350-601 Practice Test 30 — 15 Questions

Question 1

An engineer is configuring OSPF on a Nexus 9000 switch in a data center spine-leaf topology. Which OSPF network type is most appropriate on the point-to-point links between leaf and spine switches to ensure fast convergence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

point-to-point. In a spine-leaf topology, the links between leaf and spine switches are typically point-to-point, even if they are Ethernet interfaces. Configuring the OSPF network type as point-to-point on these links eliminates the need for a Designated Router (DR) and Backup Designated Router (BDR) election, which reduces OSPF adjacency formation time and ensures faster convergence. This network type also allows OSPF to use multicast hello packets (224.0.0.5) without the overhead of a DR/BDR election, making it the most appropriate choice for fast convergence.

Answer

broadcast

Answer

point-to-multipoint

Answer

non-broadcast

Question 2

Refer to the exhibit. A UCS manager profile is configured with two vNICs on separate fabrics. The server is failing to communicate with the default gateway on VLAN 100. Both vNICs are up. What is the most likely issue?

Accepted Answer

The VLAN 100 is not defined on the fabric interconnects. The most likely issue is that VLAN 100 is not defined on the fabric interconnects. In UCS Manager, even if the vNICs are up and the MAC pool is available, the server cannot communicate with the default gateway if the VLAN is not present on the fabric interconnect's VLAN database. The fabric interconnect must have VLAN 100 created and assigned to the appropriate uplink ports or port-channels for traffic to be forwarded.

Answer

The MAC pool is exhausted

Answer

The boot policy is missing

Answer

The server is using active-standby NIC teaming and the active vNIC is on a fabric that does not have the VLAN

Question 3

A Cisco ACI fabric administrator wants to implement microsegmentation using Cisco Group-Based Policy (GBP) in a network that hosts virtual machines and bare-metal servers. Which component must be used to enforce microsegmentation policies for bare-metal servers?

Accepted Answer

Leaf switch. In Cisco ACI, microsegmentation for bare-metal servers is enforced at the leaf switch using Cisco Group-Based Policy (GBP). Unlike virtual machines that rely on a virtual switch (e.g., Cisco AVS) to apply policies, bare-metal servers connect directly to the leaf switch via physical interfaces. The leaf switch uses the opflex protocol to receive policy definitions from the APIC and applies them at the port level, enabling microsegmentation without requiring a hypervisor or virtual switch.

Answer

Application Policy Infrastructure Controller (APIC)

Answer

Virtual Switch (e.g., Cisco AVS)

Answer

External firewall appliance

Question 4

A Nexus 9000 switch is configured with VPC. The VPC keepalive link fails. What is the effect on the VPC domain?

Accepted Answer

The secondary switch suspends its VPC member ports.. In a VPC domain, the keepalive link is used to monitor the liveness of the peer switch, but it does not carry data traffic. When the keepalive link fails, the secondary switch cannot confirm the primary is alive, so it suspends its VPC member ports to prevent a dual-active scenario. The primary switch remains active and continues forwarding traffic normally because it assumes the secondary has failed.

Answer

Both switches suspend the VPC VLANs.

Answer

Both switches continue to forward traffic normally.

Answer

The primary switch becomes orphan.

Question 5

A large financial institution has recently migrated its data center network to a new Cisco ACI fabric. The operations team is tasked with automating the provisioning of new application tenants, including EPGs, contracts, and bridge domains, using the APIC REST API. They have developed a comprehensive set of Python scripts that successfully performed these actions in their lab environment. However, when deploying the scripts to production, they receive an 'SSL: CERTIFICATE_VERIFY_FAILED' error from the requests library. The production APIC cluster uses a self-signed certificate for HTTPS, and the corporate security policy strictly prohibits the use of HTTP or disabling certificate verification. Additionally, the policy does not allow replacing the self-signed certificate with a CA-signed one without a lengthy approval process that could delay the automation project. The team needs an immediate solution that maintains security best practices. What should the team do?

Accepted Answer

Add the self-signed certificate to the Python trust store by using the cert file in the verify parameter.. The Python requests library allows you to pass a self-signed certificate file via the `verify` parameter, which adds that certificate to the trusted store for that session. This satisfies the security policy by maintaining HTTPS encryption and certificate verification without disabling SSL checks or requiring a CA-signed certificate. The team can export the APIC's self-signed certificate (e.g., from the APIC GUI or CLI) and use it in their scripts as `requests.get(url, verify='/path/to/cert.pem')`.

Answer

Use HTTP instead of HTTPS for the API calls.

Answer

Disable SSL certificate verification in the Python requests by setting verify=False.

Answer

Request an exception to the security policy to allow a CA-signed certificate.

Question 6

Refer to the exhibit. A UCS administrator applies a service profile with this boot policy to a blade. The blade boots from the SAN LUN successfully. However, after a reboot due to a firmware update, the blade boots from the local disk instead of the SAN. What is the most likely reason?

Accepted Answer

The boot order has local disk before the SAN target.. The most likely reason is that the boot order in the service profile's boot policy lists the local disk before the SAN target. After a firmware update, the UCS Manager re-evaluates the boot policy, and if the local disk is present and has a higher priority, the blade will boot from it instead of the SAN LUN. The initial successful boot from SAN occurred because the local disk was not present at that time, but after the reboot, the local disk became available and took precedence.

Answer

The WWPN of the SAN target is incorrect.

Answer

The SAN target LUN ID changed after the firmware update.

Answer

The local disk was not present at initial association.

Question 7

Which TWO statements about Fibre Channel zoning are correct? (Choose two.)

