350-601 Practice Test 2 — 25 Questions

Question 1

When using Cisco NSO (Network Services Orchestrator) to automate service creation across a data center network, what is a key consideration regarding device compatibility?

Accepted Answer

Each device must have a corresponding NED that matches its OS version.. B is correct because Cisco NSO uses Network Element Drivers (NEDs) to translate service models into device-specific CLI, SNMP, or NETCONF commands. Each NED is tied to a specific device OS version (e.g., IOS-XE 16.12, NX-OS 9.3), so mismatched NEDs cause configuration failures or incomplete deployments. Without a compatible NED, NSO cannot communicate with or configure the device.

Answer

NSO requires NETCONF for all devices.

Answer

Device YANG models must be hand-coded by the team.

Answer

NSO only supports Cisco devices.

Question 2

A UCS Central administrator is creating a global service profile policy that applies to multiple UCS domains. The policy must include boot order settings. What is the recommended approach to ensure consistency across domains?

Accepted Answer

Use UCS Central to create a global boot policy and assign it to service profiles. UCS Central allows creation of global policies that are applied to service profiles in multiple domains, ensuring consistency.

Answer

Rely on default boot policy

Answer

Define the boot order directly in the service profile template

Answer

Create a local boot policy in each UCS domain

Question 3

Which TWO are best practices when automating ACI fabric configuration using Ansible?

Accepted Answer

Use the cisco.aci collection. The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

Answer

Set validate_certs: no to avoid certificate errors

Answer

Store credentials in plain text in playbooks

Answer

Use delegate_to: localhost for all tasks

Question 4

A network engineer is configuring a new UCS B-series blade server. The engineer wants the server to automatically inherit network and storage settings without manual configuration when replaced. Which UCS technology enables this capability?

Accepted Answer

Service profile template. Service profile templates in Cisco UCS Manager allow administrators to define a reusable configuration for network and storage settings. When a server fails or is replaced, the template is applied to the new blade, automatically inheriting all settings without manual intervention. This capability is central to UCS's stateless computing model, where hardware identity and policies are abstracted from the physical server.

Answer

Fabric Interconnect failover

Answer

Cisco IMC Supervisor

Answer

Cisco UCS Manager

Question 5

In a Cisco HyperFlex cluster, the management plane uses vCenter, but the data plane uses which protocol to replicate data across nodes?

Accepted Answer

HX Data Platform. In a Cisco HyperFlex cluster, the data plane replication across nodes is handled by the HX Data Platform, which is a distributed, log-structured file system that synchronously replicates data at the hypervisor level. This platform manages all I/O operations and ensures data consistency across the cluster without relying on external storage protocols like Fibre Channel or iSCSI.

Answer

Fibre Channel

Answer

NFS

Answer

iSCSI

Question 6

A network engineer wants to automate the deployment of VLANs across 50 Nexus switches in a data center. Which approach provides the most consistent and repeatable results with minimal manual effort?

Accepted Answer

Ansible playbook with nxos_vlan module. Ansible playbook with the nxos_vlan module is the correct choice because it provides idempotent, declarative automation that ensures consistent VLAN configuration across all 50 Nexus switches with minimal manual effort. Ansible handles SSH connectivity and state management natively, eliminating the need for custom scripting and reducing the risk of human error.

Answer

Python script using netmiko

Answer

Manual CLI on each switch

Answer

Bash script with SSH

Question 7

A data center engineer is designing a UCS Manager solution that requires VLAN segmentation across multiple fabric interconnects. The network team requires that each VLAN is assigned a unique native VLAN ID per fabric. Which pool configuration supports this requirement?

Accepted Answer

Create separate VLAN pools for each fabric with non-overlapping ranges. UCS Manager allows separate VLAN pools to be assigned per fabric interconnect, enabling unique native VLAN IDs per fabric. By creating non-overlapping VLAN pools for each fabric, the engineer ensures that each fabric has its own native VLAN ID without conflict, meeting the requirement for VLAN segmentation across multiple fabric interconnects.

Answer

Use derived VLAN pools based on chassis location

Answer

Create a single VLAN pool that includes all required VLANs

Answer

Configure VLANs directly in the service profile using inline pools

Question 8

A data center administrator is troubleshooting slow storage performance on a UCS B-Series blade server. The server is connected to a Cisco UCS 6300 Series Fabric Interconnect and uses local SAS drives. The administrator checks the UCS Manager and sees that the storage adapter has a driver version that is not recommended. What is the most likely impact of using a non-recommended driver version?

