350-601 Exam Questions and Answers

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

MTU mismatch on the underlay network

Anycast gateway is not configured on the leaf

BGP EVPN peers are not established

The VLAN-to-VNI mapping is missing under the VLAN configuration

A VNI appears in 'show nve vni' only when its VLAN is mapped to it under the VLAN configuration. Without that mapping, the NVE interface stays up/up but the VNI is never instantiated, breaking VXLAN bridging for that VLAN across leaf switches.

Why: The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

Set OSPF priority to 255 on the interface

Set OSPF priority to 0 on the interface

OSPF priority determines DR election eligibility on multi-access segments; the highest priority wins, with ties broken by router ID. Setting priority to 0 makes the interface ineligible, so the Nexus switch never becomes DR or BDR, satisfying the stated requirement.

Change the OSPF network type to point-to-point

Configure the interface as passive under OSPF

Why: Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

Upgrade both switches simultaneously using ISSU

Reload both switches to a previous version, then upgrade

Upgrade the primary vPC peer first, then the secondary

Upgrade the secondary vPC peer first, then the primary

Upgrading the secondary vPC peer first keeps the primary forwarding traffic throughout, so the vPC domain retains at least one active member and disruption is minimal. The primary is then upgraded while the secondary carries traffic, preserving the peer link and anycast behaviour.

Why: In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

The underlay network provides IP connectivity between VTEPs

Underlay routing (e.g., IS-IS, OSPF) enables VTEP-to-VTEP reachability.

BGP EVPN advertises MAC addresses and IP addresses as routes

EVPN Type-2 routes carry MAC/IP information.

VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

VXLAN uses a 32-bit network identifier (VNI)

The control plane is responsible for actual data forwarding

Why: The VXLAN underlay network (typically an IP-based fabric using protocols like OSPF or IS-IS) provides IP connectivity between VTEPs, enabling them to encapsulate and decapsulate VXLAN packets. Without this underlay reachability, VTEPs cannot communicate, making it a foundational requirement for VXLAN operation.

Refer to the exhibit. An engineer is configuring a server-facing interface on a Nexus switch. The server is running VMware ESXi with multiple virtual machines in VLANs 10, 20, and 30. After applying the configuration, the ESXi host reports that it cannot communicate on VLAN 30. Which configuration change should be made?

Remove the 'spanning-tree port type edge trunk' command

Change the native VLAN to 30

Create VLAN 30 in the global VLAN database

VLAN 30 must exist in the Nexus global VLAN database before it can be assigned to the server-facing interface or carried in a trunk. Without it, the switch drops VLAN 30 traffic, so the ESXi host cannot communicate on that VLAN.

Configure the port as an access port in VLAN 30

Why: VLAN 30 must exist in the global VLAN database before it can be used on any interface. Even though the interface configuration allows VLAN 30 as a trunked VLAN, the switch will not forward traffic for a VLAN that has not been created globally. Without the 'vlan 30' command in global configuration mode, the VLAN is not present in the switch's VLAN database, and the interface will not pass traffic for that VLAN.

Refer to the exhibit. A VXLAN VNI (10030) is operationally down. What is the most likely cause?

The source interface loopback0 is not up

The NVE mode should be L2VPN instead of L3VPN

The VLAN associated with VNI 10030 is not configured or mapped

The VNI must be mapped to a VLAN using 'vn-segment vlan-id' under the VLAN configuration; missing mapping causes operational down.

The multicast group 239.1.1.1 is not reachable

Why: VXLAN VNI 10030 is operationally down because the VLAN that maps to this VNI is either not created or not associated with the VNI under the NVE interface. In Cisco NX-OS, a VNI becomes operationally up only when the corresponding VLAN exists and is properly mapped via the `member vni 10030 associate-vrf` or `member vni 10030` command under the NVE interface. Without this mapping, the NVE cannot forward traffic for that VNI, leaving it in a down state.

Want more Network practice?

All Storage Network questions

Domain 2: Storage Network

20% of exam · 6 sample questions below

An engineer is configuring a Fibre Channel over Ethernet (FCoE) SAN. Which statement about FCoE Initialization Protocol (FIP) is true?

