350-601 Practice Exam 4 — 20 Questions

Question 1

A data center architect is designing security for a Cisco ACI fabric that must comply with PCI DSS. The requirement is to encrypt all traffic between EPGs within the same tenant. Which solution should be used?

Accepted Answer

Use a contract with the 'encrypt' flag enabled between the EPGs.. Option B is correct because Cisco ACI supports encryption of traffic between EPGs within the same tenant using a contract with the 'encrypt' flag enabled. This leverages the ACI fabric's built-in capability to apply AES-based encryption (e.g., AES-256-GCM) at the leaf switch level, ensuring data confidentiality for PCI DSS compliance without requiring external devices or complex routing changes.

Answer

Enable port security on the leaf switch interfaces.

Answer

Create separate VRFs for each EPG and route traffic through a firewall.

Answer

Configure a site-to-site VPN between the leaf switches.

Question 2

An engineer is configuring a new data center leaf switch to enforce micro-segmentation using Cisco ACI. The requirement is to permit traffic from web servers to application servers on TCP port 8080, but deny all other traffic. The web servers are in EPG 'web_EPG' and application servers in EPG 'app_EPG'. Which contract configuration should be applied?

Accepted Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer.. Option C is correct because in Cisco ACI, contracts define the rules for communication between EPGs. The provider EPG offers a service, and the consumer EPG accesses it. By setting the filter direction to 'both', the contract enforces bidirectional traffic on TCP port 8080, which is necessary for web-to-application communication (e.g., HTTP responses). This configuration ensures that only traffic matching the filter is permitted, while all other traffic is implicitly denied by ACI's default deny behavior.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Use vzAny for both EPGs.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Assign web_EPG as provider and app_EPG as consumer.

Answer

Create a contract with subject 'web_to_app' and apply filter 'ip'. Assign web_EPG as provider and app_EPG as consumer.

Question 3

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

Accepted Answer

show authentication interface ethernet 1/1. Option C is correct because the 'show authentication interface ethernet 1/1' command displays the 802.1X authentication status, including the state machine, authorized status, and method list for a specific interface. This command is part of the Identity-Based Networking Services (IBNS) framework and provides a comprehensive view of all authentication methods (802.1X, MAB, WebAuth) configured on the port, which is essential for troubleshooting authentication failures on edge ports.

Answer

show aaa authentication

Answer

show dot1x

Answer

show port-security interface ethernet 1/1

Question 4

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

Accepted Answer

Upgrade the secondary vPC peer first, then the primary. In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

Answer

Upgrade both switches simultaneously using ISSU

Answer

Reload both switches to a previous version, then upgrade

Answer

Upgrade the primary vPC peer first, then the secondary

Question 5

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

Accepted Answer

VRF. The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default. This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Answer

Context (default)

Answer

Application-profile

Answer

Global

Question 6

Which TWO statements correctly describe the use of Cisco UCS Manager service profiles for server deployment?

Accepted Answer

Service profiles decouple server identity from hardware, enabling rapid provisioning.. Service profiles decouple the logical server identity (UUID, MAC addresses, WWPNs) from the physical hardware. This allows an administrator to rapidly provision or repurpose a server by simply associating the profile with a different blade or rack server, without reconfiguring the OS or SAN/NIC settings. This abstraction is the core value of Cisco UCS Manager for scalable, stateless computing.

Answer

Service profiles can only be applied to servers of the same model.

Answer

A service profile can be associated with multiple servers simultaneously.

Answer

Service profiles are stored locally on the server's boot drive.

Question 7

Which THREE of the following are valid methods to secure the control plane on a Cisco Nexus 9000 switch?

Accepted Answer

Enable control plane policing (CoPP) to rate-limit control plane traffic.. Control plane policing (CoPP) is a valid method to secure the control plane on a Cisco Nexus 9000 switch. CoPP uses a policy map applied to the control plane to rate-limit or drop traffic destined to the supervisor module, protecting the CPU from excessive or malicious traffic. This is a direct control plane security mechanism defined in Cisco NX-OS.

