350-601 Practice Test 23 — 15 Questions

Question 1

An administrator is configuring a Cisco MDS switch for FCoE. Which two DCB features must be enabled to support FCoE traffic? (Choose two.)

Accepted Answer

Data Center Bridging Exchange (DCBX). For FCoE on a Cisco MDS switch, DCBX (Option C) must be enabled because it is the discovery and negotiation protocol that exchanges DCB capabilities and configuration—such as PFC and ETS parameters—between the switch and converged network adapters, ensuring consistent per-priority settings. Priority Flow Control (PFC, Option D) is also required because FCoE is a lossless storage protocol; PFC provides per-priority PAUSE so that FCoE traffic (typically CoS 3) can be paused independently without halting other traffic, preventing frame drops. Jumbo frames (Option A) are often recommended for FCoE efficiency but are not a required DCB feature, LACP (Option B) is a link-aggregation protocol unrelated to DCB lossless requirements, and ETS (Option E) provides bandwidth allocation among traffic classes but is not one of the two mandatory DCB features for basic FCoE support.

Answer

Jumbo frames

Answer

Link Aggregation Control Protocol (LACP)

Answer

Enhanced Transmission Selection (ETS)

Question 2

A Cisco MDS switch is being configured for FCoE. Which three DCB components are required for lossless Ethernet operation? (Choose three.)

Accepted Answer

DCBX (Data Center Bridging Exchange). DCBX (Data Center Bridging Exchange) is correct because it is the negotiation protocol that advertises and exchanges DCB capabilities such as PFC and ETS between directly connected FCoE peers, ensuring consistent lossless Ethernet parameters. PFC (Priority Flow Control) is correct because it provides per-priority PAUSE frames (IEEE 802.1Qbb) so that a congested priority class can be paused without halting all traffic, which is essential for lossless FCoE frames. ETS (Enhanced Transmission Selection) is correct because it allocates guaranteed bandwidth per traffic class (IEEE 802.1Qaz) and prevents one class from starving another, supporting the lossless behavior FCoE requires. FIP (FCoE Initialization Protocol) is not a DCB component; it is the FCoE control protocol used for discovery, login, and fabric establishment, not for lossless Ethernet. iSCSI is a separate SCSI-over-TCP/IP storage protocol and has no role in DCB or FCoE lossless Ethernet operation.

Answer

FIP (FCoE Initialization Protocol)

Answer

iSCSI

Question 3

In a Cisco ACI fabric, the administrator notices that traffic between two endpoints in different EPGs but on the same leaf switch is being dropped when a contract is applied. The endpoints are in the same VRF but different bridge domains. What is the likely cause?

Accepted Answer

The contract does not allow communication between those EPGs.. In Cisco ACI, inter-EPG communication is governed by contracts. Even when endpoints reside on the same leaf switch, same VRF, and different bridge domains, traffic is dropped unless a contract explicitly permits the communication between the source and destination EPGs. The contract defines the filter (e.g., IP protocol, ports) and the direction (provider/consumer) required for traffic to flow.

Answer

The VRF is not configured correctly.

Answer

The bridge domains are not in the same network.

Answer

The leaf switch is missing a route to the destination.

Question 4

Which tool provides a programmatic HTTP-based interface to execute CLI commands on Cisco Nexus switches and returns structured JSON data?

Accepted Answer

NX-API. NX-API (Option D) is the correct answer because it provides a programmatic HTTP/HTTPS-based interface that allows you to send CLI commands to Cisco Nexus switches and receive structured JSON (or XML) responses. This enables automation and integration without requiring an SSH session, directly fulfilling the question's requirement for an HTTP-based interface with structured JSON output.

Answer

Ansible

Answer

pyATS

Answer

Netmiko

Question 5

A network engineer is hardening a Nexus switch. Which two security best practices should be applied? (Choose two.)

Accepted Answer

Disable unused services. Option A is correct because disabling unused services on a Nexus switch reduces the attack surface by eliminating unnecessary daemons and ports that could be exploited, a foundational hardening practice. Option E is correct because enabling only SSH for remote management ensures encrypted, authenticated administrative sessions instead of cleartext protocols. Option B is wrong because default SNMP community strings such as 'public' or 'private' are well-known and easily guessed, so they must be changed or SNMP disabled. Option C is wrong because enabling the HTTP server exposes management traffic in cleartext; HTTPS should be used if web management is required. Option D is wrong because Telnet transmits credentials and session data unencrypted, making it unsuitable for a hardened device.

Answer

Use default SNMP community strings

Answer

Enable HTTP server for management

Answer

Enable Telnet for remote access

Question 6

Which Nexus security feature validates ARP packets to prevent ARP spoofing attacks?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is the Nexus feature that intercepts and validates ARP packets on untrusted ports by comparing the sender MAC and IP against the DHCP snooping binding table (or static ARP ACLs). Invalid or spoofed ARP packets are dropped, preventing ARP poisoning/man-in-the-middle attacks. It is enabled per VLAN with 'ip arp inspection vlan <vlan-id>' and requires DHCP snooping to build the binding database.

Answer

Port Security

Answer

IP Source Guard

Answer

DHCP Snooping

Question 7

A Nexus switch is being hardened. An engineer wants to protect the control plane from CPU-targeted attacks, such as heavy ICMP traffic. Which feature should be configured?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) allows the switch to rate-limit or drop traffic destined to the control plane.

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Question 8

What is the primary benefit of using UCS service profiles for server deployment?

Accepted Answer

Hardware abstraction and stateless computing. UCS service profiles decouple server identity and configuration (UUID, MAC addresses, firmware, BIOS settings, network and storage policies) from physical hardware, enabling stateless computing. This means a service profile can be moved to any compatible blade, and the server assumes the same identity and configuration, dramatically simplifying deployment and recovery.

