350-601 Practice Exam 4 — 20 Questions

Question 1

In a spine-leaf architecture, what is the primary advantage of using a full mesh between spines and leaves?

Accepted Answer

It provides uniform low-latency paths between any two leaves. In a spine-leaf architecture, a full mesh between spines and leaves ensures that every leaf switch is connected to every spine switch. This design provides multiple equal-cost paths between any two leaf switches, allowing for uniform low-latency forwarding because traffic can traverse a single spine hop without congestion or path asymmetry. The full mesh eliminates the need for complex path selection and guarantees predictable, consistent latency across the fabric.

Answer

It reduces the total number of ports required

Answer

It removes the requirement for Spanning Tree Protocol

Answer

It eliminates the need for VLANs in the data center

Question 2

A network engineer is configuring OSPF on a Nexus switch. To ensure fast convergence in case of a link failure, which OSPF feature should be enabled?

Accepted Answer

OSPF Fast Hello. OSPF Fast Hello (B) is the correct feature to enable for fast convergence on a Nexus switch because it reduces the dead interval to less than one second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF neighbors to detect a link failure much faster than the default 40-second dead interval on broadcast networks, triggering quicker SPF recalculation and route convergence.

Answer

OSPF authentication

Answer

OSPF stub area

Answer

OSPF route summarization

Question 3

Which statement about RSTP (802.1w) is true?

Accepted Answer

RSTP reduces convergence time by using a proposal/agreement handshake. RSTP (802.1w) significantly reduces convergence time compared to legacy STP by using a proactive proposal/agreement handshake mechanism. Instead of relying on timers (like STP's 30-50 second convergence), RSTP switches immediately negotiate port roles and transition to forwarding by exchanging proposal and agreement BPDUs, enabling sub-second convergence in a properly designed network.

Answer

RSTP uses a timer-based convergence similar to STP

Answer

RSTP requires explicit configuration of edge ports to prevent loops

Answer

RSTP elects the root bridge based on the highest MAC address

Question 4

A network engineer needs to replace a failed UCS B-Series blade server with a new blade of the same model. The original blade had a custom service profile with specific vNIC and vHBA settings. What is the most efficient method to apply the same configuration to the new blade without manual reconfiguration?

Accepted Answer

Disassociate the existing service profile from the failed blade and associate it with the new blade.. Cisco UCS service profiles are logical constructs that encapsulate server identity and configuration (vNICs, vHBAs, boot order, UUID, etc.) and are associated with physical blades. Disassociating the profile from the failed blade and associating it with the new blade of the same model applies the entire configuration instantly, with no manual reconfiguration. This is the core benefit of UCS stateless computing.

Answer

Create a new service profile from scratch for the new blade.

Answer

Use Cisco IMC Supervisor to import the configuration from the failed blade.

Answer

Manually configure the new blade using UCS Manager GUI with the same settings as the original blade.

Question 5

Which BGP variant is commonly used in spine-leaf fabrics to advertise EVPN routes for VXLAN?

Accepted Answer

MP-BGP with EVPN address family. MP-BGP with the EVPN address family (AFI 25 / SAFI 70) is the control-plane protocol used in VXLAN spine-leaf fabrics to advertise MAC/VTEP reachability, host routes, and integrated routing and bridging (IRB) information. This allows the spine to act as a route reflector, distributing EVPN type-2 (MAC/IP) and type-3 (IMET) routes to all leaf nodes, enabling efficient, loop-free overlay forwarding.

Answer

OSPF with opaque LSA

Answer

eBGP with standard IPv4 unicast

Answer

iBGP with standard IPv4 unicast

Question 6

An engineer is configuring a new VLAN on a Nexus switch that is part of a vPC pair. Which step is mandatory to ensure the VLAN is created on both vPC peers?

Accepted Answer

Create the VLAN on both peers manually.. In a vPC domain, VLANs are not automatically synchronized between peers. The engineer must manually create the VLAN on both vPC peers to ensure it is present in the local VLAN database on each switch. This is because vPC relies on consistent local configuration on both devices for proper operation, and there is no built-in mechanism to propagate VLAN definitions from one peer to the other.

Answer

Use vPC peer-gateway to propagate VLANs.

Answer

Create the VLAN on the secondary peer only; the primary will learn via STP.

Answer

Create the VLAN on the primary peer only; it will sync automatically.

Question 7

In the context of ACI L3Out, which object is used to advertise external networks into the ACI fabric and is associated with a VRF?

