350-601 Practice Test 31 — 15 Questions

Question 1

Which management interface is used for out-of-band management of UCS C-Series rack servers, providing features like KVM, virtual media, and remote firmware upgrade?

Accepted Answer

CIMC. Cisco Integrated Management Controller (CIMC) is the out-of-band management interface built into UCS C-Series rack servers, providing KVM, virtual media, and remote firmware upgrade capabilities independent of the host OS. It is accessed via a dedicated management port and is the correct answer for out-of-band management of C-Series.

Answer

Cisco IMC Supervisor

Answer

UCS Central

Answer

UCS Manager

Question 2

Which statement accurately describes the APIC REST API?

Accepted Answer

It uses JSON over HTTPS and interacts with the MIT.. The Cisco APIC REST API uses JSON (or XML) payloads transported over HTTPS and interacts with the Management Information Tree (MIT), which is the hierarchical object model that stores all managed objects in ACI. Configuration and monitoring are both performed by reading/writing MIT objects via REST calls, making JSON-over-HTTPS-to-MIT the accurate description.

Answer

It uses XML over SSH for communication.

Answer

It is only used for monitoring, not configuration.

Answer

It requires the use of the Cobra SDK.

Question 3

In a VXLAN environment, what is the function of a VTEP?

Accepted Answer

It encapsulates and decapsulates VXLAN packets. A VTEP (VXLAN Tunnel Endpoint) is the device that performs VXLAN encapsulation and decapsulation. It takes an original Layer 2 frame, adds a VXLAN header (with a VNI to identify the tenant segment), a UDP header (port 4789), and an outer IP/Ethernet header, then sends the packet over the underlay network. On the receiving side, the VTEP strips these headers and forwards the original frame to the destination host. This encapsulation/decapsulation function is the core purpose of a VTEP in a VXLAN environment.

Answer

It manages the VXLAN multicast groups

Answer

It acts as a DHCP server for tenant VMs

Answer

It provides Layer 3 routing between VXLAN segments

Question 4

A DevOps team wants to apply Infrastructure as Code principles to manage their data center network. Which tool is best suited for declaratively managing ACI configurations using Terraform?

Accepted Answer

Terraform with terraform-provider-aci. Terraform uses the terraform-provider-aci to declaratively manage ACI objects like tenants, APs, EPGs, etc.

Answer

Cobra SDK

Answer

Python acitoolkit

Answer

Ansible with cisco.nxos collection

Question 5

In ACI, which construct defines the set of endpoints that can communicate based on contracts?

Accepted Answer

EPG. In Cisco ACI, an Endpoint Group (EPG) is the logical grouping of endpoints (such as servers, VMs, or storage) that share the same policy requirements. Contracts define the rules for communication between EPGs, specifying which EPGs can talk to each other and what services (e.g., HTTP, SSH) are allowed. Thus, the EPG construct directly defines the set of endpoints that can communicate based on contracts.

Answer

VRF

Answer

Bridge Domain

Answer

Tenant

Question 6

A network engineer is automating a repetitive configuration task on a Nexus 9000 switch using Python scripts with NX-API. The script sends a CLI command via POST request but receives HTTP 400 status with error 'Invalid request payload'. What is the most likely cause?

Accepted Answer

The JSON payload does not include the required 'ins_api' wrapper with version and type fields.. NX-API requires a specific JSON structure for CLI commands: the payload must be wrapped in an 'ins_api' object containing 'version', 'type' (e.g., 'cli_show' or 'cli_conf'), 'chunk', 'sid', 'input', and 'output_format' fields. If the wrapper is missing or malformed, the switch returns HTTP 400 with 'Invalid request payload'. Adding the correct ins_api wrapper resolves the error.

Answer

The switch is running an unsupported NX-OS version.

Answer

The script is using HTTP instead of HTTPS.

Answer

The CLI command syntax is incorrect with too many spaces.

Question 7

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

Accepted Answer

The underlay network provides IP connectivity between VTEPs. The VXLAN underlay network (typically an IP-based fabric using protocols like OSPF or IS-IS) provides IP connectivity between VTEPs, enabling them to encapsulate and decapsulate VXLAN packets. Without this underlay reachability, VTEPs cannot communicate, making it a foundational requirement for VXLAN operation.

Answer

VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

Answer

VXLAN uses a 32-bit network identifier (VNI)

Answer

The control plane is responsible for actual data forwarding

Question 8

When using Cisco NSO (Network Services Orchestrator) to automate service creation across a data center network, what is a key consideration regarding device compatibility?

Accepted Answer

Each device must have a corresponding NED that matches its OS version.. B is correct because Cisco NSO uses Network Element Drivers (NEDs) to translate service models into device-specific CLI, SNMP, or NETCONF commands. Each NED is tied to a specific device OS version (e.g., IOS-XE 16.12, NX-OS 9.3), so mismatched NEDs cause configuration failures or incomplete deployments. Without a compatible NED, NSO cannot communicate with or configure the device.

Answer

NSO requires NETCONF for all devices.

Answer

Device YANG models must be hand-coded by the team.

