350-601 Practice Test 22 — 15 Questions

Question 1

A large financial institution has recently migrated its data center network to a new Cisco ACI fabric. The operations team is tasked with automating the provisioning of new application tenants, including EPGs, contracts, and bridge domains, using the APIC REST API. They have developed a comprehensive set of Python scripts that successfully performed these actions in their lab environment. However, when deploying the scripts to production, they receive an 'SSL: CERTIFICATE_VERIFY_FAILED' error from the requests library. The production APIC cluster uses a self-signed certificate for HTTPS, and the corporate security policy strictly prohibits the use of HTTP or disabling certificate verification. Additionally, the policy does not allow replacing the self-signed certificate with a CA-signed one without a lengthy approval process that could delay the automation project. The team needs an immediate solution that maintains security best practices. What should the team do?

Accepted Answer

Add the self-signed certificate to the Python trust store by using the cert file in the verify parameter.. Option C is correct because adding the self-signed certificate to the Python trust store allows verification to succeed while maintaining security. Option A disables verification, violating security. Option B requires policy change that is not immediate. Option D uses HTTP, which is insecure.

Answer

Use HTTP instead of HTTPS for the API calls.

Answer

Disable SSL certificate verification in the Python requests by setting verify=False.

Answer

Request an exception to the security policy to allow a CA-signed certificate.

Question 2

A data center engineer is configuring VLANs in a Cisco UCS domain. Which TWO statements are true regarding VLAN configuration?

Accepted Answer

Each vNIC must have a native VLAN specified for untagged traffic on that vNIC.. Option A is correct because VLANs must be defined in the global VLAN database before they can be used in service profiles. Option D is correct because each vNIC must have a native VLAN specified for untagged traffic. Option B is false because VLANs cannot be created directly in service profiles. Option C is false because service profiles use VLANs from the global pool and cannot override the VLAN ID. Option E is false because VLANs can be created via both CLI and GUI.

Answer

VLANs can be created directly within a service profile without prior global definition.

Answer

VLANs can be created only through the CLI of UCS Manager.

Answer

Service profiles can override the VLAN ID of a global VLAN definition.

Question 3

Refer to the exhibit. An engineer is creating a service profile template in Cisco UCSM. What is the effect of setting the vnet to 'VM_Network' for vNIC_A?

Accepted Answer

The VM_Network VLAN must be previously defined in the global VLAN database.. Option A is correct because UCS requires that any VLAN referenced in a vNIC must already exist in the global VLAN database. Option B is false because VLANs are not created automatically; they must be defined manually beforehand. Option C is false because if the VLAN does not exist, the vNIC will not come up. Option D is false because VM_Network is a typical naming convention for data VLANs, not FCoE.

Answer

The VM_Network VLAN is a pre-defined FCoE VLAN for storage traffic.

Answer

The vNIC_A will be placed in VLAN 1 (default) if VM_Network does not exist.

Answer

The VM_Network VLAN will be created automatically as a standard VLAN.

Question 4

An engineer is troubleshooting a VXLAN network where traffic between two VTEPs in the same VNI is not being forwarded. The underlay network is operational and IP connectivity exists between the VTEPs. Which two actions should the engineer take to verify the VXLAN configuration?

Accepted Answer

Verify that the NVE interface is configured with the correct source-interface.. A and B are correct because the NVE interface must have a valid source-interface to encapsulate VXLAN packets, and the VNI must be mapped to the correct VLAN to forward traffic. Option C is incorrect because multicast group reachability is only required for BUM traffic, not unicast. Option D is incorrect because VTEP IPs can be on different subnets. Option E is incorrect because VXLAN is a Layer 2 overlay and does not involve routing.

Answer

Verify that the multicast group for BUM traffic is reachable.

Answer

Verify that the VXLAN tunnel endpoint IP addresses are in the same subnet.

Answer

Verify that the VXLAN routing table is populated correctly.

Question 5

Refer to the exhibit. An engineer configured a VXLAN tunnel endpoint (VTEP) but the VXLAN tunnel is not operational. The underlay OSPF adjacency is established. What is the missing configuration?

Accepted Answer

The loopback0 interface is not included in the OSPF process.. Option B is correct because the loopback0 interface is the source interface for the NVE, but it is not included in the OSPF process, making its IP unreachable from other VTEPs. Option A is incorrect because NVE interfaces are typically administratively up by default. Option C is incorrect because multicast reachability is not directly related to the tunnel operational status. Option D is incorrect because VNI-to-VLAN mapping is not shown in the exhibit and is required for Layer 2 forwarding, but the immediate issue is the unreachable source interface.

Answer

The NVE interface must be enabled with the no shutdown command.

Answer

The multicast group must be reachable via the underlay.

Answer

The VNI must be mapped to a VLAN.

Question 6

Which TWO methods are used to secure management plane access on Cisco Nexus 9000 series switches?

Accepted Answer

SSH. SSH provides encrypted remote access, and AAA provides authentication and authorization for management users. SNMPv3 is for monitoring, CoPP protects the control plane, and VRF is for data plane segmentation.

Answer

SNMPv3

Answer

CoPP

Answer

VRF

Question 7

Refer to the exhibit. What is the effect of this configuration on traffic in VLAN 10?

Accepted Answer

Telnet traffic is denied; all other traffic is permitted.. The VACL first matches telnet traffic and drops it. The second sequence forwards all other traffic. Thus, only telnet is denied; all other traffic is permitted.

