for the CPM (e.g., routing protocols, ICMP). Matched packets are copied to the CPM while data-plane traffic is forwarded normally."

Other Options are INCORRECT:

A: Capture-filter ACL is for packet mirroring (e.g., SPAN), not CPM copying.

C/D: Ingress/Egress ACLs filter user traffic and are not specific to CPM-bound packets.

Extract from Nokia SR Linux ACL Configuration Guide:

"Only cpm-filter ACLs are globally applied across line cards for CPM protection. Interface ACLs (ingress/egress) operate locally and do not copy packets to the CPM."

Comprehensive and Detailed Explanation with Exact Extracts:

Option A (VNI is included): The IMET route explicitly carries the VNI (as the Ethernet Tag ID) to identify the Layer 2 domain.

Extract from Nokia EVPN-VXLAN Guide (Section: IMET Route):

"The IMET (Type 3) route includes the VNI (Ethernet Tag ID) to signal membership in a specific broadcast domain."

Option B (Flooding list is NOT included): The IMET route does not contain a flooding list. Each VTEP independently builds the flooding list by aggregating all received IMET routes for the same VNI (e.g., VTEP1 uses IMET routes from VTEP2 and VTEP3 to build its list).

Extract from Nokia SR Linux Fundamentals Guide (Section: EVPN BUM Handling):

"The flooding list for a VNI is dynamically constructed by each VTEP based on received IMET routes. The IMET route itself only advertises the sender's VTEP IP and VNI, not a pre-defined list of peers."

Option C (Route Distinguisher is included): The IMET route includes the MAC-VRF's Route Distinguisher (RD) to ensure uniqueness in the control plane.

Extract from Nokia EVPN Configuration Guide:

"Every IMET route carries the MAC-VRF's RD to distinguish overlapping VNIs across different network instances."

Option D (VTEP IP is included): The IMET route advertises the VTEP's IP address (via the PMSI Tunnel attribute) to establish the BUM traffic tunnel endpoint.

Extract from Nokia SR Linux Configuration Guide (Section: EVPN Routes):

"The IMET route includes the originating VTEP's IP address in the PMSI Tunnel field. This IP is used as the destination for VXLAN-encapsulated BUM traffic."

Exhibit Analysis:

The IMET routes (advertised by VTEP1, VTEP2, VTEP3) are shown.

Each VTEP's locally configured flooding list (e.g., VTEP1: [VTEP2, VTEP3]) is derived from received IMET routes, not embedded in the IMET route itself.

Comprehensive and Detailed Explanation with Exact Extracts:

Exhibit Analysis:

The configuration defines a log file named bgp-log (not a buffer) under system logging.

It includes messages from subsystems bgp and netinst (network-instance).

SR Linux Logging Command Syntax:

show system logging file  is the operational command to display contents of a log file.

show system logging buffer  is used for memory buffers, not files.

info commands display configuration, not log contents.

Verification from Documentation:Extract from Nokia SR Linux CLI Guide (Section: Logging Commands):

"Use show system logging file  to display the current contents of a configured log file. For example:

text

Copy

Download

A:dc-leaf-1# show system logging file bgp-log

This outputs the log entries stored in the specified file."

Extract from Nokia SR Linux Configuration Guide (Section: Log Files):

"Log files are persistent entities stored in /var/log/srlinux/. Their contents are viewed exclusively via show system logging file, not info or buffer commands."

Why Other Options Are Incorrect:

A: buffer references in-memory logs, not persistent files.

C/D: info displays configuration (e.g., info system logging shows the snippet in the exhibit), not log contents.

Comprehensive and Detailed Explanation with Exact Extracts:

Options A, B, and C ARE configured in static-routes:

Blackhole: Configured under static-routes for a prefix to drop traffic.

IPv4 destination prefix: Defined directly in the static-routes container.

Preference value: Set per static route entry within static-routes.

Extract from Nokia SR Linux Configuration Guide (Section: Static Routes):

"Static routes are configured under /routing-policy/static-routes. Each entry requires a prefix (e.g., 0.0.0.0/0). The blackhole parameter and preference value are configured directly within this container for a specific prefix."

Option D (Next-hop group) CANNOT be configured in static-routes:

Next-hop groups are separate objects defined under /routing-policy/next-hop-groups.

The static-routes container references a next-hop group by name but does not define its properties.

Extract from Nokia SR Linux Configuration Guide (Section: Next-Hop Groups):

"Next-hop groups are configured under /routing-policy/next-hop-groups. Each group is given a name and defines properties like next-hop IPs, blackhole behavior, or indirect settings. Static routes reference a next-hop group via the next-hop-group parameter under /routing-policy/static-routes but do not configure the group itself here."

Comprehensive and Detailed Explanation with Exact Extracts:

Option A (TRUE): SR Linux uses local6 as the default syslog facility.

Extract from Nokia SR Linux System Management Guide:

"System logs are emitted with the syslog facility local6 by default, allowing integration with standard Linux syslog utilities."

Option B (TRUE): SR Linux supports local encrypted log storage.

Extract from Nokia SR Linux Security Guide:

"Log files stored locally can be encrypted using AES-256 to ensure confidentiality and integrity of audit trails."

Option C (TRUE): Log filters are fully supported for message selection.

Extract from Nokia SR Linux Configuration Guide (Section: Logging):

"Filters can be applied to log messages based on severity, subsystem, or content, enabling granular control over log destinations."

Option D (FALSE): SR Linux uses systemd-journald, not rsyslog, for log management.

*Extract from Nokia SR Linux Release Notes (v21.11+):*

"SR Linux logging configurations are not translated to /etc/rsyslog.conf. The system relies on systemd-journald for log collection and storage, with configurations managed via SR Linux CLI and stored in /etc/journald.conf."