350-601 Practice Test 18 — 15 Questions

Question 1

Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?

Accepted Answer

IP Source Guard. IP Source Guard uses DHCP snooping binding to validate source IP.

Answer

Port Security

Answer

ACL

Answer

Dynamic ARP Inspection

Question 2

A network engineer is configuring a Cisco MDS 9000 switch. The engineer needs to verify the WWPN of the HBA connected to interface fc1/1. Which command should be used?

Accepted Answer

show flogi database. The show flogi database command is the correct choice because it lists all devices that have performed fabric login, including their WWPNs and the interfaces they are connected to. This allows the engineer to directly find the WWPN associated with fc1/1. The other commands provide interface statistics, name server entries, or zoning information, but none directly map an interface to a logged-in device's WWPN.

Answer

show interface fc1/1

Answer

show zoneset active vsan 1

Answer

show fcns database

Question 3

In a HyperFlex cluster with hybrid nodes (HDD+SSD), which statement best describes the role of the SSD cache?

Accepted Answer

SSD acts as a write cache and read cache to accelerate I/O.. In HyperFlex, the SSD (or flash) in hybrid nodes serves as a cache for frequently accessed data, while the HDDs provide bulk storage. The HXDP uses SSDs for both caching and persistent storage in all-flash nodes.

Answer

SSD is used only for metadata storage.

Answer

SSD is used for long-term persistent storage, while HDD is used for caching.

Answer

SSD is not used; all data is stored on HDD.

Question 4

A storage administrator is configuring a new storage array that supports thin provisioning. The array reports 10 TB of physical storage and 50 TB of thin-provisioned logical capacity. Which risk is most important to monitor to avoid out-of-space conditions?

Accepted Answer

The rate of physical capacity consumption and remaining free space. With thin provisioning, the array presents more logical capacity (50 TB) than physical capacity (10 TB), relying on actual consumption staying below physical limits. The critical risk is that physical capacity is exhausted before administrators can add storage, causing write failures and potential data loss. Monitoring the rate of physical capacity consumption and remaining free space is therefore the most important safeguard.

Answer

High latency on the Fibre Channel links

Answer

The number of snapshots taken

Answer

The replication status

Question 5

An engineer is designing a SAN extension over a WAN link using FCIP. The link has high latency (50 ms RTT). Which configuration is most critical to maintain performance?

Accepted Answer

Configure a large TCP window size.. FCIP encapsulates Fibre Channel frames over TCP/IP. High latency (50 ms RTT) means the TCP sender must wait longer for acknowledgments, which can stall the connection if the TCP window is too small. A large TCP window size (e.g., using window scaling per RFC 1323) allows more data to be in flight before requiring an ACK, thereby maintaining throughput and preventing performance collapse on high-latency WAN links.

Answer

Enable compression on the FCIP tunnel.

Answer

Increase the buffer-to-buffer credits.

Answer

Reduce the TCP MSS to 512 bytes.

Question 6

A small business SAN consists of a single Cisco MDS 9148S switch with 16 Gb Fibre Channel ports. The storage array has four active paths to the switch, and four servers each have two HBAs. The administrator wants to ensure that all paths are utilized and that no single point of failure exists. Currently, all devices are in a single VSAN and zoning is permissive (default deny). After powering on all devices, the administrator notices that the storage array only logs in on two of its four ports. The other two ports show 'no light'. The switch has not been configured with any port settings. What is the most likely cause?

Accepted Answer

The storage array's other two ports are not physically connected or are disabled on the array end.. The symptom 'no light' on two switch ports means the switch is not receiving any optical signal on those ports, which points to a physical-layer issue — the array's ports are either not cabled or disabled on the array side. Zoning, VSAN membership, and speed negotiation all occur after link initialization, so they cannot explain a complete absence of light. Since the switch has no port settings configured, there is no software reason to block link establishment on those specific ports.

Answer

The switch ports need to have their speed manually configured to match the array.

Answer

The unused ports are in a different VSAN.

Answer

The zoning configuration prevents the array from logging in on those ports.

Question 7

A UCS C-Series rack server with a boot from SAN policy fails to discover the LUN during POST. The HBA is correctly zoned with the storage array. Which step should be taken to troubleshoot the issue?

Accepted Answer

Review the SAN boot target configuration in Cisco IMC. When a UCS C-Series rack server with a boot-from-SAN policy fails to discover the LUN during POST, the most direct troubleshooting step is to review the SAN boot target configuration in Cisco IMC. The HBA is already correctly zoned, so the issue likely lies in the boot target parameters (e.g., WWPN, LUN ID, or target name) configured in the IMC's SAN boot settings, which the HBA uses during the BIOS-level boot process. Verifying these settings ensures the HBA can properly address and log into the storage target.

