350-601 Practice Exam 3 — 20 Questions

Question 1

A Cisco UCS Manager administrator notices that a newly provisioned service profile is showing 'Config Error' for the vNIC. The vNIC is configured to use a dynamic MAC address from a pool that has no free addresses. What is the correct remediation?

Accepted Answer

Add more MAC addresses to the MAC pool used by the vNIC. The 'Config Error' for the vNIC indicates that the dynamic MAC address assignment failed because the MAC pool is exhausted. Adding more MAC addresses to the pool resolves the issue by providing available addresses for the vNIC to consume, allowing the service profile to deploy successfully.

Answer

Upgrade the firmware on the Fabric Interconnect

Answer

Change the vNIC to use a static MAC address

Answer

Reassociate the service profile to a different blade

Question 2

A network engineer wants to automate the deployment of a new VLAN across all Cisco Nexus switches in a data center using Python scripts. Which tool is most appropriate for this task?

Accepted Answer

Cisco NX-API with Python requests. Cisco NX-API provides a RESTful API interface on Nexus switches, allowing direct HTTP/HTTPS calls to configure VLANs programmatically. Using Python's requests library, you can send structured JSON payloads to the API endpoint, making it the most direct and efficient method for script-driven automation without requiring intermediate tools or protocols.

Answer

SSH CLI commands via Paramiko

Answer

Ansible playbook

Answer

SNMP SET commands

Question 3

A Cisco MDS switch is connected to a Fibre Channel storage array and a host. The host cannot see the storage LUNs. The 'show flogi database' command on the MDS shows the host's WWPN, but the 'show fcns database' does not show the storage target. What is the most likely cause?

Accepted Answer

The storage target is not logged into the fabric.. The 'show flogi database' command displays all devices that have completed the Fabric Login (FLOGI) process, which the host has done. However, the 'show fcns database' command lists only devices that have registered with the Fabric Name Server (via FDISC or FLOGI with PLOGI). Since the storage target is not in the name server database, it means the target has not logged into the fabric (or has not registered its FC-4 type/SCSI features), preventing the host from discovering its LUNs. This is the most likely cause because the host can see its own WWPN in the FLOGI database but cannot see the target in the FCNS database.

Answer

The zone configuration is incorrect.

Answer

The host and target are in different VSANs.

Answer

The host is not in the name server database.

Question 4

A data center team is troubleshooting an automation script that uses REST API to configure a Cisco Nexus 9000 switch. The script fails with a '401 Unauthorized' error. What is the most likely cause?

Accepted Answer

Invalid or expired authentication token. A 401 Unauthorized error in REST API communication indicates that the request lacks valid authentication credentials. For Cisco Nexus 9000 switches, REST API access typically requires a token-based authentication (e.g., using HTTP Basic Auth to obtain a session token or cookie). If the token is invalid or expired, the API server rejects the request with a 401 status code, as the script cannot prove its identity.

Answer

API rate limiting has been exceeded

Answer

Network connectivity issue between the script and the switch

Answer

The user account does not have admin privileges

Question 5

Refer to the exhibit. An engineer sees this error on a Cisco MDS switch. What is the best action to resolve the issue?

Accepted Answer

Assign a different domain ID to one of the switches.. The error indicates a domain ID conflict between two switches in the same VSAN. In Fibre Channel fabrics, each switch must have a unique domain ID to build a correct forwarding table. Assigning a different domain ID to one of the switches resolves the conflict without disrupting the fabric.

Answer

Reload both switches to reset domain IDs.

Answer

Shut and no shut the ISL between the switches.

Answer

Change the VSAN on one of the switches.

Question 6

Which TWO statements about NPV (N_Port Virtualization) mode in FC networks are correct?

Accepted Answer

NPV is commonly used in top-of-rack (ToR) deployments to simplify SAN cabling.. Option A is correct because NPV is specifically designed for top-of-rack (ToR) deployments to reduce the number of physical cables and simplify SAN cabling. In NPV mode, the ToR switch acts as a transparent proxy, forwarding FLOGI requests from end devices to the core NPV-enabled switch, which handles all fabric services. This eliminates the need for each ToR switch to have its own domain ID, reducing management complexity.

Answer

An NPV switch connects to the core switch using E-ports.

Answer

NPV switches can be used to connect FC and FCoE devices without a separate FCoE VLAN.

Answer

NPV switches perform fabric login (FLOGI) on behalf of attached devices.

Question 7

A DevOps team uses Ansible to automate the configuration of Cisco Nexus switches. After running a playbook, some switches have the correct configuration but others do not. The playbook uses the 'nxos_config' module. Which action should be taken to ensure consistent configuration?

Accepted Answer

Use the 'backup' option to save the running config before changes. The 'nxos_config' module's 'backup' option saves the running configuration to a file before applying changes. This ensures that if a switch fails to apply the configuration correctly, the original configuration is preserved for rollback, enabling consistent recovery across all switches. Without this, some switches may have partial or incorrect configurations that cannot be easily reverted.

Answer

Set 'ignore_errors' to true in the playbook

Answer

Use 'serial' directive to run the playbook on one switch at a time

Answer

Enable check mode to verify changes before applying

Question 8

A network engineer is troubleshooting CoPP drops on a Cisco Nexus 9000 switch. The 'show control-plane' output indicates that packets are being dropped due to 'CoPP' on the 'default' control-plane class. Which action is most likely to resolve the issue without affecting routing protocol stability?