Accepted Answer

Degraded storage performance or instability. Using a non-recommended driver version for the storage adapter in a UCS B-Series blade server can lead to degraded storage performance or system instability. Cisco validates specific driver versions for compatibility with the UCS 6300 Series Fabric Interconnect and local SAS drives; deviations may cause suboptimal I/O handling, increased latency, or unexpected errors. This is a common issue in compute environments where driver- firmware mismatches affect storage throughput.

Answer

Loss of redundancy on the fabric interconnect

Answer

Inability to boot the server

Answer

Increased security vulnerabilities

Question 9

Which best practice should be followed when creating a UCS service profile template for stateless computing?

Accepted Answer

Assign MAC and WWN addresses from pools. Stateless computing in UCS requires that all server identity information, such as MAC addresses and WWNs, be abstracted away from the hardware and assigned dynamically from pools. This allows the service profile to be applied to any compatible blade or rack server without manual reconfiguration, enabling rapid provisioning and seamless hardware replacement. Defining these addresses directly in the profile or using static assignments would break the stateless model by tying the profile to specific hardware.

Answer

Use local storage on each server for boot images

Answer

Configure Windows Server NIC teaming for all vNICs

Answer

Define MAC addresses directly in the service profile

Question 10

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

Accepted Answer

Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.. APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.

Answer

Change the authentication method in the script from password-based to certificate-based authentication.

Answer

Regenerate the API key for the service account and update the script with the new key.

Answer

Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.

Question 11

A data center engineer is configuring a Cisco UCS C-Series server with a hardware RAID controller. The server will host a critical database. The RAID controller supports RAID 0, 1, 5, 6, and 10. Which RAID level should be chosen to provide the best combination of performance and fault tolerance?

Accepted Answer

RAID 10. RAID 10 (striping of mirrors) provides the best combination of performance and fault tolerance for a critical database workload. It offers high read/write performance through striping and full redundancy via mirroring, allowing up to one disk failure per mirrored pair without data loss. This is ideal for a Cisco UCS C-Series server with a hardware RAID controller where both I/O throughput and availability are paramount.

Answer

RAID 6

Answer

RAID 5

Answer

RAID 0

Question 12

A Cisco UCS upgrade from release 3.1(1) to 4.0(4) is planned. The current release has a known issue that affects NVRAM backup. What is the best practice to avoid an outage during this upgrade?

Accepted Answer

Upgrade to an intermediate release that is recommended for the upgrade path.. Cisco UCS firmware upgrades must follow a supported upgrade path to avoid incompatibilities and known issues. Skipping directly from 3.1(1) to 4.0(4) is not supported; an intermediate release (e.g., 3.2(x) or 4.0(1)) is required to resolve the NVRAM backup issue and ensure a seamless upgrade without service disruption.

Answer

Perform a cold reboot of all Fabric Interconnects before starting.

Answer

Upgrade all components simultaneously to reduce transition time.

Answer

Upgrade the firmware on the chassis first, then the Fabric Interconnects.

Question 13

A storage administrator reports that a Cisco UCS domain is not booting from the Fibre Channel SAN. The boot policy is correctly configured and the vHBA is associated. Which two alignment issues could cause this problem? (Choose two.)

Accepted Answer

The WWPN of the vHBA is not zoned on the SAN fabric.. If the WWPN of the vHBA is not properly zoned on the SAN fabric, the Fibre Channel switch will not allow the server to log in to the target storage. Even with a correct boot policy and vHBA association, without zoning, the initiator cannot discover or communicate with the boot LUN, causing the boot to fail.

Answer

The Ethernet LAN is not configured on the FI.

Answer

The disk firmware on the server is outdated.

Question 14

An administrator needs to reset the CIMC password on a Cisco UCS C-Series server without physical access. Which method can be used?

Accepted Answer

Use the CIMC XML API. The CIMC XML API allows remote management of Cisco UCS C-Series servers, including password resets, without physical access. This API provides a programmatic interface to CIMC functions, enabling administrators to send authenticated XML requests over HTTPS to reset the CIMC password. Physical access is not required because the API operates over the network, making it the correct method for this scenario.

Answer

Use the front panel reset button

Answer

Use UCS Manager

Answer

Connect via serial console during boot

Question 15

A UCS administrator needs to ensure that server boot order always starts from the local disk if available, and falls back to a SAN LUN if local disk fails. Which boot policy setting should be used?

