350-601 Practice Exam 3 — 20 Questions

Question 1

Refer to the exhibit. A network engineer notices that the NVE1 interface is up but VXLAN traffic is not being encapsulated. What is the most likely cause?

Accepted Answer

The BGP EVPN address-family is not activated.. VXLAN traffic encapsulation on the NVE1 interface requires the BGP EVPN address-family to be activated under the BGP configuration to exchange VNI-to-VTEP mappings. Without this address-family, the NVE interface cannot learn remote VTEPs, so VXLAN packets are never encapsulated with the outer UDP/IP header.

Answer

The VNI 10000 is not mapped to a VLAN.

Answer

The ingress replication protocol must be static.

Answer

The loopback0 interface is not configured.

Question 2

In a VXLAN BGP EVPN fabric, which component is responsible for handling BUM traffic using ingress replication, and how does the VTEP learn the list of remote VTEPs to replicate to?

Accepted Answer

The ingress VTEP learns remote VTEPs via MP-BGP EVPN Type 3 routes.. In a VXLAN BGP EVPN fabric, ingress replication is the default method for handling BUM traffic, where the ingress VTEP replicates packets and sends unicast copies to each remote VTEP. The ingress VTEP learns the list of remote VTEPs from MP-BGP EVPN Type 3 routes (Inclusive Multicast routes), which advertise the VNI and the originating VTEP's IP address, allowing the ingress VTEP to build its replication list.

Answer

The ingress VTEP learns remote VTEPs via IGMP snooping.

Answer

The egress VTEP sends unicast copies to all other VTEPs.

Answer

The spine switch performs replication to all leaf VTEPs.

Question 3

An engineer is configuring Cisco ACI to secure inter-tenant traffic. Tenants 'TenantA' and 'TenantB' need to communicate via a shared service, such as a DNS server in TenantA. How should the contract be configured?

Accepted Answer

Create a contract in TenantA. Set the DNS EPG as provider. In TenantB, create a consumer EPG and provide the contract from TenantA.. In Cisco ACI, inter-tenant communication via a shared service requires the contract to be created in the tenant that owns the shared service (provider). The provider EPG (DNS server in TenantA) is set as the provider, and the consumer EPG (in TenantB) consumes the contract from TenantA. This allows TenantB to access the DNS service without exposing its own EPGs, maintaining security isolation while enabling necessary traffic.

Answer

Create a contract in TenantA and apply it to the VRF shared between tenants.

Answer

Create a contract in TenantB. Set the DNS EPG as consumer. In TenantA, create a provider EPG and provide the contract from TenantB.

Answer

Create a contract in TenantA. Set both DNS EPG and TenantB EPG as providers.

Question 4

Which three EVPN route types are essential for VXLAN EVPN operation in a typical data center fabric? (Choose three.)

Accepted Answer

Type-3 (Inclusive Multicast Ethernet Tag). Type-3 (Inclusive Multicast Ethernet Tag) routes are essential for VXLAN EVPN because they enable BUM traffic replication across the underlay network by advertising the VNI and multicast group mapping, allowing VTEPs to join the correct multicast tree for flooding unknown unicast, broadcast, and multicast frames.

Answer

Type-4 (Ethernet Segment)

Answer

Type-1 (Ethernet Auto-Discovery)

Question 5

A company is planning to deploy Cisco Intersight to manage a hybrid environment including on-premises UCS domains and AWS EC2 instances. Which THREE of the following are required components for integrating AWS with Intersight?

Accepted Answer

An Intersight account with appropriate licenses. A valid Intersight account with the appropriate licenses (e.g., Intersight Essentials or Premier) is required to enable the AWS integration feature. Without the proper license tier, the Intersight account cannot access the cloud orchestration or management capabilities needed to connect and manage external cloud providers like AWS.

Answer

An Intersight Virtual Appliance deployed in AWS

Answer

A VPN tunnel between the on-premises network and AWS

Question 6

A network engineer is configuring Cisco Nexus VXLAN with BGP EVPN. The VTEPs are using loopback0 as the NVE source. The physical interfaces are up, but the NVE interface remains down. What is the most likely cause?