Answer

Enable Bidirectional Forwarding Detection (BFD) on all interfaces.

Answer

Implement routing protocol authentication (e.g., OSPF MD5).

Question 8

Refer to the exhibit. A VXLAN VNI (10030) is operationally down. What is the most likely cause?

Accepted Answer

The VLAN associated with VNI 10030 is not configured or mapped. VXLAN VNI 10030 is operationally down because the VLAN that maps to this VNI is either not created or not associated with the VNI under the NVE interface. In Cisco NX-OS, a VNI becomes operationally up only when the corresponding VLAN exists and is properly mapped via the `member vni 10030 associate-vrf` or `member vni 10030` command under the NVE interface. Without this mapping, the NVE cannot forward traffic for that VNI, leaving it in a down state.

Answer

The source interface loopback0 is not up

Answer

The NVE mode should be L2VPN instead of L3VPN

Answer

The multicast group 239.1.1.1 is not reachable

Question 9

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

Accepted Answer

Enable DHCP snooping globally and configure uplink ports as trusted.. DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.

Answer

Enable dynamic ARP inspection on all VLANs.

Answer

Enable IP source guard on all access ports.

Answer

Enable MAC port security on all access ports.

Question 10

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 1 is not allowed on the trunk, so untagged frames are dropped.. The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1. This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Answer

The spanning-tree port type edge trunk is causing BPDU guard to block the port.

Answer

The port is in err-disabled state due to a loop.

Answer

The port is administratively down.

Question 11

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

Accepted Answer

Set OSPF priority to 0 on the interface. Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

Answer

Set OSPF priority to 255 on the interface

Answer

Change the OSPF network type to point-to-point

Answer

Configure the interface as passive under OSPF

Question 12

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

Accepted Answer

The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract. In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.

Answer

The contract is applied but not enforced due to a configuration error

Answer

The VRF has a default route that bypasses contract enforcement

Answer

A preferred group contract is applied to the VRF

Question 13

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

Accepted Answer

The underlay network provides IP connectivity between VTEPs. Option A is correct because the VXLAN underlay network (typically an IP-based fabric using protocols like OSPF or IS-IS) provides IP connectivity between VTEPs, enabling them to encapsulate and decapsulate VXLAN packets. Without this underlay reachability, VTEPs cannot communicate, making it a foundational requirement for VXLAN operation.

Answer

VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

Answer

VXLAN uses a 32-bit network identifier (VNI)

Answer

The control plane is responsible for actual data forwarding

Question 14

Refer to the exhibit. An engineer is configuring a server-facing interface on a Nexus switch. The server is running VMware ESXi with multiple virtual machines in VLANs 10, 20, and 30. After applying the configuration, the ESXi host reports that it cannot communicate on VLAN 30. Which configuration change should be made?

Accepted Answer

Create VLAN 30 in the global VLAN database. Option C is correct because VLAN 30 must exist in the global VLAN database before it can be used on any interface. Even though the interface configuration allows VLAN 30 as a trunked VLAN, the switch will not forward traffic for a VLAN that has not been created globally. Without the 'vlan 30' command in global configuration mode, the VLAN is not present in the switch's VLAN database, and the interface will not pass traffic for that VLAN.

Answer

Remove the 'spanning-tree port type edge trunk' command

Answer

Change the native VLAN to 30

Answer

Configure the port as an access port in VLAN 30

Question 15

An engineer is deploying a new UCS chassis with two Fabric Interconnects. The design requires that server traffic can fail over to the secondary FI if the primary FI fails, without requiring any changes to the server's network configuration. Which technology must be enabled on the uplink ports of the Fabric Interconnects to the upstream switches to ensure transparent failover of server traffic?

Accepted Answer

Enable pin groups with 'failover' mode on the server ports.. Pin groups with 'failover' mode enable transparent server traffic failover by pinning server vNICs to a specific Fabric Interconnect (FI) and automatically repinning them to the secondary FI upon primary FI failure, without requiring any changes to the server's network configuration. This ensures that the server's MAC and IP addresses remain active on the secondary FI, maintaining connectivity without manual intervention.

