350-601 Practice Test 1 — 30 Questions

Question 1

A company is deploying FCoE in their data center. The design includes a Cisco Nexus 9000 switch with FEX modules. The storage team insists on using dedicated FCoE VLANs. Which best practice should be followed to ensure lossless behavior for FCoE traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable PFC on the switch for the FCoE VLAN. FCoE requires lossless transport to prevent frame drops that could corrupt Fibre Channel frames. Priority Flow Control (PFC), defined in IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured with a dedicated priority class that receives no-drop treatment. On Cisco Nexus 9000 switches, this is achieved by enabling PFC on the specific VLAN used for FCoE traffic, ensuring lossless behavior without affecting other traffic classes.

Answer

Configure traffic shaping on FCoE interfaces

Answer

Use the same VLAN for FCoE and IP traffic to reduce VLAN count

Answer

Disable flow control on all interfaces

Question 2

In a Cisco ACI fabric, which component is responsible for managing the policy repository, fault monitoring, and API endpoints?

Accepted Answer

APIC controller. The APIC (Application Policy Infrastructure Controller) is the centralized management and policy engine in Cisco ACI. It maintains the policy repository (the logical and physical policy model), aggregates faults and events from all fabric nodes, and exposes northbound REST API endpoints for automation and integration. Without the APIC, the fabric cannot enforce policies or provide a single point of management.

Answer

DCNM

Answer

Spine switch

Answer

Leaf switch

Question 3

An engineer is configuring vPC on a pair of Nexus switches. Which statement correctly describes the vPC peer-keepalive link?

Accepted Answer

It is a Layer 3 link used to verify the health of the vPC peer. The vPC peer-keepalive link is a Layer 3 link used exclusively to monitor the health of the vPC peer. It sends periodic keepalive messages (typically using UDP port 3200) to detect if the peer switch has failed, enabling the surviving switch to take over the vPC traffic. This link does not carry data traffic, BPDUs, or control-plane information beyond the keepalive probes.

Answer

It is used to forward data traffic between vPC peers

Answer

It must be a dedicated Layer 2 link between vPC peers

Answer

It carries BPDUs to prevent loops

Question 4

A data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?

Accepted Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit ip any any. ACLs are processed top-down, and the first match wins. The explicit permit for SSH from the jump host (10.10.1.100) must come before the deny for the entire 10.10.0.0/16 range to ensure the exception is honored. The final permit ip any any allows all other non-management traffic, which is necessary to avoid dropping legitimate traffic on the management interface.

Answer

permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22

Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255

Answer

deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any

Question 5

In an FCoE environment, which protocol is responsible for discovering and initializing FCoE-capable endpoints, including the exchange of MAC addresses and establishing virtual links?

Accepted Answer

FIP. FIP (FCoE Initialization Protocol) is the protocol defined in FC-BB-5 that discovers FCoE-capable endpoints (ENodes and FCFs), exchanges MAC addresses, and establishes virtual links between them. It performs the FCoE equivalent of fabric login before FCoE data traffic flows. FCoE itself is the encapsulation of Fibre Channel frames over Ethernet, not the discovery/initialization protocol.

Answer

ARP

Answer

DCBX

Answer

FCoE

Question 6

Refer to the exhibit. An engineer configured NX-API on a Nexus 9000 switch. The REST API client receives 'SSL_ERROR_BAD_CERT_DOMAIN'. What is the most likely cause?

Accepted Answer

The certificate does not match the switch's hostname. The SSL_ERROR_BAD_CERT_DOMAIN error indicates that the certificate presented by the Nexus 9000 switch does not match the hostname used in the REST API client's request. When NX-API uses HTTPS, the client validates the server's certificate against the requested domain; a mismatch triggers this error. This is a common TLS/SSL certificate validation issue, not a problem with HTTP conflicts, missing keys, or corrupted files.

Answer

HTTP is enabled which conflicts with HTTPS

Answer

The key file is missing

Answer

The certificate file is corrupted

Question 7

Which THREE are benefits of using Cisco UCS Manager to manage compute resources? (Choose three.)

