350-601 Practice Test 31 — 15 Questions

Question 1

Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?

Accepted Answer

The DHCP server port is trusted for all VLANs. Option C is correct because when a DHCP server is connected to a switch port and clients in different VLANs (like VLAN 10) obtain IP addresses, the switch must trust the DHCP server port for all VLANs. This is typically achieved by configuring the port as a DHCP snooping trusted port or by using an IP helper address on the VLAN interface. Without trust, DHCP snooping would drop server responses on untrusted ports, preventing the client from obtaining an address.

Answer

The DHCP server is in VLAN 20

Answer

The DHCP client is using a static IP address

Answer

The DHCP client MAC address is not verified

Question 2

An organization uses VXLAN EVPN for network segmentation. Which component provides per-tenant isolation of control plane traffic?

Accepted Answer

VRF. In VXLAN EVPN, per-tenant isolation of control plane traffic is achieved through the use of VRFs (Virtual Routing and Forwarding instances). Each tenant is assigned a unique VRF, which maintains its own separate routing table and forwarding decisions, ensuring that control plane information (such as MAC/IP routes advertised via MP-BGP EVPN) is isolated between tenants. This is distinct from data plane isolation, which is provided by VXLAN Network Identifiers (VNIs).

Answer

VLAN

Answer

VNI

Answer

VXLAN tunnel

Question 3

A Nexus switch experiences high CPU utilization due to excessive ICMP traffic. An engineer applies a CoPP policy that includes a class matching ICMP with a drop action. After applying, legitimate OSPF hello packets are also being dropped. What is the most likely cause?

Accepted Answer

OSPF packets match the default class which has a drop action. Option C is correct because when a CoPP policy is applied, traffic that does not match any explicit class-map falls into the default class. If the default class has a drop action, all unmatched traffic—including OSPF hello packets (which use IP protocol 89)—will be dropped. The class-map matching ICMP (typically based on protocol or DSCP) does not match OSPF, so OSPF packets are handled by the default class, causing the observed behavior.

Answer

The CoPP policy is applied to the wrong interface

Answer

The CoPP policy rate-limits all traffic including OSPF below its needed rate

Answer

The class-map matches multiple protocols including OSPF

Question 4

A company uses Cisco ISE for 802.1X authentication on data center edge switches. After a recent upgrade, some endpoints that previously authenticated successfully now fail. The ISE logs show the endpoint is in the wrong authorization profile. What is the most likely cause?

Accepted Answer

The endpoint posture assessment is failing. Option C is correct because a failing posture assessment can cause ISE to apply a different authorization profile (e.g., a quarantine or remediation profile) instead of the expected one, even though the endpoint previously authenticated successfully. Posture checks occur after 802.1X authentication and can change the authorization result based on endpoint compliance, which aligns with the symptom of the endpoint being in the wrong profile after an upgrade.

Answer

The switch port is in multi-authentication mode

Answer

The switch has incorrect RADIUS shared secret

Answer

The ISE policy is using a different identity source

Question 5

Which three actions can be taken when a port security violation occurs? (Choose three.)

Accepted Answer

Shutdown. When a port security violation occurs, the switch can be configured to take one of three actions: shutdown, restrict, or protect. The shutdown action (A) immediately disables the port and places it in an errdisable state, which is the default behavior. This is correct because it provides the most secure response by completely blocking traffic from the violating MAC address.

Answer

Errdisable recovery

Answer

Log

Question 6

Refer to the exhibit. A web server in VLAN 10 with IP 10.0.0.5 is experiencing connectivity issues. Clients from subnet 10.0.0.0/24 can access the server, but clients from other subnets cannot. What is the most likely cause?

Accepted Answer

The ACL denies all traffic from other subnets. The exhibit shows an ACL applied to the VLAN 10 SVI that permits HTTP traffic only from the 10.0.0.0/24 subnet. Since clients from other subnets are denied, the ACL is explicitly blocking all traffic from those subnets, which matches option C. This is the most likely cause because the server is reachable from the local subnet but not from elsewhere, indicating a filtering issue rather than a routing or gateway problem.

Answer

The ACL is missing a permit for return traffic

Answer

The server's default gateway is incorrect

Answer

The ACL permits HTTP only from the local subnet

Question 7

In a private VLAN configuration, a host in a community VLAN needs to communicate with a host in the primary VLAN. What configuration is required on the switch?

Accepted Answer

The host in primary VLAN must be on a promiscuous port. In a private VLAN configuration, a host in a community VLAN can communicate with a host in the primary VLAN only if the host in the primary VLAN is on a promiscuous port. The promiscuous port can communicate with all other ports in the private VLAN, including community and isolated ports, enabling inter-VLAN traffic through a Layer 3 gateway or a server connected to that port.

Answer

The host in community VLAN must be on an isolated port

Answer

The host in community VLAN must be on a promiscuous port

Answer

The host in primary VLAN must be on a community port

Question 8

Refer to the exhibit. A client connected to Ethernet1/2 cannot obtain an IP address via DHCP. What is the most likely cause?

Accepted Answer

The DHCP snooping trust configuration is missing on the server port. The client cannot obtain an IP address via DHCP because the DHCP server port (Ethernet1/1) is not configured as a DHCP snooping trusted port. By default, all ports are untrusted, and DHCP snooping drops all DHCP server responses (OFFER, ACK) received on untrusted ports. Configuring the port connecting to the DHCP server as trusted is required to allow these messages to reach the client.