Answer

Increased network bandwidth

Answer

Reduced power consumption

Answer

Simplified storage zoning

Question 9

Which two of the following are benefits of using YANG data models for network automation? (Choose two.)

Accepted Answer

They enable network automation and multi-vendor interoperability. Option A is correct because YANG is a vendor-neutral, IETF-standardised data modelling language (RFC 6020/7950) that lets automation tools and controllers manipulate configuration and state across devices from different vendors, enabling multi-vendor interoperability and programmatic network automation. Option E is correct because YANG defines a hierarchical, structured schema with typed nodes, containers, lists, and leaves that provides a standardised representation of both configuration data and operational state, which is essential for consistent, model-driven automation. The unmarked options do not belong: YANG is not Cisco-proprietary (B is false), it does not remove the need for CLI since CLI remains a valid management interface (C is false), and YANG models can be transported over NETCONF, RESTCONF, or gNMI rather than requiring NETCONF exclusively (D is false).

Answer

They are only supported by Cisco devices

Answer

They eliminate the need for any CLI commands

Answer

They require the use of NETCONF exclusively

Question 10

A network automation engineer is developing a CI/CD pipeline for network configuration changes. Which tool would best serve as a version control system for Infrastructure as Code (IaC) files in a data center network?

Accepted Answer

Git. Git is the industry-standard version control system for IaC, enabling branching, merging, and collaboration. Terraform and Ansible are automation tools, not version control. Jenkins is a CI/CD server, not version control.

Answer

Terraform

Answer

Jenkins

Answer

Ansible

Question 11

In UCS Manager, which feature provides role-based access control for managing the fabric interconnects?

Accepted Answer

Role-Based Access Control (RBAC). UCS Manager provides Role-Based Access Control (RBAC) natively, allowing administrators to define roles (e.g., read-only, operations, admin) and assign them to user accounts or LDAP/AAA users, scoping permissions to specific organizations, service profiles, or the entire fabric. This is the built-in feature for managing who can do what on the fabric interconnects.

Answer

Cisco ISE integration

Answer

CoPP

Answer

AAA with TACACS+

Question 12

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

Accepted Answer

Priority Flow Control (PFC) with a no-drop queue for iSCSI.. Priority Flow Control (PFC) is the IEEE 802.1Qbb mechanism designed to provide lossless behavior for specific traffic classes, such as iSCSI storage traffic, on Nexus 9000 switches. By creating a no-drop queue for iSCSI, PFC uses pause frames on a per-priority basis to prevent buffer overflow, ensuring zero packet loss required by storage protocols.

Answer

Tail drop with DSCP-based classification.

Answer

Weighted Round Robin (WRR) with three queues.

Answer

Policing at the ingress and marking at the egress.

Question 13

An administrator is configuring CHAP authentication for iSCSI. Which two statements about CHAP are correct? (Choose two.)

Accepted Answer

CHAP authentication is optional and can be disabled.. Option A is correct because CHAP is an optional authentication mechanism in iSCSI; it is not mandatory, and an administrator can choose to disable it or leave it unconfigured, in which case sessions proceed without authentication. Option D is correct because CHAP operates on a challenge-response model using a pre-shared secret (the CHAP password) that must be configured identically on both the initiator and the target for authentication to succeed. Option B is incorrect because CHAP only authenticates identities; it does not encrypt iSCSI payload data, which would require IPsec or similar. Option C is incorrect because CHAP can be applied to normal (full-feature) iSCSI sessions, not just discovery sessions. Option E is incorrect because CHAP relies on a shared secret, not digital certificates, which are used by certificate-based authentication methods.

Answer

CHAP provides encryption of iSCSI data.

Answer

CHAP authentication is only used for discovery sessions.

Answer

CHAP uses a digital certificate for authentication.

Question 14

A network engineer is implementing port security on a Cisco Nexus 9000 switch to limit the number of MAC addresses learned on a single access port. The switchport is configured as follows:

interface Ethernet 1/2
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation shutdown
  switchport port-security mac-address sticky

After connecting two authorized devices, a third unauthorized device is connected, causing the port to enter the err-disabled state. The engineer needs to restore connectivity for the two authorized devices as quickly as possible, while maintaining the security posture. What is the best practice to recover the port automatically in the future?

Accepted Answer

Configure 'errdisable recovery cause psecure-violation' to automatically recover the port after the configured interval.. The 'errdisable recovery cause psecure-violation' command enables automatic recovery from the err-disabled state caused by a port-security violation. This allows the port to come back up after a default or configured interval (typically 300 seconds) without manual intervention, restoring connectivity for the two authorized devices while maintaining the security posture of limiting MAC addresses to two.

Answer

Manually shut down and then no shutdown the interface to recover from err-disabled state.

Answer

Remove port-security configuration entirely to prevent future err-disables.

Answer

Increase the maximum MAC address limit to 3 to accommodate the third device.

Question 15

A Cisco MDS switch is connected to another MDS via a Fibre Channel link. The two switches need to carry traffic for multiple VSANs over a single physical link. Which feature should be configured?

Accepted Answer

EISL trunking. EISL (Enhanced Inter-Switch Link) trunking allows multiple VSANs to be carried over a single physical ISL between Cisco MDS switches. This is configured by enabling trunking on the ISL ports, which encapsulates frames with VSAN tags. NPV mode is used for fabric port reduction, PortChannel aggregates links for bandwidth, and VSAN-based zoning is for access control, not for carrying multiple VSANs over a single link.

Answer

NPV mode

Answer

PortChannel

Answer

VSAN-based zoning