350-601 Practice Test 36 — 15 Questions

Question 1

An organization has deployed a pair of Nexus 93180YC-EX switches as vPC peers in a data center. The switches are connected to a server with two 10GbE interfaces configured as an LACP port-channel. The vPC configuration has been verified and was working correctly for months. After a scheduled maintenance window that included upgrading the NX-OS software from version 7.0(3)I7(1) to 7.0(3)I7(5), the server begins experiencing frequent link flaps on the port-channel. The server administrator reports that every 5-10 minutes, the link goes down for about 2 seconds and then recovers. The network team checks the logs on the Nexus switches and sees repeated messages: 'LACP-3-MISCONFIG: Port-channel <channel> is misconfigured: partner not on same aggregator.' The 'show vpc brief' output shows all vPCs in the 'up' state. The 'show port-channel summary' shows the port-channel is up with both member ports in the bundle. What is the most likely root cause?

Accepted Answer

The LACP system priority is not configured consistently between the vPC peers, causing the LACP system identifier to differ.. Option C is correct because in a vPC setup, both peer switches must have the same LACP system identifier (derived from system priority and MAC address) so the server sees a single logical partner. If the LACP system priority is not consistent across the peers, the system identifiers will differ, causing the server to detect multiple partners, leading to the 'partner not on same aggregator' error and link flaps. Option A is incorrect because the LACP rate timer mismatch would cause constant timeout issues, not intermittent flaps with the specific log message. Option B is incorrect because VLAN mismatch would cause persistent connectivity failures, not intermittent flaps. Option D is incorrect because delay-restore timer affects recovery after link failure, not during steady-state operation.

Answer

The LACP fast rate timer default changed to slow in the new software, causing a timeout mismatch with the server.

Answer

The vPC delay-restore timer is set too low, causing the vPC to prematurely come up before LACP is fully up.

Answer

The vPC peer-link VLAN allowed list does not include the server's VLAN, causing intermittent drops.

Question 2

A financial services company operates a multi-site data center with Cisco ACI. The automation team uses Ansible Tower to manage configurations. They have a playbook that configures EPGs using the 'aci_epg' module. The playbook runs successfully for most sites but fails on one site with the error 'Object 'uni/tn-Tenant1/ap-AP1/epg-EPG1' doesn't exist'. The engineer checks the ACI fabric and confirms that the tenant, application profile, and EPG exist on that site. The playbook uses the same credentials and variables across all sites. What is the most likely cause of the failure?

Accepted Answer

The fabric name in the Ansible inventory is incorrect for that site. The error 'Object doesn't exist' despite the EPG being present on the ACI fabric indicates that Ansible is targeting the wrong fabric or APIC. Since the playbook uses the same credentials and variables across all sites, the most likely cause is an incorrect fabric name in the Ansible inventory for that specific site, causing the module to query a different APIC cluster where the object does not exist.

Answer

The Ansible Tower job runs with a different user that lacks permissions on that site

Answer

The ACI APIC version is incompatible with the Ansible module

Answer

The EPG name in the playbook has a typo that only affects this site

Question 3

You are a data center engineer at a financial company. The production environment uses UCS B-Series blades with fabric interconnects in a clustered configuration. One of the blades (blade 3) is running a critical trading application. The server is associated with a service profile that boots from SAN using a single HBA path. During a routine network upgrade, the storage administrator reports that LUN 0 on the primary storage array is no longer accessible from blade 3. The server is still powered on, but the application is unresponsive. You check UCS Manager and see that the vHBA for blade 3 is in an 'Unavailable' state. The fabric interconnect ports show no errors. The storage array logs show that the target port is active. Which action should you take to restore connectivity with minimal downtime?

Accepted Answer

Unassign and reassign the vHBA's WWPN from the pool in the service profile. The vHBA being in an 'Unavailable' state while the fabric interconnect ports and storage target are healthy indicates a WWPN (World Wide Port Name) conflict or corruption at the fabric level. Unassigning and reassigning the vHBA's WWPN from the pool forces UCS Manager to generate a new WWPN and re-login to the SAN fabric, re-establishing the Fibre Channel session without requiring a server reboot or service profile re-association, minimizing downtime for the critical trading application.

