350-601 Practice Test 29 — 15 Questions

Question 1

A security engineer is deploying IP Source Guard on a Nexus switch. Which two components must be operational for IP Source Guard to function correctly?

Accepted Answer

Dynamic ARP Inspection. IP Source Guard on Nexus switches relies on both DHCP snooping and Dynamic ARP Inspection. DHCP snooping builds the binding table that IP Source Guard uses to validate source IP addresses, while Dynamic ARP Inspection prevents ARP spoofing attacks and ensures IP integrity. Without both, IP Source Guard cannot function correctly.

Answer

ACL

Answer

Cisco TrustSec

Answer

Port security

Question 2

In a VXLAN overlay network, what is the primary purpose of ingress replication for BUM traffic?

Accepted Answer

To forward broadcast, unknown unicast, and multicast traffic without requiring multicast in the underlay. Ingress replication is a technique used in VXLAN overlay networks to handle BUM (Broadcast, Unknown unicast, Multicast) traffic without requiring a multicast-enabled underlay. The ingress VTEP (VXLAN Tunnel End Point) replicates the BUM packet and sends a separate unicast copy to each remote VTEP in the same VXLAN Network Identifier (VNI) segment, ensuring all relevant endpoints receive the traffic while relying solely on unicast routing in the underlay.

Answer

To reduce the need for ARP suppression

Answer

To enable multipathing of BUM traffic across multiple paths

Answer

To assign VXLAN Network Identifiers (VNIs) to tenant traffic

Question 3

Two Cisco Nexus 9000 switches are connected via Ethernet interface 1/1. The engineer wishes to secure the link using MACsec (IEEE 802.1ae) with a pre-shared key for connectivity association key (CAK) protection. Both switches have the same hardware and software version supporting MACsec. The engineer configures the following on both switches:

feature macsec
macsec policy MACSEC_POLICY
  cipher-suite gcm-aes-128
  security-mode no-encrypt
  mka sak-rekey-time 30
interface ethernet 1/1
  macsec policy MACSEC_POLICY

However, the link comes up without MACsec encryption (the port counter shows MACsec frames dropped). The engineer checks that the pre-shared key is configured correctly via 'macsec key-chain' but notices it was not explicitly applied. What is the most likely reason for MACsec failing to establish?

Accepted Answer

The MACsec key chain must be created and referenced in the macsec policy, and the MKA policy must be applied to the interface with 'macsec mka policy'.. MACsec on Cisco Nexus 9000 switches requires a key chain to be defined and explicitly referenced within the MACsec policy. Without the 'key-chain' command under the 'macsec policy', the pre-shared key (CAK) is not available for MKA (MACsec Key Agreement) to derive session keys. Additionally, the MKA policy must be applied to the interface using 'macsec mka policy' to enable the key agreement protocol; simply enabling MACsec on the interface without these steps leaves the link unsecured, causing MACsec frames to be dropped.

Answer

Both switches must have the same MACsec profile name.

Answer

The interface must be put in a 'macsec' mode with 'switchport macsec'.

Answer

The 'feature macsec' command is not enabled, so MACsec is not operational.

Question 4

A network engineer is troubleshooting high CPU utilization on a Nexus 9000 switch. Which command is most useful to identify the process consuming the most CPU?

Accepted Answer

show process cpu sort. The 'show process cpu sort' command on Nexus 9000 switches displays the current CPU utilization sorted by the process consuming the most CPU, allowing the engineer to quickly identify the top CPU consumer. This command provides a real-time, sorted list of processes with their CPU usage percentages, which is directly useful for troubleshooting high CPU utilization.

Answer

show processes cpu history

Answer

show system resources

Answer

show cpu usage

Question 5

A HyperFlex cluster uses RF2 and consists of 5 nodes. One node fails. Data is re-replicated to the remaining nodes. After re-replication, what is the largest number of additional node failures that can occur without data loss?

