350-601 Practice Test 41 — 15 Questions

Question 1

A UCS administrator needs to update the firmware on a remote rack server that is not reachable via the production network. Which two features of Cisco IMC can be used? (Choose two.)

Accepted Answer

Virtual media. Cisco IMC's Virtual Media (option C) lets the administrator mount a remote ISO image over the network as if it were a local DVD drive, so the firmware update package can be booted and applied even though the server's production network is unreachable. The KVM console (option E) provides out-of-band, browser-based keyboard, video, and mouse access to the server through Cisco IMC, allowing the administrator to interact with the boot process and run the update locally. Together, KVM plus Virtual Media form the standard out-of-band firmware-update path for a remote rack server. Syslog (A) and SNMP traps (B) are only event/logging and alerting mechanisms and cannot deliver or install firmware, while HTTP server integration (D) is a configuration/automation interface, not a mechanism for booting or updating the host.

Answer

Syslog

Answer

SNMP traps

Answer

HTTP server integration

Question 2

Which of the following best describes stateless computing in Cisco UCS?

Accepted Answer

All server configuration is stored in the service profile, allowing any physical blade to assume the identity.. Stateless computing means that all configuration (BIOS, firmware, network, storage settings) is stored in the service profile on UCS Manager, not on the server. Thus, a failed blade can be replaced without reconfiguration.

Answer

VLANs and VSANs are not configured on the Fabric Interconnects.

Answer

Server state is saved to a local disk for recovery.

Answer

The server has no operating system installed.

Question 3

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

Accepted Answer

Enable DHCP snooping globally and configure uplink ports as trusted.. DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.

Answer

Enable dynamic ARP inspection on all VLANs.

Answer

Enable IP source guard on all access ports.

Answer

Enable MAC port security on all access ports.

Question 4

In a spine-leaf architecture using eBGP as the routing protocol, what is the primary purpose of using eBGP rather than iBGP between spine and leaf switches?

Accepted Answer

To avoid the need for an IGP and simplify configuration. In a spine-leaf architecture using eBGP, the primary purpose is to avoid the need for an IGP (such as OSPF or IS-IS) and simplify configuration. eBGP between spine and leaf switches allows each leaf to be in a different private AS (e.g., 65001–650XX), and the spine can use the BGP AS_PATH to detect and prevent loops without requiring an underlying IGP. This eliminates the complexity of running a separate IGP for underlay routing, reducing operational overhead and configuration steps.

Answer

To enable faster convergence than OSPF

Answer

To support EVPN address families

Answer

To allow for unequal-cost load balancing

Question 5

A large cloud provider is building a new data center using Cisco ACI with multiple leaf and spine switches. They plan to host thousands of tenants with overlapping IP addresses in different VRFs. The network team has deployed the fabric with a common security policy. During testing, they discover that traffic from Tenant A to Tenant B is being allowed even though a contract should deny it. The APIC policy shows the contract is applied to the EPGs and the deny rule is present. What is the most likely cause of the policy not being enforced?

Accepted Answer

The leaf switches have not downloaded the updated policy.. In Cisco ACI, the leaf switches enforce contracts locally based on the policy downloaded from the APIC. If a contract is correctly configured on the APIC but traffic is still permitted, the most likely cause is that the leaf switches have not yet received or applied the updated policy. This can happen due to a delay in policy propagation, a communication issue between the APIC and leaf switches, or the leaf not having completed the policy resolution process.

Answer

The fabric is using VRF leaking that bypasses contracts.

Answer

The contract is not configured with the correct subject.

Answer

The EPGs are in the same bridge domain.

Question 6

When troubleshooting a VXLAN EVPN fabric with Cisco Nexus 9000 switches, which three commands provide information about the EVPN operation? (Choose three.)

Accepted Answer

show bgp l2vpn evpn summary.. The 'show bgp l2vpn evpn summary' command is correct because it displays the BGP session status for the L2VPN address family, which is the control plane protocol for VXLAN EVPN. This command shows neighbor states, prefixes received, and route table statistics, directly indicating whether EVPN route exchange is operational.

Answer

show running-config interface nve1.

Answer

show ip interface brief.

Question 7

An engineer wants to automate the configuration of BGP on a Nexus switch using Ansible. Which module from the cisco.nxos collection is appropriate?

Accepted Answer

nxos_bgp. The nxos_bgp module is designed to manage BGP configuration on NX-OS devices.

Answer

nxos_interface

Answer

nxos_config

Answer

nxos_vlan

Question 8

An engineer notices that AAA authentication using RADIUS is failing, and the RADIUS server logs show no incoming authentication requests. Which of the following is the most likely cause?

Accepted Answer

The device has not been configured with any RADIUS server host. If the RADIUS server logs show no incoming authentication requests, the issue is that the device is not sending any traffic to the server. This occurs when no RADIUS server host is configured on the device, meaning the device has no IP address or hostname to which it can send authentication packets. Without a configured server host, the device will not attempt any RADIUS communication, resulting in zero requests reaching the server.