Answer

Change the boot policy to use a secondary LUN on the same array

Answer

Reset the fabric interconnect to restore cluster state

Answer

Reboot the server to force re-initialization of the HBA

Question 4

An organization has deployed a Cisco UCS B-Series blade server with a Fabric Interconnect pair. The administrator is tasked with deploying a new server for a critical application. The administrator creates a service profile from an existing template that includes vNIC, vHBA, and storage policies. The blade is located in chassis 2, slot 1. The administrator attempts to associate the profile with this blade but fails with the error: 'No suitable compute resource available.' The administrator verifies that the blade's firmware is updated, that the blade is not already associated with another profile, and that it has sufficient memory and CPU. What is the most likely cause?

Accepted Answer

The server pool policy is not assigned to the service profile template.. The error 'No suitable compute resource available' typically occurs when the service profile is configured to use a server pool, but no server pool policy is assigned to the service profile template. Without a server pool, the Fabric Interconnect cannot identify which blades are eligible for association, even if the blade itself is available and meets hardware requirements. Assigning a server pool policy to the template ensures that blades in the specified pool (e.g., chassis 2, slot 1) are considered as valid compute resources.

Answer

The blade's firmware version is incompatible with the service profile.

Answer

The blade is in the wrong chassis slot.

Answer

The vNIC/vHBA policies in the service profile have invalid MAC/WWN assignments.

Question 5

A data center engineer is using Cisco Intersight to manage a hybrid infrastructure that includes UCS servers and HyperFlex clusters. The engineer needs to deploy a new server profile to a UCS domain that is claimed in Intersight. The profile includes a firmware policy that specifies version 4.1(3c) for the motherboard and 5.0(3a) for the storage controller. The target server is a C-Series rack mount server currently running firmware version 4.0(2a) on the motherboard. After deploying the profile, the server goes into a 'Pending' state and does not become 'Selectable'. The engineer checks the UCS Manager and sees that the server is in 'Discovery Failed' state. The engineer has verified that network connectivity is fine and the CIMC is accessible. What should the engineer do to resolve this?

Accepted Answer

Update the firmware manually on the server using UCS Manager before deploying the profile.. Option D is correct because when a firmware policy in Intersight specifies a version that is not compatible with the current firmware on the server, the server may enter a 'Discovery Failed' state. In this scenario, the motherboard firmware must be updated to a version that supports the storage controller firmware 5.0(3a) before the profile can be applied. Manually updating the firmware via UCS Manager ensures the server meets the prerequisite firmware baseline, allowing Intersight to complete the deployment.

Answer

Ensure that the firmware policy in Intersight is consistent with the current firmware on the server.

Answer

Remove the server from Intersight inventory and re-claim it.

Answer

Reset the server's CIMC to factory defaults and re-discover it.

Question 6

A large enterprise runs a Cisco HyperFlex cluster with three nodes, managed through Intersight. After a planned maintenance window, the administrator notices that one of the nodes is in a 'Degraded' state and the cluster is running in 'Read-Only' mode. The administrator checks the Intersight dashboard and sees that the node's disk status shows 'Missing' for one of the SSDs. The administrator also notices that the node's IP address is reachable and the ESXi host is still operational. The administrator reviews the cluster health and sees no other alerts. What is the most likely root cause and the recommended action to restore full cluster health?

Accepted Answer

The SSD failed due to a hardware fault; the administrator should replace the SSD and then use Intersight to rebuild the node's disk group.. A is correct because a missing SSD in a HyperFlex node triggers a 'Degraded' state and forces the cluster into 'Read-Only' mode to prevent data corruption. Since the node's IP is reachable and ESXi is operational, the issue is a hardware fault, not a network or CVM problem. Replacing the SSD and using Intersight to rebuild the disk group restores the node's storage capacity and cluster health.

