350-601 Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. A Python script using the Cisco ACI Cobra SDK fails with 'AuthenticationError'. Which of the following is the most likely cause?

Accepted Answer

The username or password is incorrect. The 'AuthenticationError' in the Cisco ACI Cobra SDK indicates that the APIC rejected the login credentials. This error is raised specifically when the username or password provided in the script's login method (e.g., 'Login('apic_url', 'username', 'password')') does not match a valid APIC local or AAA-authenticated user. The SDK performs an HTTP POST to the APIC's '/api/aaaLogin.json' endpoint, and a non-200 response with an authentication failure triggers this exception.

Answer

The APIC URL is incorrect

Answer

The user does not have API access

Answer

The script is missing required imports

Question 2

An administrator is troubleshooting a performance issue in an FC SAN. The initiator and target are in the same VSAN. The link is 16 Gbps but throughput is only 4 Gbps. The engineer checks the BB_Credit utilization and sees a high count of BB_Credit zero. What is the most likely cause?

Accepted Answer

Buffer-to-buffer credit exhaustion. BB_Credit zero indicates buffer-to-buffer credit exhaustion, which pauses transmission and reduces throughput. This is typically due to distance or small credit pool. Link errors would show CRC errors, congestion would cause other symptoms, and zoning is unrelated.

Answer

Congestion on the target port

Answer

High link error rates

Answer

Incorrect zoning configuration

Question 3

A data center engineer is designing a storage network for a virtualized environment with 100 hosts and 50 storage arrays. Each host requires 4 Gbps of bandwidth to storage, and each storage array provides 8 Gbps. All devices use 16 Gbps FC links. What is the minimum number of 16 Gbps FC links required to support the total bandwidth demand without oversubscription?

Accepted Answer

25. The total bandwidth demand from hosts is 100 hosts × 4 Gbps = 400 Gbps. Each storage array provides 8 Gbps, so total storage bandwidth is 50 arrays × 8 Gbps = 400 Gbps. Since all links are 16 Gbps FC, the minimum number of links required to carry 400 Gbps without oversubscription is 400 / 16 = 25 links. This assumes full-duplex links and no oversubscription in the fabric.

Answer

50

Answer

200

Answer

100

Question 4

An enterprise requires that all virtual machines using a specific service profile must have the same MAC address pool. Which policy should be configured on the service profile template?

Accepted Answer

MAC Pool Policy. A MAC Pool Policy is correct because it defines a range of MAC addresses that are dynamically assigned to virtual network adapters in a service profile. When multiple VMs use the same service profile template, configuring a MAC Pool Policy ensures all VMs derive their MAC addresses from the same pool, guaranteeing consistency and avoiding address conflicts across the cluster.

Answer

UUID Pool Policy

Answer

Server Pool Policy

Answer

WWPN Pool Policy

Question 5

An organization uses VXLAN EVPN for network segmentation. Which component provides per-tenant isolation of control plane traffic?

Accepted Answer

VRF. In VXLAN EVPN, per-tenant isolation of control plane traffic is achieved through the use of VRFs (Virtual Routing and Forwarding instances). Each tenant is assigned a unique VRF, which maintains its own separate routing table and forwarding decisions, ensuring that control plane information (such as MAC/IP routes advertised via MP-BGP EVPN) is isolated between tenants. This is distinct from data plane isolation, which is provided by VXLAN Network Identifiers (VNIs).

Answer

VLAN

Answer

VNI

Answer

VXLAN tunnel

Question 6

An engineer needs to automate configuration backups on NX-OS switches using Python. Which Python library is specifically designed for this purpose?

Accepted Answer

nxapi. The `nxapi` library is specifically designed for automating configuration backups and other management tasks on Cisco NX-OS switches. It provides a Pythonic interface to the NX-API, which uses HTTP/HTTPS-based REST or XML/JSON-RPC calls to execute CLI commands and retrieve structured output, making it the correct choice for this purpose.

Answer

requests

Answer

paramiko

Answer

cli

Question 7

An engineer is configuring intelligent zoning and wants to use device aliases to simplify zone membership. What is a characteristic of device aliases compared to zone aliases?

Accepted Answer

Device aliases can be used in multiple zones across different VSANs.. Device aliases are globally unique across all VSANs in a Cisco MDS fabric, allowing the same alias to be used in multiple zones and across different VSANs without conflict. This simplifies zone configuration because a single device alias can represent an N-port (e.g., a host HBA) and be referenced in zone memberships for different VSANs, reducing administrative overhead. In contrast, zone aliases are local to a single VSAN and cannot be shared across VSANs.

Answer

Device aliases require a specific DNS entry.

Answer

Device aliases are restricted to a single VSAN.

Answer

Device aliases are automatically assigned to the default zone.

Question 8

An engineer needs to implement port security on a Cisco Nexus 1000v virtual switch to prevent MAC flooding attacks. The requirement is to allow only the first MAC address learned on the port. Which command sequence accomplishes this?

Accepted Answer

interface ethernet 1/1
  switchport port-security
  switchport port-security maximum 1
  switchport port-security violation shutdown. The command sequence sets the maximum number of MAC addresses to 1, which ensures only the first learned MAC address is allowed on the port. The 'violation shutdown' action disables the port if a violation occurs, effectively preventing MAC flooding attacks by stopping any additional MAC addresses from being learned.