Answer

The device is using TACACS+ instead of RADIUS

Answer

The RADIUS server is not reachable due to a firewall

Answer

The RADIUS shared secret is incorrect

Question 9

Which THREE components are part of an EVPN VXLAN fabric? (Choose three)

Accepted Answer

MP-BGP. MP-BGP is the control plane protocol for EVPN VXLAN fabrics. It advertises MAC/VPN reachability information using EVPN address families (L2VPN AFI/SAFI 70/128) and enables overlay route distribution between VTEPs. Without MP-BGP, the fabric cannot dynamically learn remote MAC addresses or maintain a scalable, loop-free control plane.

Answer

IS-IS

Answer

VPC

Question 10

Which two features allow running Python scripts directly on a Cisco Nexus switch? (Choose two.)

Accepted Answer

EEM with Python applets. EEM with Python applets (A) is correct because the Embedded Event Manager on Nexus switches supports Python applets, allowing Python scripts to be triggered directly by system events on the switch itself. Guest shell (C) is correct because it provides a Linux container (based on CentOS) on the Nexus switch where Python scripts can be executed locally via the guestshell command. NX-API REST (B) only exposes switch functionality over HTTP/HTTPS for remote programmatic calls; it does not run Python scripts on the switch. Ansible (D) and Terraform (E) are external automation/orchestration tools that run on a management host and interact with the switch remotely, not on the switch itself.

Answer

NX-API REST

Answer

Ansible

Answer

Terraform

Question 11

Which TWO statements are true regarding the differences between REST API (NX-API) and NETCONF for automating Nexus switches?

Accepted Answer

NX-API uses HTTP/HTTPS as the transport protocol. Option B is correct because NX-API on Nexus switches is a REST-based interface that transports requests over HTTP or HTTPS, typically using JSON or XML payloads. Option D is correct because NETCONF is defined in RFC 6241 and uses YANG (RFC 6020/7950) as its standardized data modeling language for configuration and state data. Option A is false because NETCONF supports both configuration (edit-config) and operational state retrieval (get, get-config). Option C is false because NETCONF primarily uses XML encoding, not JSON, though JSON encodings exist in some implementations. Option E is false because NX-API defaults to HTTP/HTTPS, not SSH, while NETCONF commonly uses SSH as its transport.

Answer

NETCONF can only be used for configuration, not for operational state

Answer

NETCONF primarily uses JSON for data encoding

Answer

Both use SSH as their default transport

Question 12

Which feature in NX-OS allows for direct API calls to the switch for automation purposes?

Accepted Answer

NX-API. NX-API (option A) is the correct answer because it is the native NX-OS feature that exposes a RESTful API interface, allowing direct HTTP/HTTPS calls (e.g., GET, POST, PUT, DELETE) to the switch for automation and programmability. This enables tools like Ansible, Postman, or custom scripts to send structured data (JSON/XML) to configure, monitor, and manage the switch without requiring CLI parsing or SSH sessions.

Answer

Python scripting

Answer

Bash shell

Answer

SNMP

Question 13

A network engineer is troubleshooting an OSPF adjacency that fails to reach FULL state between two Nexus 9000 switches. Which TWO are common causes for this issue?

Accepted Answer

Mismatched area ID. OSPF requires that both routers in a neighbor relationship belong to the same area. If the area IDs differ, the routers will not exchange routing information and the adjacency will stall at the EXSTART or EXCHANGE state, never reaching FULL. This is a fundamental OSPF neighbor requirement defined in RFC 2328.

Answer

Mismatched OSPF process ID

Answer

Mismatched router ID

Answer

Mismatched network type

Question 14

A mid-size organization is upgrading its data center network to support server virtualization. They have deployed two Nexus 9300 switches as access switches for their server racks. The servers are configured with VLAN tagging and connect to the switches using trunks. The network administrator needs to ensure that the switches can provide default gateway services to the servers to reduce latency. They have configured interface VLAN interfaces and HSRP for redundancy. After implementation, the servers can communicate within the same VLAN but fail to reach the default gateway. The network administrator checks the switch configuration and finds that "ip routing" is not enabled globally. What is the most likely impact of this missing configuration?

Accepted Answer

The switches will not forward traffic between VLANs.. Without the 'ip routing' command enabled globally, the Nexus 9300 switches operate as Layer 2 devices only. This means they can forward frames within the same VLAN (since that relies on MAC address learning and switching), but they cannot perform IP routing between VLANs or route traffic to the configured SVI (VLAN interface) default gateway. The servers can communicate within the same VLAN because that is purely Layer 2 switching, but any attempt to reach the default gateway (which requires Layer 3 forwarding) fails because the switch does not have IP routing enabled.

Answer

The servers will not receive DHCP addresses.

Answer

HSRP will not elect an active router.

Answer

The VLAN interfaces will not come up.

Question 15

Which Fibre Channel frame field is used to identify the upper-layer protocol being carried?

Accepted Answer

R_CTL. The R_CTL (Routing Control) field in the Fibre Channel frame header is used to identify the upper-layer protocol being carried, such as SCSI-FCP, IP, or VI. It contains the routing bits and information category that specify the frame type and protocol context, enabling the receiver to interpret the payload correctly.

Answer

Source FC ID

Answer

D_ID

Answer

CS_CTL