Answer

The node lost connectivity to the cluster's internal network; the administrator should check the network switches and restore the VLAN configuration.

Answer

The node's controller VM (stCVM) is not running; the administrator should reboot the node and wait for the CVM to start.

Answer

The cluster has split-brain due to a partition; the administrator should force a cluster consensus by shutting down the other nodes.

Question 7

A UCS B-Series blade server (blade 5) has been running a database application for months. Recently, the storage team upgraded the SAN firmware. Since then, the blade experiences intermittent 'SCSI command timeout' errors in the system logs. The application performance degrades periodically. You check the UCS Manager performance data and see that the vHBA statistics show a high number of 'Link Reset' events. The storage array logs show no errors. The fibre channel cables are new. Which step should you take to resolve the issue?

Accepted Answer

Update the HBA firmware on the blade to match the SAN compatibility matrix. Option C is correct because the SAN firmware upgrade likely introduced a change in the Fibre Channel protocol behavior (e.g., link initialization or error recovery) that is incompatible with the current HBA firmware on the blade. The high 'Link Reset' events indicate that the vHBA is repeatedly reinitializing the link, which directly causes SCSI command timeouts. Updating the HBA firmware to match the SAN compatibility matrix ensures the HBA can properly negotiate and interoperate with the upgraded SAN fabric, resolving the intermittent timeouts.

Answer

Delete and recreate the vHBA in the service profile

Answer

Replace the fibre channel cables between the IOM and storage

Answer

Rezone the SAN fabric to use a different target port

Question 8

Your company integrates UCS B-Series blades with VMware vSphere using UCS Manager and vCenter. You have configured a UCS service profile with a boot policy that boots from SAN. The virtual infrastructure administrator reports that a new ESXi host (blade 6) fails to meet host profile compliance for the 'Boot Device' policy. The host profile requires the boot LUN to be set to 'VMware LUN' but the UCS boot policy uses a generic 'SAN Target' setting. The ESXi host boots and runs, but compliance checks fail. You cannot modify the host profile because it is managed by a separate team. Which action should you take to resolve the compliance failure while maintaining boot functionality?

Accepted Answer

Change the UCS boot policy to use the 'VMware LUN' target type and ensure the LUN is presented correctly. Option D is correct because the host profile compliance failure is caused by the UCS boot policy using a generic 'SAN Target' type instead of the 'VMware LUN' target type. By changing the boot policy to 'VMware LUN' and ensuring the correct LUN is presented, the ESXi host will boot from the same LUN but now the boot device name will match what the host profile expects, resolving the compliance check without affecting boot functionality.

Answer

Create a new vCenter cluster with a different host profile

Answer

Use a local disk boot policy and install ESXi locally

Answer

Request the host profile to be updated to accept generic SAN targets

Question 9

A data center runs OSPF as the underlay for an EVPN-VXLAN fabric. The fabric includes two spine switches and eight leaf switches. After adding a new leaf switch, the network team notices that some EVPN routes are missing from the other leaves. The new leaf has established BGP EVPN sessions to both spines and the BGP sessions are up. The spines report receiving all routes from the new leaf, but the other leaves do not receive certain prefixes. The engineer checks the BGP configuration on the new leaf and sees the address-family l2vpn evpn is configured under router bgp. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify the new leaf has the address-family l2vpn evpn activated under the neighbor configuration. The issue is that the new leaf has BGP EVPN sessions to both spines, but other leaves do not receive certain prefixes. Since the spines (acting as route reflectors) receive all routes from the new leaf but do not propagate them to other leaves, the most likely cause is that the address-family l2vpn evpn is not activated under the neighbor configuration on the new leaf. Without this activation, the new leaf does not advertise its EVPN routes to the spines, even though the BGP session is up and the address-family is configured globally under router bgp.

