350-601 Practice Test 33 — 15 Questions

Question 1

An organization is deploying Cisco Nexus 9000 switches with NX-OS and needs to prevent ARP spoofing attacks. The network engineer enables Dynamic ARP Inspection (DAI) on all VLANs. However, some legitimate hosts are unable to obtain IP addresses via DHCP. What is the most likely reason?

Accepted Answer

DHCP snooping is not enabled, so DAI lacks the DHCP snooping binding table.. DAI relies on the DHCP snooping binding table to validate ARP packets. Without DHCP snooping enabled, the binding table is empty, so DAI cannot determine which ARP packets are legitimate, causing it to drop all ARP packets, including DHCP discovery and request messages. This prevents hosts from obtaining IP addresses via DHCP.

Answer

The ARP rate limit on the port is too low, causing all ARP requests to be dropped.

Answer

IP Source Guard is enabled and is blocking ARP packets.

Answer

An ARP ACL is not configured to allow static IP bindings.

Question 2

A Cisco MDS switch is configured with two VSANs. Hosts in VSAN 1 cannot communicate with hosts in VSAN 2. What is the most likely reason?

Accepted Answer

The VSANs are not connected through an IVR zone.. By default, VSANs are isolated from each other, meaning traffic cannot cross VSAN boundaries. Inter-VSAN Routing (IVR) must be explicitly configured to allow communication between hosts in different VSANs. Without IVR, hosts in VSAN 1 and VSAN 2 remain in separate fabrics and cannot communicate, even if they are connected to the same switch.

Answer

The IVR is not configured.

Answer

The FC domain ID is conflicting.

Answer

The switch does not support multi VSAN.

Answer

The hosts are on different switches.

Question 3

An engineer needs to ensure that only authorized servers can connect to a specific switch port in a data center. The port connects to a critical database server with fixed MAC address 00:1a:2b:3c:4d:5e. Which configuration is most appropriate?

Accepted Answer

switchport port-security
switchport port-security mac-address 001a.2b3c.4d5e
switchport port-security violation shutdown. Option A is correct because it explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.

Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown

Answer

no switchport port-security
spanning-tree portfast

Answer

switchport port-security
switchport port-security maximum 2
switchport port-security violation protect

Question 4

A storage administrator reports that a new host cannot log into the SAN. The host is connected to a Cisco MDS switch. The switch interface shows up/up but the host is not in the active zone. What is the most likely cause?

Accepted Answer

The zone set is not activated.. The host cannot log into the SAN despite the interface showing up/up because the zone set is not activated. In Cisco MDS Fibre Channel SANs, zone configurations are stored in the zone database but only take effect when the zone set is activated (using the 'zone activate' command). Without an active zone set, no zoning is enforced, and the host's WWPN is effectively invisible to other devices, preventing login even though the physical link is operational.

Answer

The switch port is in an isolated state.

Answer

The FC cable is faulty.

Answer

The host's WWPN is not in the zone configuration.

Answer

The host's driver is not installed.

Question 5

Which feature allows a Fibre Channel switch to use multiple links between two switches as a single logical link?

Accepted Answer

SAN port channel. SAN port channel (C) is correct because it allows multiple physical Fibre Channel links between two switches to be aggregated into a single logical link, providing load balancing and redundancy. This is achieved by bundling up to 16 physical ISLs into one logical interface, using a proprietary hashing algorithm to distribute frames across the member links while maintaining in-order delivery.

Answer

NPIV

Answer

NPV

Answer

SPAN

Answer

FCIP

Question 6

A storage administrator wants to ensure that only designated initiators can access a specific target in a Fibre Channel SAN. Which mechanism enforces this policy?

Accepted Answer

Zoning. Zoning is the correct mechanism because it restricts Fibre Channel (FC) communication to only those initiators and targets that are members of the same zone. By defining a zone that includes only the designated initiator WWPNs and the target WWPN, the switch enforces access control at the fabric level, preventing any unauthorized device from discovering or communicating with the target.

Answer

IVR

Answer

Port channel

Answer

VSAN

Answer

Credit recovery

Question 7

An engineer is configuring FCoE on a Cisco Nexus 5000 switch. The switch connects to a Fibre Channel storage array. The FCoE Initialization Protocol (FIP) snooping must be enabled. What is the effect of enabling FIP snooping?

Accepted Answer

It constructs a database of ENode MAC addresses and FC-MAPs.. FIP snooping on a Cisco Nexus 5000 switch constructs a database of ENode MAC addresses and FC-MAPs by inspecting FIP discovery, advertisement, and login frames. This database is used to enforce FCoE traffic only between authorized ENodes and FCFs, preventing rogue devices from injecting FCoE traffic. It does not terminate FCoE VLANs, act as an FCoE forwarder, or enforce zone-based policies directly.

Answer

It enables the switch to terminate FCoE VLANs.

Answer

It provides FC-BB_6 compliant FCoE traffic forwarding.

Answer

It enables the switch to act as an FCoE forwarder.

Answer

It allows the switch to enforce zone-based policy for FCoE traffic.

Question 8

A storage administrator is troubleshooting FCoE performance issues between a Cisco UCS FI and a storage array. The fabric is configured with FIP snooping and DCB. The administrator checks the FCoE interface counters and sees many dropped frames due to 'no buffer space'. What is the most likely root cause?

Accepted Answer

Priority flow control settings are mismatched between the upstream switch and the storage array. The 'no buffer space' drops on FCoE interfaces indicate that the receive buffers are being exhausted, which is a classic symptom of Priority Flow Control (PFC) being misconfigured or mismatched between the upstream switch and the storage array. PFC (IEEE 802.1Qbb) is essential for lossless FCoE transport; if one side sends pause frames that the other does not honor, or if the PFC priorities are not aligned, buffers overflow and frames are dropped. This directly explains the observed counter behavior.