FIP operates only over lossless Ethernet.

FIP uses Ethernet MAC addresses for communication.

FIP operates at Layer 2, encapsulating its discovery, login and keepalive frames directly in Ethernet frames addressed by MAC addresses, since FCoE has no native Fibre Channel link layer before FIP establishes the virtual link. This distinguishes it from FC, which addresses ports by 24-bit N_Port IDs.

FIP is used only for FCoE initialization, not for maintenance.

FIP requires IP addresses to establish FCoE sessions.

Why: FCoE Initialization Protocol (FIP) uses Ethernet MAC addresses for communication during the discovery, initialization, and maintenance phases of an FCoE session. FIP frames are encapsulated in standard Ethernet frames with a specific EtherType (0x8914), allowing FCoE-capable endpoints to discover each other and establish virtual links without relying on IP addresses.

A storage administrator needs to ensure that a Fibre Channel zone configuration is operationally effective without disrupting the current active zone set. Which approach should be used?

Create the new zone configuration in the defined configuration, then activate it as a new zone set.

Building the new configuration in the defined configuration and then activating it as a new zone set performs a non-disruptive change: the switch validates the new zone set before committing it, and traffic continues on the existing active zone set until activation completes.

Delete the active zone set and create a new one.

Edit the active zone set directly.

Use the 'commit' command to update the zone set.

Why: In Cisco MDS Fibre Channel SANs, zone configurations are created in the defined configuration and then activated as a new zone set. This approach ensures that the current active zone set remains operational and unaffected during the configuration process, preventing any disruption to existing traffic. Only when the new zone set is explicitly activated does it replace the active set, allowing for a controlled cutover.

A data center deployment uses NPV mode on a Cisco MDS switch to connect to a core Fibre Channel switch. After configuration, the NPV switch does not register with the core. What is the most likely cause?

Fibre Channel ports are in trunk mode.

The core switch has NPV mode enabled.

NPIV is not enabled on the core switch.

NPV switches register upstream as NPIV-capable nodes, so the core switch must have NPIV enabled on the relevant interface. Without NPIV on the core, the NPV switch's fabric login fails and it never registers, matching the reported symptom exactly.

The NPV switch has an incorrect domain ID.

Why: NPV (N_Port Virtualization) mode requires NPIV (N_Port ID Virtualization) to be enabled on the core Fibre Channel switch. NPIV allows a single physical N_Port to register multiple FCIDs (Fibre Channel IDs) for multiple virtual initiators behind the NPV switch. Without NPIV on the core, the NPV switch cannot complete the FLOGI (Fabric Login) process and will not register with the fabric.

An engineer is tuning performance for a storage network. Which two practices improve FC SAN performance?

Disabling flow control.

Using single-initiator zoning.

Single-initiator zoning isolates each host to its own target ports, preventing multiple initiators contending for the same target queue and reducing arbitration overhead. This limits interference between hosts, directly improving throughput and latency on the SAN fabric.

Ensuring adequate buffer credits.

Adequate buffer credits directly address the flow-control constraint in a Fibre Channel SAN: each credit represents a frame the receiving port can buffer, so insufficient credits stall transmission and throttle throughput. Provisioning enough credits sustains the link's full bandwidth over distance, satisfying the stem's performance-tuning requirement.

Enabling broadcast zoning.

Setting fabric login timeout to the maximum.

Why: Option B (single-initiator zoning) is correct because zoning each initiator with only its intended target(s) limits the number of devices sharing a zone, reducing unnecessary fabric traffic and RSCN (Registered State Change Notification) propagation, which improves overall SAN performance and stability. Option C (ensuring adequate buffer credits) is correct because Fibre Channel uses a credit-based flow control mechanism; if a port has too few buffer credits for the link distance and speed, it cannot keep the link fully utilized, so provisioning sufficient credits (especially over long-distance ISLs) is essential to sustain throughput. Option A is wrong because disabling flow control removes the buffer-credit mechanism that prevents frame loss and congestion, degrading rather than improving performance. Option D is wrong because broadcast zoning allows broadcast/RSCN traffic to reach many ports, increasing unnecessary traffic and disrupting hosts. Option E is wrong because maximizing the fabric login timeout only delays error detection and recovery; it does not improve throughput or latency.