Answer

Check the new leaf's BGP router ID for uniqueness

Answer

Ensure the new leaf's BGP next-hop-self is enabled

Answer

Verify the cluster ID on the route reflectors is consistent

Question 10

A mid-size organization is upgrading its data center network to support server virtualization. They have deployed two Nexus 9300 switches as access switches for their server racks. The servers are configured with VLAN tagging and connect to the switches using trunks. The network administrator needs to ensure that the switches can provide default gateway services to the servers to reduce latency. They have configured interface VLAN interfaces and HSRP for redundancy. After implementation, the servers can communicate within the same VLAN but fail to reach the default gateway. The network administrator checks the switch configuration and finds that "ip routing" is not enabled globally. What is the most likely impact of this missing configuration?

Accepted Answer

The switches will not forward traffic between VLANs.. Without the 'ip routing' command enabled globally, the Nexus 9300 switches operate as Layer 2 devices only. This means they can forward frames within the same VLAN (since that relies on MAC address learning and switching), but they cannot perform IP routing between VLANs or route traffic to the configured SVI (VLAN interface) default gateway. The servers can communicate within the same VLAN because that is purely Layer 2 switching, but any attempt to reach the default gateway (which requires Layer 3 forwarding) fails because the switch does not have IP routing enabled.

Answer

The servers will not receive DHCP addresses.

Answer

HSRP will not elect an active router.

Answer

The VLAN interfaces will not come up.

Question 11

Two Cisco Nexus 9000 switches are connected via Ethernet interface 1/1. The engineer wishes to secure the link using MACsec (IEEE 802.1ae) with a pre-shared key for connectivity association key (CAK) protection. Both switches have the same hardware and software version supporting MACsec. The engineer configures the following on both switches:

feature macsec
macsec policy MACSEC_POLICY
  cipher-suite gcm-aes-128
  security-mode no-encrypt
  mka sak-rekey-time 30
interface ethernet 1/1
  macsec policy MACSEC_POLICY

However, the link comes up without MACsec encryption (the port counter shows MACsec frames dropped). The engineer checks that the pre-shared key is configured correctly via 'macsec key-chain' but notices it was not explicitly applied. What is the most likely reason for MACsec failing to establish?

Accepted Answer

The MACsec key chain must be created and referenced in the macsec policy, and the MKA policy must be applied to the interface with 'macsec mka policy'.. Option C is correct because MACsec on Cisco Nexus 9000 switches requires a key chain to be defined and explicitly referenced within the MACsec policy. Without the 'key-chain' command under the 'macsec policy', the pre-shared key (CAK) is not available for MKA (MACsec Key Agreement) to derive session keys. Additionally, the MKA policy must be applied to the interface using 'macsec mka policy' to enable the key agreement protocol; simply enabling MACsec on the interface without these steps leaves the link unsecured, causing MACsec frames to be dropped.

Answer

Both switches must have the same MACsec profile name.

Answer

The interface must be put in a 'macsec' mode with 'switchport macsec'.

Answer

The 'feature macsec' command is not enabled, so MACsec is not operational.

Question 12

A large cloud provider is building a new data center using Cisco ACI with multiple leaf and spine switches. They plan to host thousands of tenants with overlapping IP addresses in different VRFs. The network team has deployed the fabric with a common security policy. During testing, they discover that traffic from Tenant A to Tenant B is being allowed even though a contract should deny it. The APIC policy shows the contract is applied to the EPGs and the deny rule is present. What is the most likely cause of the policy not being enforced?

Accepted Answer

The leaf switches have not downloaded the updated policy.. In Cisco ACI, the leaf switches enforce contracts locally based on the policy downloaded from the APIC. If a contract is correctly configured on the APIC but traffic is still permitted, the most likely cause is that the leaf switches have not yet received or applied the updated policy. This can happen due to a delay in policy propagation, a communication issue between the APIC and leaf switches, or the leaf not having completed the policy resolution process.

Answer

The fabric is using VRF leaking that bypasses contracts.

Answer

The contract is not configured with the correct subject.

Answer

The EPGs are in the same bridge domain.

