350-601 Practice Exam 2 — 20 Questions

Question 1

In an ACI fabric, an EPG is configured with a contract that provides a service to another EPG. The contract has a filter for TCP port 80. Which component defines the directionality of the communication between the provider and consumer EPG?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The provider and consumer labels in the contract. In Cisco ACI, the provider and consumer labels in the contract define the directionality of communication. The provider EPG offers a service, and the consumer EPG initiates the request; the contract's provider/consumer relationship determines which EPG can start the conversation and in which direction the filter (e.g., TCP port 80) applies. This is fundamental to ACI's policy model, where the contract is unidirectional from consumer to provider by default.

Answer

The filter direction specified in the contract

Answer

The BD subnets

Answer

The subject of the contract

Question 2

Refer to the exhibit. What is the intended effect of this Ansible playbook task?

Accepted Answer

It ensures VLAN 10 exists with the name 'Automation_VLAN' on the target switches.. The Ansible playbook task uses the `cisco.nxos.nxos_vlans` module with the `state: merged` directive, which ensures that the specified VLAN configuration (VLAN 10 with name 'Automation_VLAN') is present on the target Nexus switches. If VLAN 10 does not exist, it will be created; if it exists with a different name, it will be updated. The `merged` operation does not delete or reboot; it only applies the configuration to align the device's state with the playbook's desired state.

Answer

It deletes VLAN 10 from all switches.

Answer

It saves the running configuration to startup.

Answer

It reboots the Nexus switches after applying the configuration.

Question 3

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

Accepted Answer

IP Source Guard. IP Source Guard (IPSG) uses the DHCP snooping binding table to validate the source IP address of packets received on untrusted ports. It drops any packet whose source IP does not match an entry in the binding table, preventing IP spoofing attacks. Dynamic ARP Inspection (DAI) also relies on the DHCP snooping binding table to validate ARP packets, ensuring that the sender MAC and IP addresses match a legitimate binding, thereby blocking ARP poisoning attacks.

Answer

Port Security

Answer

Private VLANs

Answer

MACsec

Question 4

A Cisco MDS 9000 switch is used in a storage network. The security policy requires that a junior administrator named 'user1' can view zone configurations but cannot make any changes. Currently, 'user1' is assigned the default 'network-operator' role, which allows read-only access to most configuration, but the engineer wants to ensure that zone modification is explicitly denied. The engineer creates a custom role named 'zone-viewer' and assigns it to 'user1'. The role should permit viewing of the running configuration related to zones but deny any command that modifies zone or zoneset configurations. Which configuration best achieves this objective?

Accepted Answer

role name zone-viewer
  permit command show zone*; permit command show zoneset*. It uses the 'permit command' statements with wildcard patterns ('show zone*' and 'show zoneset*') to explicitly allow only show commands related to zones and zonesets. By not including any 'permit' or 'deny' statements for configuration commands (like 'configure terminal', 'zone', or 'zoneset'), the role implicitly denies all other commands, including those that modify zone or zoneset configurations. This matches the requirement to allow viewing but deny modifications.

Answer

role name zone-viewer
  feature zone; permit command configure terminal ; zone name etc.

Answer

role name zone-viewer
  rule 1 permit read-write; feature zone

Answer

role name zone-viewer
  permit command zone; permit command zoneset; permit command zone-create

Question 5

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

Accepted Answer

show dot1x interface ethernet 1/1. The correct command on Cisco Nexus switches to verify 802.1X authentication status on a specific interface is 'show dot1x interface ethernet 1/1'. This command displays the 802.1X state, authorized status, and other details for the specified interface. Option B, 'show dot1x interface ethernet 1/1', is correct. Option C is incorrect because 'show authentication interface' is not a valid command on Nexus NX-OS; it is used on IOS-based switches. Option A is unrelated to 802.1X, and option D shows port security, not authentication status.

Answer

show aaa authentication

Answer

show authentication interface ethernet 1/1

Answer

show port-security interface ethernet 1/1

Question 6

When using Cisco NSO (Network Services Orchestrator) to automate service creation across a data center network, what is a key consideration regarding device compatibility?

Accepted Answer

Each device must have a corresponding NED that matches its OS version.. B is correct because Cisco NSO uses Network Element Drivers (NEDs) to translate service models into device-specific CLI, SNMP, or NETCONF commands. Each NED is tied to a specific device OS version (e.g., IOS-XE 16.12, NX-OS 9.3), so mismatched NEDs cause configuration failures or incomplete deployments. Without a compatible NED, NSO cannot communicate with or configure the device.

