Reinforce 350-601 concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For 350-601 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the 350-601 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your 350-601 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real 350-601 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass 350-601.
Sample cards from the 350-601 flashcard bank. Read the question, think of the answer, then read the explanation below.
In ACI, which model is used for micro-segmentation to allow traffic between EPGs?
Whitelist model using contracts
ACI uses a whitelist model via contracts to permit traffic between EPGs.
An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?
It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.
The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.
An engineer is configuring a new Fibre Channel switch in a Cisco MDS environment. The switch will connect to end devices such as servers and storage arrays. Which two port types will be used on the switch to connect to these end devices?
F_port and FL_port
On a Fibre Channel switch, F_ports connect to N_ports on hosts and storage. N_ports are on end devices, not on the switch. E_ports are for ISLs between switches. NP_ports are used in NPV mode.
An engineer wants to automate the creation of VLANs on a Nexus 9000 switch using Python scripts. Which on-box solution allows running Python scripts directly on the switch without an external server?
Guest shell
Guest shell provides a secure Linux environment on Nexus switches to run Python scripts and tools.
A network engineer is configuring a new UCS B-series blade server. The engineer wants the server to automatically inherit network and storage settings without manual configuration when replaced. Which UCS technology enables this capability?
Service profile template
Service profile templates in Cisco UCS Manager allow administrators to define a reusable configuration for network and storage settings. When a server fails or is replaced, the template is applied to the new blade, automatically inheriting all settings without manual intervention. This capability is central to UCS's stateless computing model, where hardware identity and policies are abstracted from the physical server.
In Cisco ACI, which component is responsible for translating EPG communication policies into concrete configuration on leaf switches?
APIC controller
The APIC controller is the centralized policy engine in Cisco ACI. It translates high-level EPG communication policies (contracts, filters, subjects) into the concrete switch configuration (e.g., OpFlex policy elements, VXLAN tunnel mappings, and hardware table entries) and pushes them to leaf switches via the OpFlex protocol. Without the APIC, leaf switches cannot autonomously interpret or apply these policies.
An engineer is configuring OSPF on a Cisco Nexus switch in a data center. The network consists of multiple point-to-point links. To improve convergence, the engineer wants to reduce the dead interval to 10 seconds. Which command sets the dead interval correctly?
ip ospf dead-interval 10
Option C is correct because the 'ip ospf dead-interval 10' command directly sets the OSPF dead interval to 10 seconds on a Cisco Nexus switch. The dead interval is the time a router waits without receiving a hello packet before declaring the neighbor down, and reducing it to 10 seconds speeds up convergence on point-to-point links.
An engineer is configuring BGP EVPN for VXLAN in a spine-leaf fabric. The leaf switches must advertise host IP-to-MAC mappings to the control plane. Which BGP address family should be enabled on the leaf switches?
address-family l2vpn evpn
In a VXLAN BGP EVPN fabric, leaf switches must advertise host IP-to-MAC mappings using the BGP EVPN address family. This is enabled with the command 'address-family l2vpn evpn' under the BGP configuration, which carries Type-2 routes (MAC/IP advertisement routes) that contain both the MAC address and the associated IP address of the host.
Which VLAN range is reserved by default on Cisco Nexus switches?
VLAN 1
VLAN 1 is the default VLAN on Cisco Nexus switches and cannot be deleted or renamed. It is automatically created on all switches and carries all untagged traffic by default, making it a reserved VLAN that is always present in the VLAN database.
In VXLAN overlay networks, which mechanism is used to forward broadcast, unknown unicast, and multicast (BUM) traffic when multicast is not enabled in the underlay?
Ingress replication
In VXLAN overlay networks, when multicast is not enabled in the underlay, ingress replication is used to forward BUM traffic. With ingress replication, the source VTEP (ingress node) replicates the BUM packet and sends a separate unicast-encapsulated copy to each remote VTEP in the VXLAN segment. This avoids reliance on underlay multicast trees, making it suitable for networks that do not support multicast routing.
Which command is used to verify the OSPF neighbor state in NX-OS?
show ip ospf neighbors
In NX-OS, the correct command to verify OSPF neighbor state is 'show ip ospf neighbors'. This command displays the OSPF neighbor table, including neighbor ID, priority, state (e.g., FULL, 2WAY), and dead timer. The 'ip' keyword is mandatory in NX-OS to specify the IPv4 address family, distinguishing it from other protocols like OSPFv3 for IPv6.
In a Cisco ACI fabric, which component is responsible for policy enforcement and management of the entire infrastructure?
APIC controller
The APIC (Application Policy Infrastructure Controller) is the central policy and management entity in Cisco ACI. It enforces the application-centric policy model, manages the fabric's operational state, and provides the single point of configuration and monitoring for the entire ACI fabric. Without the APIC, the leaf and spine switches operate as standalone devices with no centralized policy enforcement.
In a Cisco NX-OS environment, which command is used to verify the operational state of a virtual Port Channel (vPC) peer link?
show vpc brief
The 'show vpc brief' command displays the operational state of the vPC peer link, including whether the peer link is up, the role of the switch (primary/secondary), and the status of the vPC domain. This command is specifically designed to verify the health and operational status of the vPC peer link and member ports in a Cisco NX-OS environment.
Refer to the exhibit. The interface fc1/1 is configured as an E_port. The connected switch also has an E_port configured. However, the interface shows an 'init' state. What is the most likely cause?