A SAN administrator notices intermittent connectivity issues between an initiator and target. The Fibre Channel link shows CRC errors. What is the most likely cause?

Incorrect domain ID.

Faulty SFP or fiber optic cable.

CRC errors indicate corrupted frames arriving at the receiver, which points to a physical-layer fault in the transmission path rather than zoning, login or congestion problems. A degraded SFP transceiver or damaged fibre optic cable corrupts the optical signal, producing exactly these intermittent CRC errors on the Fibre Channel link.

Buffer credit starvation.

Incorrect zone configuration.

Why: CRC errors on a Fibre Channel link indicate physical-layer issues such as signal degradation, dirty connectors, or faulty hardware. The most common cause is a faulty SFP module or damaged fiber optic cable, which introduces bit errors that the CRC check detects. This is the first component to verify when troubleshooting intermittent connectivity with CRC errors.

In a Cisco UCS environment, which component provides the Fibre Channel connectivity to the SAN switches when using FCoE?

IOM (I/O Module)

Cisco VIC adapter

UCS Manager

UCS Fabric Interconnect

The Fabric Interconnect carries the FCoE traffic, converting Fibre Channel frames into Ethernet frames and presenting the uplinks to the SAN switches. This satisfies the requirement for FC connectivity to the SAN, since the blade VIC adapters connect through the FI rather than directly to the MDS fabric.

Why: In a Cisco UCS environment, the Fabric Interconnect (FI) is the component that provides Fibre Channel connectivity to SAN switches when using FCoE. The FI integrates both Ethernet and Fibre Channel traffic, performing FCoE encapsulation and forwarding the Fibre Channel frames to the SAN via its native Fibre Channel uplink ports. This allows the UCS domain to connect directly to Fibre Channel SAN fabrics without requiring external FCoE-capable switches.

Want more Storage Network practice?

Domain 3: Automation

15% of exam · 6 sample questions below

All Automation questions

A network engineer wants to automate the deployment of a new VLAN across all Cisco Nexus switches in a data center using Python scripts. Which tool is most appropriate for this task?

Cisco NX-API with Python requests

NX-API exposes REST endpoints on Nexus switches, letting Python requests issue structured configuration calls directly over HTTPS. This satisfies the requirement to automate VLAN deployment across all switches, unlike screen-scraping CLI or agentless tools that lack native Nexus configuration semantics.

SSH CLI commands via Paramiko

Ansible playbook

SNMP SET commands

Why: Cisco NX-API provides a RESTful API interface on Nexus switches, allowing direct HTTP/HTTPS calls to configure VLANs programmatically. Using Python's requests library, you can send structured JSON payloads to the API endpoint, making it the most direct and efficient method for script-driven automation without requiring intermediate tools or protocols.

A data center team is troubleshooting an automation script that uses REST API to configure a Cisco Nexus 9000 switch. The script fails with a '401 Unauthorized' error. What is the most likely cause?

API rate limiting has been exceeded

Network connectivity issue between the script and the switch

The user account does not have admin privileges

Invalid or expired authentication token

A 401 response means the request lacked valid credentials, so the REST API rejected it before processing. An invalid or expired authentication token satisfies the stem's failure condition, since the script's structure and payload are irrelevant until the token is refreshed.

Why: A 401 Unauthorized error in REST API communication indicates that the request lacks valid authentication credentials. For Cisco Nexus 9000 switches, REST API access typically requires a token-based authentication (e.g., using HTTP Basic Auth to obtain a session token or cookie). If the token is invalid or expired, the API server rejects the request with a 401 status code, as the script cannot prove its identity.

An engineer is designing an automation solution for a large data center with multiple Cisco UCS Manager domains. Which approach best ensures idempotent configuration operations?

Writing imperative Python scripts that execute CLI commands

Using a declarative automation tool like Ansible with idempotent modules

Ansible modules are declarative and idempotent: rerunning a playbook converges each Cisco UCS Manager domain to the desired state without duplicating changes. This satisfies the stem's requirement for idempotent operations across multiple domains, unlike imperative scripting that reapplies commands unconditionally.

