350-601 Practice Test 37 — 15 Questions

Question 1

An administrator notices that a new server connected to a Fibre Channel switch cannot log in. The 'show flogi database' command does not show the server's WWPN. What is the most likely cause?

Accepted Answer

Port security enabled with WWN mismatch. The 'show flogi database' command lists all devices that have successfully completed the Fabric Login (FLOGI) process. If the server's WWPN is absent, it indicates that the FLOGI request was rejected by the switch. Port security with a WWN mismatch is the most likely cause because the switch is configured to allow only specific WWPNs, and the server's WWPN does not match the allowed list, causing the switch to silently drop the FLOGI request without logging the device.

Answer

Trunking mode not enabled on the port

Answer

Incorrect zoning configuration

Answer

Speed mismatch between the server and switch

Question 2

During a fabric reconfigure event, which behavior is expected if all switches are running the same Cisco SAN-OS version and have the same domain ID configuration?

Accepted Answer

A domain ID conflict will cause a segmentation of the fabric.. When all switches in a fabric reconfigure event run the same Cisco SAN-OS version and have the same domain ID configured, a domain ID conflict occurs because the principal switch cannot assign a unique domain ID to each switch. This conflict causes the fabric to segment, as the principal switch isolates the conflicting switch into a separate principal switch selection process, preventing a stable merged fabric.

Answer

The principal switch selection will re-elect based on highest WWN.

Answer

The principal switch will force a new domain ID assignment.

Answer

The fabric will merge without any issues as long as VSANs match.

Question 3

A data center switch port is configured for 802.1X with MAB as fallback. A device that does not support 802.1X is connected. Which method will allow the device to authenticate?

Accepted Answer

MAC authentication bypass. When a device that does not support 802.1X is connected to a port configured for 802.1X with MAB as fallback, the switch detects that no EAPOL frames are received from the device. It then initiates MAC authentication bypass (MAB), which uses the device's MAC address as the identity for authentication against the RADIUS server. If the MAC address is allowed, the port is authorized, providing a seamless fallback authentication method for non-802.1X-capable devices.

Answer

EAP-TLS

Answer

Web authentication

Answer

Local authentication using a pre-shared key

Question 4

A storage administrator needs to monitor traffic between two specific storage arrays without causing any disruption. Which approach should be used?

Accepted Answer

Configure a SPAN session on the MDS switch to copy traffic between the storage ports.. A SPAN (Switched Port Analyzer) session on an MDS switch copies traffic from source ports to a destination port without affecting the original traffic flow. This allows the administrator to monitor the traffic between the two storage arrays non-disruptively, as SPAN does not introduce latency or packet loss on the monitored ports.

Answer

Use FC traceroute to identify the path.

Answer

Enable FC ping between arrays.

Answer

Use IVR to route traffic through a monitoring zone.

Answer

Configure port channel between arrays.

Question 5

A UCS domain has two fabric interconnects in end-host mode. The engineer needs to implement a policy that ensures all traffic from a specific vNIC is load-balanced across both uplinks to the upstream switches. Which type of policy should be used?

Accepted Answer

Pin group policy. In a UCS domain with fabric interconnects in end-host mode, a Pin Group policy is used to explicitly map a vNIC's traffic to specific uplink ports, ensuring load balancing across the upstream switches. This policy overrides the default MAC-based hashing and allows the engineer to control traffic distribution, which is critical for consistent performance and redundancy.

Answer

Link aggregation policy

Answer

QoS policy

Answer

Network control policy

Question 6

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

Accepted Answer

VRF. The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default. This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Answer

Context (default)

Answer

Application-profile

Answer

Global

Question 7

A NETCONF session to an NX-OS switch fails with 'Connection refused'. What is the most likely cause?

Accepted Answer

NETCONF is not enabled on the switch. NETCONF uses SSH port 830 by default, but the 'Connection refused' error specifically indicates that the TCP connection was actively rejected by the switch, not that it timed out or was unreachable. This occurs when the NETCONF subsystem is not available because the 'netconf' feature has not been enabled on the NX-OS device, which is required to start the NETCONF server process.

Answer

All of the above

Answer

Wrong SSH port (default 830)

Answer

The switch is unreachable

Question 8

Which two BGP features are commonly used in a Cisco Data Center spine-leaf fabric to achieve optimal ECMP load balancing? (Choose two.)

Accepted Answer

BGP add-path. BGP add-path (A) allows the advertisement of multiple paths for the same prefix to a peer, enabling the spine to install multiple equal-cost paths in its routing table for ECMP load balancing. BGP multipath (C) instructs the router to install multiple equal-cost BGP paths into the routing table, which is essential for distributing traffic across multiple spine links in a Clos fabric.

