350-601 Practice Test 32 — 15 Questions

Question 1

An iSCSI SAN is experiencing performance issues. The storage array and initiators are connected via a dedicated VLAN. The network team notices high jitter. What is the most effective mitigation?

Accepted Answer

Implement QoS to give iSCSI traffic higher priority. High jitter indicates variable latency in the network, which is detrimental to iSCSI performance because iSCSI relies on TCP and is sensitive to delay variation. Implementing QoS to prioritize iSCSI traffic ensures consistent low-latency delivery by marking iSCSI frames (e.g., with DSCP CS4 or AF41) and queuing them ahead of other traffic, directly mitigating jitter. This is the most effective mitigation because it addresses the root cause—uncontrolled network congestion—rather than increasing parallelism or frame size.

Answer

Use multiple iSCSI sessions per initiator

Answer

Configure link aggregation between switches

Answer

Enable jumbo frames on all switches

Question 2

Which THREE statements accurately describe FCIP (Fibre Channel over IP) configurations on Cisco MDS switches?

Accepted Answer

FCIP uses VE_port (Virtual E_port) interfaces to connect to the FC fabric. FCIP encapsulates Fibre Channel frames into IP packets and uses VE_ports (Virtual E_ports) to connect separate FC fabrics over an IP network. VE_ports behave like standard E_ports but operate over an FCIP tunnel, allowing Fibre Channel fabric services to extend across the IP link.

Answer

FCIP requires IPsec for security over public networks

Answer

FCIP compression reduces the latency of the IP transport

Question 3

A network administrator must enforce security policies for east-west traffic in a Cisco TrustSec-enabled data center without using IP-based ACLs. Which technology should be used?

Accepted Answer

SGACL. SGACLs (Security Group ACLs) are the policy enforcement mechanism within Cisco TrustSec, applying role-based access control to east-west traffic based on Security Group Tags (SGTs) rather than IP addresses. They are pushed to network devices via Cisco ISE and enforced at the egress point of the source's security group, allowing scalable segmentation without IP-based ACL sprawl. This directly satisfies the requirement to enforce security policies without IP-based ACLs.

Answer

VLAN ACLs

Answer

CoPP

Answer

ACI contracts

Question 4

Which THREE are correct about using Ansible with Cisco NX-OS? (Choose three.)

Accepted Answer

The cisco.nxos collection includes the nxos_vlan module.. Option B is correct because the cisco.nxos collection (part of the Ansible network automation content) ships the nxos_vlan module, which lets you declaratively create, modify, and delete VLANs on NX-OS devices. Option C is correct because Ansible playbooks are always authored in YAML, the human-readable data-serialization format Ansible uses for tasks, plays, and variables. Option E is correct because nxos_config is the module designed to push, back up, and manage configuration sections on NX-OS devices, supporting lines, parents, and src parameters. Option A is incorrect because Ansible is agentless and connects to Nexus switches over SSH or NX-API rather than requiring a software agent on the switch. Option D is incorrect because Ansible communicates using standard, open protocols such as SSH (network_cli) and HTTPS (NX-API), not a proprietary protocol.

Answer

Ansible requires an agent installed on the Nexus switch.

Answer

Ansible uses a proprietary protocol to communicate with Nexus switches.

Question 5

An engineer is tuning performance for a storage network. Which two practices improve FC SAN performance?

Accepted Answer

Using single-initiator zoning.. Option B (single-initiator zoning) is correct because zoning each initiator with only its intended target(s) limits the number of devices sharing a zone, reducing unnecessary fabric traffic and RSCN (Registered State Change Notification) propagation, which improves overall SAN performance and stability. Option C (ensuring adequate buffer credits) is correct because Fibre Channel uses a credit-based flow control mechanism; if a port has too few buffer credits for the link distance and speed, it cannot keep the link fully utilized, so provisioning sufficient credits (especially over long-distance ISLs) is essential to sustain throughput. Option A is wrong because disabling flow control removes the buffer-credit mechanism that prevents frame loss and congestion, degrading rather than improving performance. Option D is wrong because broadcast zoning allows broadcast/RSCN traffic to reach many ports, increasing unnecessary traffic and disrupting hosts. Option E is wrong because maximizing the fabric login timeout only delays error detection and recovery; it does not improve throughput or latency.