Directly calling UCS Manager XML API using POST requests

Using SNMP to set configuration parameters

Why: Ansible's declarative modules for Cisco UCS Manager (e.g., `ucs_*` modules) are designed to be idempotent: they compare the current state of the configuration against the desired state defined in the playbook and only apply changes when necessary. This ensures that running the same playbook multiple times yields the same result without unintended side effects, which is critical for large-scale automation across multiple UCS domains.

A network engineer is implementing automated configuration management using Cisco NSO (Network Services Orchestrator). The team wants to ensure that any configuration changes made directly on the devices (out-of-band) are detected and reconciled. Which NSO feature should be used?

Configuration Database (CDB) snapshots

Fast-map synchronization

Fast-map synchronisation reconciles NSO's CDB with live device configuration by reading the device and updating the CDB, detecting out-of-band changes. It satisfies the requirement to detect and reconcile direct device edits, unlike slow-map, which pushes NSO state to devices and would overwrite rather than detect those changes.

Service model templates

Rollback and recovery mechanism

Why: Fast-map synchronization is the correct NSO feature because it is specifically designed to detect and reconcile configuration changes made directly on managed devices (out-of-band changes). It compares the device's running configuration against NSO's CDB and generates the necessary NETCONF or CLI operations to bring the device back into sync with NSO's desired state, ensuring consistency without manual intervention.

Which TWO statements about Cisco NX-API are correct? (Choose two.)

NX-API uses SSH for transport.

NX-API only supports GET requests.

NX-API uses HTTP/HTTPS as the transport protocol.

NX-API transports requests over HTTP or HTTPS, satisfying the stem's requirement for a correct statement about its operation. HTTPS adds TLS encryption, while HTTP sends data in clear text. This distinguishes NX-API from CLI-only access methods such as SSH or Telnet, and enables browser-based and programmatic interaction with the switch.

NX-API is only available on Nexus 3000 series switches.

NX-API can output data in XML and JSON formats.

NX-API returns structured output in both XML and JSON, letting scripts parse responses without screen-scraping CLI text. This satisfies the stem's requirement for correct NX-API statements, since JSON suits modern automation tooling while XML supports legacy integrations, and both are natively produced by the HTTPS-based API.

Why: Cisco NX-API is a programmatic interface that uses HTTP/HTTPS as the transport protocol, allowing RESTful API calls to configure and monitor Nexus switches. It supports both XML and JSON output formats, enabling flexible data parsing in automation scripts. This makes options C and E correct.

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.

Idempotency is achieved by targeting specific objects.

The XML API is based on a management information model (MIT) similar to ACI.

UCS Manager uses a MIT similar to ACI.

The API uses XML for both request and response payloads.

It is an XML-based API.

The API uses SNMP for configuration changes.

The UCS Manager XML API uses RESTful JSON format.

Why: The Cisco UCS Manager XML API allows operations to be idempotent by using the 'dn' (distinguished name) attribute to target a specific managed object. When you include the 'dn' in an XML request, the operation applies only to that exact object, so repeating the same request produces the same result without side effects. This is a key design principle of the management information model (MIT) that ensures predictable and safe automation.

Want more Automation practice?

Domain 4: Compute

25% of exam · 6 sample questions below

All Compute questions

Which TWO statements correctly describe the use of Cisco UCS Manager service profiles for server deployment?

Service profiles can only be applied to servers of the same model.

Service profiles decouple server identity from hardware, enabling rapid provisioning.

Service profiles abstract server identity, allowing quick redeployment.

A service profile can be associated with multiple servers simultaneously.

Service profiles are stored locally on the server's boot drive.

Service profiles include policies for firmware, BIOS, boot order, and network.

Service profiles encapsulate all server identity and policy settings.

Why: Service profiles decouple the logical server identity (UUID, MAC addresses, WWPNs) from the physical hardware. This allows an administrator to rapidly provision or repurpose a server by simply associating the profile with a different blade or rack server, without reconfiguring the OS or SAN/NIC settings. This abstraction is the core value of Cisco UCS Manager for scalable, stateless computing.