Accepted Answer

Centralized management of multiple chassis. Cisco UCS Manager provides a single pane of glass for the entire UCS domain, so option A (Centralized management of multiple chassis) is correct because one UCS Manager instance can manage up to 20 chassis and hundreds of blades from a single interface. Option C (Policy-based provisioning to automate server deployment) is correct because UCS Manager uses service profiles and pools (UUID, MAC, WWN, BIOS, boot policy) to abstract hardware and automate consistent, repeatable server deployment. Option E (Unified fabric for LAN and SAN traffic) is correct because UCS Manager manages the fabric interconnects that carry both Ethernet LAN and Fibre Channel SAN traffic over a unified fabric (FCoE), reducing cabling and adapters. Option B is not a UCS Manager benefit because UCS Manager manages physical compute, network, and storage-access resources, not guest VMs, which are managed by hypervisors such as vCenter or Hyper-V. Option D is incorrect because UCS Manager does not improve performance by disabling hardware features; it enables features and applies BIOS/firmware policies, and disabling hardware would generally reduce capability rather than improve performance.

Answer

Direct management of virtual machines

Answer

Improved performance by disabling hardware features

Question 8

An organization requires disk encryption for data at rest in their UCS environment. Which technology should be used?

Accepted Answer

SED. Self-encrypting drives (SEDs) provide hardware-based encryption for data at rest.

Answer

AES-256 software encryption

Answer

FC-SP-2

Answer

SAN encryption

Question 9

A data center uses NPV to connect edge switches to a core Fibre Channel switch. The edge switches report that some servers cannot log in. What is a likely cause?

Accepted Answer

NPIV not enabled on the core switch. In an NPV environment, the edge switch (NPV mode) relies on the core Fibre Channel switch to handle fabric login (FLOGI) and name server registration. NPIV (N_Port ID Virtualization) must be enabled on the core switch to allow multiple N_Port IDs to be assigned to a single physical N_Port, which is essential for NPV to function. If NPIV is not enabled on the core, the core switch cannot accept FLOGI requests from the NPV edge switch, preventing servers from logging into the fabric.

Answer

Overlapping VSAN IDs between edge and core

Answer

F port binding on the edge switch

Answer

Trunking mode not enabled on the core switch

Question 10

A storage administrator wants to ensure that only designated initiators can access a specific target in a Fibre Channel SAN. Which mechanism enforces this policy?

Accepted Answer

Zoning. Zoning is the correct mechanism because it restricts Fibre Channel (FC) communication to only those initiators and targets that are members of the same zone. By defining a zone that includes only the designated initiator WWPNs and the target WWPN, the switch enforces access control at the fabric level, preventing any unauthorized device from discovering or communicating with the target.

Answer

IVR

Answer

Port channel

Answer

VSAN

Answer

Credit recovery

Question 11

An engineer is implementing CI/CD for network changes. Which tool is commonly used for version control of network configuration files and infrastructure code?

Accepted Answer

Git. Git is the industry-standard version control system used for managing infrastructure as code, including network configurations.

Answer

Docker

Answer

Jenkins

Answer

Ansible

Question 12

A data center has 100 Nexus switches in a fabric managed by Cisco Nexus Dashboard Orchestrator (NDO). The network team needs to automate the creation of a new network template that includes multiple VLANs and VRF configurations. They want to ensure that the template is applied consistently across all leaf switches without manual intervention. The engineer writes a Python script using the NDO REST API to create the template and deploy it. However, the deployment fails with an error 'Template validation failed: overlapping IP subnets'. Upon reviewing the template, the engineer notices that two VLANs have overlapping subnet definitions. Which action should the engineer take to resolve this issue efficiently?

Accepted Answer

Manually correct the overlapping subnets in the template and re-run the deployment script. The root cause of the deployment failure is overlapping IP subnets in the template definition. Manually correcting the overlapping subnets in the template and re-running the deployment script directly resolves the validation error without introducing unnecessary complexity or risk. This approach ensures the template is valid before deployment, maintaining consistency across all leaf switches.

