350-601 Practice Test 2 — 10 Questions

Question 1

A large financial institution has a Cisco ACI fabric with multiple tenants. The security team requires that all management access to the APIC controllers be authenticated via multi-factor authentication (MFA) using a RADIUS server. The RADIUS server is configured to send a One-Time Password (OTP) challenge during authentication. The current configuration uses local authentication. The engineer needs to implement RADIUS authentication with MFA for APIC GUI and CLI access. The RADIUS server is reachable at 10.10.10.10, shared secret 'SecureSecret123'. The APIC is running software version 4.2(3). The engineer must ensure that local authentication is used as fallback if the RADIUS server is unreachable. Which of the following actions should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a RADIUS provider with IP 10.10.10.10 and secret 'SecureSecret123', create a login domain with realm 'radius', set fallback to 'local', and assign the domain to users.. It follows the required steps to configure RADIUS authentication with MFA on Cisco APIC: adding a RADIUS provider with the correct IP and shared secret, creating a login domain with realm 'radius', setting fallback to 'local', and assigning the domain to users. This ensures that the APIC sends authentication requests to the RADIUS server, which can issue an OTP challenge for MFA, and falls back to local authentication if the RADIUS server is unreachable.

Answer

Configure TACACS+ as the authentication protocol and set the server IP and secret.

Answer

Enable local authentication only and require strong passwords.

Answer

Configure LDAP authentication with the RADIUS server acting as an LDAP proxy.

Question 2

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets?

Accepted Answer

VTEP. The VTEP (VXLAN Tunnel Endpoint) is the device that performs encapsulation and decapsulation of Ethernet frames into UDP packets. It is the edge component in a VXLAN network that maps tenant traffic to VXLAN segments and handles the actual tunneling by adding the VXLAN header (including VNI) and outer UDP/IP headers.

Answer

VNI

Answer

VXLAN tunnel

Answer

VXLAN gateway

Question 3

Which TWO statements about Cisco UCS service profiles are correct? (Choose TWO.)

Accepted Answer

Service profiles can include policies for firmware management.. Cisco UCS service profiles can include firmware management policies that specify the firmware versions to be applied to the associated server components, such as adaptors, BIOS, and storage controllers. This allows administrators to enforce consistent firmware levels across the infrastructure without manual intervention.

Answer

Service profiles are only supported on B-Series blades.

Answer

Service profiles are tied to specific physical hardware.

Answer

A service profile does not include network identity settings such as MAC addresses.

Question 4

A data center uses NPV to connect edge switches to a core Fibre Channel switch. The edge switches report that some servers cannot log in. What is a likely cause?

Accepted Answer

NPIV not enabled on the core switch. In an NPV environment, the edge switch (NPV mode) relies on the core Fibre Channel switch to handle fabric login (FLOGI) and name server registration. NPIV (N_Port ID Virtualization) must be enabled on the core switch to allow multiple N_Port IDs to be assigned to a single physical N_Port, which is essential for NPV to function. If NPIV is not enabled on the core, the core switch cannot accept FLOGI requests from the NPV edge switch, preventing servers from logging into the fabric.

Answer

Overlapping VSAN IDs between edge and core

Answer

F port binding on the edge switch

Answer

Trunking mode not enabled on the core switch

Question 5

A storage administrator wants to ensure that only designated initiators can access a specific target in a Fibre Channel SAN. Which mechanism enforces this policy?

Accepted Answer

Zoning. Zoning is the correct mechanism because it restricts Fibre Channel (FC) communication to only those initiators and targets that are members of the same zone. By defining a zone that includes only the designated initiator WWPNs and the target WWPN, the switch enforces access control at the fabric level, preventing any unauthorized device from discovering or communicating with the target.

Answer

IVR

Answer

Port channel

Answer

VSAN

Answer

Credit recovery

Question 6

Refer to the exhibit. An administrator notices the blade firmware is outdated. What is the recommended first step to update the blade firmware?