A company is deploying a new Cisco UCS Mini with a single Fabric Interconnect 6324. They need to connect to an existing Fibre Channel SAN. Which action is required to enable Fibre Channel connectivity?

Enable NPV mode on the Fabric Interconnect to connect to the SAN.

Install a Fibre Channel module in the Fabric Interconnect.

Add a Cisco MDS 9148S Fibre Channel switch and connect it to the Fabric Interconnect via FC uplinks.

Configure the uplink Ethernet ports as unified ports to support Fibre Channel.

Correct. The unified ports on the 6324 must be configured as FC uplinks to provide Fibre Channel connectivity.

Why: The Cisco UCS 6324 Fabric Interconnect has built-in unified ports that can be configured as 2/4/8-Gbps Fibre Channel uplinks. To connect to an existing Fibre Channel SAN, you configure these unified ports as FC uplinks (option D); no external MDS switch is required. Adding an MDS is unnecessary and not a required action.

A UCS administrator needs to deploy 20 identical servers with the same firmware, BIOS, and boot order. Which approach is the most efficient?

Use a UUID suffix pool to auto-generate identities.

Use a Cisco UCS Central 'Gold' template to deploy the servers.

Create a service profile template and then generate service profiles from it.

A service profile template defines firmware, BIOS and boot order once, then generating service profiles from it applies those identical settings across all 20 servers. This satisfies the efficiency constraint by eliminating repeated manual configuration, ensuring consistency and reducing deployment effort.

Create a service profile for each server manually.

Why: Creating a service profile template and then generating service profiles from it is the most efficient approach because it allows you to define the firmware, BIOS, and boot order once in a reusable template, then automatically create multiple service profiles with unique identities (e.g., UUID, MAC, WWN) for each of the 20 identical servers. This leverages Cisco UCS Manager's built-in template-to-instance workflow, ensuring consistency and reducing manual effort.

A company is deploying a Cisco UCS Mini in a remote office. They need to support both VMware vSphere and Microsoft Hyper-V on the same UCS domain. What is the best practice for deploying compute resources for both hypervisors?

Create separate service profile templates for each hypervisor

Separate service profile templates let each hypervisor receive its own BIOS policy, boot order and firmware package, since vSphere and Hyper-V demand different local disk and SAN boot settings. This satisfies the stem's requirement to run both hypervisors within one UCS domain without policy conflicts.

Use a single service profile but assign different VLANs for management traffic

Place each hypervisor in a separate UCS Organization within the same service profile template

Create a single service profile template and use different identity pools for each hypervisor

Why: Separate service profile templates are required because VMware vSphere and Microsoft Hyper-V have different boot and storage configuration requirements. Each hypervisor needs its own boot policy (e.g., SAN boot vs. local disk), firmware settings, and potentially different vNIC/vHBA configurations. Using distinct templates ensures that each hypervisor's compute resources are correctly provisioned without conflicts.

A Cisco UCS Manager administrator notices that a newly provisioned service profile is showing 'Config Error' for the vNIC. The vNIC is configured to use a dynamic MAC address from a pool that has no free addresses. What is the correct remediation?

Add more MAC addresses to the MAC pool used by the vNIC

Expanding the MAC pool directly resolves the exhaustion causing the 'Config Error'. UCS Manager allocates dynamic MAC addresses from the named pool at service profile association; with zero free addresses, allocation fails and the vNIC flags the error. Adding addresses restores available entries, allowing the next association or re-apply to succeed.

Upgrade the firmware on the Fabric Interconnect

Change the vNIC to use a static MAC address

Reassociate the service profile to a different blade

Why: The 'Config Error' for the vNIC indicates that the dynamic MAC address assignment failed because the MAC pool is exhausted. Adding more MAC addresses to the pool resolves the issue by providing available addresses for the vNIC to consume, allowing the service profile to deploy successfully.

Which THREE are benefits of using Cisco UCS Manager to manage compute resources? (Choose three.)

Centralized management of multiple chassis

UCS Manager provides a single management domain spanning multiple chassis, so administrators configure and monitor all fabric interconnects, blades and service profiles from one interface. This eliminates per-chassis logins, directly satisfying the centralised management benefit the question requires.