Accepted Answer

Increase the policer rate for the 'default' class in the CoPP policy.. The 'default' class in a CoPP policy catches all control-plane traffic not explicitly matched by higher-priority classes. Drops in this class indicate that the aggregate policer rate for unmatched traffic is too low. Increasing the policer rate for the 'default' class allows more legitimate control-plane packets (e.g., ARP, BFD, or management traffic) to pass without impacting the dedicated policers for critical protocols like OSPF or BGP, thus preserving routing stability.

Answer

Disable CoPP globally to allow all control-plane traffic.

Answer

Modify the class-map to reclassify the dropped packets to a higher priority class.

Answer

Increase the ingress buffer size on the control-plane interface.

Question 9

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. Option C is correct because SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 10

In a VXLAN EVPN multi-tier design, which feature ensures traffic between leaf switches takes the optimal path without hair-pinning through a spine?

Accepted Answer

ECMP. C is correct because Equal-Cost Multipath (ECMP) in a VXLAN EVPN multi-tier design allows leaf switches to load-balance traffic across multiple equal-cost spine paths, ensuring that traffic between leaf switches takes the most direct route without being forced to hair-pin through a spine. ECMP leverages the underlying IP fabric's routing to forward VXLAN-encapsulated packets over any available spine, avoiding suboptimal forwarding that would occur if a single spine were used as a relay.

Answer

Anycast gateway

Answer

Type-2 routes

Answer

ARP suppression

Question 11

Match each Cisco data center security feature to its purpose.

Question 12

Match each Cisco UCS Manager CLI command to its function.

Question 13

Match each Cisco data center high availability feature to its description.

Question 14

Which THREE factors should be considered when determining the number of upstream Ethernet uplinks from a UCS Fabric Interconnect to the core network? (Choose THREE.)

Accepted Answer

The number of vNICs per service profile and their bandwidth limits.. Option C is correct because the number of vNICs per service profile and their bandwidth limits directly determine the aggregate traffic that must be carried by the upstream Ethernet uplinks. Each vNIC is assigned a specific bandwidth cap (e.g., via QoS policy or vNIC template), and the sum of these caps across all service profiles on a Fabric Interconnect dictates the minimum uplink capacity required to avoid oversubscription.

Answer

Number of VLANs defined on the Fabric Interconnect.

Answer

Server CPU oversubscription ratio.

Question 15

Which TWO options are correct regarding Cisco UCS server profiles? (Select TWO.)

Accepted Answer

Resource pools, such as UUID pools, can be shared across service profile templates.. Option B is correct because resource pools like UUID pools, MAC pools, and WWN pools are global objects in Cisco UCS Manager that can be shared across multiple service profile templates. This allows administrators to define a pool once and reference it from any template, ensuring consistent allocation and avoiding conflicts.

Answer

Service profiles can be updated while the server is in OS configuration.

Answer

A vHBA in a service profile inherits the boot policy automatically.

Answer

A service profile can be associated with multiple servers simultaneously to provide load balancing.

Question 16

An organization is deploying a new leaf-spine fabric with Cisco ACI. The requirement is to allow inter-tenant communication between two EPGs in different tenants. Which configuration object is necessary to enable this communication?

Accepted Answer

A shared contract between the two EPGs.. In Cisco ACI, inter-tenant communication between EPGs in different tenants requires a shared contract. A contract defines the rules (filters) that permit traffic between EPGs, and when it is marked as 'shared,' it can be consumed by EPGs across tenant boundaries. This allows the provider EPG in one tenant to expose services to a consumer EPG in another tenant without merging the tenants' VRFs or bridge domains.

Answer

A common VRF that spans both tenants.

Answer

A filter that permits the required traffic.

Answer

A bridge domain that connects both EPGs.

Question 17

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

Accepted Answer

The VLAN-to-VNI mapping is missing under the VLAN configuration. The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

Answer

MTU mismatch on the underlay network

Answer

Anycast gateway is not configured on the leaf

Answer

BGP EVPN peers are not established

Question 18

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

Accepted Answer

Priority Flow Control (PFC) with a no-drop queue for iSCSI.. Option C is correct because Priority Flow Control (PFC) is the IEEE 802.1Qbb mechanism designed to provide lossless behavior for specific traffic classes, such as iSCSI storage traffic, on Nexus 9000 switches. By creating a no-drop queue for iSCSI, PFC uses pause frames on a per-priority basis to prevent buffer overflow, ensuring zero packet loss required by storage protocols.

Answer

Tail drop with DSCP-based classification.

Answer

Weighted Round Robin (WRR) with three queues.

Answer

Policing at the ingress and marking at the egress.

Question 19

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

Accepted Answer

Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.. Option C is correct because Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

Answer

Assign the 'read-only' role to the user within the tenant.

Answer

Create a separate VRF for each tenant and assign admin to that VRF.

Answer

Assign the 'tenant-admin' role to the user globally.

Question 20

An organization is deploying Cisco ACI in a brownfield data center. They have existing VLANs that need to be mapped to ACI EPGs. The network team notices that some VLANs are used across multiple tenants. How should the engineer design the VLAN pool to support overlapping VLANs?

Accepted Answer

Create separate VLAN pools per tenant, each containing the required VLANs.. Option B is correct because in Cisco ACI, VLAN pools are scoped to a physical domain, and overlapping VLANs across tenants require separate VLAN pools per tenant. Each tenant's EPG is statically bound to its own VLAN pool, ensuring isolation and preventing VLAN conflicts. This design aligns with ACI's multi-tenant architecture where VLAN IDs must be unique within a domain but can be reused across different domains.

Answer

Configure the VLANs as part of the EPG static binding without a pool.

Answer

Create one VLAN pool per physical domain and assign tenants to that domain.

Answer

Create a global VLAN pool with all VLANs and assign it to all tenants.