Answer

Disabling flow control.

Answer

Enabling broadcast zoning.

Answer

Setting fabric login timeout to the maximum.

Question 6

Which TWO are benefits of using the Cisco NX-API for network automation compared to traditional SSH-based scripting?

Accepted Answer

Enables batching multiple CLI commands in a single HTTP request. Option A is correct because NX-API supports CLI-based requests over HTTP/HTTPS where multiple show or configuration commands can be bundled into a single JSON or XML payload, reducing round trips compared to opening an SSH session and issuing commands one at a time. Option B is correct because NX-API can return responses in structured JSON or XML formats, which are easier for automation tools to parse and are less dependent on the exact CLI text formatting that may change between NX-OS versions. Option C is incorrect because IPSec and SSL VPN configuration is not a benefit specific to NX-API; those features are configured on the device itself regardless of the management interface used. Option D is incorrect because NX-API still requires authentication, typically via username/password or token-based mechanisms over HTTPS. Option E is incorrect because real-time syslog streaming is not a function of NX-API; syslog is delivered through the logging subsystem to a syslog server, not through NX-API requests.

Answer

Supports direct configuration of IPSec and SSL VPNs

Answer

Eliminates the need for any authentication

Answer

Allows for real-time streaming of syslog messages

Question 7

Which TWO statements about Cisco TrustSec in a data center environment are true? (Choose two.)

Accepted Answer

Cisco ISE can dynamically assign SGTs to endpoints during authentication.. Cisco ISE can dynamically assign Security Group Tags (SGTs) to endpoints during authentication via 802.1X or MAB, enabling role-based access control. This is a core TrustSec feature where the SGT is propagated to the network infrastructure to enforce policies.

Answer

TrustSec requires MACsec encryption on all links to function.

Answer

SGTs are assigned based on the source IP address of the traffic.

Answer

TrustSec policies are enforced at Layer 3 only.

Question 8

Which feature prevents IP spoofing by ensuring that a client uses only the IP address assigned by DHCP?

Accepted Answer

IP Source Guard. IP Source Guard uses DHCP snooping binding to filter traffic based on source IP and MAC.

Answer

DHCP snooping

Answer

Port security

Answer

Dynamic ARP Inspection

Question 9

Which THREE factors should be considered when sizing buffer credits for a long-haul FC link?

Accepted Answer

Link speed. Link speed (A) is a critical factor because higher speeds require more buffer credits to maintain full throughput over a given distance. The buffer credit requirement scales linearly with link speed, as each credit represents the ability to send one frame before receiving an acknowledgment. For example, a 16 Gbps link needs twice as many buffer credits as an 8 Gbps link for the same distance.

Answer

Number of targets

Answer

Buffer-to-buffer credit pool size

Question 10

An administrator is configuring a HyperFlex cluster with 4 nodes. To ensure data availability in the event of two simultaneous node failures, what replication factor should be configured?

Accepted Answer

RF3. HyperFlex replication factor (RF) defines how many copies of data are maintained across nodes. RF3 keeps three replicas, so the cluster can tolerate two simultaneous node failures while still retaining at least one complete copy of data. For a 4-node cluster requiring two-failure tolerance, RF3 is the correct setting.

Answer

RF2

Answer

RF4

Answer

RF1

Question 11

An engineer is configuring a UCS service profile for PXE boot. The server must obtain an IP address from a DHCP server and then download the OS image from a TFTP server. Which boot policy parameters must be configured?