The speed on the remote switch interface is set to 8000 Mbps.
The 'init' state on an E_port indicates that the link is up but the port is still initializing the Exchange Link Parameters (ELP) and Exchange Switch Capabilities (ESC) protocols. If the remote switch interface speed is set to 8000 Mbps (8 Gbps) while the local interface is configured for a different speed (e.g., 4 Gbps or 16 Gbps), the speed negotiation will fail, preventing the E_port from transitioning to the 'online' state. Cisco MDS switches require matching speed settings on both ends of an E_port for successful initialization.
An engineer is configuring OSPF in a data center fabric with multiple Nexus 9000 switches. To ensure fast convergence after a link failure, which OSPF feature should be enabled?
OSPF Fast Hello
OSPF Fast Hello reduces the dead interval to less than 1 second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF to detect a link failure in milliseconds rather than the default 40 seconds, significantly improving convergence time in a data center fabric where rapid failover is critical.
A data center engineer is configuring vPC on a pair of Cisco Nexus switches. The vPC peer-link is established but the vPC member ports remain suspended. After checking the configuration, the engineer notices that the vPC peer-keepalive link is not functioning. What is the most likely cause of the suspended member ports?
Peer-keepalive link failure causing dual-active detection issues
When the vPC peer-keepalive link fails, each vPC peer switch cannot detect whether the other peer is operational. This triggers the dual-active detection mechanism, causing the secondary switch to suspend its vPC member ports to prevent a split-brain scenario where both switches forward traffic for the same vPC VLAN. The suspended state is a protective measure until the peer-keepalive link is restored or the vPC role is resolved.
In a VXLAN overlay network, what is the primary purpose of ingress replication for BUM traffic?
To forward broadcast, unknown unicast, and multicast traffic without requiring multicast in the underlay
Ingress replication is a technique used in VXLAN overlay networks to handle BUM (Broadcast, Unknown unicast, Multicast) traffic without requiring a multicast-enabled underlay. The ingress VTEP (VXLAN Tunnel End Point) replicates the BUM packet and sends a separate unicast copy to each remote VTEP in the same VXLAN Network Identifier (VNI) segment, ensuring all relevant endpoints receive the traffic while relying solely on unicast routing in the underlay.
An engineer is configuring OSPF on a Nexus 9000 switch in a data center spine-leaf topology. Which OSPF network type is most appropriate on the point-to-point links between leaf and spine switches to ensure fast convergence?
point-to-point
In a spine-leaf topology, the links between leaf and spine switches are typically point-to-point, even if they are Ethernet interfaces. Configuring the OSPF network type as point-to-point on these links eliminates the need for a Designated Router (DR) and Backup Designated Router (BDR) election, which reduces OSPF adjacency formation time and ensures faster convergence. This network type also allows OSPF to use multicast hello packets (224.0.0.5) without the overhead of a DR/BDR election, making it the most appropriate choice for fast convergence.
In ACI, which object defines the logical separation of traffic within a tenant, analogous to a VLAN in traditional networking, and is associated with a VRF?
Bridge Domain
In Cisco ACI, a Bridge Domain (BD) defines the Layer 2 boundary and provides logical separation of traffic within a tenant, analogous to a VLAN in traditional networking. Each BD is associated with a VRF (Layer 3 context) to enable IP forwarding, and it encapsulates traffic using VXLAN (VNID) rather than 802.1Q VLAN tags.
What is the purpose of the vPC peer keepalive link in a vPC domain?
To provide a keepalive mechanism to detect peer failure
The vPC peer keepalive link is a dedicated Layer 3 link used to detect a failure of the vPC peer switch. It sends periodic UDP-based keepalive messages (default every second) to ensure the peer is still operational, allowing the surviving switch to take over the vPC forwarding role. This mechanism is critical for preventing dual-active scenarios where both switches would incorrectly forward traffic for the same vPC VLAN.
An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?
It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.
The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.
In a spine-leaf architecture with 40 leaf switches and 4 spine switches, each leaf has four 40G uplinks to the spines. What is the oversubscription ratio if each leaf has 48 ports of 10G for servers?
3:1
The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48 ports × 10G = 480G of server-facing bandwidth, and 4 uplinks × 40G = 160G of spine-facing bandwidth. The ratio is 480:160 = 3:1, meaning three times as much server bandwidth as uplink bandwidth, which is a common design target in Cisco ACI and NX-OS spine-leaf fabrics.
In a spine-leaf architecture using eBGP as the routing protocol, what is the primary purpose of using eBGP rather than iBGP between spine and leaf switches?
To avoid the need for an IGP and simplify configuration
In a spine-leaf architecture using eBGP, the primary purpose is to avoid the need for an IGP (such as OSPF or IS-IS) and simplify configuration. eBGP between spine and leaf switches allows each leaf to be in a different private AS (e.g., 65001–650XX), and the spine can use the BGP AS_PATH to detect and prevent loops without requiring an underlying IGP. This eliminates the complexity of running a separate IGP for underlay routing, reducing operational overhead and configuration steps.
The 350-601 flashcard bank covers all 5 official blueprint domains published by Cisco. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Security
Network
Storage Network
Automation
Compute
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that 350-601 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.350-601 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective 350-601 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free 350-601 flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 1000+ original 350-601 flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Cisco exam objectives.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official 350-601 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included