350-601 Practice Test 11 — 15 Questions

Question 1

An ACI fabric has multiple tenants and the requirement to allow only HTTP traffic from the web EPG to the app EPG. The contract must restrict traffic to TCP port 80. Which ACI object defines that specific port?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Filter. In ACI, filters define the L4/L5 parameters such as protocol and port. The filter for TCP port 80 is created and then used in the subject.

Answer

EPG

Answer

Subject

Answer

Contract

Question 2

In Cisco ACI, when creating a contract, which three components are part of the contract definition? (Choose three.)

Accepted Answer

Subject. In Cisco ACI, a contract defines the rules for communication between endpoint groups (EPGs). The contract definition consists of three mandatory components: Subject, Filter, and Provider/Consumer. The Subject specifies the direction and type of traffic allowed, the Filter defines the specific protocols and ports (e.g., TCP/UDP, ICMP), and the Provider/Consumer labels establish which EPG offers the service and which consumes it. Without these three, the contract cannot enforce policy-based connectivity.

Answer

VRF

Answer

Endpoint IP address

Question 3

Which THREE are valid methods for handling BUM traffic in VXLAN? (Choose three.)

Accepted Answer

Ingress replication. Ingress replication is a valid method for handling BUM traffic in VXLAN where the ingress VTEP replicates broadcast, unknown unicast, and multicast frames to all remote VTEPs in the VXLAN segment. This approach does not require a multicast routing infrastructure in the underlay, making it simpler to deploy in networks that lack multicast support. It is defined in RFC 7348 and is commonly used in VXLAN EVPN fabrics.

Answer

Egress replication

Answer

Flood and learn

Question 4

An engineer is troubleshooting a vPC consistency check failure. Which parameter must be identical on both vPC peer switches to avoid a consistency check violation for a vPC member port?

Accepted Answer

Allowed VLAN list on the port channel. In a vPC environment, the allowed VLAN list on the port channel must be identical on both peer switches for a vPC member port. If the lists differ, the vPC consistency check fails, causing the port to be suspended or placed in a consistency-check failure state. This ensures that both peers forward the same set of VLANs across the vPC, preventing asymmetric forwarding and potential loops.

Answer

STP root guard setting

Answer

MTU size

Answer

Spanning-tree port type

Question 5

A network administrator is configuring a Cisco Nexus switch to use NX-API for automation. Which statement about NX-API is true?

Accepted Answer

NX-API supports JSON-RPC and RESTful API calls. NX-API is a feature on Cisco Nexus switches that provides both a RESTful API using HTTP/HTTPS and a JSON-RPC interface for programmatic access to the switch's CLI commands. This dual support allows automation tools to interact with the switch using standard web protocols and data formats, making option A correct.

Answer

NX-API requires the use of Python scripts exclusively

Answer

NX-API only supports XML data format

Answer

NX-API requires a separate license and is not included in NX-OS

Question 6

A server administrator reports that a newly provisioned application server cannot access its LUN on the storage array. The SAN zoning uses WWPNs. The administrator verifies that the server's HBA WWPN is correctly zoned with the storage port's WWPN. Which additional check should the engineer perform to isolate the issue?

Accepted Answer

Verify that the zone set is activated and that the zones are in the active zone set. Even if the WWPNs are correctly configured in the zone, the zone set must be activated for the zoning to take effect. Without activation, the zone configuration remains in the pending or offline zone set, and the Fibre Channel fabric will not enforce the access controls. The engineer should verify that the zone set is activated and that the zones appear in the active zone set using commands like 'show zoneset active' on the MDS switch.

Answer

Confirm that VSAN interop is enabled on the MDS switch

Answer

Ensure that the switch port is configured in F mode and local switching is enabled

Answer

Check whether FCIP is configured on the storage array

Question 7

A Fibre Channel fabric has multiple initiators and targets. The engineer wants to ensure that only specific hosts can access specific storage volumes. Which zoning practice is most secure?

Accepted Answer

Single-initiator zoning with WWPNs. Single-initiator zoning with WWPNs is the most secure practice because it creates a one-to-one mapping between a single initiator and its target(s) using the globally unique World Wide Port Name. This eliminates any possibility of unauthorized access or interference from other initiators, as each zone contains exactly one initiator, preventing any form of 'spoofing' or 'zoning overlap' that could allow a rogue host to access storage volumes it should not see.

Answer

Zoning by storage array aliases

Answer

Using VSANs instead of zones

Answer

Soft zoning with domain/port IDs

Question 8

An engineer is configuring BGP EVPN for VXLAN in a spine-leaf fabric. The leaf switches must advertise host IP-to-MAC mappings to the control plane. Which BGP address family should be enabled on the leaf switches?

