350-601 Practice Test 4 — 25 Questions

Question 1

A network engineer is configuring an ACI contract between an EPG and an external EPG. Which construct is used to permit traffic from the external EPG to the internal EPG?

Accepted Answer

The external EPG is the provider and the internal EPG is the consumer.. In Cisco ACI, the provider EPG exposes a contract, and the consumer EPG consumes it. To permit traffic from an external EPG to an internal EPG, the internal EPG must be the consumer (initiating the communication) and the external EPG must be the provider (offering the contract). This aligns with the default directionality of contracts, where the provider's filter rules allow inbound traffic from the consumer.

Answer

The internal EPG is the provider and the external EPG is the consumer.

Answer

Both EPGs are providers.

Answer

Both EPGs are consumers.

Question 2

A data center automation script uses Python's requests library to call the NX-API for a Nexus 9000 switch. The script works but returns HTTP 400. Which is a likely cause?

Accepted Answer

The request payload is malformed. HTTP 400 indicates a bad request, which in the context of NX-API typically means the JSON or XML payload sent to the switch does not conform to the expected schema. Common issues include missing required fields (e.g., 'ins_api' version, 'type', 'chunk', 'sid', 'input', 'outputformat'), incorrect JSON syntax, or invalid values for parameters like 'version' or 'type'. The requests library successfully delivered the HTTP request, but the NX-API rejected it due to malformed content.

Answer

The switch has no management IP

Answer

The script uses HTTP instead of HTTPS

Answer

The API is not enabled

Question 3

A server team reports that after connecting a new server to a switchport, the server can receive traffic but cannot send traffic. The port is configured with port security. What is the most likely cause?

Accepted Answer

The port security violation mode is set to protect. When port security violation mode is set to 'protect', the switch drops traffic from unauthorized MAC addresses without generating a syslog message or incrementing the violation counter. In this scenario, the server can receive traffic because the switch still forwards broadcast and unknown unicast frames to the port, but the server's transmitted frames are silently dropped because the switch does not learn the server's MAC address or forward its frames. This matches the symptom of one-way communication where the server can receive but not send.

Answer

The port is in errdisable state

Answer

The port security maximum is set to 1 and another device is connected

Answer

The server MAC address is not in the allowed list

Question 4

A storage administrator needs to isolate traffic between two departments on the same Fibre Channel SAN infrastructure. Each department has its own storage array and hosts. Which technology should be used to create separate logical fabrics without additional hardware?

Accepted Answer

VSANs. VSANs (Virtual SANs) allow partitioning of a single physical Fibre Channel fabric into multiple isolated logical fabrics, similar to VLANs in Ethernet.

Answer

NPV

Answer

Zoning

Answer

PortChannels

Question 5

An organization is deploying UCS B-series blades in a 5108 chassis connected to Fabric Interconnects A and B. Each blade has two vNICs. How should the vNICs be connected to the fabric to ensure maximum redundancy and bandwidth?

Accepted Answer

vNIC0 to FI A, vNIC1 to FI B, both active-active. For redundancy, vNICs should be connected to separate fabric interconnects (A and B) and active-active failover is recommended.

Answer

vNIC0 to FI A, vNIC1 to FI A via different ports

Answer

vNIC0 to FI A, vNIC1 to FI B with active-standby

Answer

Both vNICs connected to Fabric Interconnect A with active-standby failover

Question 6

Refer to the exhibit. The interface shows CRC errors. What is the most likely cause of these errors?

Accepted Answer

Faulty SFP or fiber cable.. CRC errors indicate that frames are being received with invalid checksums, which is typically caused by physical-layer issues such as a faulty SFP module or damaged fiber cable. These errors occur when the cyclic redundancy check computed by the receiver does not match the CRC appended by the sender, pointing to corruption during transmission. In Fibre Channel storage networks, a faulty SFP or cable is the most common root cause of CRC errors, as they directly affect signal integrity.

Answer

Insufficient buffer credits for the distance.

Answer

The port is configured as F port but should be E port.

Answer

Speed mismatch between the ports.

Question 7

A Nexus switch experiences high CPU utilization due to excessive ICMP traffic. An engineer applies a CoPP policy that includes a class matching ICMP with a drop action. After applying, legitimate OSPF hello packets are also being dropped. What is the most likely cause?

Accepted Answer

OSPF packets match the default class which has a drop action. When a CoPP policy is applied, traffic that does not match any explicit class-map falls into the default class. If the default class has a drop action, all unmatched traffic—including OSPF hello packets (which use IP protocol 89)—will be dropped. The class-map matching ICMP (typically based on protocol or DSCP) does not match OSPF, so OSPF packets are handled by the default class, causing the observed behavior.