Answer

Verify VSAN membership on the fabric interconnect

Answer

Update the server firmware to the latest version

Answer

Check the service profile association in UCS Manager

Question 8

An engineer notices that a Fibre Channel link between two Cisco MDS 9000 series switches is flapping every few minutes. The interface counters show a high number of CRC errors. What is the most likely cause of this issue?

Accepted Answer

Faulty SFP or optical cable. CRC errors on a Fibre Channel link indicate physical-layer corruption of frames, typically caused by faulty optics, dirty or damaged fiber cables, or marginal signal integrity. Flapping occurs because the link repeatedly fails to maintain proper synchronization due to excessive bit errors, triggering port reset or re-initialization. A faulty SFP or optical cable directly introduces noise or attenuation that corrupts the data stream, leading to CRC errors and link instability.

Answer

NPV mode enabled on the switch

Answer

Incorrect zoning configuration

Answer

VSAN mismatch between switches

Question 9

A data center team is configuring a Cisco MDS switch to support multiple isolated SAN environments on the same physical infrastructure. They need to create separate fabrics that are completely isolated at Layer 2. Which technology should be used?

Accepted Answer

VSANs. VSANs (Virtual SANs) allow multiple isolated fabrics to share the same physical Fibre Channel infrastructure by partitioning the switch into separate logical switches, each with its own fabric services, zoning, and domain ID. This provides Layer 2 isolation between SAN environments, which is exactly what the team needs. VSANs are a Cisco MDS-specific feature and are the correct technology for fabric isolation.

Answer

NPV

Answer

Zoning

Answer

PortChannels

Question 10

An iSCSI storage array is being deployed with two network interfaces for redundancy. The hosts also have two iSCSI initiators. To ensure load balancing and failover, which feature should be configured?

Accepted Answer

MPIO. MPIO (Multipath I/O) is the feature that allows multiple physical paths between a host and storage array to be used simultaneously for load balancing and failover. With two network interfaces on the array and two initiators on the host, MPIO aggregates the paths, providing redundancy and increased throughput. It is the standard solution for iSCSI redundancy and performance.

Answer

Jumbo frames

Answer

VLAN tagging

Answer

CHAP authentication

Question 11

Which security feature on a Nexus switch prevents a rogue DHCP server from assigning invalid IP addresses to clients?

Accepted Answer

DHCP Snooping. DHCP Snooping is a security feature on Nexus switches that prevents rogue DHCP servers from assigning invalid IP addresses by filtering DHCP messages. It classifies switch ports as trusted or untrusted; only trusted ports (connected to legitimate DHCP servers) can send DHCP offers, while untrusted ports can only send DHCP requests. This prevents unauthorized DHCP servers from responding to client requests. Other features like Port Security, IP Source Guard, and Dynamic ARP Inspection serve different purposes.

Answer

Port Security

Answer

IP Source Guard

Answer

Dynamic ARP Inspection

Question 12

Refer to the exhibit. A network engineer notices that traffic for VNI 10000 is not being encapsulated. What is the most likely reason?

Accepted Answer

VNI 10000 is not configured under the nve interface.. VNI 10000 must be explicitly mapped to an NVE interface under the 'interface nve1' configuration using the 'member vni 10000' command. Without this mapping, the NVE interface does not know which VNI to encapsulate traffic for, even if the VNI exists in the network. Option B correctly identifies this missing configuration as the most likely cause.

Answer

BGP EVPN is not configured.

Answer

The VRF association is incorrect.

Answer

The source-interface is not reachable.

Question 13

Which MST configuration parameter must match across all switches in the same MST region?

Accepted Answer

Region name, revision, and VLAN mapping. In MST (Multiple Spanning Tree) protocol, switches in the same MST region must share the same region name, revision number, and VLAN-to-instance mapping. These parameters define the region boundary; if any differ, switches will treat each other as being in different regions, breaking MST interoperability and causing them to run separate spanning trees (e.g., PVST+).

Answer

Port cost

Answer

Root bridge

Answer

Bridge priority

Question 14

Refer to the exhibit. An engineer notices intermittent packet loss on interface Ethernet 1/1 of the Fabric Interconnect. Based on the transceiver statistics shown, which condition is the most likely cause?

Accepted Answer

The receive power is below the low warning threshold.. The exhibit shows that the receive power is -16.3 dBm, which is below the low warning threshold of -13.3 dBm. This indicates the incoming optical signal is too weak, causing intermittent packet loss due to bit errors or link flaps. The transceiver statistics confirm that the receive power is the only parameter breaching its threshold, making it the most likely cause.

Answer

The supply voltage is out of range.

Answer

The transmit power is too low.

Answer

The transceiver temperature is too high.

Question 15

A network engineer is hardening a Nexus 9000 switch. Which action is most effective in reducing the attack surface?

Accepted Answer

Disabling all unused services. Disabling unused services reduces the number of potential attack vectors.

Answer

Configuring a strong enable password

Answer

Implementing CoPP

Answer

Enabling SNMP v3 with secure keys