Accepted Answer

The loopback0 interface is not reachable via the underlay network.. The NVE interface requires the specified source interface (loopback0) to have IP reachability via the underlay network to establish VXLAN tunnels. If loopback0 is not reachable (e.g., due to missing OSPF/IS-IS routes or incorrect underlay configuration), the NVE interface will remain in a down state even if the physical interfaces are up. This is because the NVE interface depends on the underlay routing to encapsulate and forward VXLAN traffic.

Answer

The NVE interface is not configured with source-interface.

Answer

The VLAN 1 is not associated with the NVE interface.

Answer

The loopback0 interface is not created.

Question 7

Which THREE of the following are required to configure FCoE NPV on a Cisco Nexus switch?

Accepted Answer

Enable FIP snooping.. FIP snooping is required on the NPV switch to inspect and validate FCoE Initialization Protocol (FIP) frames, preventing unauthorized FCoE devices from joining the fabric. Without FIP snooping, the NPV switch cannot properly forward FCoE traffic between the ENode and the upstream FCF, making it a mandatory configuration step for FCoE NPV.

Answer

Configure a storage VLAN.

Answer

Configure a VSAN for FCoE.

Question 8

Which TWO commands are used to verify zoning configuration on a Cisco MDS switch? (Choose two.)

Accepted Answer

show zone. The 'show zone' command displays the configured zone database, including zone members and their aliases, which is essential for verifying zoning configuration. The 'show zoneset active' command shows the currently active zoneset that is enforced by the switch, confirming which zones are actually applied to traffic. Both commands directly verify zoning configuration on a Cisco MDS switch.

Answer

show fcns database

Answer

show flogi database

Answer

show vsan membership

Question 9

A storage administrator needs to configure zoning while minimizing administrative overhead and allowing multiple initiators to access multiple targets without having to change zones when new members are added. Which zoning approach is best?

Accepted Answer

Zoning by naming using a zone alias for initiators and another for targets. Zoning by name using zone aliases decouples the zone configuration from the physical port or WWN, allowing administrators to group initiators and targets into separate aliases. When new members are added to an alias, the zone automatically includes them without manual zone reconfiguration, minimizing administrative overhead while supporting multiple initiators and multiple targets.

Answer

Multiple initiator-multiple target zoning (all devices in one zone)

Answer

Single initiator-single target zoning

Answer

Single initiator-multiple target zoning (initiator-based)

Question 10

Which feature allows a Fibre Channel switch to use multiple links between two switches as a single logical link?

Accepted Answer

SAN port channel. SAN port channel (C) is correct because it allows multiple physical Fibre Channel links between two switches to be aggregated into a single logical link, providing load balancing and redundancy. This is achieved by bundling up to 16 physical ISLs into one logical interface, using a proprietary hashing algorithm to distribute frames across the member links while maintaining in-order delivery.

Answer

NPIV

Answer

NPV

Answer

SPAN

Answer

FCIP

Question 11

A storage administrator reports that a new host cannot log into the SAN. The host is connected to a Cisco MDS switch. The switch interface shows up/up but the host is not in the active zone. What is the most likely cause?

Accepted Answer

The zone set is not activated.. The host cannot log into the SAN despite the interface showing up/up because the zone set is not activated. In Cisco MDS Fibre Channel SANs, zone configurations are stored in the zone database but only take effect when the zone set is activated (using the 'zone activate' command). Without an active zone set, no zoning is enforced, and the host's WWPN is effectively invisible to other devices, preventing login even though the physical link is operational.

Answer

The switch port is in an isolated state.

Answer

The FC cable is faulty.

Answer

The host's WWPN is not in the zone configuration.

Answer

The host's driver is not installed.

Question 12

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 13

Based on the exhibited FLOGI database, what is the state of the interface fc1/1?

