350-601 Practice Test 2 — 10 Questions

Question 1

An engineer is implementing CI/CD for network changes. Which tool is commonly used for version control of network configuration files and infrastructure code?

Accepted Answer

Git. Git is the industry-standard version control system used for managing infrastructure as code, including network configurations.

Answer

Docker

Answer

Jenkins

Answer

Ansible

Question 2

A data center has 100 Nexus switches in a fabric managed by Cisco Nexus Dashboard Orchestrator (NDO). The network team needs to automate the creation of a new network template that includes multiple VLANs and VRF configurations. They want to ensure that the template is applied consistently across all leaf switches without manual intervention. The engineer writes a Python script using the NDO REST API to create the template and deploy it. However, the deployment fails with an error 'Template validation failed: overlapping IP subnets'. Upon reviewing the template, the engineer notices that two VLANs have overlapping subnet definitions. Which action should the engineer take to resolve this issue efficiently?

Accepted Answer

Manually correct the overlapping subnets in the template and re-run the deployment script. The root cause of the deployment failure is overlapping IP subnets in the template definition. Manually correcting the overlapping subnets in the template and re-running the deployment script directly resolves the validation error without introducing unnecessary complexity or risk. This approach ensures the template is valid before deployment, maintaining consistency across all leaf switches.

Answer

Use the NDO GUI to edit the template and then re-run the script

Answer

Create separate templates for each VLAN to avoid overlaps

Answer

Modify the Python script to ignore validation errors and force the deployment

Question 3

In the context of Ansible automation for Cisco Nexus switches, which module can be used to manage VLAN configurations?

Accepted Answer

nxos_vlan. The cisco.nxos collection includes the nxos_vlan module specifically for managing VLANs on NX-OS devices.

Answer

nxos_interface

Answer

nxos_bgp

Answer

nxos_config

Question 4

A data center deployment uses NPV mode on a Cisco MDS switch to connect to a core Fibre Channel switch. After configuration, the NPV switch does not register with the core. What is the most likely cause?

Accepted Answer

NPIV is not enabled on the core switch.. NPV (N_Port Virtualization) mode requires NPIV (N_Port ID Virtualization) to be enabled on the core Fibre Channel switch. NPIV allows a single physical N_Port to register multiple FCIDs (Fibre Channel IDs) for multiple virtual initiators behind the NPV switch. Without NPIV on the core, the NPV switch cannot complete the FLOGI (Fabric Login) process and will not register with the fabric.

Answer

Fibre Channel ports are in trunk mode.

Answer

The core switch has NPV mode enabled.

Answer

The NPV switch has an incorrect domain ID.

Question 5

An administrator needs to configure a Fibre Channel SAN to support two separate departments that must not see each other's storage. Each department has its own set of initiators and targets. Which technology should be used?

Accepted Answer

VSANs (Virtual SANs). VSANs (Virtual SANs) provide isolation within a single Fibre Channel fabric by partitioning the physical SAN into multiple logical SANs. Each department's initiators and targets are placed in separate VSANs, ensuring they cannot see each other's storage traffic or devices, which meets the requirement for complete separation without additional physical hardware.

Answer

Port channels

Answer

NPV

Answer

IVR (Inter-VSAN Routing)

Question 6

Ansible playbook that deploys VLANs on NX-OS fails on a particular switch with 'privilege escalation required'. What should be checked first?

Accepted Answer

The 'ansible_become_password' or 'enable' password in the playbook. The error 'privilege escalation required' indicates that Ansible cannot execute commands with the necessary elevated privileges on the NX-OS switch. In Ansible, privilege escalation is handled via the 'become' mechanism, and for network devices like NX-OS, the 'ansible_become_password' (or 'enable' password) is required to enter privileged EXEC mode. Without this password, Ansible remains in user EXEC mode, which lacks the authority to apply VLAN configurations.

Answer

The 'host_key_checking' setting

Answer

The 'ansible_user' variable

Answer

The inventory file syntax

Question 7

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 8

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.

Answer

RADIUS

Answer

LDAP

Answer

SSH

Question 9

What is the purpose of the vPC peer keepalive link in a vPC domain?

Accepted Answer

To provide a keepalive mechanism to detect peer failure. The vPC peer keepalive link is a dedicated Layer 3 link used to detect a failure of the vPC peer switch. It sends periodic UDP-based keepalive messages (default every second) to ensure the peer is still operational, allowing the surviving switch to take over the vPC forwarding role. This mechanism is critical for preventing dual-active scenarios where both switches would incorrectly forward traffic for the same vPC VLAN.

Answer

To synchronize MAC address tables

Answer

To carry BPDUs for STP

Answer

To forward data traffic between vPC peers

Question 10

A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer must configure the underlay to support load balancing of VXLAN traffic across multiple equal-cost paths. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Enable the use of the source UDP port for hashing by configuring the load-balancing algorithm to include Layer 4 information.. To load-balance VXLAN traffic across multiple equal-cost paths, the underlay must have multiple equal-cost routes installed in the routing table, and the switch must hash traffic using fields that vary per flow. Including Layer 4 information, especially the source UDP port, provides the necessary entropy. The routing protocol must support ECMP and be configured to install multiple paths. Together, these actions enable effective distribution of VXLAN traffic.

Answer

Configure the underlay routing protocol to advertise the VTEP loopback with the same cost on all spines.

Answer

Configure the load-balancing algorithm to use the source and destination IP addresses only.

Answer

Enable jumbo frames on all interfaces in the underlay to accommodate the VXLAN encapsulation overhead.