Answer

NSO only supports Cisco devices.

Question 9

Which control plane protection mechanism should be configured to limit the rate of BGP updates destined to the CPU of a Nexus 9000 switch to prevent CPU overload?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is the correct mechanism because it directly filters and rate-limits control plane traffic, such as BGP updates, before it reaches the CPU of a Nexus 9000 switch. By applying a CoPP policy, you can protect the CPU from being overwhelmed by excessive BGP updates, ensuring stability and preventing denial-of-service conditions.

Answer

VLAN Access Control Lists (VACLs)

Answer

EtherChannel load balancing

Answer

Switched Port Analyzer (SPAN)

Question 10

When configuring a UCS service profile for a blade server that needs to boot from the local disk, which boot order setting is appropriate?

Accepted Answer

Set the boot order to local disk first, with no other boot devices.. When a blade server must boot from its local disk, the service profile's boot order should place local disk (or 'Local Disk' / 'Embedded Local Disk') as the first and only boot device. This ensures the blade uses its installed OS on local storage and does not waste time attempting PXE, SAN, or virtual media boot.

Answer

Enable PXE boot only.

Answer

Configure boot from CD/DVD as first device.

Answer

Set the boot order to SAN first, then local disk.

Question 11

A network engineer is configuring DHCP snooping on a Cisco Nexus 9000 switch to prevent rogue DHCP server attacks. The switch connects to the legitimate DHCP server on Ethernet 1/1. Clients are connected to ports Ethernet 1/2 through 1/24. The engineer enables DHCP snooping globally and on VLAN 10, but clients are unable to obtain IP addresses from the DHCP server. Other connectivity between clients and the server works (e.g., static IPs). What is the most likely cause and solution?

Accepted Answer

Ethernet 1/1 is untrusted by default. Configure it as trusted with 'ip dhcp snooping trust' and verify DHCP snooping is enabled on VLAN 10.. By default, all interfaces on a Cisco Nexus 9000 switch are untrusted for DHCP snooping. The legitimate DHCP server is connected to Ethernet 1/1, which must be explicitly configured as trusted using the 'ip dhcp snooping trust' interface command. Without this, the switch discards DHCP server messages (OFFER, ACK) received on that port, preventing clients from obtaining IP addresses even though DHCP snooping is enabled globally and on VLAN 10.

Answer

Disable DHCP snooping as it is not needed in this topology.

Answer

Configure a static DHCP binding for each client on the switch.

Answer

Add 'ip dhcp snooping information option' on Ethernet 1/1 to allow DHCP option 82.

Question 12

A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?

Accepted Answer

Configure the port connected to the DHCP server as trusted. Configuring the port connected to the DHCP server as trusted is a best practice because DHCP snooping treats all ports as untrusted by default. Only trusted ports are allowed to forward DHCP server messages (OFFER, ACK, NAK), preventing rogue DHCP server attacks. This ensures that only the legitimate DHCP server can assign IP addresses, maintaining network integrity.

Answer

Disable DHCP snooping on the DHCP server VLAN

Answer

Set the DHCP server IP address in the binding database

Answer

Enable DHCP snooping on all VLANs

Question 13

In a Cisco ACI fabric, which component is responsible for policy enforcement and management of the entire infrastructure?

Accepted Answer

APIC controller. The APIC (Application Policy Infrastructure Controller) is the central policy and management entity in Cisco ACI. It enforces the application-centric policy model, manages the fabric's operational state, and provides the single point of configuration and monitoring for the entire ACI fabric. Without the APIC, the leaf and spine switches operate as standalone devices with no centralized policy enforcement.

Answer

Leaf switch

Answer

DCNM

Answer

Spine switch

Question 14

A data center uses FCoE on Nexus 9000 switches. The storage team reports inconsistent performance during peak times. Queuing drops are seen on the FCoE-enabled interfaces. Which QoS configuration change would best address the issue?

Accepted Answer

Ensure sufficient buffer allocation for the no-drop class. In FCoE networks, lossless behavior is required for storage traffic, which is enforced by priority flow control (PFC) on the no-drop class. Queuing drops on FCoE-enabled interfaces indicate that the no-drop class is experiencing buffer exhaustion under congestion. Increasing buffer allocation for the no-drop class ensures that FCoE frames are not dropped, maintaining the lossless fabric required by Fibre Channel over Ethernet.

Answer

Enable WRED on the FCoE class

Answer

Increase MTU on the FCoE VLAN

Answer

Increase the number of pause frames on the no-drop class

Question 15

In a Cisco MDS switch, what is the effect of the command 'fcdomain restart vsan 100'?

Accepted Answer

It causes a fabric reconfiguration, which may disrupt traffic.. The 'fcdomain restart vsan 100' command triggers a fabric reconfiguration (RCF) on VSAN 100. This process resets the principal switch selection and domain ID distribution, causing all switches in the VSAN to renegotiate their roles and domain IDs, which disrupts existing Fibre Channel traffic during the reconfiguration.

Answer

It enables NPV mode on VSAN 100.

Answer

It clears the zone configuration for VSAN 100.

Answer

It reboots the switch.