350-601 Practice Test 3 — 10 Questions

Question 1

In an ACI fabric, an EPG is configured with a contract that provides a service to another EPG. The contract has a filter for TCP port 80. Which component defines the directionality of the communication between the provider and consumer EPG?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The provider and consumer labels in the contract. In Cisco ACI, the provider and consumer labels in the contract define the directionality of communication. The provider EPG offers a service, and the consumer EPG initiates the request; the contract's provider/consumer relationship determines which EPG can start the conversation and in which direction the filter (e.g., TCP port 80) applies. This is fundamental to ACI's policy model, where the contract is unidirectional from consumer to provider by default.

Answer

The filter direction specified in the contract

Answer

The BD subnets

Answer

The subject of the contract

Question 2

Refer to the exhibit. What is the intended effect of this Ansible playbook task?

Accepted Answer

It ensures VLAN 10 exists with the name 'Automation_VLAN' on the target switches.. The Ansible playbook task uses the `cisco.nxos.nxos_vlans` module with the `state: merged` directive, which ensures that the specified VLAN configuration (VLAN 10 with name 'Automation_VLAN') is present on the target Nexus switches. If VLAN 10 does not exist, it will be created; if it exists with a different name, it will be updated. The `merged` operation does not delete or reboot; it only applies the configuration to align the device's state with the playbook's desired state.

Answer

It deletes VLAN 10 from all switches.

Answer

It saves the running configuration to startup.

Answer

It reboots the Nexus switches after applying the configuration.

Question 3

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

Accepted Answer

IP Source Guard. IP Source Guard (IPSG) uses the DHCP snooping binding table to validate the source IP address of packets received on untrusted ports. It drops any packet whose source IP does not match an entry in the binding table, preventing IP spoofing attacks. Dynamic ARP Inspection (DAI) also relies on the DHCP snooping binding table to validate ARP packets, ensuring that the sender MAC and IP addresses match a legitimate binding, thereby blocking ARP poisoning attacks.

Answer

Port Security

Answer

Private VLANs

Answer

MACsec

Question 4

A Cisco MDS 9000 switch is used in a storage network. The security policy requires that a junior administrator named 'user1' can view zone configurations but cannot make any changes. Currently, 'user1' is assigned the default 'network-operator' role, which allows read-only access to most configuration, but the engineer wants to ensure that zone modification is explicitly denied. The engineer creates a custom role named 'zone-viewer' and assigns it to 'user1'. The role should permit viewing of the running configuration related to zones but deny any command that modifies zone or zoneset configurations. Which configuration best achieves this objective?

Accepted Answer

role name zone-viewer
  permit command show zone*; permit command show zoneset*. It uses the 'permit command' statements with wildcard patterns ('show zone*' and 'show zoneset*') to explicitly allow only show commands related to zones and zonesets. By not including any 'permit' or 'deny' statements for configuration commands (like 'configure terminal', 'zone', or 'zoneset'), the role implicitly denies all other commands, including those that modify zone or zoneset configurations. This matches the requirement to allow viewing but deny modifications.

Answer

role name zone-viewer
  feature zone; permit command configure terminal ; zone name etc.

Answer

role name zone-viewer
  rule 1 permit read-write; feature zone

Answer

role name zone-viewer
  permit command zone; permit command zoneset; permit command zone-create

Question 5

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

Accepted Answer

show dot1x interface ethernet 1/1. The correct command on Cisco Nexus switches to verify 802.1X authentication status on a specific interface is 'show dot1x interface ethernet 1/1'. This command displays the 802.1X state, authorized status, and other details for the specified interface. Option B, 'show dot1x interface ethernet 1/1', is correct. Option C is incorrect because 'show authentication interface' is not a valid command on Nexus NX-OS; it is used on IOS-based switches. Option A is unrelated to 802.1X, and option D shows port security, not authentication status.

Answer

show aaa authentication

Answer

show authentication interface ethernet 1/1

Answer

show port-security interface ethernet 1/1

Question 6

When using Cisco NSO (Network Services Orchestrator) to automate service creation across a data center network, what is a key consideration regarding device compatibility?

Accepted Answer

Each device must have a corresponding NED that matches its OS version.. B is correct because Cisco NSO uses Network Element Drivers (NEDs) to translate service models into device-specific CLI, SNMP, or NETCONF commands. Each NED is tied to a specific device OS version (e.g., IOS-XE 16.12, NX-OS 9.3), so mismatched NEDs cause configuration failures or incomplete deployments. Without a compatible NED, NSO cannot communicate with or configure the device.

Answer

NSO requires NETCONF for all devices.

Answer

Device YANG models must be hand-coded by the team.

Answer

NSO only supports Cisco devices.

Question 7

A UCS Central administrator is creating a global service profile policy that applies to multiple UCS domains. The policy must include boot order settings. What is the recommended approach to ensure consistency across domains?

Accepted Answer

Use UCS Central to create a global boot policy and assign it to service profiles. UCS Central allows creation of global policies that are applied to service profiles in multiple domains, ensuring consistency.

Answer

Rely on default boot policy

Answer

Define the boot order directly in the service profile template

Answer

Create a local boot policy in each UCS domain

Question 8

Which TWO are best practices when automating ACI fabric configuration using Ansible?

Accepted Answer

Use the cisco.aci collection. The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

Answer

Set validate_certs: no to avoid certificate errors

Answer

Store credentials in plain text in playbooks

Answer

Use delegate_to: localhost for all tasks

Question 9

A network engineer is configuring a new UCS B-series blade server. The engineer wants the server to automatically inherit network and storage settings without manual configuration when replaced. Which UCS technology enables this capability?

Accepted Answer

Service profile template. Service profile templates in Cisco UCS Manager allow administrators to define a reusable configuration for network and storage settings. When a server fails or is replaced, the template is applied to the new blade, automatically inheriting all settings without manual intervention. This capability is central to UCS's stateless computing model, where hardware identity and policies are abstracted from the physical server.

Answer

Fabric Interconnect failover

Answer

Cisco IMC Supervisor

Answer

Cisco UCS Manager

Question 10

In a Cisco HyperFlex cluster, the management plane uses vCenter, but the data plane uses which protocol to replicate data across nodes?

Accepted Answer

HX Data Platform. In a Cisco HyperFlex cluster, the data plane replication across nodes is handled by the HX Data Platform, which is a distributed, log-structured file system that synchronously replicates data at the hypervisor level. This platform manages all I/O operations and ensures data consistency across the cluster without relying on external storage protocols like Fibre Channel or iSCSI.

Answer

Fibre Channel

Answer

NFS

Answer

iSCSI