Accepted Answer

Add a LAN boot entry and select the appropriate vNIC for PXE.. PXE boot requires the server to first obtain an IP via DHCP and then fetch the boot image over the network using TFTP. In a UCS service profile, this is achieved by adding a LAN boot entry in the boot policy and selecting the vNIC that connects to the PXE-capable network, so option D is correct. The DHCP and TFTP server addresses are supplied by the network infrastructure (DHCP options 66/67), not configured inside the boot policy itself.

Answer

Configure the boot policy to use iSCSI boot.

Answer

Specify the DHCP server IP and TFTP server IP in the boot policy.

Answer

Select the SAN boot option and specify the WWPN.

Question 12

In a Cisco UCS B-Series environment, which component provides the physical connectivity between blade chassis and Fabric Interconnects?

Accepted Answer

I/O Module (IOM). The I/O Module (IOM) is the component that physically sits in the back of the UCS blade chassis and provides the data path between the blade's mezzanine adapters/VICs and the Fabric Interconnects. Each chassis has two IOMs (one per fabric), connecting to FI ports via 2208XP/2204XP fabric extender uplinks. The IOM is essentially a FEX embedded in the chassis, but in UCS B-Series terminology the physical connectivity component is the IOM.

Answer

Fabric Extender (FEX)

Answer

Virtual Interface Card (VIC)

Answer

Mezzanine adapter

Question 13

An engineer is automating ACI configuration using Terraform. Which provider and resource should be used to create an Application Profile under a Tenant?

Accepted Answer

provider = cisco.aci and resource = aci_application_profile. The Cisco ACI Terraform provider is published as cisco.aci, and within that provider the resource type aci_application_profile maps directly to the APIC's fvAp managed object, which represents an Application Profile inside a Tenant. To create an Application Profile under a Tenant, you declare resource "aci_application_profile" with a tenant_dn or relation_fv_tenant reference to the parent tenant. This is the canonical, documented way to provision APs declaratively in ACI automation.

Answer

provider = cisco.aci and resource = aci_tenant

Answer

provider = cisco.aci and resource = aci_epg

Answer

provider = cisco.nxos and resource = nxos_vlan

Question 14

An engineer is troubleshooting a UCS blade server that fails to boot from SAN. The server is associated with a service profile that includes a SAN connectivity policy. Which two items should be verified to ensure the boot from SAN works? (Choose two.)

Accepted Answer

The boot policy includes the SAN target as the first boot device.. Option A is correct because a boot-from-SAN service profile must reference a boot policy whose boot order lists the SAN target (the vHBA and its boot LUN/target) as the first boot device; otherwise the blade will not attempt to boot from the SAN LUN. Option C is correct because the WWPNs assigned to the vHBAs must be zoned correctly on the SAN switches so the blade's initiator can see and log in to the target storage array; without proper zoning the boot LUN is invisible and boot fails. Option B is incorrect because vNIC placement/fabric failover applies to Ethernet vNICs, not to vHBA SAN boot. Option D is incorrect because a QoS policy on the vHBA affects bandwidth/priority, not the ability to boot from SAN. Option E is incorrect because a local disk is irrelevant to boot from SAN and is not required.

Answer

The vNIC placement policy is set to fabric failover.

Answer

The QoS policy is applied to the vHBA.

Answer

The server has a local disk installed.

Question 15

An engineer is troubleshooting a SAN performance issue. The show interface counters command shows high output discard counts on a particular Fibre Channel interface. What is the most likely cause?

Accepted Answer

Insufficient buffer credits on the transmitting port.. High output discard counts on a Fibre Channel interface indicate that the transmitting port is attempting to send frames faster than the receiving port can accept them. This is most commonly caused by insufficient buffer credits on the transmitting port, which limits the number of frames that can be in flight before an acknowledgment is required. When buffer credits are exhausted, frames are discarded at the transmit side, leading to output discards.

Answer

High CRC errors on the link.

Answer

Insufficient bandwidth due to latency.

Answer

Mismatched zone configurations.