Direct management of virtual machines

Policy-based provisioning to automate server deployment

Service profiles and templates let UCS Manager apply policy-based provisioning, so a server's identity, firmware and network settings deploy automatically from a single policy. This removes manual, per-blade configuration, directly delivering the automated server deployment benefit the question asks about.

Improved performance by disabling hardware features

Unified fabric for LAN and SAN traffic

Cisco UCS Manager consolidates LAN and SAN traffic onto a single unified fabric through FCoE and converged network adapters, eliminating separate switching paths. This satisfies the benefit of reduced cabling and adapter count while managing both traffic types under one management domain.

Why: Cisco UCS Manager provides a single pane of glass for the entire UCS domain, so option A (Centralized management of multiple chassis) is correct because one UCS Manager instance can manage up to 20 chassis and hundreds of blades from a single interface. Option C (Policy-based provisioning to automate server deployment) is correct because UCS Manager uses service profiles and pools (UUID, MAC, WWN, BIOS, boot policy) to abstract hardware and automate consistent, repeatable server deployment. Option E (Unified fabric for LAN and SAN traffic) is correct because UCS Manager manages the fabric interconnects that carry both Ethernet LAN and Fibre Channel SAN traffic over a unified fabric (FCoE), reducing cabling and adapters. Option B is not a UCS Manager benefit because UCS Manager manages physical compute, network, and storage-access resources, not guest VMs, which are managed by hypervisors such as vCenter or Hyper-V. Option D is incorrect because UCS Manager does not improve performance by disabling hardware features; it enables features and applies BIOS/firmware policies, and disabling hardware would generally reduce capability rather than improve performance.

Want more Compute practice?

Domain 5: Security

15% of exam · 6 sample questions below

All Security questions

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

Assign the 'read-only' role to the user within the tenant.

Create a separate VRF for each tenant and assign admin to that VRF.

Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.

Security domains partition the fabric so a tenant admin's RBAC role applies only within their assigned domain. Scoping the tenant-admin role to a per-tenant domain restricts object management to that tenant, meeting the isolation requirement.

Assign the 'tenant-admin' role to the user globally.

Why: Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

Enable dynamic ARP inspection on all VLANs.

Enable IP source guard on all access ports.

Enable DHCP snooping globally and configure uplink ports as trusted.

DHCP snooping globally filters server messages on untrusted ports, while marking uplink ports trusted permits legitimate replies from the real DHCP server. Rogue offers arriving on access ports are dropped, directly preventing DHCP spoofing on the Nexus 9000 fabric.

Enable MAC port security on all access ports.

Why: DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.

An engineer is configuring Cisco ACI to secure inter-tenant traffic. Tenants 'TenantA' and 'TenantB' need to communicate via a shared service, such as a DNS server in TenantA. How should the contract be configured?

Create a contract in TenantA and apply it to the VRF shared between tenants.

Create a contract in TenantA. Set the DNS EPG as provider. In TenantB, create a consumer EPG and provide the contract from TenantA.

Contracts are unidirectional and defined in the provider's tenant. Placing the contract in TenantA with the DNS EPG as provider, then having TenantB consume it, permits the required cross-tenant communication while keeping the contract owned by the provider.

Create a contract in TenantB. Set the DNS EPG as consumer. In TenantA, create a provider EPG and provide the contract from TenantB.

Create a contract in TenantA. Set both DNS EPG and TenantB EPG as providers.

Why: In Cisco ACI, inter-tenant communication via a shared service requires the contract to be created in the tenant that owns the shared service (provider). The provider EPG (DNS server in TenantA) is set as the provider, and the consumer EPG (in TenantB) consumes the contract from TenantA. This allows TenantB to access the DNS service without exposing its own EPGs, maintaining security isolation while enabling necessary traffic.

Which TWO of these are best practices for securing the Cisco ACI fabric?

Use security domains to control RBAC.

Security domains scope a user's RBAC permissions to specific tenants, fabrics or APIC resources, so an administrator cannot modify objects outside their assigned area. This limits blast radius from compromised or misused accounts, a core ACI fabric hardening practise.

Use in-band management for APIC connectivity.