Accepted Answer

Zoning can be used to prevent unauthorized access to storage targets.. Fibre Channel zoning restricts which initiators can communicate with which targets, effectively preventing unauthorized access to storage LUNs. By defining zone members (via WWN or port ID), the fabric enforces these access controls at the switch level, ensuring that only devices within the same zone can exchange Fibre Channel frames.

Answer

Zoning is required to increase the distance between a host and storage.

Answer

Zoning can only be applied within a single VSAN.

Answer

Zoning is used to load balance traffic across multiple paths.

Question 8

In a spine-leaf architecture using eBGP as the routing protocol, what is the primary purpose of using eBGP rather than iBGP between spine and leaf switches?

Accepted Answer

To avoid the need for an IGP and simplify configuration. In a spine-leaf architecture using eBGP, the primary purpose is to avoid the need for an IGP (such as OSPF or IS-IS) and simplify configuration. eBGP between spine and leaf switches allows each leaf to be in a different private AS (e.g., 65001–650XX), and the spine can use the BGP AS_PATH to detect and prevent loops without requiring an underlying IGP. This eliminates the complexity of running a separate IGP for underlay routing, reducing operational overhead and configuration steps.

Answer

To enable faster convergence than OSPF

Answer

To support EVPN address families

Answer

To allow for unequal-cost load balancing

Question 9

A UCS B-series blade is configured to boot from SAN using a vHBA that connects to a Fibre Channel SAN. The storage administrator reports that the LUN is not being presented to the blade. Which component in the UCS domain is responsible for mapping the vHBA WWPN to the physical Fibre Channel interface?

Accepted Answer

Fabric Interconnect. In UCS, the Fabric Interconnect (FI) acts as a Fibre Channel forwarder (FCF) or NPV switch. The vHBA's WWPN is assigned by UCS Manager and the FI maps it to the appropriate uplink Fibre Channel interface. The UCS Manager itself configures this mapping, but the actual mapping occurs on the FI.

Answer

IOM (FEX)

Answer

CIMC

Answer

UCS Manager

Question 10

In a UCS domain, fabric interconnects are deployed in an end-host mode. What is a characteristic of this mode?

Accepted Answer

The FI uses N-Port Virtualization (NPV) to reduce the number of uplinks needed. End-host mode (also called N-Port Virtualization) allows the FI to act as a switch that presents server vNICs as if they were directly connected to the upstream network, simplifying VLAN/VXLAN configurations.

Answer

The FI must be configured with Spanning Tree Protocol

Answer

The FI supports only Fibre Channel traffic

Answer

The FI operates as a standard Layer 2 switch

Question 11

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

Accepted Answer

The script uses strict type checking, and the values are returned as strings instead of integers.. The NX-API returns all values as strings in JSON output, including numeric fields like VLAN IDs. If the script uses strict type checking (e.g., `===` in Python or JavaScript), comparing the string '100' to the integer 100 will fail, even though the interface is correctly configured in access mode with VLAN 100. This is a common pitfall when parsing NX-API responses without explicit type conversion.

Answer

The JSON output is malformed and cannot be parsed.

Answer

The interface is administratively down.

Answer

The JSON output is missing the 'switchportMode' field.

Question 12

An engineer is troubleshooting high CPU utilization on a Nexus 7700 switch. The output of 'show process cpu' shows high usage from the 'netstack' process. Which action should the engineer take to identify the cause?

Accepted Answer

Use 'show system internal netstack stats'.. The 'netstack' process handles network stack operations, including packet processing and forwarding. The 'show system internal netstack stats' command provides detailed internal statistics about the netstack process, such as packet drops, buffer usage, and error counters, which help pinpoint the root cause of high CPU utilization.

Answer

Enable 'feature netstack' to get more details.

Answer

Reboot the switch to clear the process.

Answer

Check for broadcast storms using 'show interface'.

Question 13

A storage administrator is configuring a new storage array that supports thin provisioning. The array reports 10 TB of physical storage and 50 TB of thin-provisioned logical capacity. Which risk is most important to monitor to avoid out-of-space conditions?

Accepted Answer

The rate of physical capacity consumption and remaining free space. Thin provisioning overcommits physical storage; monitoring actual physical usage and growth rate is critical to prevent running out of space.

Answer

High latency on the Fibre Channel links

Answer

The number of snapshots taken

Answer

The replication status

Question 14

An engineer is troubleshooting a UCS B-Series server that fails to boot from SAN. The SAN boot LUN is correctly zoned and presented. The service profile has WWPNs configured. What is a likely cause?

Accepted Answer

Incorrect boot policy order. The SAN boot LUN is correctly zoned and presented, and the WWPNs are configured in the service profile, so the connectivity and identity are set. However, if the boot policy order is incorrect (e.g., the SAN boot target is listed after a local disk or another boot device), the server will attempt to boot from the wrong device first and fail to boot from the SAN. The boot policy defines the sequence of boot devices, and a misconfigured order is a common cause of boot failures in UCS B-Series.

Answer

Server firmware mismatch

Answer

Missing vNIC template

Answer

VLAN mismatch

Question 15

Which TWO statements about Cisco NX-API are correct? (Choose two.)

Accepted Answer

NX-API uses HTTP/HTTPS as the transport protocol.. Cisco NX-API is a programmatic interface that uses HTTP/HTTPS as the transport protocol, allowing RESTful API calls to configure and monitor Nexus switches. It supports both XML and JSON output formats, enabling flexible data parsing in automation scripts. This makes options C and E correct.

Answer

NX-API uses SSH for transport.

Answer

NX-API only supports GET requests.

Answer

NX-API is only available on Nexus 3000 series switches.