Answer

Configure a virtual PortChannel (vPC) between the Fabric Interconnects and upstream switches.

Answer

Apply QoS policies to prioritize failover traffic.

Answer

Implement Private VLANs on the uplink ports to isolate traffic.

Question 16

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

Accepted Answer

Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.. When the vPC peer link fails, the peer-keepalive link is used by the secondary switch to detect that the primary is still alive and to avoid becoming the primary (which would cause a split-brain scenario). Using a dedicated management interface or a separate VRF ensures the keepalive messages are isolated from the data plane and remain reachable even if the peer link goes down, allowing the secondary to correctly keep its vPC member ports in a suspended state and maintain convergence.

Answer

Disable vPC on both switches and reconfigure the port channels.

Answer

Reconfigure the vPC domain with a lower priority on the secondary switch.

Answer

Increase the vPC peer-keepalive hold timeout to 5 seconds.

Question 17

A company is deploying a Cisco UCS Mini in a remote office. They need to support both VMware vSphere and Microsoft Hyper-V on the same UCS domain. What is the best practice for deploying compute resources for both hypervisors?

Accepted Answer

Create separate service profile templates for each hypervisor. Separate service profile templates are required because VMware vSphere and Microsoft Hyper-V have different boot and storage configuration requirements. Each hypervisor needs its own boot policy (e.g., SAN boot vs. local disk), firmware settings, and potentially different vNIC/vHBA configurations. Using distinct templates ensures that each hypervisor's compute resources are correctly provisioned without conflicts.

Answer

Use a single service profile but assign different VLANs for management traffic

Answer

Place each hypervisor in a separate UCS Organization within the same service profile template

Answer

Create a single service profile template and use different identity pools for each hypervisor

Question 18

A UCS administrator needs to deploy 20 identical servers with the same firmware, BIOS, and boot order. Which approach is the most efficient?

Accepted Answer

Create a service profile template and then generate service profiles from it.. Creating a service profile template and then generating service profiles from it is the most efficient approach because it allows you to define the firmware, BIOS, and boot order once in a reusable template, then automatically create multiple service profiles with unique identities (e.g., UUID, MAC, WWN) for each of the 20 identical servers. This leverages Cisco UCS Manager's built-in template-to-instance workflow, ensuring consistency and reducing manual effort.

Answer

Use a UUID suffix pool to auto-generate identities.

Answer

Use a Cisco UCS Central 'Gold' template to deploy the servers.

Answer

Create a service profile for each server manually.

Question 19

Which THREE are benefits of using Cisco UCS Manager to manage compute resources? (Choose three.)

Accepted Answer

Centralized management of multiple chassis. Option A is correct because Cisco UCS Manager provides a single-pane-of-glass management interface that can centrally manage up to 160 chassis (including UCS 5108 and UCS 9508) in a single domain. This eliminates the need to configure each chassis individually, reducing operational overhead and ensuring consistent configuration across the entire compute infrastructure.

Answer

Direct management of virtual machines

Answer

Improved performance by disabling hardware features

Question 20

A data center engineer is planning a Cisco UCS deployment for a virtualized environment. The requirement is to maximize performance for virtual machine traffic while minimizing latency. Which feature should be enabled on the UCS Manager to offload packet processing from the host CPU?

Accepted Answer

Hardware VLAN tagging and checksum offload. Hardware VLAN tagging and checksum offload offloads packet processing tasks (VLAN insertion/stripping and checksum calculation) from the host CPU to the Cisco UCS virtual interface card (VIC) adapter. This reduces CPU overhead and minimizes latency for virtual machine traffic, directly meeting the requirement to maximize performance in a virtualized environment.

Answer

Data Center Ethernet (DCE) priority flow control

Answer

vNIC failover policy

Answer

Fibre Channel over Ethernet (FCoE) offload