Accepted Answer

1. With RF2 (two copies), the cluster can tolerate one failure. After a failure and re-replication, the cluster has 4 nodes. If one more node fails, data might still be available if the surviving node holds a copy. However, with RF2, a second failure could lead to data loss if both copies are lost. The maximum tolerable is one additional failure, because with two failures, some data may have only one copy left (if the second failure affects the only remaining copy). Actually, with RF2, you can tolerate one failure. After re-replication, same tolerance: one more failure. So answer is 1.

Answer

0

Answer

2

Answer

3

Question 6

In ACI, when integrating with VMware vSphere, which component is used to automatically push port group configurations to virtual switches?

Accepted Answer

VMM domain. The VMM (Virtual Machine Manager) domain in ACI is the integration point with VMware vSphere. It automatically pushes port group configurations to virtual switches by leveraging the VMware vCenter API, ensuring that ACI network policies are consistently applied to the hypervisor's virtual switches without manual intervention.

Answer

APIC

Answer

Tenant

Answer

L3Out

Question 7

A network engineer is designing a Cisco HyperFlex cluster for a virtualized environment. The cluster will run VDI workloads. Which storage policy should be selected to ensure that all VMs have the highest possible performance while maintaining data redundancy?

Accepted Answer

Dual replication with deduplication and compression. For VDI workloads in a Cisco HyperFlex cluster, the storage policy must balance performance and data redundancy. Dual replication with deduplication and compression provides the highest performance by using two copies of data (mirroring) for redundancy, while deduplication and compression reduce storage overhead without the write penalty of parity-based schemes. This avoids the performance degradation of RAID 5 parity or erasure coding, which are unsuitable for latency-sensitive VDI.

Answer

Triple replication with RAID 5 parity

Answer

Erasure coding with deduplication

Answer

No replication with compression

Question 8

A network engineer is configuring OSPF on a pair of Nexus 9000 switches acting as spine switches in a VXLAN fabric. The engineer needs to ensure that the spine switches do not become the DR for any VLAN. Which configuration should be applied?

Accepted Answer

Set ospf priority to 0 on the spine interfaces.. Setting the OSPF priority to 0 on the spine interfaces prevents the spine switches from participating in the DR/BDR election process, ensuring they never become the Designated Router (DR) for any VLAN. This is the standard method to suppress DR election on a multi-access network segment.

Answer

Configure passive-interface default under OSPF.

Answer

Set ospf network type to point-to-multipoint.

Answer

Set ospf priority to 255 on the spine interfaces.

Question 9

Which THREE conditions can cause Fibre Channel buffer credit starvation? (Choose three.)

Accepted Answer

Frequent CRC errors causing retransmissions. Frequent CRC errors indicate corrupted frames, which require retransmission. Each retransmission consumes an additional buffer credit, effectively starving the port of available credits for new transmissions. This leads to reduced throughput and potential credit starvation.

Answer

High oversubscription ratio on the ISL

Answer

Multiple VSANs configured on the same trunk

Question 10

A storage administrator is configuring Fibre Channel zoning on a Cisco MDS switch to restrict access between initiators and targets. Which two statements about hard zoning vs. soft zoning are true? (Choose two.)

Accepted Answer

Hard zoning provides security against WWPN spoofing.. Hard zoning uses hardware ACLs to enforce access at the port level, providing security against WWPN spoofing. Soft zoning relies on the name server to filter responses, but a device can still attempt to communicate; it is less secure.

Answer

Hard zoning uses the Fibre Channel name server to restrict access.

Answer

Both hard and soft zoning require the active zone set to be configured.

Answer

Soft zoning enforces access at the hardware level.

Question 11

Refer to the exhibit. An administrator connects a new server to Ethernet1/1 and the port immediately goes into errdisable state. The previous device was connected to that port. What is the most likely cause?

