350-601 Practice Test 4 — 25 Questions

Question 1

A Cisco MDS switch is configured with fabric binding to restrict which switches can join the fabric. A new switch is added, but it fails to establish an E-port connection. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The new switch's WWN is not included in the fabric binding configuration. Fabric binding on a Cisco MDS switch uses the fabric-binding database to enforce a whitelist of allowed switch WWNs. When a new switch attempts to bring up an E-port, the principal switch checks the new switch's WWN against this database. If the WWN is not present, the E-port is automatically isolated, preventing the switch from joining the fabric. This is the most direct cause of the failure described.

Answer

Incompatible SFP modules between the switches

Answer

Incorrect zoning configuration on the existing switch

Answer

The new switch has a higher priority than the principal switch

Question 2

A Cisco ACI fabric has contracts configured to allow traffic between two EPGs. After deployment, traffic between endpoints in these EPGs is being dropped, but contract statistics show no packets have been permitted. The administrator checks the contract configuration and it looks correct. What is the most likely cause?

Accepted Answer

The contract is configured only on the provider EPG, but the consumer EPG is not consuming the contract.. The most likely cause is that the contract is configured on the provider EPG but the consumer EPG is not configured to consume it. In Cisco ACI, a contract must be explicitly provided by one EPG and consumed by another for traffic to be permitted. If the consumer EPG does not have the contract applied, the contract will not be enforced, and traffic will be dropped even if the contract configuration appears correct. The contract statistics showing no permitted packets confirm that the contract is not being applied to the traffic flow.

Answer

The contract is applied to the wrong VRF.

Answer

The filter direction is set to both, but the contract is using an incorrect filter.

Answer

The endpoints are in different VMM domains.

Question 3

A network engineer is troubleshooting an OSPF adjacency issue between two Nexus switches. The neighbors are stuck in the EXSTART state. What is the most likely cause?

Accepted Answer

MTU mismatch. When OSPF neighbors are stuck in the EXSTART state, the most common cause is an MTU mismatch. In EXSTART, the routers exchange Database Description (DBD) packets, which must be no larger than the interface MTU. If one interface has a smaller MTU, the DBD packet is dropped, preventing the adjacency from progressing to the Exchange state. Cisco Nexus switches default to an MTU of 1500 bytes, but any mismatch will cause this issue.

Answer

Hold timer mismatch

Answer

Incorrect area ID

Answer

Duplicate router ID

Question 4

An engineer is designing a UCS environment for a virtualized workload that requires high availability. Two Fabric Interconnects are deployed in an active-active configuration. Which statement about the role of the Fabric Interconnects is accurate?

Accepted Answer

Both FIs are active and can forward traffic, but only one manages the chassis at a time.. In a Cisco UCS environment with two Fabric Interconnects in an active-active cluster, both FIs are operational and can forward data traffic, but only one FI acts as the primary manager for the chassis at any given time. This provides high availability: if one FI fails, the other takes over management and continues forwarding traffic. Option B accurately describes this behavior.

Answer

The FIs are used only for management traffic and not for data traffic.

Answer

One FI acts as primary and the other as secondary, forwarding traffic only if the primary fails.

Answer

The FIs operate in a standalone mode and must be configured independently.

Question 5

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

Accepted Answer

It uses the SGACL to permit HTTP and deny other traffic. SGACLs enforce policy based on SGTs, not IP addresses.

Answer

It forwards the traffic to the Cisco ISE for policy decision

Answer

It applies an IP ACL based on the SGT

Answer

It drops all traffic between different SGTs unless a contract exists

Question 6

A network administrator implements the ACL shown. After verifying the ACL statistics, all counters show 0 matches. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface.. If the ACL is applied to the wrong interface, traffic never traverses that interface, so the ACL counters remain at 0. ACLs must be applied to the interface where traffic enters (inbound) or exits (outbound) the device; applying to an interface that does not carry the relevant traffic results in no matches.

Answer

The ACL entries are in the wrong order.

Answer

The 'permit ip any any' entry causes all traffic to be permitted before inspection.

Answer

The ACL is applied outbound instead of inbound.

Question 7

An automation engineer is using the cisco_nxapi Python library to configure a Nexus switch. Which step is required before using the library?

Accepted Answer

Enable NX-API on the Nexus switch with 'feature nxapi'.. The cisco_nxapi library uses NX-API, which must be enabled on the Nexus switch via 'feature nxapi'.