Accepted Answer

It is an NP port (proxy FW) because multiple FCIDs appear on the same interface.. The FLOGI database shows multiple FCIDs (0x010000, 0x010001) associated with the same interface fc1/1, which is characteristic of an NP port (proxy FW) in NPV mode. An NP port acts as a proxy for multiple end devices behind it, such as in a Fibre Channel NPV switch or a converged network adapter (CNA) in FCoE NPV mode, allowing multiple FCIDs to share a single physical link.

Answer

It is an F port with a hub attached.

Answer

It is a trunking E port.

Answer

It is a disabled port because there are two WWNs.

Question 14

Which ECMP load-balancing method is recommended for data center spine-leaf fabrics to ensure optimal traffic distribution?

Accepted Answer

Per-flow load balancing based on src-dst IP. Per-flow load balancing based on src-dst IP ensures that all packets belonging to the same flow (identified by source and destination IP addresses) follow the same path, preventing packet reordering while still distributing different flows across multiple equal-cost paths. In spine-leaf fabrics, this method provides optimal traffic distribution because it leverages the IP header information that is consistently available across Layer 3 boundaries, aligning with the fabric's routing-based forwarding model.

Answer

Per-packet load balancing

Answer

Weighted load balancing

Answer

Per-flow load balancing based on src-dst MAC

Question 15

An administrator configures 'aaa authentication login default group tacacs+ local'. What happens if the TACACS+ server is unreachable?

Accepted Answer

Local username database is used. The command 'aaa authentication login default group tacacs+ local' configures a method list where the first method is TACACS+ and the second is local. If the TACACS+ server is unreachable (not responding, not rejecting), the switch falls back to the next method in the list, which is local authentication using the local username database. This fallback behavior is defined by Cisco IOS/IOS-XE authentication method lists, where 'local' acts as a backup when the primary method is unavailable.

Answer

The switch uses no authentication

Answer

Authentication fails

Answer

The switch tries the next method in the group

Question 16

An engineer needs to ensure that only authorized servers can connect to a specific switch port in a data center. The port connects to a critical database server with fixed MAC address 00:1a:2b:3c:4d:5e. Which configuration is most appropriate?

Accepted Answer

switchport port-security
switchport port-security mac-address 001a.2b3c.4d5e
switchport port-security violation shutdown. It explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.

Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown

Answer

no switchport port-security
spanning-tree portfast

Answer

switchport port-security
switchport port-security maximum 2
switchport port-security violation protect

Question 17

What is the primary function of the Cisco Integrated Management Controller (CIMC) on UCS C-series rack servers?

Accepted Answer

To provide out-of-band management with KVM, virtual media, and remote firmware update. CIMC provides out-of-band management capabilities such as remote KVM, virtual media, and firmware updates, allowing administrators to manage the server independently of the host OS.

Answer

To manage the server's power and cooling via IPMI

Answer

To provide in-band management through the host OS

Answer

To integrate the rack server into UCS Manager fabric

Question 18

Match each Cisco data center technology to its primary purpose.

Accepted Answer

VDC: Enables partitioning a single physical switch into multiple logical switches.. VDC partitions switches; VPC provides redundant LAG; FEX extends fabric ports; OTV extends Layer 2 over Layer 3.

Answer

VPC: Enables partitioning a single physical switch into multiple logical switches.

Answer

FEX: Allows a link aggregation group to terminate on two upstream switches for redundancy.

Question 19

An engineer is configuring a storage network with FCoE and must ensure that the FCoE traffic does not interfere with standard LAN traffic. Which two mechanisms should be implemented?

Accepted Answer

Enable PFC on the FCoE VLAN.. FCoE requires lossless transport to prevent frame drops that would corrupt Fibre Channel frames. Priority Flow Control (PFC), defined by IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured as lossless while standard LAN traffic remains best-effort. This ensures FCoE traffic does not interfere with LAN traffic by isolating the flow control behavior.

Answer

Use the same VLAN for FCoE and LAN.

Answer

Disable flow control on FCoE VLAN.

Answer

Use jumbo frames for LAN traffic only.

Question 20

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.

Answer

RADIUS

Answer

LDAP

Answer

SSH