350-601 Practice Test 4 — 10 Questions

Question 1

A data center designer is evaluating oversubscription ratios in a spine-leaf topology with 40 leaf switches and 4 spine switches. Each leaf has 4x100G uplinks to spines, and each spine has 40x100G downlinks. The leaf switches have 48x25G server ports. What is the oversubscription ratio from the server ports to the spine uplinks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

3:1. The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48x25G server ports = 1200G, and 4x100G uplinks = 400G, giving a leaf-level ratio of 3:1 (1200:400). Since all leaves are identical and the spine count doesn't affect the leaf-level ratio, the overall ratio remains 3:1.

Answer

2:1

Answer

4:1

Answer

5:1

Question 2

A storage array supports RAID-5, RAID-6, and RAID-10. The array has 12 disks of equal size. The requirement is to maximize usable capacity while tolerating up to two simultaneous disk failures without data loss. Which RAID level should be chosen?

Accepted Answer

RAID-6. RAID-6 can tolerate two disk failures with parity overhead of 2 disks, providing high usable capacity. RAID-5 tolerates only one failure; RAID-10 tolerates multiple failures but capacity is 50%.

Answer

RAID-10

Answer

RAID-5

Answer

RAID-0

Question 3

Two data center switches are connected via a fiber link. They need to encrypt all traffic at Layer 2. Which configuration is required on both switches to establish MACsec?

Accepted Answer

Enable MACsec and configure a pre-shared key or CA. MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption between directly connected switches. To establish a MACsec session, both switches must enable MACsec on the interface and either configure a pre-shared key (PSK) or use a CA (Connectivity Association) key agreement protocol like MKA (MACsec Key Agreement, IEEE 802.1X-2010). This ensures all Ethernet frames are encrypted at the data link layer.

Answer

Configure the interface as a trunk

Answer

Enable IPsec on the interface

Answer

Enable 802.1X on the interface

Question 4

An engineer configures vPC on a pair of Nexus switches. The vPC peer-keepalive link fails, but the vPC peer-link remains operational. What is the expected behavior?

Accepted Answer

The vPC domain remains operational with both switches forwarding traffic.. When the vPC peer-keepalive link fails but the peer-link remains up, the vPC domain continues to operate normally because the peer-link is used for control-plane synchronization and data-plane forwarding. The peer-keepalive is only a secondary heartbeat to detect a dual-active scenario when the peer-link is down. Since the peer-link is still functional, both switches can exchange vPC consistency parameters and forward traffic without risk of loops.

Answer

Both switches suspend all vPC member ports to avoid loops.

Answer

The primary switch reloads to prevent a split-brain scenario.

Answer

The secondary switch suspends its vPC member ports.

Question 5

An administrator wants to create separate FC fabrics on a single Cisco MDS switch for isolation of production and backup traffic. Which technology should they use?

Accepted Answer

VSAN. VSANs (Virtual SANs) allow a single physical MDS switch to be partitioned into multiple logical Fibre Channel fabrics, each with its own fabric services, zoning, and domain ID. This provides the isolation needed to separate production and backup traffic on the same hardware.

Answer

PortChannel

Answer

NPV

Answer

Zoning

Question 6

A Fibre Channel fabric has multiple initiators and targets. The engineer wants to ensure that only specific hosts can access specific storage volumes. Which zoning practice is most secure?

Accepted Answer

Single-initiator zoning with WWPNs. Single-initiator zoning with WWPNs is the most secure practice because it creates a one-to-one mapping between a single initiator and its target(s) using the globally unique World Wide Port Name. This eliminates any possibility of unauthorized access or interference from other initiators, as each zone contains exactly one initiator, preventing any form of 'spoofing' or 'zoning overlap' that could allow a rogue host to access storage volumes it should not see.

Answer

Zoning by storage array aliases

Answer

Using VSANs instead of zones

Answer

Soft zoning with domain/port IDs

Question 7

A storage administrator connects a host to an MDS switch via Fibre Channel. The host has an HBA with WWPN 21:00:00:1b:32:12:34:56. Which port type does the MDS switch automatically configure on the interface connecting to the host?

Accepted Answer

F-port. When a host HBA (N-port) connects to an MDS switch, the switch port automatically configures itself as an F-port (Fabric port) to serve the N-port. F-ports provide fabric services (name server, login, zoning) to attached node ports. This is the standard SAN topology: N-port on the host, F-port on the switch.

Answer

Trunk port

Answer

NP-port

Answer

E-port

Question 8

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Accepted Answer

DHCP Snooping. DHCP Snooping (A) is correct because it builds a trusted binding table of MAC-to-IP-to-port mappings by inspecting DHCP traffic, which prevents rogue DHCP servers and serves as the foundation for other Layer 2 protections. IP Source Guard (C) is correct because it uses the DHCP Snooping binding table to filter out frames with spoofed source IP or MAC addresses on untrusted ports, blocking IP/MAC spoofing attacks. Dynamic ARP Inspection (D) is correct because it validates ARP packets against the DHCP Snooping binding database, dropping ARP spoofing/poisoning attempts used for man-in-the-middle attacks. RBAC (B) is not a Layer 2 attack mitigation but an access-control mechanism for managing user privileges on the switch, and CoPP (E) is a control-plane policing feature that rate-limits traffic destined to the CPU, protecting the control plane rather than mitigating Layer 2 attacks like spoofing or DHCP/ARP abuse.

Answer

RBAC

Answer

CoPP

Question 9

An administrator needs to perform a remote firmware upgrade on a UCS C220 rack server. The server has CIMC configured with an IP address. Which method should the administrator use to upgrade the CIMC firmware?

Accepted Answer

Use the CIMC web interface to upload and apply the firmware image.. The CIMC (Cisco Integrated Management Controller) on a standalone UCS C-Series rack server is managed via its own web interface, which provides a Firmware Management section where the administrator can upload a firmware image and apply it directly to the CIMC. This is the standard, supported method for a remote CIMC firmware upgrade when only the CIMC IP is available. No UCS Manager or external supervisor is required for a standalone C-series server.

Answer

Use the KVM console to boot from a firmware upgrade ISO.

Answer

Use UCS Manager to upgrade the firmware of the C-series server.

Answer

Use Cisco IMC Supervisor to upgrade firmware across multiple servers.

Question 10

Match each Cisco UCS component to its function.

Accepted Answer

Fabric Interconnect: Manages network connectivity and provides management access.. The correct matches are: Fabric Interconnect provides network connectivity and management; UCS Manager provides unified management; Blade Chassis houses servers and provides power/cooling. Common confusions include swapping functions with I/O Module or between chassis and interconnect.

Answer

Fabric Interconnect: Houses blade servers and provides power and cooling.

Answer

UCS Manager: Connects blade chassis to fabric interconnects.

Answer

Blade Chassis: Provides network connectivity and management.