Answer

Configure a NETCONF session.

Answer

Generate an SSH key pair for authentication.

Answer

Install the library on the Nexus switch using pip.

Question 8

An engineer is configuring FCoE on a Cisco Nexus 5000 switch. The switch connects to a Fibre Channel storage array. The FCoE Initialization Protocol (FIP) snooping must be enabled. What is the effect of enabling FIP snooping?

Accepted Answer

It constructs a database of ENode MAC addresses and FC-MAPs.. FIP snooping on a Cisco Nexus 5000 switch constructs a database of ENode MAC addresses and FC-MAPs by inspecting FIP discovery, advertisement, and login frames. This database is used to enforce FCoE traffic only between authorized ENodes and FCFs, preventing rogue devices from injecting FCoE traffic. It does not terminate FCoE VLANs, act as an FCoE forwarder, or enforce zone-based policies directly.

Answer

It enables the switch to terminate FCoE VLANs.

Answer

It provides FC-BB_6 compliant FCoE traffic forwarding.

Answer

It enables the switch to act as an FCoE forwarder.

Answer

It allows the switch to enforce zone-based policy for FCoE traffic.

Question 9

Which VLAN trunking protocol is used by default on Cisco Nexus switches to carry multiple VLANs over a single link?

Accepted Answer

802.1Q. 802.1Q is the IEEE standard trunking protocol used by default on Cisco Nexus switches to carry multiple VLANs over a single link. Unlike older Cisco switches that defaulted to ISL, Nexus switches exclusively support 802.1Q encapsulation for VLAN trunking, as ISL is not supported on the NX-OS platform.

Answer

VTP

Answer

DTP

Answer

ISL

Question 10

In ACI, which model is used for micro-segmentation to allow traffic between EPGs?

Accepted Answer

Whitelist model using contracts. ACI uses a whitelist (default-deny) security model where no traffic flows between EPGs unless a contract explicitly permits it. Contracts define the protocols and ports allowed between a provider EPG and a consumer EPG, and the contract must be applied to both sides for traffic to pass. This is the foundational micro-segmentation mechanism in ACI.

Answer

Blacklist model using taboo contracts

Answer

IP-based ACLs on leaf switches

Answer

VRF leaking

Question 11

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions.

Answer

LDAP

Answer

RADIUS

Answer

Kerberos

Question 12

A storage administrator notices that a Fiber Channel link between a server and a Cisco MDS switch is flapping every few minutes. The server's HBA and the switch port are both configured for 16 Gbps. Which action is most likely to resolve the issue?

Accepted Answer

Replace the SFP module on the switch port with a compatible Cisco SFP. The most likely cause of link flapping on a 16 Gbps Fiber Channel link is an incompatible or faulty SFP module. Cisco MDS switches require Cisco-qualified SFPs to ensure proper signal integrity and protocol negotiation; using a third-party or mismatched SFP can cause intermittent link drops. Replacing the SFP with a compatible Cisco SFP directly addresses the hardware compatibility issue that leads to flapping.

Answer

Increase the link timeout interval on the switch port

Answer

Configure the switch port speed to auto-negotiate

Answer

Change the admin state of the interface to shut and no shut

Question 13

A network engineer is designing a spine-leaf fabric with oversubscription ratio of 3:1. Each leaf switch uses 40 Gbps uplinks to the spine and has 48 x 10 Gbps server ports. How many spine links are needed per leaf to achieve the target oversubscription?

Accepted Answer

4. The oversubscription ratio is the ratio of server-facing bandwidth to spine-facing bandwidth. Each leaf has 48 x 10 Gbps = 480 Gbps of server-facing capacity. To achieve a 3:1 oversubscription ratio, the spine-facing bandwidth must be 480 Gbps / 3 = 160 Gbps. Since each uplink is 40 Gbps, you need 160 / 40 = 4 spine links per leaf.

Answer

3

Answer

2

Answer

5

Question 14

A data center architect needs to enforce role-based access control for UCS Manager. What is the correct approach?

Accepted Answer

Create user roles with specific privileges in UCS Manager. UCS Manager provides RBAC by allowing administrators to create custom roles with specific privileges and assign them to users.

Answer

Enable CoPP for management access

Answer

Use TACACS+ to assign roles

Answer

Use RADIUS for authentication only

Question 15

What is the primary purpose of NX-API on Cisco Nexus switches in a data center automation context?

