350-601 Practice Test 2 — 25 Questions

Question 1

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The script uses strict type checking, and the values are returned as strings instead of integers.. The NX-API returns all values as strings in JSON output, including numeric fields like VLAN IDs. If the script uses strict type checking (e.g., `===` in Python or JavaScript), comparing the string '100' to the integer 100 will fail, even though the interface is correctly configured in access mode with VLAN 100. This is a common pitfall when parsing NX-API responses without explicit type conversion.

Answer

The JSON output is malformed and cannot be parsed.

Answer

The interface is administratively down.

Answer

The JSON output is missing the 'switchportMode' field.

Question 2

An engineer is configuring a Cisco MDS switch to connect to a core switch in NPV mode. The edge switch will be connected to the core via an ISL. What port mode should be configured on the edge switch's interface connecting to the core?

Accepted Answer

NP-port. In NPV (N_Port Virtualization) mode, the edge switch does not participate in the core fabric's domain ID space. Instead, its uplink to the core acts as an NP-port (N-port proxy), which behaves like an N-port to the core but proxies logins from the edge devices. Therefore, the interface on the edge switch connecting to the core must be configured as an NP-port.

Answer

F-port

Answer

E-port

Answer

auto

Question 3

An engineer notices that a vPC peer link is flapping. Which vPC component must be operational for the vPC to function correctly?

Accepted Answer

vPC peer link. The vPC peer link is the critical component that must be operational for the vPC to function correctly. It carries control-plane traffic (e.g., Cisco Fabric Services over Ethernet, or CFSoE) and data-plane traffic between the two vPC peer switches. If the peer link flaps, the vPC domain cannot synchronize the necessary state information, causing the vPC to fail or become unstable.

Answer

vPC member port

Answer

vPC consistency check

Answer

vPC peer keepalive link

Question 4

A company is deploying a Cisco UCS Mini in a remote office. They need to support both VMware vSphere and Microsoft Hyper-V on the same UCS domain. What is the best practice for deploying compute resources for both hypervisors?

Accepted Answer

Create separate service profile templates for each hypervisor. Separate service profile templates are required because VMware vSphere and Microsoft Hyper-V have different boot and storage configuration requirements. Each hypervisor needs its own boot policy (e.g., SAN boot vs. local disk), firmware settings, and potentially different vNIC/vHBA configurations. Using distinct templates ensures that each hypervisor's compute resources are correctly provisioned without conflicts.

Answer

Use a single service profile but assign different VLANs for management traffic

Answer

Place each hypervisor in a separate UCS Organization within the same service profile template

Answer

Create a single service profile template and use different identity pools for each hypervisor

Question 5

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

Accepted Answer

Set OSPF priority to 0 on the interface. Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

Answer

Set OSPF priority to 255 on the interface

Answer

Change the OSPF network type to point-to-point

Answer

Configure the interface as passive under OSPF

Question 6

A data center designer is evaluating oversubscription ratios in a spine-leaf topology with 40 leaf switches and 4 spine switches. Each leaf has 4x100G uplinks to spines, and each spine has 40x100G downlinks. The leaf switches have 48x25G server ports. What is the oversubscription ratio from the server ports to the spine uplinks?

Accepted Answer

3:1. The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48x25G server ports = 1200G, and 4x100G uplinks = 400G, giving a leaf-level ratio of 3:1 (1200:400). Since all leaves are identical and the spine count doesn't affect the leaf-level ratio, the overall ratio remains 3:1.

Answer

2:1

Answer

4:1

Answer

5:1

Question 7

A storage array supports RAID-5, RAID-6, and RAID-10. The array has 12 disks of equal size. The requirement is to maximize usable capacity while tolerating up to two simultaneous disk failures without data loss. Which RAID level should be chosen?

Accepted Answer

RAID-6. RAID-6 can tolerate two disk failures with parity overhead of 2 disks, providing high usable capacity. RAID-5 tolerates only one failure; RAID-10 tolerates multiple failures but capacity is 50%.

Answer

RAID-10

Answer

RAID-5

Answer

RAID-0

Question 8

Two data center switches are connected via a fiber link. They need to encrypt all traffic at Layer 2. Which configuration is required on both switches to establish MACsec?