Answer

The DHCP snooping information option is disabled

Answer

The DHCP server is on a different VLAN

Answer

IP source guard is enabled on the client port

Question 9

A Cisco ACI fabric has contracts configured to allow traffic between two EPGs. After deployment, traffic between endpoints in these EPGs is being dropped, but contract statistics show no packets have been permitted. The administrator checks the contract configuration and it looks correct. What is the most likely cause?

Accepted Answer

The contract is configured only on the provider EPG, but the consumer EPG is not consuming the contract.. The most likely cause is that the contract is configured on the provider EPG but the consumer EPG is not configured to consume it. In Cisco ACI, a contract must be explicitly provided by one EPG and consumed by another for traffic to be permitted. If the consumer EPG does not have the contract applied, the contract will not be enforced, and traffic will be dropped even if the contract configuration appears correct. The contract statistics showing no permitted packets confirm that the contract is not being applied to the traffic flow.

Answer

The contract is applied to the wrong VRF.

Answer

The filter direction is set to both, but the contract is using an incorrect filter.

Answer

The endpoints are in different VMM domains.

Question 10

Refer to the exhibit. Two Nexus switches are connected via Ethernet1/1. MKA does not initiate. What is the issue?

Accepted Answer

The policy is not applied to the interface. The exhibit shows that the MACsec policy is defined but not applied to interface Ethernet1/1. Without applying the policy using the `macsec policy` command under the interface configuration, MKA (MACsec Key Agreement) cannot initiate because the switch does not know which security policy to enforce on that link.

Answer

The interface is not administratively up

Answer

The cipher-suite is not supported

Answer

The MACsec key chain is missing

Question 11

In an ACI fabric, an EPG is configured with a contract that allows HTTP traffic to an external network. The external network is reachable via a Layer 3 Outside. However, HTTP traffic from the EPG fails. What is the most likely cause?

Accepted Answer

The L3Out and the EPG are in different VRFs. Option B is correct because in Cisco ACI, communication between an EPG and an external network via a Layer 3 Outside requires both to be in the same VRF. If the EPG and the L3Out are in different VRFs, the contract cannot be enforced, and traffic will fail even if the contract allows HTTP. The VRF provides the routing and policy enforcement boundary for the contract.

Answer

The subject action is set to deny

Answer

The filter uses the wrong direction

Answer

The contract is applied to the consumer EPG instead of the provider

Question 12

A Nexus 7000 switch is experiencing high CPU utilization due to control plane traffic. The engineer notices that many packets are being punted to the CPU from the data plane, particularly ARP packets. After examining the CoPP configuration, the engineer sees that the 'arp' class-map is matched in a policy-map with a police rate of 1000 pps and a conform-action of 'transmit'. The current ARP rate is 2000 pps. What is the immediate impact?

Accepted Answer

Approximately half of the ARP packets are dropped, reducing CPU load but potentially causing reachability issues.. The CoPP policy is configured with a police rate of 1000 pps for ARP packets, but the current ARP rate is 2000 pps. Since the rate exceeds the policer, the conform-action 'transmit' only applies to packets within the rate; excess packets are dropped by default (drop action is implicit when no exceed-action is specified). This results in approximately half of the ARP packets being dropped, which reduces CPU load but can cause ARP resolution failures and reachability issues.

Answer

All ARP packets are transmitted normally because the conform-action is 'transmit'.

Answer

The switch applies an ACL to drop all ARP packets.

Answer

Packets are marked down and transmitted.

Question 13

A VACL is configured to capture traffic between hosts in the same VLAN. The capture port is configured and the VACL is applied to the VLAN. However, no traffic is being captured. What is a likely reason?

Accepted Answer

The VACL does not have a capture action. Option C is correct because a VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.

Answer

The VACL is applied in the wrong direction

Answer

The capture port is a SPAN destination port

Answer

The capture port is not in the same VLAN

Question 14

An engineer is troubleshooting a DHCP issue in a data center VLAN. Clients are unable to obtain IP addresses from the DHCP server. The switch has DHCP snooping enabled on the VLAN, and the DHCP server is connected to a trusted port. The clients are on untrusted ports. Which additional security feature is most likely causing the problem if the DHCP server is on a different subnet and the switch is not configured as a DHCP relay?

Accepted Answer

DHCP snooping with no IP helper address configured. When the DHCP server resides on a different subnet and the switch lacks an IP helper address (ip helper-address) configuration, DHCP snooping will not forward the DHCP broadcast from the client to the server. DHCP snooping relies on the switch to relay DHCP packets across subnets; without the helper address, the broadcast is dropped at the VLAN interface, preventing clients from obtaining IP addresses.

Answer

Dynamic ARP Inspection (DAI)

Answer

Control Plane Policing (CoPP) dropping DHCP packets

Answer

Port security with maximum MAC limit

Question 15

A network administrator implements the ACL shown. After verifying the ACL statistics, all counters show 0 matches. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface.. Option B is correct because if the ACL is applied to the wrong interface, traffic never traverses that interface, so the ACL counters remain at 0. ACLs must be applied to the interface where traffic enters (inbound) or exits (outbound) the device; applying to an interface that does not carry the relevant traffic results in no matches.

Answer

The ACL entries are in the wrong order.

Answer

The 'permit ip any any' entry causes all traffic to be permitted before inspection.

Answer

The ACL is applied outbound instead of inbound.

350-601 Practice Test 31 — 15 Questions

Exhibit

350-601 Practice Test 31 — 15 Questions

Exhibit