Answer

NSO requires NETCONF for all devices.

Answer

Device YANG models must be hand-coded by the team.

Answer

NSO only supports Cisco devices.

Question 7

A UCS Central administrator is creating a global service profile policy that applies to multiple UCS domains. The policy must include boot order settings. What is the recommended approach to ensure consistency across domains?

Accepted Answer

Use UCS Central to create a global boot policy and assign it to service profiles. UCS Central allows creation of global policies that are applied to service profiles in multiple domains, ensuring consistency.

Answer

Rely on default boot policy

Answer

Define the boot order directly in the service profile template

Answer

Create a local boot policy in each UCS domain

Question 8

Which TWO are best practices when automating ACI fabric configuration using Ansible?

Accepted Answer

Use the cisco.aci collection. The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

Answer

Set validate_certs: no to avoid certificate errors

Answer

Store credentials in plain text in playbooks

Answer

Use delegate_to: localhost for all tasks

Question 9

A network engineer is configuring a new UCS B-series blade server. The engineer wants the server to automatically inherit network and storage settings without manual configuration when replaced. Which UCS technology enables this capability?

Accepted Answer

Service profile template. Service profile templates in Cisco UCS Manager allow administrators to define a reusable configuration for network and storage settings. When a server fails or is replaced, the template is applied to the new blade, automatically inheriting all settings without manual intervention. This capability is central to UCS's stateless computing model, where hardware identity and policies are abstracted from the physical server.

Answer

Fabric Interconnect failover

Answer

Cisco IMC Supervisor

Answer

Cisco UCS Manager

Question 10

In a Cisco HyperFlex cluster, the management plane uses vCenter, but the data plane uses which protocol to replicate data across nodes?

Accepted Answer

HX Data Platform. In a Cisco HyperFlex cluster, the data plane replication across nodes is handled by the HX Data Platform, which is a distributed, log-structured file system that synchronously replicates data at the hypervisor level. This platform manages all I/O operations and ensures data consistency across the cluster without relying on external storage protocols like Fibre Channel or iSCSI.

Answer

Fibre Channel

Answer

NFS

Answer

iSCSI

Question 11

A network engineer wants to automate the deployment of VLANs across 50 Nexus switches in a data center. Which approach provides the most consistent and repeatable results with minimal manual effort?

Accepted Answer

Ansible playbook with nxos_vlan module. Ansible playbook with the nxos_vlan module is the correct choice because it provides idempotent, declarative automation that ensures consistent VLAN configuration across all 50 Nexus switches with minimal manual effort. Ansible handles SSH connectivity and state management natively, eliminating the need for custom scripting and reducing the risk of human error.

Answer

Python script using netmiko

Answer

Manual CLI on each switch

Answer

Bash script with SSH

Question 12

A data center engineer is designing a UCS Manager solution that requires VLAN segmentation across multiple fabric interconnects. The network team requires that each VLAN is assigned a unique native VLAN ID per fabric. Which pool configuration supports this requirement?

Accepted Answer

Create separate VLAN pools for each fabric with non-overlapping ranges. UCS Manager allows separate VLAN pools to be assigned per fabric interconnect, enabling unique native VLAN IDs per fabric. By creating non-overlapping VLAN pools for each fabric, the engineer ensures that each fabric has its own native VLAN ID without conflict, meeting the requirement for VLAN segmentation across multiple fabric interconnects.

Answer

Use derived VLAN pools based on chassis location

Answer

Create a single VLAN pool that includes all required VLANs

Answer

Configure VLANs directly in the service profile using inline pools

Question 13

A data center administrator is troubleshooting slow storage performance on a UCS B-Series blade server. The server is connected to a Cisco UCS 6300 Series Fabric Interconnect and uses local SAS drives. The administrator checks the UCS Manager and sees that the storage adapter has a driver version that is not recommended. What is the most likely impact of using a non-recommended driver version?

Accepted Answer

Degraded storage performance or instability. Using a non-recommended driver version for the storage adapter in a UCS B-Series blade server can lead to degraded storage performance or system instability. Cisco validates specific driver versions for compatibility with the UCS 6300 Series Fabric Interconnect and local SAS drives; deviations may cause suboptimal I/O handling, increased latency, or unexpected errors. This is a common issue in compute environments where driver- firmware mismatches affect storage throughput.