Answer

interface ethernet 1/1
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation restrict

Answer

interface ethernet 1/1
  switchport port-security
  switchport port-security maximum 10
  switchport port-security violation protect

Answer

interface ethernet 1/1
  switchport port-security manual
  switchport port-security mac-address 0000.1111.2222

Question 9

An engineer is configuring FCoE on a Cisco Nexus 5000 switch. The switch connects to a Fibre Channel storage array. The FCoE Initialization Protocol (FIP) snooping must be enabled. What is the effect of enabling FIP snooping?

Accepted Answer

It constructs a database of ENode MAC addresses and FC-MAPs.. FIP snooping on a Cisco Nexus 5000 switch constructs a database of ENode MAC addresses and FC-MAPs by inspecting FIP discovery, advertisement, and login frames. This database is used to enforce FCoE traffic only between authorized ENodes and FCFs, preventing rogue devices from injecting FCoE traffic. It does not terminate FCoE VLANs, act as an FCoE forwarder, or enforce zone-based policies directly.

Answer

It enables the switch to terminate FCoE VLANs.

Answer

It provides FC-BB_6 compliant FCoE traffic forwarding.

Answer

It enables the switch to act as an FCoE forwarder.

Answer

It allows the switch to enforce zone-based policy for FCoE traffic.

Question 10

Order the steps to upgrade the software on a Cisco Nexus switch using ISSU.

Accepted Answer

Copy the new image to the bootflash, then set the boot variable to the new image, then perform a compatibility check, then issue the 'install all' command, then reload the switch.. ISSU requires image copy, boot variable, compatibility check, upgrade command, and reload.

Answer

Copy the new image to the bootflash, then perform a compatibility check, then set the boot variable to the new image, then issue the 'install all' command, then reload the switch.

Answer

Copy the new image to the bootflash, then set the boot variable to the new image, then issue the 'install all' command, then perform a compatibility check, then reload the switch.

Answer

Set the boot variable to the new image, then copy the new image to the bootflash, then perform a compatibility check, then issue the 'install all' command, then reload the switch.

Question 11

Sequence the steps to configure a VXLAN with BGP EVPN on a Cisco Nexus switch.

Accepted Answer

1. Enable overlay features (feature nv overlay, feature vni, feature bgp).
2. Configure VTEP loopback and NVE source interface.
3. Configure VLAN and VNI mapping (vn-segment).
4. Configure BGP EVPN address-family and neighbors.. VXLAN EVPN requires overlay feature, VNI mapping, VTEP loopback, BGP peering, and verification.

Answer

1. Configure VTEP loopback and NVE source interface.
2. Enable overlay features.
3. Configure VLAN and VNI mapping.
4. Configure BGP EVPN address-family and neighbors.

Answer

1. Enable overlay features.
2. Configure VLAN and VNI mapping.
3. Configure VTEP loopback and NVE source interface.
4. Configure BGP EVPN address-family and neighbors.

Answer

1. Enable overlay features.
2. Configure VTEP loopback and NVE source interface.
3. Configure BGP EVPN address-family and neighbors.
4. Configure VLAN and VNI mapping.

Question 12

Which TWO features are used to validate ARP packets and prevent ARP spoofing attacks? (Select exactly 2)

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is correct because it validates ARP packets by checking them against the DHCP snooping binding database, ensuring that only legitimate ARP replies and requests are forwarded. This prevents ARP spoofing attacks where an attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate device.

Answer

IP Source Guard

Answer

Private VLANs

Answer

Port Security

Question 13

A data center deployment uses NPV mode on a Cisco MDS switch to connect to a core Fibre Channel switch. After configuration, the NPV switch does not register with the core. What is the most likely cause?

Accepted Answer

NPIV is not enabled on the core switch.. NPV (N_Port Virtualization) mode requires NPIV (N_Port ID Virtualization) to be enabled on the core Fibre Channel switch. NPIV allows a single physical N_Port to register multiple FCIDs (Fibre Channel IDs) for multiple virtual initiators behind the NPV switch. Without NPIV on the core, the NPV switch cannot complete the FLOGI (Fabric Login) process and will not register with the fabric.

Answer

Fibre Channel ports are in trunk mode.

Answer

The core switch has NPV mode enabled.

Answer

The NPV switch has an incorrect domain ID.

Question 14

An engineer notices that the LED of an FC interface is off on a Cisco MDS switch. The interface is up/up. What is the most likely cause?

Accepted Answer

The link is up but the LED is disabled in software configuration.. On Cisco MDS switches, the interface LED can be administratively disabled via the `no led` command in interface configuration mode, even when the interface is fully operational (up/up). This allows operators to selectively turn off LEDs for troubleshooting or to reduce visual noise in a data center, without affecting traffic. The LED being off while the interface shows up/up directly points to this software-based LED disablement.

Answer

The port LED firmware is corrupted.

Answer

The interface is administratively down.

Answer

The SFP is faulty.

Question 15

Match each Cisco storage protocol to its characteristic.

Accepted Answer

Fibre Channel: Uses dedicated optical cabling and switches.. The correct matches are: Fibre Channel uses dedicated hardware, iSCSI uses IP, FCoE encapsulates FC over Ethernet, and NVMe-oF extends NVMe over fabrics. Common confusions include mixing Fibre Channel and FCoE, or iSCSI and Fibre Channel characteristics.

Answer

Fibre Channel: Runs over standard Ethernet.

Answer

iSCSI: Uses dedicated fabric and optical cabling.