Accepted Answer

Enable MACsec and configure a pre-shared key or CA. MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption between directly connected switches. To establish a MACsec session, both switches must enable MACsec on the interface and either configure a pre-shared key (PSK) or use a CA (Connectivity Association) key agreement protocol like MKA (MACsec Key Agreement, IEEE 802.1X-2010). This ensures all Ethernet frames are encrypted at the data link layer.

Answer

Configure the interface as a trunk

Answer

Enable IPsec on the interface

Answer

Enable 802.1X on the interface

Question 9

An engineer configures vPC on a pair of Nexus switches. The vPC peer-keepalive link fails, but the vPC peer-link remains operational. What is the expected behavior?

Accepted Answer

The vPC domain remains operational with both switches forwarding traffic.. When the vPC peer-keepalive link fails but the peer-link remains up, the vPC domain continues to operate normally because the peer-link is used for control-plane synchronization and data-plane forwarding. The peer-keepalive is only a secondary heartbeat to detect a dual-active scenario when the peer-link is down. Since the peer-link is still functional, both switches can exchange vPC consistency parameters and forward traffic without risk of loops.

Answer

Both switches suspend all vPC member ports to avoid loops.

Answer

The primary switch reloads to prevent a split-brain scenario.

Answer

The secondary switch suspends its vPC member ports.

Question 10

An administrator wants to create separate FC fabrics on a single Cisco MDS switch for isolation of production and backup traffic. Which technology should they use?

Accepted Answer

VSAN. VSANs (Virtual SANs) allow a single physical MDS switch to be partitioned into multiple logical Fibre Channel fabrics, each with its own fabric services, zoning, and domain ID. This provides the isolation needed to separate production and backup traffic on the same hardware.

Answer

PortChannel

Answer

NPV

Answer

Zoning

Question 11

A Fibre Channel fabric has multiple initiators and targets. The engineer wants to ensure that only specific hosts can access specific storage volumes. Which zoning practice is most secure?

Accepted Answer

Single-initiator zoning with WWPNs. Single-initiator zoning with WWPNs is the most secure practice because it creates a one-to-one mapping between a single initiator and its target(s) using the globally unique World Wide Port Name. This eliminates any possibility of unauthorized access or interference from other initiators, as each zone contains exactly one initiator, preventing any form of 'spoofing' or 'zoning overlap' that could allow a rogue host to access storage volumes it should not see.

Answer

Zoning by storage array aliases

Answer

Using VSANs instead of zones

Answer

Soft zoning with domain/port IDs

Question 12

A storage administrator connects a host to an MDS switch via Fibre Channel. The host has an HBA with WWPN 21:00:00:1b:32:12:34:56. Which port type does the MDS switch automatically configure on the interface connecting to the host?

Accepted Answer

F-port. When a host HBA (N-port) connects to an MDS switch, the switch port automatically configures itself as an F-port (Fabric port) to serve the N-port. F-ports provide fabric services (name server, login, zoning) to attached node ports. This is the standard SAN topology: N-port on the host, F-port on the switch.

Answer

Trunk port

Answer

NP-port

Answer

E-port

Question 13

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Accepted Answer

DHCP Snooping. DHCP Snooping (A) is correct because it builds a trusted binding table of MAC-to-IP-to-port mappings by inspecting DHCP traffic, which prevents rogue DHCP servers and serves as the foundation for other Layer 2 protections. IP Source Guard (C) is correct because it uses the DHCP Snooping binding table to filter out frames with spoofed source IP or MAC addresses on untrusted ports, blocking IP/MAC spoofing attacks. Dynamic ARP Inspection (D) is correct because it validates ARP packets against the DHCP Snooping binding database, dropping ARP spoofing/poisoning attempts used for man-in-the-middle attacks. RBAC (B) is not a Layer 2 attack mitigation but an access-control mechanism for managing user privileges on the switch, and CoPP (E) is a control-plane policing feature that rate-limits traffic destined to the CPU, protecting the control plane rather than mitigating Layer 2 attacks like spoofing or DHCP/ARP abuse.

Answer

RBAC

Answer

CoPP

Question 14

An administrator needs to perform a remote firmware upgrade on a UCS C220 rack server. The server has CIMC configured with an IP address. Which method should the administrator use to upgrade the CIMC firmware?