Enable certificate-based authentication for APIC access.

Certificate-based authentication for APIC access replaces shared passwords with per-user X.509 credentials, satisfying the stem's requirement for fabric hardening. It enforces identity verification at the management plane, supports revocation, and integrates with Microsoft Entra ID via SAML or LDAP, reducing credential-theft risk across administrative sessions.

Leave default passwords for fabric discovery.

Place APIC controllers in a DMZ.

Why: Option A is correct because Cisco ACI security domains are the mechanism that scopes RBAC roles to specific tenants, so assigning users to security domains with least-privilege roles limits what each account can view or change in the fabric. Option C is correct because enabling certificate-based authentication for APIC access replaces simple username/password logins with X.509 client certificates validated against a trusted CA, providing stronger, phishing-resistant authentication for fabric administrators. Option B is not a best practice because in-band management exposes the APIC management interface to the data-plane network; out-of-band management on a dedicated management network is preferred. Option D is wrong because default credentials must always be changed during fabric discovery to prevent unauthorized access. Option E is wrong because placing APICs in a DMZ exposes the fabric's management plane to untrusted networks; APICs belong on a protected out-of-band management network.

Which TWO of the following are required components for a Cisco ACI contract to allow communication between EPGs?

A filter that specifies the traffic parameters.

An ACI contract requires at least one subject, and each subject contains a filter defining the permitted traffic parameters such as EtherType, protocol, and port ranges. Without a filter, the contract cannot classify or permit any traffic between EPGs.

A subject that defines the filter.

A contract must contain at least one subject, which groups one or more filters and defines whether traffic is permitted or denied. The subject is the mandatory structural element that binds filters into an enforceable contract between EPGs.

A tenant.

A QoS class.

A VRF.

Why: In Cisco ACI, a contract is composed of one or more subjects, and each subject must reference at least one filter, so option B (a subject that defines the filter) and option A (a filter that specifies the traffic parameters) are the two required building blocks for permitting traffic between EPGs. The subject is the container that binds filters together and is what gets associated with the EPG as a provider or consumer, while the filter contains the actual traffic-matching criteria (such as EtherType, IP protocol, TCP/UDP ports, and ARP) via its entries. Without a subject there is nothing to apply, and without a filter the subject has no traffic parameters to permit, so both are mandatory. A tenant (option C) is the logical container in which contracts live but is not itself a component of the contract, a QoS class (option D) is an optional attribute for marking/prioritizing traffic rather than a required contract element, and a VRF (option E) is a separate network-context construct that is not part of the contract definition.

A large financial institution has a Cisco ACI fabric with multiple tenants. The security team requires that all management access to the APIC controllers be authenticated via multi-factor authentication (MFA) using a RADIUS server. The RADIUS server is configured to send a One-Time Password (OTP) challenge during authentication. The current configuration uses local authentication. The engineer needs to implement RADIUS authentication with MFA for APIC GUI and CLI access. The RADIUS server is reachable at 10.10.10.10, shared secret 'SecureSecret123'. The APIC is running software version 4.2(3). The engineer must ensure that local authentication is used as fallback if the RADIUS server is unreachable. Which of the following actions should the engineer take?

Configure TACACS+ as the authentication protocol and set the server IP and secret.

Enable local authentication only and require strong passwords.

Add a RADIUS provider with IP 10.10.10.10 and secret 'SecureSecret123', create a login domain with realm 'radius', set fallback to 'local', and assign the domain to users.

Adding the RADIUS provider, creating a login domain with realm radius, and setting fallback to local satisfies MFA via OTP challenge while preserving local authentication if the server is unreachable, covering both GUI and CLI access.

Configure LDAP authentication with the RADIUS server acting as an LDAP proxy.

Why: It follows the required steps to configure RADIUS authentication with MFA on Cisco APIC: adding a RADIUS provider with the correct IP and shared secret, creating a login domain with realm 'radius', setting fallback to 'local', and assigning the domain to users. This ensures that the APIC sends authentication requests to the RADIUS server, which can issue an OTP challenge for MFA, and falls back to local authentication if the RADIUS server is unreachable.

Want more Security practice?