Accepted Answer

The new server has a different MAC address than the sticky MAC. The port immediately entering errdisable state upon connecting a new server indicates a port security violation. When port security is enabled with sticky MAC addresses, the switch dynamically learns and 'sticks' the MAC address of the first connected device to the running configuration. Connecting a device with a different MAC address triggers a security violation, and if the violation mode is 'shutdown' (the default), the port is placed into errdisable state. This matches the scenario where the previous device's MAC was learned as sticky, and the new server's MAC differs.

Answer

The port security violation mode is set to protect

Answer

The port security maximum MAC addresses is set too high

Answer

The port is configured as a trunk

Question 12

Which TWO benefits does NPIV (N_Port ID Virtualization) provide in a Fibre Channel SAN? (Choose two.)

Accepted Answer

Enables Fibre Channel connectivity for virtual machines. NPIV allows a single physical N_Port to register multiple N_Port IDs (FCIDs) with the Fibre Channel fabric. This enables each virtual machine on a virtualized server to have its own unique WWN and FCID, providing direct Fibre Channel connectivity to storage without requiring a dedicated physical HBA per VM. By sharing a single physical port among multiple VMs, NPIV reduces the number of physical ports and HBAs needed in virtualized environments.

Answer

Enhances security by isolating traffic at the port level

Answer

Increases throughput by aggregating bandwidth

Answer

Allows multiple VSANs on a single link

Question 13

Refer to the exhibit. What is the most likely cause of the NVE interface being down?

Accepted Answer

The source interface is not configured.. The NVE (Network Virtualization Edge) interface requires a valid source interface (typically a loopback) to establish VXLAN tunnels. If the source interface is not configured under the NVE interface, the interface remains in a down state because it cannot form VXLAN overlay adjacencies. This is the most common cause of an NVE interface being down in Cisco NX-OS.

Answer

The VXLAN destination UDP port is incorrect.

Answer

The overlay VLAN is not configured.

Answer

The VNI list is empty.

Question 14

A mid-size organization is upgrading its data center network to support server virtualization. They have deployed two Nexus 9300 switches as access switches for their server racks. The servers are configured with VLAN tagging and connect to the switches using trunks. The network administrator needs to ensure that the switches can provide default gateway services to the servers to reduce latency. They have configured interface VLAN interfaces and HSRP for redundancy. After implementation, the servers can communicate within the same VLAN but fail to reach the default gateway. The network administrator checks the switch configuration and finds that "ip routing" is not enabled globally. What is the most likely impact of this missing configuration?

Accepted Answer

The switches will not forward traffic between VLANs.. Without the 'ip routing' command enabled globally, the Nexus 9300 switches operate as Layer 2 devices only. This means they can forward frames within the same VLAN (since that relies on MAC address learning and switching), but they cannot perform IP routing between VLANs or route traffic to the configured SVI (VLAN interface) default gateway. The servers can communicate within the same VLAN because that is purely Layer 2 switching, but any attempt to reach the default gateway (which requires Layer 3 forwarding) fails because the switch does not have IP routing enabled.

Answer

The servers will not receive DHCP addresses.

Answer

HSRP will not elect an active router.

Answer

The VLAN interfaces will not come up.

Question 15

A small business has a Cisco MDS 9148S switch with a single fabric. Two hosts are connected to ports fc1/1 and fc1/2, and a storage array is connected to ports fc1/3 and fc1/4. The administrator wants to ensure that each host can only see its own assigned LUNs on the array. They have configured a zone for each host containing the host pWWN and the target pWWN for the respective LUNs. However, Host A is able to see Host B's LUNs. What is the most likely cause?

Accepted Answer

The zoning configuration is using a zone alias that includes both hosts. The administrator likely used a zone alias that inadvertently includes both hosts' pWWNs. In Cisco MDS zoning, a zone alias is a named set of pWWNs; if the alias contains both Host A and Host B, then any zone using that alias will include both hosts, allowing Host A to see Host B's LUNs. This violates the intended hard-zoning isolation, as zones must contain only the specific host-target pairs to enforce LUN masking.

Answer

The zone is not active

Answer

The zones are not in the same VSAN

Answer

The target ports are using soft zoning