Accepted Answer

Create a firmware management policy to stage the update. Cisco UCS Manager uses firmware management policies to stage firmware updates across blades in a controlled, non-disruptive manner. Staging the update allows the administrator to schedule the activation during a maintenance window, ensuring all blades receive the same firmware version consistently without immediate impact on production traffic.

Answer

Upgrade the fabric interconnects first

Answer

Update each blade individually using the CIMC

Answer

Reboot all blades immediately

Question 7

A HyperFlex cluster uses replication factor 3 (RF3) and consists of 4 all-flash nodes. One node fails permanently. After replacing the node, the cluster re-replicates data. What is the minimum number of additional node failures that can be tolerated without data loss after re-replication completes?

Accepted Answer

2. With RF3 (three copies of data), the cluster can tolerate up to two simultaneous failures (quorum requires at least two copies). After replacing the failed node, the cluster returns to full health, so again can tolerate two failures. However, if the cluster originally had 4 nodes and one fails, only 3 remain; if another fails during re-replication, data could be at risk. But after re-replication, 4 nodes exist, so two failures are tolerable.

Answer

1

Answer

0

Answer

3

Question 8

A network engineer is implementing port security on a Cisco Nexus 9000 switch to limit the number of MAC addresses learned on a single access port. The switchport is configured as follows:

interface Ethernet 1/2
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation shutdown
  switchport port-security mac-address sticky

After connecting two authorized devices, a third unauthorized device is connected, causing the port to enter the err-disabled state. The engineer needs to restore connectivity for the two authorized devices as quickly as possible, while maintaining the security posture. What is the best practice to recover the port automatically in the future?

Accepted Answer

Configure 'errdisable recovery cause psecure-violation' to automatically recover the port after the configured interval.. The 'errdisable recovery cause psecure-violation' command enables automatic recovery from the err-disabled state caused by a port-security violation. This allows the port to come back up after a default or configured interval (typically 300 seconds) without manual intervention, restoring connectivity for the two authorized devices while maintaining the security posture of limiting MAC addresses to two.

Answer

Manually shut down and then no shutdown the interface to recover from err-disabled state.

Answer

Remove port-security configuration entirely to prevent future err-disables.

Answer

Increase the maximum MAC address limit to 3 to accommodate the third device.

Question 9

An engineer needs to extend a Layer 2 VLAN across a VXLAN EVPN fabric. Which construct maps the VLAN to the overlay network?

Accepted Answer

VNI. In a VXLAN EVPN fabric, the VNI (VXLAN Network Identifier) is the construct that maps a Layer 2 VLAN to the overlay network. The VNI uniquely identifies a Layer 2 segment across the underlay, allowing VLAN traffic to be encapsulated and transported over the IP fabric. This mapping is configured on the VTEP (VXLAN Tunnel Endpoint) using commands like 'vlan 100' mapped to 'vn-segment 10100' under the VLAN configuration.

Answer

VLAN ID

Answer

VTEP IP

Answer

VPC

Question 10

A Cisco MDS switch is configured as an NPV switch to connect to a core switch. Which statement about NPV operation is true?

Accepted Answer

The NPV switch uses FDISC to register multiple N-Port IDs from a single physical link.. In N_Port Virtualization (NPV) mode, a Cisco MDS switch acts as a passthrough device that aggregates multiple end-device N_Ports onto a single uplink to a core Fibre Channel switch. The NPV switch uses the Fabric Discovery (FDISC) protocol to register multiple N_Port IDs (NPIV) from a single physical link, allowing each end device to obtain its own FC ID from the core switch. This is correct because NPV does not assign FC IDs itself but relies on the core switch for fabric login and address assignment.

Answer

The NPV switch allocates FC IDs to end devices from its own pool.

Answer

The NPV switch requires at least one VSAN to be defined as a fabric VSAN.

Answer

The NPV switch performs fabric login (FLOGI) on behalf of all attached end devices.