Answer

BGP confederation

Answer

BGP next-hop-self

Answer

BGP bestpath tie-break

Question 9

Refer to the exhibit. The blade server is unassociated. Which action is required to assign a service profile to this server?

Accepted Answer

Create a service profile and associate it with the server. A service profile defines the server identity, firmware, policies, and connectivity settings for a UCS blade server. When a server is unassociated, you must create a service profile and then associate it with the server to apply those configurations and bring the server into operation.

Answer

Configure the server's BIOS settings

Answer

Create a boot policy

Answer

Create a vNIC template

Question 10

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

Accepted Answer

Set OSPF priority to 0 on the interface. Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

Answer

Set OSPF priority to 255 on the interface

Answer

Change the OSPF network type to point-to-point

Answer

Configure the interface as passive under OSPF

Question 11

A storage administrator configures a new Cisco MDS switch and enables NPV mode. However, the upstream switch shows the NPV switch as an end device instead of a switch. What is the most likely reason?

Accepted Answer

NPIV is not enabled on the upstream switch.. When NPV mode is enabled on a Cisco MDS switch, it operates as an N-port proxy, requiring the upstream Fibre Channel switch to support NPIV (N_Port ID Virtualization). NPIV allows multiple FC IDs to be assigned to a single N port, which is essential for the NPV switch to present multiple end devices behind a single physical link. Without NPIV enabled on the upstream switch, the NPV switch is treated as a single end device (like a server HBA) rather than as a switch fabric element.

Answer

The upstream switch port is configured as an E port.

Answer

The NPV switch has a domain ID that conflicts with the upstream switch.

Answer

The NPV switch is configured with N port mode.

Question 12

A storage administrator is troubleshooting FCoE performance issues between a Cisco UCS FI and a storage array. The fabric is configured with FIP snooping and DCB. The administrator checks the FCoE interface counters and sees many dropped frames due to 'no buffer space'. What is the most likely root cause?

Accepted Answer

Priority flow control settings are mismatched between the upstream switch and the storage array. The 'no buffer space' drops on FCoE interfaces indicate that the receive buffers are being exhausted, which is a classic symptom of Priority Flow Control (PFC) being misconfigured or mismatched between the upstream switch and the storage array. PFC (IEEE 802.1Qbb) is essential for lossless FCoE transport; if one side sends pause frames that the other does not honor, or if the PFC priorities are not aligned, buffers overflow and frames are dropped. This directly explains the observed counter behavior.

Answer

Jumbo frames are disabled on the switch ports

Answer

The FCoE VLAN is not trunked to the storage array

Answer

FIP snooping is not enabled on the FCoE VLAN

Question 13

Which TWO statements are true about Control Plane Policing (CoPP) on a Cisco Nexus 9000 switch? (Choose two.)

Accepted Answer

CoPP can be used to limit the rate of ICMP unreachable messages.. CoPP can rate-limit control-plane traffic such as ICMP unreachable messages. By applying a policy-map in the 'control-plane' sub-mode, you can define class-maps that match specific control-plane protocols (e.g., ICMP) and then police their rate to prevent CPU overload from floods of such packets.

Answer

CoPP automatically drops all unknown unicast traffic.

Answer

CoPP applies only to traffic destined to the switch management IP.

Answer

CoPP can be used to prioritize OSPF traffic over SSH.

Question 14

An engineer is configuring vPC on a pair of Nexus switches. Which statement correctly describes the vPC peer-keepalive link?

Accepted Answer

It is a Layer 3 link used to verify the health of the vPC peer. The vPC peer-keepalive link is a Layer 3 link used exclusively to monitor the health of the vPC peer. It sends periodic keepalive messages (typically using UDP port 3200) to detect if the peer switch has failed, enabling the surviving switch to take over the vPC traffic. This link does not carry data traffic, BPDUs, or control-plane information beyond the keepalive probes.

Answer

It is used to forward data traffic between vPC peers

Answer

It must be a dedicated Layer 2 link between vPC peers

Answer

It carries BPDUs to prevent loops

Question 15

A storage administrator reports that a host cannot reach any of the targets on a Cisco MDS 9000 Series switch. The VSAN configuration is correct, and all interfaces are up. Which two commands should be used to verify the Fibre Channel name server database and zoning configuration?

Accepted Answer

show zoneset active. The 'show zoneset active' command displays the currently active zone set, which is essential for verifying which zones are enforced by the switch. Since the VSAN configuration is correct and interfaces are up, a missing or incorrect active zone set could prevent the host from reaching any targets, even if the name server database is populated.

Answer

show zone

Answer

show flogi database

Answer

show fcns details