Accepted Answer

To provide a RESTful API that allows programmatic access to CLI commands and structured data output.. NX-API provides a RESTful API interface on Cisco Nexus switches, enabling programmatic access to CLI commands and returning structured data in formats like JSON or XML. This is essential for data center automation because it allows external tools (e.g., Ansible, Python scripts) to configure and retrieve state from the switch without requiring interactive CLI sessions, directly supporting infrastructure-as-code workflows.

Answer

To replace SNMP for monitoring and alerting.

Answer

To enable direct configuration from a web browser without CLI.

Answer

To create a web-based GUI for manual switch configuration.

Question 16

An engineer configures an ISL between two MDS switches using E_ports. To utilize all available bandwidth, the engineer wants to bundle four physical links into a single logical link. Which technology should be used?

Accepted Answer

Fibre Channel PortChannel. Fibre Channel PortChannel (also called SAN port channel) bundles multiple physical ISLs between E_ports into one logical link, providing increased aggregate bandwidth, load balancing, and link redundancy. It is the standard Cisco MDS mechanism for combining parallel ISLs while preserving in-order frame delivery over Fibre Channel.

Answer

NPV mode

Answer

FCoE trunking

Answer

EISL trunking

Question 17

An engineer needs to extend a Layer 2 VLAN across a VXLAN EVPN fabric. Which construct maps the VLAN to the overlay network?

Accepted Answer

VNI. In a VXLAN EVPN fabric, the VNI (VXLAN Network Identifier) is the construct that maps a Layer 2 VLAN to the overlay network. The VNI uniquely identifies a Layer 2 segment across the underlay, allowing VLAN traffic to be encapsulated and transported over the IP fabric. This mapping is configured on the VTEP (VXLAN Tunnel Endpoint) using commands like 'vlan 100' mapped to 'vn-segment 10100' under the VLAN configuration.

Answer

VLAN ID

Answer

VTEP IP

Answer

VPC

Question 18

An engineer is configuring zoning on a Cisco MDS switch. The requirement is to ensure that only the storage array ports with specific WWPNs can access the host initiators. Which zoning approach should be used to enforce this policy regardless of physical port changes?

Accepted Answer

Hard zoning by WWPN. Hard zoning by WWPN enforces access control at the hardware/ASIC level in the MDS switch, so only the specific WWPNs listed in the zone can communicate — this is enforced regardless of which physical port the device is plugged into. Because WWPNs are burned into the HBA and storage array ports, the policy follows the device even if it is moved to a different port.

Answer

Soft zoning by WWPN

Answer

Soft zoning by port ID

Answer

Hard zoning by domain/port

Question 19

A company is deploying a new Cisco UCS Mini with a single Fabric Interconnect 6324. They need to connect to an existing Fibre Channel SAN. Which action is required to enable Fibre Channel connectivity?

Accepted Answer

Configure the uplink Ethernet ports as unified ports to support Fibre Channel.. The Cisco UCS 6324 Fabric Interconnect has built-in unified ports that can be configured as 2/4/8-Gbps Fibre Channel uplinks. To connect to an existing Fibre Channel SAN, you configure these unified ports as FC uplinks (option D); no external MDS switch is required. Adding an MDS is unnecessary and not a required action.

Answer

Enable NPV mode on the Fabric Interconnect to connect to the SAN.

Answer

Install a Fibre Channel module in the Fabric Interconnect.

Answer

Add a Cisco MDS 9148S Fibre Channel switch and connect it to the Fabric Interconnect via FC uplinks.

Question 20

A storage administrator is troubleshooting FCoE performance issues between a Cisco UCS FI and a storage array. The fabric is configured with FIP snooping and DCB. The administrator checks the FCoE interface counters and sees many dropped frames due to 'no buffer space'. What is the most likely root cause?

Accepted Answer

Priority flow control settings are mismatched between the upstream switch and the storage array. The 'no buffer space' drops on FCoE interfaces indicate that the receive buffers are being exhausted, which is a classic symptom of Priority Flow Control (PFC) being misconfigured or mismatched between the upstream switch and the storage array. PFC (IEEE 802.1Qbb) is essential for lossless FCoE transport; if one side sends pause frames that the other does not honor, or if the PFC priorities are not aligned, buffers overflow and frames are dropped. This directly explains the observed counter behavior.

Answer

Jumbo frames are disabled on the switch ports

Answer

The FCoE VLAN is not trunked to the storage array

Answer

FIP snooping is not enabled on the FCoE VLAN