Accepted Answer

L3Out. In ACI, an L3Out is the logical construct that provides connectivity from the ACI fabric to external Layer 3 networks. It is associated with a VRF to define the routing context, and it is the object under which external networks are advertised into the fabric via route redistribution or static routes. The L3Out contains the external EPGs and the protocol profiles (e.g., OSPF, BGP, EIGRP) that control the advertisement.

Answer

Bridge Domain

Answer

Contract

Answer

External EPG

Question 8

A company is consolidating its storage network into a single fabric using a Cisco MDS 9509. They want to use VSANs to isolate different departments. The VSANs will be 10, 20, and 30. They have a single ISL between two MDS switches. The engineers want to carry all three VSANs over the ISL. They configure both ends of the ISL as E ports and enable trunking. After configuration, they notice that only VSAN 10 traffic passes over the ISL. The other VSANs appear isolated. The show vsan membership shows all three VSANs are present on both switches. The show interface trunk on the ISL shows that the trunk is up but only VSAN 10 is allowed. What is the most likely cause?

Accepted Answer

The allowed VSAN list on the trunk port is limited to only VSAN 10. On Cisco MDS switches, an ISL configured as an E port with trunking enabled will only carry the VSANs that are explicitly permitted in the trunk's allowed VSAN list. The 'show interface trunk' output confirms the trunk is up but only VSAN 10 is allowed, meaning the allowed VSAN list on the trunk port was restricted to VSAN 10. To carry VSANs 20 and 30, the allowed VSAN list must be modified to include them (e.g., using the 'switchport trunk allowed vsan' command).

Answer

The other VSANs are not configured on the trunk interface

Answer

The trunk mode is set to 'on' instead of 'desirable'/'auto'

Answer

The ISL is in an error-disabled state for VSAN 20 and 30

Question 9

A storage administrator needs to isolate Fibre Channel traffic between two departments in a data center using a single MDS switch. The administrator decides to create separate VSANs. Which statement about VSANs is true?

Accepted Answer

VSANs provide isolation similar to VLANs in Ethernet networks.. VSANs provide isolation similar to VLANs in Ethernet: each VSAN is a separate logical fabric with its own fabric services, zoning, and domain IDs. This allows two departments to share a single MDS switch while remaining isolated.

Answer

VSANs share the same fabric services across all VSANs.

Answer

VSANs require separate physical interfaces for each VSAN.

Answer

VSANs cannot be used with FCoE.

Question 10

What is the purpose of a witness VM in a HyperFlex cluster?

Accepted Answer

To break ties in cluster quorum decisions. In a HyperFlex cluster, the witness VM provides a tie-breaking vote for cluster quorum decisions when the cluster experiences a network partition or node failure. It ensures that the surviving side can maintain a majority and continue operating, preventing split-brain scenarios where both sides would independently write data.

Answer

To act as a management node for the cluster

Answer

To provide additional storage capacity

Answer

To replicate data across sites

Question 11

A network engineer is deploying a Cisco HyperFlex cluster with four HX220c M5 nodes. The engineer wants to ensure that the cluster can tolerate a single node failure without data loss while maximizing usable capacity. Which replication factor should the engineer configure?

Accepted Answer

Replication Factor 2 (RF2). Replication Factor 2 (RF2) ensures two copies of data, allowing the cluster to survive one node failure. It is the standard configuration for clusters requiring single-failure tolerance and offers better capacity utilization than RF3. RF1 offers no redundancy, and erasure coding is not a replication factor.

Answer

Erasure Coding

Answer

Replication Factor 1 (RF1)

Answer

Replication Factor 3 (RF3)

Question 12

In a Cisco ACI fabric, a new EPG is created and associated with a bridge domain that has 'Unicast Routing' enabled. However, endpoints in that EPG cannot communicate with endpoints in other EPGs in the same VRF. What is missing?

Accepted Answer

A contract between the EPGs. In Cisco ACI, communication between EPGs within the same VRF is not allowed by default; it requires a contract. A contract defines the policies (allow/deny) and filters for traffic between EPGs. Without a contract, all traffic is dropped, even if the bridge domain has unicast routing enabled. Option C is correct because the missing element is the contract that explicitly permits inter-EPG communication.

Answer

The EPG must be attached to a Layer 3 outside

Answer

The bridge domain must have 'L3 Unknown Multicast Flooding' set

Answer

A route leak between bridge domains

Question 13

Refer to the exhibit. What is the current state of the VPC domain?

Accepted Answer

Operational. The exhibit shows the output of 'show vpc' with the vPC domain ID set to 100, the peer-keepalive link status as 'Active', and the peer-link status as 'up'. The vPC role is 'primary' and the operational status is listed as 'operational', which indicates that the vPC domain is fully functional and all consistency checks have passed. Therefore, the current state is operational.