Answer

Telnet traffic is permitted; all other traffic is denied.

Answer

All traffic is denied except telnet.

Answer

All traffic is permitted.

Question 8

In a BGP EVPN deployment, route type 2 (MAC/IP advertisement) is used to advertise MAC addresses. What additional information is carried in route type 2 for IP routing?

Accepted Answer

IP address and MAC address. In BGP EVPN, route type 2 (MAC/IP Advertisement Route) is used to advertise both MAC addresses and their associated IP addresses. The additional information carried for IP routing is the IP address and the MAC address, enabling the control plane to support both Layer 2 bridging and Layer 3 routing (e.g., host route advertisement for IP-based forwarding). This is defined in RFC 7432, where the route type 2 NLRI includes a MAC address field and an optional IP address field.

Answer

IP address and route distinguisher

Answer

IP prefix and next-hop

Answer

MAC address and VNI

Question 9

In a centralized anycast gateway VXLAN EVPN design, which is a requirement?

Accepted Answer

All VTEPs share a common anycast IP address for the default gateway.. In a centralized anycast gateway VXLAN EVPN design, all VTEPs share a common anycast IP address and MAC address for the default gateway. This allows any VTEP to serve as the first-hop router for hosts, enabling optimal east-west traffic forwarding without requiring a separate gateway device. The anycast IP is configured on each VTEP's VLAN interface, and the same IP/MAC is advertised via EVPN Type-2 routes.

Answer

Each VTEP has a unique anycast IP address.

Answer

The anycast gateway is configured on the spine switches.

Answer

The route reflector is an external BGP speaker.

Question 10

Refer to the exhibit. What is the most likely cause of the NVE interface being down?

Accepted Answer

The source interface is not configured.. The NVE (Network Virtualization Edge) interface requires a valid source interface (typically a loopback) to establish VXLAN tunnels. If the source interface is not configured under the NVE interface, the interface remains in a down state because it cannot form VXLAN overlay adjacencies. This is the most common cause of an NVE interface being down in Cisco NX-OS.

Answer

The VXLAN destination UDP port is incorrect.

Answer

The overlay VLAN is not configured.

Answer

The VNI list is empty.

Question 11

In a VXLAN EVPN fabric, which protocol is used to exchange MAC and IP address reachability information among VTEPs?

Accepted Answer

BGP. In a VXLAN EVPN fabric, BGP (Border Gateway Protocol) is used as the control plane protocol to exchange MAC and IP address reachability information among VTEPs. Specifically, MP-BGP (Multiprotocol BGP) with EVPN address family (AFI L2VPN / SAFI EVPN) carries Type-2 routes (MAC/IP advertisement) to distribute host reachability across the overlay network, enabling efficient MAC learning and ARP suppression.

Answer

IS-IS

Answer

EIGRP

Answer

OSPF

Question 12

Which two VXLAN control plane options are supported on Cisco Nexus 9000 switches? (Choose two.)

Accepted Answer

Multicast. VXLAN on Cisco Nexus 9000 switches supports both multicast-based control plane (using IGMP/PIM to flood BUM traffic) and MP-BGP EVPN (RFC 7432) as the control plane for distributing MAC/VTEP reachability. Multicast is the traditional method for handling BUM traffic in VXLAN fabrics, while MP-BGP EVPN provides a more scalable, standards-based control plane with host route advertisement and multi-tenancy.

Answer

OTV

Answer

Static VXLAN tunnel

Answer

OpenFlow

Question 13

When configuring BGP EVPN on spine switches functioning as route reflectors, which two address families must be configured? (Choose two.)

Accepted Answer

address-family l2vpn evpn. B is correct because BGP EVPN (Ethernet VPN) uses the L2VPN address family (l2vpn evpn) to carry MAC/VXLAN routing information between spine and leaf switches. This address family is mandatory for EVPN control plane operation in a VXLAN fabric, enabling MAC address learning and advertisement via MP-BGP.

Answer

address-family link-state

Answer

address-family ipv6 unicast

Answer

address-family vpnv4

Question 14

A Nexus 9000 switch is configured with VPC. The VPC keepalive link fails. What is the effect on the VPC domain?

Accepted Answer

The secondary switch suspends its VPC member ports.. In a VPC domain, the keepalive link is used to monitor the liveness of the peer switch, but it does not carry data traffic. When the keepalive link fails, the secondary switch cannot confirm the primary is alive, so it suspends its VPC member ports to prevent a dual-active scenario. The primary switch remains active and continues forwarding traffic normally because it assumes the secondary has failed.

Answer

Both switches suspend the VPC VLANs.

Answer

Both switches continue to forward traffic normally.

Answer

The primary switch becomes orphan.

Question 15

Which statement is true about the VLANs carried on a VPC peer-link?

Accepted Answer

The peer-link carries all VLANs that are allowed on the trunk interface.. In a vPC domain, the peer-link is a special trunk that carries all VLANs allowed on the trunk interface, including those not present on any member port. This ensures that orphaned traffic (traffic arriving on the peer-link destined for a device connected to the other vPC peer) can be forwarded correctly. The peer-link must carry all VLANs to maintain Layer 2 connectivity and loop-free behavior without relying on spanning tree.

Answer

The peer-link carries only the VLANs allowed on the member interfaces.

Answer

The peer-link requires spanning-tree port type edge trunk configuration.

Answer

The peer-link must be configured as a layer 3 interface.