Answer

The CoPP policy is applied to the wrong interface

Answer

The CoPP policy rate-limits all traffic including OSPF below its needed rate

Answer

The class-map matches multiple protocols including OSPF

Question 8

On a Cisco MDS 9700, an engineer configures an FC port channel with 4 member interfaces. The connected storage array also supports port channels. Which load-balancing algorithm provides the best distribution of I/O when the array uses multiple LUNs per target?

Accepted Answer

Source FC ID (OXID) and destination FC ID (RXID). The OXID (Originator Exchange ID) and RXID (Responder Exchange ID) provide per-exchange granularity, which distributes I/O across all member links in the FC port channel. When multiple LUNs are presented under a single target (same DID), algorithms based on SID/DID or WWPN would hash all traffic to the same link, causing imbalance. The OXID/RXID algorithm ensures that each Fibre Channel exchange (e.g., each SCSI command) can be load-balanced independently, maximizing throughput.

Answer

Source ID (SID) and Destination ID (DID)

Answer

Source and destination port ID

Answer

Source and destination WWPN

Question 9

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions.

Answer

LDAP

Answer

RADIUS

Answer

Kerberos

Question 10

A storage array supports RAID-5, RAID-6, and RAID-10. The array has 12 disks of equal size. The requirement is to maximize usable capacity while tolerating up to two simultaneous disk failures without data loss. Which RAID level should be chosen?

Accepted Answer

RAID-6. RAID-6 can tolerate two disk failures with parity overhead of 2 disks, providing high usable capacity. RAID-5 tolerates only one failure; RAID-10 tolerates multiple failures but capacity is 50%.

Answer

RAID-10

Answer

RAID-5

Answer

RAID-0

Question 11

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

Accepted Answer

Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.. Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

Answer

Assign the 'read-only' role to the user within the tenant.

Answer

Create a separate VRF for each tenant and assign admin to that VRF.

Answer

Assign the 'tenant-admin' role to the user globally.

Question 12

A company uses Cisco TrustSec in its data center to enforce segmentation. Servers in VLAN 10 (Finance) should only communicate with servers in VLAN 20 (ERP) via an application gateway. Which TrustSec component is used to assign a Security Group Tag (SGT) to traffic from the Finance servers?

Accepted Answer

Identity Services Engine (ISE) as the authentication and policy server. In Cisco TrustSec, the Identity Services Engine (ISE) acts as the authentication and policy server that assigns Security Group Tags (SGTs) to endpoints or traffic based on identity and policy. ISE uses 802.1X, MAB, or web authentication to identify the Finance servers and then dynamically assigns the appropriate SGT, which is then used for segmentation enforcement.

Answer

MACsec encryption on the links

Answer

802.1X port-based authentication

Answer

VLAN ACL (VACL) on the switch

Question 13

An engineer is deploying FCoE on a Cisco Nexus 9000v switch in a converged network. The storage array is connected via native Fibre Channel to an MDS switch, and the MDS is connected to the Nexus using an FCoE link. The engineer creates a virtual Fibre Channel (VFC) interface on the Nexus, binds it to an Ethernet interface, and maps VSAN 200 to VLAN 200. The MDS side has an FCoE port configured and enabled. Servers connected to the Nexus with FCoE initiators can successfully log into the storage targets, but performance is very poor and intermittent. The engineer checks for drops on all interfaces and finds none. The engineer also verifies that the FCoE VLAN is not blocked by spanning tree. What is the most likely cause of the performance issue?

Accepted Answer

The Ethernet interface MTU is set to 1500 instead of 2500.. FCoE requires a jumbo MTU (typically 2500 bytes) to encapsulate Fibre Channel frames without fragmentation. An MTU of 1500 forces fragmentation and reassembly, causing retransmissions and poor performance. Option B is incorrect because the engineer verified that the FCoE VLAN is not blocked by spanning tree. Option C is incorrect because servers can log in, indicating FCoE is enabled on the MDS interface. Option D is incorrect because the VFC binding was already verified as correct.

Answer

The FCoE VLAN is blocking spanning tree.

Answer

The MDS has not enabled FCoE on the interface.

Answer

The VFC interface is not bound to the correct port-channel.

Question 14

Which VLAN range is reserved by default on Cisco Nexus switches?

Accepted Answer

VLAN 1. VLAN 1 is the default VLAN on Cisco Nexus switches and cannot be deleted or renamed. It is automatically created on all switches and carries all untagged traffic by default, making it a reserved VLAN that is always present in the VLAN database.

Answer

VLAN 1002-1005

Answer

VLAN 3968-4047

Answer

VLAN 4094

Question 15

An engineer needs to automate a repetitive configuration task on a Nexus switch. Which method is most suitable for programmatic access?

