350-601 Practice Test 3 — 10 Questions

Question 1

A large enterprise is deploying a new storage network for a VMware vSphere cluster with 200 VMs. The cluster uses vSphere 7 with vVols and requires a SAN that supports 16 Gbps FC. The storage team wants to use a Cisco MDS 9148S switch and has configured two VSANs: VSAN 100 for production and VSAN 200 for backup. The backup server is connected to VSAN 200. After the deployment, the backup administrator reports that backup jobs from the backup server to the storage array are failing. The storage array is connected to both VSANs via a single FC interface configured in 'auto' mode. The backup server is connected to an F-port in VSAN 200. The storage array's interface shows 'trunking' enabled and is in 'up' state. What is the most likely cause of the backup failure?

Accepted Answer

Configure the MDS switch interface connected to the storage array as a trunk port and ensure VSAN 200 is in the allowed list.. The storage array is connected to both VSANs via a single interface with trunking enabled, but the MDS switch interface connected to the array is not configured as a trunk port. Without trunking on the switch side, the interface can only belong to one VSAN (likely VSAN 100 by default), so traffic from the backup server in VSAN 200 cannot reach the storage array. Option A resolves this by configuring the switch interface as a trunk port and explicitly allowing VSAN 200 in the allowed VSAN list, enabling the array to communicate with both VSANs.

Answer

Move the backup server to VSAN 100 to match the production storage.

Answer

Change the storage array interface to 'F' mode to force it to be in a single VSAN.

Answer

Disable trunking on the storage array interface to prevent VSAN mismatch.

Question 2

A network engineer is implementing automated configuration management using Cisco NSO (Network Services Orchestrator). The team wants to ensure that any configuration changes made directly on the devices (out-of-band) are detected and reconciled. Which NSO feature should be used?

Accepted Answer

Fast-map synchronization. Fast-map synchronization is the correct NSO feature because it is specifically designed to detect and reconcile configuration changes made directly on managed devices (out-of-band changes). It compares the device's running configuration against NSO's CDB and generates the necessary NETCONF or CLI operations to bring the device back into sync with NSO's desired state, ensuring consistency without manual intervention.

Answer

Configuration Database (CDB) snapshots

Answer

Service model templates

Answer

Rollback and recovery mechanism

Question 3

Which TWO statements about Cisco NX-API are correct? (Choose two.)

Accepted Answer

NX-API uses HTTP/HTTPS as the transport protocol.. Cisco NX-API is a programmatic interface that uses HTTP/HTTPS as the transport protocol, allowing RESTful API calls to configure and monitor Nexus switches. It supports both XML and JSON output formats, enabling flexible data parsing in automation scripts. This makes options C and E correct.

Answer

NX-API uses SSH for transport.

Answer

NX-API only supports GET requests.

Answer

NX-API is only available on Nexus 3000 series switches.

Question 4

Refer to the exhibit. An automation script is used to configure a new VLAN 40 on Eth1/2 trunk. The script sends the following NX-API command: 'switchport trunk allowed vlan add 40'. After execution, the engineer runs 'show running-config interface eth1/2' and sees that the trunk allowed VLAN list shows '10,20,30,40'. However, the automation script logs indicate success for adding VLAN 40, but the running config does not show the change. What is the most likely issue?

Accepted Answer

The engineer is viewing a different switch or the configuration was reverted by another process.. Option B is correct because the running config shows VLANs 10,20,30,40, indicating that VLAN 40 was successfully added. The script logs confirm success, so the command syntax and interface target are correct. The discrepancy between the logs and the running config is most likely due to the engineer viewing a different switch (e.g., a management console pointing to a different device) or the configuration being reverted by another process (e.g., a configuration rollback or a competing automation script).

Answer

The command syntax is incorrect; 'add' is not a valid keyword.

Answer

The script actually removed the existing VLANs and replaced them with only VLAN 40.

Answer

The NX-API command was sent to the wrong interface.

Question 5

An engineer is configuring AAA on a Cisco Nexus switch to authenticate management access via TACACS+. The switch is reachable, but login attempts repeatedly fail. Which action should the engineer take to isolate the issue?

Accepted Answer

Run 'test aaa authentication login legacy' to validate AAA configuration.. Option B is correct because the 'test aaa authentication login' command with the 'legacy' keyword directly validates the AAA authentication configuration against the TACACS+ server without requiring a full login session. This isolates whether the issue is with the AAA configuration itself versus network connectivity or server reachability, as the command simulates the exact authentication flow the switch uses.

Answer

Enable 'debug tacacs' on the switch to see detailed TACACS+ exchange.

Answer

Verify IP connectivity to the TACACS+ server using ping.

Answer

Check if the TACACS+ server port (49) is open using Telnet.

Question 6

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

Accepted Answer

Create a contract between EPGs with appropriate filters.. In Cisco ACI, contracts are the primary mechanism for enforcing policy-based communication between EPGs. By creating a contract between the web and app EPGs with a filter that permits HTTP (TCP/80), and another contract between management and web EPGs with a filter that denies SSH (TCP/22), the architect can precisely meet both requirements. Contracts allow granular control over which protocols and ports are allowed or denied, making them the correct construct for this access control scenario.

Answer

Use a tenant to separate the EPGs logically.

Answer

Configure a VRF to isolate traffic between EPGs.

Answer

Define a bridge domain with L2 policies.

Question 7

An organization is deploying Cisco ISE for 802.1X authentication on Cisco Nexus switches. Some endpoints fail authentication and fall back to the MAB. The security policy requires that endpoints failing both 802.1X and MAB be placed in a restricted VLAN. Which configuration is needed on the switch port?

Accepted Answer

authentication failed action authorize vlan 999. Option C is correct because the 'authentication failed action authorize vlan 999' command configures the switch port to place endpoints that fail both 802.1X and MAB into a restricted VLAN (VLAN 999). This directly meets the security policy requirement for endpoints that cannot authenticate via either method.

Answer

authentication order dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication event server dead action authorize vlan 999

Question 8

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

Accepted Answer

Add 'spanning-tree bpdufilter enable' on the interface.. Option C is correct because enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Answer

Add 'spanning-tree guard loop' to the interface.

Answer

Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.

Answer

Change the port type to 'spanning-tree port type network trunk'.

Question 9

Sequence the steps to configure a VXLAN with BGP EVPN on a Cisco Nexus switch.

Question 10

Sequence the steps for configuring OSPF on a Cisco Nexus switch in a data center fabric.