Answer

Jumbo frames are disabled on the switch ports

Answer

The FCoE VLAN is not trunked to the storage array

Answer

FIP snooping is not enabled on the FCoE VLAN

Question 9

An engineer is designing a SAN to connect hosts to two storage arrays for redundancy. The hosts are dual-attached to two MDS switches. Each storage array has two controllers, each with a single FC port. The engineer wants to avoid a single point of failure and ensure that each host can reach both storage controllers. Which design should be used?

Accepted Answer

Connect each host HBA to a different switch, and zone each HBA to both storage controller ports.. Option E is correct because it provides full redundancy: each host HBA connects to a different MDS switch, and each HBA is zoned to both storage controller ports. This ensures that if a switch, HBA, or storage controller fails, the host can still reach at least one storage controller via the remaining path. The dual-zoning per HBA allows each host to access both controllers without a single point of failure, meeting the requirement for host-to-controller reachability.

Answer

Connect both HBAs of each host to the same switch, and create zones that include both HBAs and both storage ports.

Answer

Connect each host HBA to a separate switch, and zone each HBA to one storage controller port.

Answer

Use NPV mode to simplify connectivity.

Answer

Connect each host HBA to a different switch, and zone each HBA to a specific storage controller, using zones that cross VSANs.

Question 10

A Cisco MDS switch is configured in NPV mode. A host connected to this switch fails to log into the SAN. Which command should be used to verify the host's FLOGI status?

Accepted Answer

show flogi database module . In NPV mode, the MDS switch acts as a passthrough and does not maintain its own FLOGI database; instead, it forwards FLOGI requests to the upstream NPIV-capable switch. The 'show flogi database module ' command is used on the NPV switch to verify the host's FLOGI status because it displays the FLOGI entries learned from the upstream switch for the specific module where the host is connected, which is essential for troubleshooting login failures.

Answer

show zone

Answer

show fcns database

Answer

show flogi database

Answer

show port-channel summary

Question 11

Which TWO of the following are valid methods to recover from buffer credit loss on a Fibre Channel link?

Accepted Answer

Reduce the link speed.. Reducing the link speed is a valid method to recover from buffer credit loss because it decreases the number of frames transmitted per unit time, allowing the receiver's buffer credits to replenish and preventing further overrun. This is a temporary workaround that reduces the effective bandwidth but can stabilize the link when buffer credit starvation occurs due to distance or congestion.

Answer

Enable WRED on the switch.

Answer

Use port channel to aggregate links.

Answer

Credit recovery using RDMA.

Question 12

Which TWO of the following are characteristics of NPV (N-Port Virtualization) in a Cisco MDS fabric?

Accepted Answer

It enables multiple hosts to share the same physical uplink.. NPV (N-Port Virtualization) allows multiple hosts to share a single physical uplink from an NPV switch to a core NPIV-enabled switch. This is achieved by multiplexing multiple Fibre Channel N-Port IDs over the same physical link, reducing the number of domain IDs required in the fabric because the NPV switch does not participate in principal switch selection or domain ID distribution. The core switch sees each host as a separate virtual N_Port, but the NPV switch itself does not consume a domain ID.

Answer

It allows the edge switch to appear as a virtual host to the core switch.

Answer

It requires FC-SP authentication.

Answer

It is only supported on 8 Gbps or higher ports.

Question 13

In a Fibre Channel SAN, flow control is managed by buffer credits. Which statement about buffer credits is accurate?

Accepted Answer

Buffer credits help manage congestion and ensure lossless delivery over distance. Buffer credits are a flow control mechanism in Fibre Channel that manage congestion by tracking the number of frames a sender can transmit before receiving an acknowledgment. They ensure lossless delivery over distance by preventing buffer overflow at the receiver, which is critical for maintaining data integrity in SANs. Option D correctly states this dual role of congestion management and lossless delivery.

Answer

Buffer credits are allocated per VSAN to isolate traffic

Answer

Increasing buffer credits always improves I/O performance

Answer

Buffer credits are used in FCoE to ensure lossless delivery

Question 14

Based on the exhibited FLOGI database, what is the state of the interface fc1/1?

Accepted Answer

It is an NP port (proxy FW) because multiple FCIDs appear on the same interface.. The FLOGI database shows multiple FCIDs (0x010000, 0x010001) associated with the same interface fc1/1, which is characteristic of an NP port (proxy FW) in NPV mode. An NP port acts as a proxy for multiple end devices behind it, such as in a Fibre Channel NPV switch or a converged network adapter (CNA) in FCoE NPV mode, allowing multiple FCIDs to share a single physical link.

Answer

It is an F port with a hub attached.

Answer

It is a trunking E port.

Answer

It is a disabled port because there are two WWNs.

Question 15

An administrator notices that a new server connected to a Fibre Channel switch cannot log in. The 'show flogi database' command does not show the server's WWPN. What is the most likely cause?

Accepted Answer

Port security enabled with WWN mismatch. The 'show flogi database' command lists all devices that have successfully completed the Fabric Login (FLOGI) process. If the server's WWPN is absent, it indicates that the FLOGI request was rejected by the switch. Port security with a WWN mismatch is the most likely cause because the switch is configured to allow only specific WWPNs, and the server's WWPN does not match the allowed list, causing the switch to silently drop the FLOGI request without logging the device.

Answer

Trunking mode not enabled on the port

Answer

Incorrect zoning configuration

Answer

Speed mismatch between the server and switch