Answer

Use the NDO GUI to edit the template and then re-run the script

Answer

Create separate templates for each VLAN to avoid overlaps

Answer

Modify the Python script to ignore validation errors and force the deployment

Question 13

In the context of Ansible automation for Cisco Nexus switches, which module can be used to manage VLAN configurations?

Accepted Answer

nxos_vlan. The cisco.nxos collection includes the nxos_vlan module specifically for managing VLANs on NX-OS devices.

Answer

nxos_interface

Answer

nxos_bgp

Answer

nxos_config

Question 14

A data center deployment uses NPV mode on a Cisco MDS switch to connect to a core Fibre Channel switch. After configuration, the NPV switch does not register with the core. What is the most likely cause?

Accepted Answer

NPIV is not enabled on the core switch.. NPV (N_Port Virtualization) mode requires NPIV (N_Port ID Virtualization) to be enabled on the core Fibre Channel switch. NPIV allows a single physical N_Port to register multiple FCIDs (Fibre Channel IDs) for multiple virtual initiators behind the NPV switch. Without NPIV on the core, the NPV switch cannot complete the FLOGI (Fabric Login) process and will not register with the fabric.

Answer

Fibre Channel ports are in trunk mode.

Answer

The core switch has NPV mode enabled.

Answer

The NPV switch has an incorrect domain ID.

Question 15

An administrator needs to configure a Fibre Channel SAN to support two separate departments that must not see each other's storage. Each department has its own set of initiators and targets. Which technology should be used?

Accepted Answer

VSANs (Virtual SANs). VSANs (Virtual SANs) provide isolation within a single Fibre Channel fabric by partitioning the physical SAN into multiple logical SANs. Each department's initiators and targets are placed in separate VSANs, ensuring they cannot see each other's storage traffic or devices, which meets the requirement for complete separation without additional physical hardware.

Answer

Port channels

Answer

NPV

Answer

IVR (Inter-VSAN Routing)

Question 16

Ansible playbook that deploys VLANs on NX-OS fails on a particular switch with 'privilege escalation required'. What should be checked first?

Accepted Answer

The 'ansible_become_password' or 'enable' password in the playbook. The error 'privilege escalation required' indicates that Ansible cannot execute commands with the necessary elevated privileges on the NX-OS switch. In Ansible, privilege escalation is handled via the 'become' mechanism, and for network devices like NX-OS, the 'ansible_become_password' (or 'enable' password) is required to enter privileged EXEC mode. Without this password, Ansible remains in user EXEC mode, which lacks the authority to apply VLAN configurations.

Answer

The 'host_key_checking' setting

Answer

The 'ansible_user' variable

Answer

The inventory file syntax

Question 17

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 18

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.

Answer

RADIUS

Answer

LDAP

Answer

SSH

Question 19

What is the purpose of the vPC peer keepalive link in a vPC domain?

Accepted Answer

To provide a keepalive mechanism to detect peer failure. The vPC peer keepalive link is a dedicated Layer 3 link used to detect a failure of the vPC peer switch. It sends periodic UDP-based keepalive messages (default every second) to ensure the peer is still operational, allowing the surviving switch to take over the vPC forwarding role. This mechanism is critical for preventing dual-active scenarios where both switches would incorrectly forward traffic for the same vPC VLAN.

Answer

To synchronize MAC address tables

Answer

To carry BPDUs for STP

Answer

To forward data traffic between vPC peers

Question 20

A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer must configure the underlay to support load balancing of VXLAN traffic across multiple equal-cost paths. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Enable the use of the source UDP port for hashing by configuring the load-balancing algorithm to include Layer 4 information.. To load-balance VXLAN traffic across multiple equal-cost paths, the underlay must have multiple equal-cost routes installed in the routing table, and the switch must hash traffic using fields that vary per flow. Including Layer 4 information, especially the source UDP port, provides the necessary entropy. The routing protocol must support ECMP and be configured to install multiple paths. Together, these actions enable effective distribution of VXLAN traffic.

Answer

Configure the underlay routing protocol to advertise the VTEP loopback with the same cost on all spines.

Answer

Configure the load-balancing algorithm to use the source and destination IP addresses only.

Answer

Enable jumbo frames on all interfaces in the underlay to accommodate the VXLAN encapsulation overhead.