Question 13

In a Cisco Application Centric Infrastructure (ACI) fabric, a tenant has two EPGs: Web and App. A contract is created between Web (consumer) and App (provider) with a filter that permits TCP port 8080 (the only port used by the application). However, traffic from App to Web is failing. The application requires bidirectional communication: Web initiates requests to App on TCP 8080, and App responds on the same connection (stateful). The engineer verifies that the filter is correctly applied and that both EPGs are in the same VRF. The contract is applied in the direction Web -> App. What is the most efficient way to resolve this issue without compromising security?

Accepted Answer

Create a second contract from App to Web with the same filter, and apply it to App as consumer and Web as provider.. In Cisco ACI, contracts are unidirectional by default. Even though the filter permits TCP 8080 from Web to App, the return traffic from App to Web is not implicitly allowed because ACI does not perform stateful inspection for TCP connections; it relies on explicit contract rules for each direction. Option C correctly creates a second contract from App (consumer) to Web (provider) with the same filter, allowing the bidirectional communication required for the application's stateful TCP session without over-permitting.

Answer

Verify that no higher-priority contract is overriding; if not, the issue is elsewhere.

Answer

Set the contract to 'allow any' between the EPGs to bypass filtering.

Answer

Modify the existing filter to allow TCP 8080 from App to Web as well.

Question 14

A data center network uses Cisco Nexus 9000 switches running NX-OS. The operations team notices that the CPU utilization on the supervisor module spikes intermittently, causing BGP session flaps. Analysis shows that the CPU spikes coincide with traceroute probes from external networks, which generate ICMP TTL exceeded messages that are process-switched. The engineer must implement a solution to protect the control plane without affecting normal ICMP functionality. The goal is to rate-limit ICMP traffic to a maximum of 1000 packets per second with a burst of 200 bytes, while allowing other control plane traffic without restriction. Which configuration should be applied?

Accepted Answer

class-map type control-plane match-all COPP-ICMP
  match protocol icmp
policy-map type control-plane COPP
  class COPP-ICMP
    police 1000 pps 200 byte burst
control-plane
  service-policy type control-plane COPP. Option D is correct because it uses a Control Plane Policing (CoPP) policy with a class-map that matches ICMP protocol traffic in the control plane, then applies a police rate of 1000 pps with a 200-byte burst. This configuration rate-limits ICMP TTL-exceeded messages that are process-switched, protecting the supervisor CPU from spikes while allowing other control plane traffic unrestricted. The 'service-policy type control-plane' command applies the policy to the control plane, which is the proper method for NX-OS CoPP.

Answer

Use the 'hardware rate-limiter' feature to limit ICMP globally.

Answer

class-map type control-plane match-any COPP-ICMP
  match access-group name ICMP-ACL
policy-map type control-plane COPP
  class COPP-ICMP
    police rate 1000 pps burst 200
control-plane
  service-policy input COPP

Answer

Apply a QoS policy on the management interface to drop excess ICMP.

Question 15

A network engineer is implementing port security on a Cisco Nexus 9000 switch to limit the number of MAC addresses learned on a single access port. The switchport is configured as follows:

interface Ethernet 1/2
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation shutdown
  switchport port-security mac-address sticky

After connecting two authorized devices, a third unauthorized device is connected, causing the port to enter the err-disabled state. The engineer needs to restore connectivity for the two authorized devices as quickly as possible, while maintaining the security posture. What is the best practice to recover the port automatically in the future?

Accepted Answer

Configure 'errdisable recovery cause psecure-violation' to automatically recover the port after the configured interval.. Option C is correct because the 'errdisable recovery cause psecure-violation' command enables automatic recovery from the err-disabled state caused by a port-security violation. This allows the port to come back up after a default or configured interval (typically 300 seconds) without manual intervention, restoring connectivity for the two authorized devices while maintaining the security posture of limiting MAC addresses to two.

Answer

Manually shut down and then no shutdown the interface to recover from err-disabled state.

Answer

Remove port-security configuration entirely to prevent future err-disables.

Answer

Increase the maximum MAC address limit to 3 to accommodate the third device.