Accepted Answer

NX-API. NX-API provides a RESTful interface that allows programmatic access to Nexus switches using HTTP/HTTPS methods (GET, POST, DELETE) with JSON or XML payloads. This makes it the most suitable method for automating repetitive configuration tasks because it supports modern scripting languages (Python, Ansible) and enables idempotent, structured configuration changes without requiring interactive CLI sessions.

Answer

FTP file transfer

Answer

CLI scripting with Tcl

Answer

SNMP v3

Question 16

An engineer is writing a Python script to automate ACI fabric discovery using the APIC SDK. The script needs to wait until the fabric formation is complete before proceeding. Which approach is most reliable?

Accepted Answer

Periodically poll the fabric membership state via REST API. The most reliable method to wait for ACI fabric formation to complete is to periodically poll the fabric membership state via the REST API. The APIC SDK provides access to the fabric membership endpoint (e.g., /api/node/class/fabricNode.json), which returns the current state of each node. By polling this endpoint until all expected nodes report an 'active' or 'in-pod' status, the script can accurately determine when the fabric is fully formed, avoiding race conditions or incomplete discovery.

Answer

Implement asynchronous callbacks using the SDK

Answer

Use the configExportP object to monitor discovery

Answer

Use time.sleep() for a fixed duration

Question 17

Which Fibre Channel addressing component uniquely identifies a port on a storage array and is used for zoning and target identification?

Accepted Answer

WWPN. A WWPN (World Wide Port Name) is a globally unique 64-bit identifier assigned to each Fibre Channel port. It is used for zoning and target identification.

Answer

FCID

Answer

WWN

Answer

WWNN

Question 18

A startup company is deploying a new web application on UCS B-Series blades. They want to use PXE boot for rapid provisioning. The network team has configured a DHCP server and a PXE server on the same VLAN as the UCS service profiles. The system administrator creates a service profile for a blade and sets the boot policy to 'PXE' as the first boot device, and local disk as second. However, when the blade powers on, it boots from the local disk instead of PXE. The PXE server logs show no request from the blade's MAC address. The DHCP server logs show no activity. The fabric interconnect is configured with a default VLAN. What is the most likely cause?

Accepted Answer

The vNIC on the service profile is not configured with the correct native VLAN. PXE boot requires the vNIC to have an untagged native VLAN that matches the PXE/DHCP subnet. If the native VLAN on the vNIC is different, DHCP requests are not forwarded. Option B wrong because PXE boot order is usually correct. Option C wrong because it would cause different symptoms. Option D wrong because service profile association is fine.

Answer

The boot policy order lists local disk before PXE

Answer

The service profile is not properly associated with the blade

Answer

The fabric interconnect uplinks are not in trunk mode

Question 19

An engineer observes that ARP packets are being dropped. Based on the exhibit, what is the drop rate percentage for ARP packets?

Accepted Answer

50%. The exhibit shows that out of 1000 total ARP packets, 500 were dropped. The drop rate percentage is calculated as (dropped packets / total packets) * 100, which is (500/1000)*100 = 50%. Therefore, option C is correct.

Answer

75%

Answer

25%

Answer

100%

Question 20

A data center engineer is troubleshooting connectivity issues between two EPGs in the same tenant on a Cisco ACI fabric. The first EPG 'web_epg' is in VLAN 100 and the second EPG 'db_epg' is in VLAN 200. The contract 'web_to_db' allows TCP port 3306 from web_epg to db_epg. The EPGs are in the same VRF. The engineer has verified that the physical connectivity is correct and the endpoints are learning their IP addresses. However, traffic from web_epg to db_epg is not reaching the destination. The engineer checks the contract and sees that the subject 'mysql_access' has filter 'mysql' with direction 'both'. The provider is db_epg and consumer is web_epg. The engineer also notices that the default action in the contract is 'deny'. What is the most likely cause of the issue?

Accepted Answer

The contract direction is reversed: the provider should be the destination of the traffic. Since web_epg initiates to db_epg, web_epg should be the provider.. In Cisco ACI, the provider EPG is the one that offers a service (the destination of the traffic), and the consumer EPG is the one that initiates the connection. Since web_epg initiates TCP traffic to db_epg, db_epg should be the provider and web_epg the consumer. The contract is reversed, so the default deny action blocks the traffic because the consumer (web_epg) is not allowed to initiate toward the provider (db_epg) under the reversed roles.

Answer

The VRF is not correctly associated with the EPGs.

Answer

A Layer 3 Outside (L3Out) is required for communication between EPGs in the same VRF.

Answer

The filter 'mysql' does not match TCP port 3306.