Accepted Answer

Use the CIMC web interface to upload and apply the firmware image.. The CIMC (Cisco Integrated Management Controller) on a standalone UCS C-Series rack server is managed via its own web interface, which provides a Firmware Management section where the administrator can upload a firmware image and apply it directly to the CIMC. This is the standard, supported method for a remote CIMC firmware upgrade when only the CIMC IP is available. No UCS Manager or external supervisor is required for a standalone C-series server.

Answer

Use the KVM console to boot from a firmware upgrade ISO.

Answer

Use UCS Manager to upgrade the firmware of the C-series server.

Answer

Use Cisco IMC Supervisor to upgrade firmware across multiple servers.

Question 15

Match each Cisco UCS component to its function.

Accepted Answer

Fabric Interconnect: Manages network connectivity and provides management access.. The correct matches are: Fabric Interconnect provides network connectivity and management; UCS Manager provides unified management; Blade Chassis houses servers and provides power/cooling. Common confusions include swapping functions with I/O Module or between chassis and interconnect.

Answer

Fabric Interconnect: Houses blade servers and provides power and cooling.

Answer

UCS Manager: Connects blade chassis to fabric interconnects.

Answer

Blade Chassis: Provides network connectivity and management.

Question 16

Which Fibre Channel address component uniquely identifies a port within a fabric and is assigned during fabric login (FLOGI)?

Accepted Answer

FCID. The FCID (Fibre Channel Identifier) is a 24-bit address assigned to a port during fabric login (FLOGI). It uniquely identifies the port within the fabric and is used for routing frames between N-ports. It is composed of Domain ID (8 bits), Area ID (8 bits), and Port ID (8 bits).

Answer

WWNN

Answer

Domain ID

Answer

WWPN

Question 17

A UCS administrator is creating a boot policy for a service profile that will be used for B-series blades. The requirement is to boot from a LUN on a SAN-attached storage array. Which boot order should be configured in the service profile boot policy?

Accepted Answer

SAN only with vHBA. For a B-series blade booting from a SAN LUN, the boot policy must specify a SAN boot target with a vHBA (virtual Host Bus Adapter) as the boot device, and it should be the only entry in the boot order so the blade does not attempt local disk or PXE first. This ensures the service profile consistently boots from the intended LUN on the SAN array.

Answer

Local disk and SAN with equal priority

Answer

PXE first, then SAN

Answer

Local disk first, then SAN

Question 18

A UCS administrator is planning to deploy stateless computing using service profiles. Which three components are abstracted from the physical hardware and defined in the service profile? (Choose three.)

Accepted Answer

Boot order. In Cisco UCS stateless computing, the service profile holds all identity and configuration data that can follow a server across hardware. Option A (Boot order) is correct because the boot policy, including boot order, is defined in the service profile and applied to the server. Option B (MAC addresses for vNICs) is correct because MAC addresses are pool-derived identities assigned to vNICs in the service profile, enabling consistent network identity. Option D (Server UUID) is correct because the server UUID is a logical identity defined in the service profile and presented to the OS. Option C (Physical disk serial numbers) is not abstracted; disk serial numbers are physical hardware identifiers tied to the actual drives. Option E (CPU model) is not abstracted; the CPU model is a physical hardware attribute of the server and cannot be defined in a service profile.

Answer

Physical disk serial numbers

Answer

CPU model

Question 19

A DevOps team wants to version control network device configurations. Which tool is best suited for tracking changes and collaborating on configuration files?

Accepted Answer

Git. Git is the industry standard for version control, enabling history, branching, and collaboration.

Answer

Python virtual environment

Answer

Ansible Tower

Answer

Cisco Prime Infrastructure

Question 20

A network engineer wants to use Ansible to automate the configuration of Nexus switches. Which two statements about the cisco.nxos Ansible collection are correct? (Choose two.)

Accepted Answer

It includes the nxos_config module for applying CLI commands.. The collection includes modules like nxos_config and nxos_vlan, and it is supported on NX-OS platforms.

Answer

It is part of the Ansible Core collection.

Answer

It can only manage VLANs.

Answer

It is used exclusively for ACI automation.