Accepted Answer

address-family l2vpn evpn. In a VXLAN BGP EVPN fabric, leaf switches must advertise host IP-to-MAC mappings using the BGP EVPN address family. This is enabled with the command 'address-family l2vpn evpn' under the BGP configuration, which carries Type-2 routes (MAC/IP advertisement routes) that contain both the MAC address and the associated IP address of the host.

Answer

address-family vpnv4 unicast

Answer

address-family ipv4 unicast

Answer

address-family link-state

Question 9

Two Nexus switches are configured for MACsec using MKA. The link between them is up, but MKA does not establish. Which issue is most likely?

Accepted Answer

Mismatched cipher suites. MKA (MACsec Key Agreement) requires both endpoints to agree on a cipher suite during the CAK (Connectivity Association Key) exchange. If the cipher suites are mismatched (e.g., one switch uses GCM-AES-128 and the other uses GCM-AES-256), the MKA negotiation will fail, and the link will remain up but unsecured. This is the most common cause of MKA not establishing on an otherwise functional Layer 2 link.

Answer

Different MTU sizes

Answer

Switches are in different VLANs

Answer

Mismatched MKA key strings

Question 10

Refer to the exhibit. An NX-API request returns this JSON error. What is the most likely cause?

Accepted Answer

The command is not allowed via NX-API. The JSON error indicates that the NX-API request was rejected because the command is not permitted through the NX-API interface. NX-API enforces a strict allowlist of commands; any command not explicitly allowed (e.g., certain show commands or configuration commands that could destabilize the switch) will return this error. This is a security and stability feature of the NX-API RESTful interface.

Answer

The API version in the request is mismatched

Answer

Invalid credentials

Answer

The switch is in maintenance mode

Question 11

Which of the following is a benefit of using Fibre Channel over Ethernet (FCoE) in a data center?

Accepted Answer

It reduces cabling complexity by using a unified fabric.. FCoE encapsulates Fibre Channel frames over Ethernet networks, allowing storage and data traffic to share the same physical infrastructure. This consolidation reduces cabling complexity and the number of required switches, adapters, and power/cooling overhead, which is the core benefit of a unified fabric.

Answer

It increases the maximum distance of Fibre Channel links.

Answer

It provides native Fibre Channel security.

Answer

It eliminates the need for zoning.

Question 12

What does the oversubscription ratio in a spine-leaf fabric represent?

Accepted Answer

Ratio of server bandwidth to leaf uplink bandwidth. In a spine-leaf fabric, the oversubscription ratio specifically compares the total bandwidth available from the servers (leaf southbound ports) to the total uplink bandwidth from the leaf to the spine (leaf northbound ports). This ratio determines how much potential congestion exists when multiple servers contend for uplink capacity, directly impacting performance in a non-blocking or oversubscribed design.

Answer

Ratio of spine to leaf bandwidth

Answer

Ratio of total fabric bandwidth to total server bandwidth

Answer

Number of spine switches per leaf

Question 13

A UCS administrator needs to update the firmware on a remote rack server that is not reachable via the production network. Which two features of Cisco IMC can be used? (Choose two.)

Accepted Answer

Virtual media. CIMC provides out-of-band management; KVM console and virtual media can be used for firmware updates even if the OS network is down.

Answer

Syslog

Answer

SNMP traps

Answer

HTTP server integration

Question 14

An engineer is configuring OSPF on a Cisco Nexus switch in a data center. The network consists of multiple point-to-point links. To improve convergence, the engineer wants to reduce the dead interval to 10 seconds. Which command sets the dead interval correctly?

Accepted Answer

ip ospf dead-interval 10. The 'ip ospf dead-interval 10' command directly sets the OSPF dead interval to 10 seconds on a Cisco Nexus switch. The dead interval is the time a router waits without receiving a hello packet before declaring the neighbor down, and reducing it to 10 seconds speeds up convergence on point-to-point links.

Answer

ip ospf dead-interval 30

Answer

ip ospf hello-interval 10

Answer

ip ospf dead-interval 40

Question 15

A network engineer is designing a spine-leaf fabric with oversubscription ratio 3:1. Each leaf switch has 48x10G host-facing ports and 4x40G uplinks to spines. What is the oversubscription ratio per leaf?

Accepted Answer

3:1. The oversubscription ratio per leaf is calculated by dividing the total host-facing bandwidth by the total uplink bandwidth. Each leaf has 48x10G host ports (480G total) and 4x40G uplinks (160G total). 480G / 160G = 3:1, matching the design target.

Answer

2:1

Answer

4:1

Answer

1.2:1