Answer

Loss of redundancy on the fabric interconnect

Answer

Inability to boot the server

Answer

Increased security vulnerabilities

Question 14

Which best practice should be followed when creating a UCS service profile template for stateless computing?

Accepted Answer

Assign MAC and WWN addresses from pools. Stateless computing in UCS requires that all server identity information, such as MAC addresses and WWNs, be abstracted away from the hardware and assigned dynamically from pools. This allows the service profile to be applied to any compatible blade or rack server without manual reconfiguration, enabling rapid provisioning and seamless hardware replacement. Defining these addresses directly in the profile or using static assignments would break the stateless model by tying the profile to specific hardware.

Answer

Use local storage on each server for boot images

Answer

Configure Windows Server NIC teaming for all vNICs

Answer

Define MAC addresses directly in the service profile

Question 15

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

Accepted Answer

Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.. APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.

Answer

Change the authentication method in the script from password-based to certificate-based authentication.

Answer

Regenerate the API key for the service account and update the script with the new key.

Answer

Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.

Question 16

A data center engineer is configuring a Cisco UCS C-Series server with a hardware RAID controller. The server will host a critical database. The RAID controller supports RAID 0, 1, 5, 6, and 10. Which RAID level should be chosen to provide the best combination of performance and fault tolerance?

Accepted Answer

RAID 10. RAID 10 (striping of mirrors) provides the best combination of performance and fault tolerance for a critical database workload. It offers high read/write performance through striping and full redundancy via mirroring, allowing up to one disk failure per mirrored pair without data loss. This is ideal for a Cisco UCS C-Series server with a hardware RAID controller where both I/O throughput and availability are paramount.

Answer

RAID 6

Answer

RAID 5

Answer

RAID 0

Question 17

A Cisco UCS upgrade from release 3.1(1) to 4.0(4) is planned. The current release has a known issue that affects NVRAM backup. What is the best practice to avoid an outage during this upgrade?

Accepted Answer

Upgrade to an intermediate release that is recommended for the upgrade path.. Cisco UCS firmware upgrades must follow a supported upgrade path to avoid incompatibilities and known issues. Skipping directly from 3.1(1) to 4.0(4) is not supported; an intermediate release (e.g., 3.2(x) or 4.0(1)) is required to resolve the NVRAM backup issue and ensure a seamless upgrade without service disruption.

Answer

Perform a cold reboot of all Fabric Interconnects before starting.

Answer

Upgrade all components simultaneously to reduce transition time.

Answer

Upgrade the firmware on the chassis first, then the Fabric Interconnects.

Question 18

A storage administrator reports that a Cisco UCS domain is not booting from the Fibre Channel SAN. The boot policy is correctly configured and the vHBA is associated. Which two alignment issues could cause this problem? (Choose two.)

Accepted Answer

The WWPN of the vHBA is not zoned on the SAN fabric.. If the WWPN of the vHBA is not properly zoned on the SAN fabric, the Fibre Channel switch will not allow the server to log in to the target storage. Even with a correct boot policy and vHBA association, without zoning, the initiator cannot discover or communicate with the boot LUN, causing the boot to fail.

Answer

The Ethernet LAN is not configured on the FI.

Answer

The disk firmware on the server is outdated.

Question 19

An administrator needs to reset the CIMC password on a Cisco UCS C-Series server without physical access. Which method can be used?

Accepted Answer

Use the CIMC XML API. The CIMC XML API allows remote management of Cisco UCS C-Series servers, including password resets, without physical access. This API provides a programmatic interface to CIMC functions, enabling administrators to send authenticated XML requests over HTTPS to reset the CIMC password. Physical access is not required because the API operates over the network, making it the correct method for this scenario.

Answer

Use the front panel reset button

Answer

Use UCS Manager

Answer

Connect via serial console during boot

Question 20

A UCS administrator needs to ensure that server boot order always starts from the local disk if available, and falls back to a SAN LUN if local disk fails. Which boot policy setting should be used?

Accepted Answer

Local Disk first, then SAN. The UCS boot policy allows you to specify a boot order where the local disk is attempted first. If the local disk is unavailable or fails, the system automatically falls back to the next boot device in the list, which is the SAN LUN. This ensures high availability and aligns with the requirement to prefer local boot while providing a failover path.

Answer

Local Disk alone

Answer

SAN first, then Local Disk

Answer

SAN Boot Only