Answer

VPC domain not configured

Answer

Peer-link down

Answer

Consistency check failed

Question 14

Which AAA protocol is recommended by Cisco for network device administration, as it separates authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions, making it preferred over RADIUS for admin access.

Answer

RADIUS

Answer

LDAP

Answer

802.1X

Question 15

A data center architect is designing a SAN with two MDS switches using VSANs. Which method ensures traffic isolation between departments while allowing sharing of a tape library?

Accepted Answer

Create separate VSANs for each department and a shared VSAN for the tape library with inter-VSAN routing (IVR).. It uses separate VSANs to isolate each department's traffic at Layer 2, while inter-VSAN routing (IVR) selectively allows the tape library to be shared across VSANs without merging them. IVR enables controlled communication between specific initiators and targets in different VSANs, preserving isolation for all other traffic.

Answer

Use FCIP tunnels for each department.

Answer

Create separate VSANs and merge them for the tape library.

Answer

Use one VSAN for all departments and one zone for each department.

Question 16

A Cisco MDS switch is configured with fabric binding to restrict which switches can join the fabric. A new switch is added, but it fails to establish an E-port connection. What is the most likely cause?

Accepted Answer

The new switch's WWN is not included in the fabric binding configuration. Fabric binding on a Cisco MDS switch uses the fabric-binding database to enforce a whitelist of allowed switch WWNs. When a new switch attempts to bring up an E-port, the principal switch checks the new switch's WWN against this database. If the WWN is not present, the E-port is automatically isolated, preventing the switch from joining the fabric. This is the most direct cause of the failure described.

Answer

Incompatible SFP modules between the switches

Answer

Incorrect zoning configuration on the existing switch

Answer

The new switch has a higher priority than the principal switch

Question 17

A Cisco ACI fabric has contracts configured to allow traffic between two EPGs. After deployment, traffic between endpoints in these EPGs is being dropped, but contract statistics show no packets have been permitted. The administrator checks the contract configuration and it looks correct. What is the most likely cause?

Accepted Answer

The contract is configured only on the provider EPG, but the consumer EPG is not consuming the contract.. The most likely cause is that the contract is configured on the provider EPG but the consumer EPG is not configured to consume it. In Cisco ACI, a contract must be explicitly provided by one EPG and consumed by another for traffic to be permitted. If the consumer EPG does not have the contract applied, the contract will not be enforced, and traffic will be dropped even if the contract configuration appears correct. The contract statistics showing no permitted packets confirm that the contract is not being applied to the traffic flow.

Answer

The contract is applied to the wrong VRF.

Answer

The filter direction is set to both, but the contract is using an incorrect filter.

Answer

The endpoints are in different VMM domains.

Question 18

A network engineer is troubleshooting an OSPF adjacency issue between two Nexus switches. The neighbors are stuck in the EXSTART state. What is the most likely cause?

Accepted Answer

MTU mismatch. When OSPF neighbors are stuck in the EXSTART state, the most common cause is an MTU mismatch. In EXSTART, the routers exchange Database Description (DBD) packets, which must be no larger than the interface MTU. If one interface has a smaller MTU, the DBD packet is dropped, preventing the adjacency from progressing to the Exchange state. Cisco Nexus switches default to an MTU of 1500 bytes, but any mismatch will cause this issue.

Answer

Hold timer mismatch

Answer

Incorrect area ID

Answer

Duplicate router ID

Question 19

An engineer is designing a UCS environment for a virtualized workload that requires high availability. Two Fabric Interconnects are deployed in an active-active configuration. Which statement about the role of the Fabric Interconnects is accurate?

Accepted Answer

Both FIs are active and can forward traffic, but only one manages the chassis at a time.. In a Cisco UCS environment with two Fabric Interconnects in an active-active cluster, both FIs are operational and can forward data traffic, but only one FI acts as the primary manager for the chassis at any given time. This provides high availability: if one FI fails, the other takes over management and continues forwarding traffic. Option B accurately describes this behavior.

Answer

The FIs are used only for management traffic and not for data traffic.

Answer

One FI acts as primary and the other as secondary, forwarding traffic only if the primary fails.

Answer

The FIs operate in a standalone mode and must be configured independently.

Question 20

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

Accepted Answer

It uses the SGACL to permit HTTP and deny other traffic. SGACLs enforce policy based on SGTs, not IP addresses.

Answer

It forwards the traffic to the Cisco ISE for policy decision

Answer

It applies an IP ACL based on the SGT

Answer

It drops all traffic between different SGTs unless a contract exists