Accepted Answer

Local Disk first, then SAN. The UCS boot policy allows you to specify a boot order where the local disk is attempted first. If the local disk is unavailable or fails, the system automatically falls back to the next boot device in the list, which is the SAN LUN. This ensures high availability and aligns with the requirement to prefer local boot while providing a failover path.

Answer

Local Disk alone

Answer

SAN first, then Local Disk

Answer

SAN Boot Only

Question 16

Refer to the exhibit. A network engineer notices that the NVE1 interface is up but VXLAN traffic is not being encapsulated. What is the most likely cause?

Accepted Answer

The BGP EVPN address-family is not activated.. VXLAN traffic encapsulation on the NVE1 interface requires the BGP EVPN address-family to be activated under the BGP configuration to exchange VNI-to-VTEP mappings. Without this address-family, the NVE interface cannot learn remote VTEPs, so VXLAN packets are never encapsulated with the outer UDP/IP header.

Answer

The VNI 10000 is not mapped to a VLAN.

Answer

The ingress replication protocol must be static.

Answer

The loopback0 interface is not configured.

Question 17

In a VXLAN BGP EVPN fabric, which component is responsible for handling BUM traffic using ingress replication, and how does the VTEP learn the list of remote VTEPs to replicate to?

Accepted Answer

The ingress VTEP learns remote VTEPs via MP-BGP EVPN Type 3 routes.. In a VXLAN BGP EVPN fabric, ingress replication is the default method for handling BUM traffic, where the ingress VTEP replicates packets and sends unicast copies to each remote VTEP. The ingress VTEP learns the list of remote VTEPs from MP-BGP EVPN Type 3 routes (Inclusive Multicast routes), which advertise the VNI and the originating VTEP's IP address, allowing the ingress VTEP to build its replication list.

Answer

The ingress VTEP learns remote VTEPs via IGMP snooping.

Answer

The egress VTEP sends unicast copies to all other VTEPs.

Answer

The spine switch performs replication to all leaf VTEPs.

Question 18

An engineer is configuring Cisco ACI to secure inter-tenant traffic. Tenants 'TenantA' and 'TenantB' need to communicate via a shared service, such as a DNS server in TenantA. How should the contract be configured?

Accepted Answer

Create a contract in TenantA. Set the DNS EPG as provider. In TenantB, create a consumer EPG and provide the contract from TenantA.. In Cisco ACI, inter-tenant communication via a shared service requires the contract to be created in the tenant that owns the shared service (provider). The provider EPG (DNS server in TenantA) is set as the provider, and the consumer EPG (in TenantB) consumes the contract from TenantA. This allows TenantB to access the DNS service without exposing its own EPGs, maintaining security isolation while enabling necessary traffic.

Answer

Create a contract in TenantA and apply it to the VRF shared between tenants.

Answer

Create a contract in TenantB. Set the DNS EPG as consumer. In TenantA, create a provider EPG and provide the contract from TenantB.

Answer

Create a contract in TenantA. Set both DNS EPG and TenantB EPG as providers.

Question 19

Which three EVPN route types are essential for VXLAN EVPN operation in a typical data center fabric? (Choose three.)

Accepted Answer

Type-3 (Inclusive Multicast Ethernet Tag). Type-3 (Inclusive Multicast Ethernet Tag) routes are essential for VXLAN EVPN because they enable BUM traffic replication across the underlay network by advertising the VNI and multicast group mapping, allowing VTEPs to join the correct multicast tree for flooding unknown unicast, broadcast, and multicast frames.

Answer

Type-4 (Ethernet Segment)

Answer

Type-1 (Ethernet Auto-Discovery)

Question 20

A company is planning to deploy Cisco Intersight to manage a hybrid environment including on-premises UCS domains and AWS EC2 instances. Which THREE of the following are required components for integrating AWS with Intersight?

Accepted Answer

An Intersight account with appropriate licenses. A valid Intersight account with the appropriate licenses (e.g., Intersight Essentials or Premier) is required to enable the AWS integration feature. Without the proper license tier, the Intersight account cannot access the cloud orchestration or management capabilities needed to connect and manage external cloud providers like AWS.

Answer

An Intersight Virtual Appliance deployed in AWS

Answer

A VPN tunnel between the on-premises network and AWS