350-601 Practice Test 42 — 15 Questions

Question 1

Which TWO of the following are valid methods to enforce security on a Cisco Nexus switch? (Choose two.)

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is a valid security enforcement method on Cisco Nexus switches because it protects the control plane from excessive or malicious traffic by applying QoS policies that rate-limit packets destined for the supervisor module. By filtering traffic such as routing protocols, SSH, or ICMP, CoPP prevents CPU overload and DoS attacks, directly enforcing security at the control plane level.

Answer

SSHv2

Answer

NetFlow

Answer

FabricPath

Question 2

In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?

Accepted Answer

RBAC in UCS Manager. UCS Manager role-based access control (RBAC) allows granular assignment of privileges to users.

Answer

CoPP

Answer

IP Source Guard

Answer

SED encryption

Question 3

A UCS domain is experiencing intermittent storage connectivity. The storage admin confirms the SAN is properly zoned and the VSANs are configured. The UCS admin finds that the host interface (HBAs) are showing 'Link Down' intermittently. Which of the following is a likely cause?

Accepted Answer

Faulty SFP or cable. Intermittent 'Link Down' on HBAs, despite correct SAN zoning and VSAN configuration, strongly points to a physical-layer issue. Faulty SFPs or damaged cables cause intermittent link flaps, which manifest as sporadic HBA link-down events. This is the most common cause of such symptoms in UCS environments.

Answer

Incompatible HBA firmware

Answer

Mismatched fabric failover policy

Answer

Incorrect Fibre Channel interface mode on the FI

Question 4

Which TWO statements about Cisco UCS service profiles are correct? (Choose TWO.)

Accepted Answer

Service profiles can include policies for firmware management.. Option B is correct because a Cisco UCS service profile is a logical container that can include firmware management policies (such as host firmware packages and BIOS settings), allowing consistent firmware versions to be applied when the profile is associated with a server. Option C is correct because a service profile is a logical identity that can be associated with only one physical server (or server pool slot) at any given time; association binds the profile's identities and policies to that specific server. Options A, D, and E are incorrect: service profiles are supported on both B-Series blades and C-Series rack servers, they are explicitly hardware-independent (decoupling logical identity from physical hardware so they can be moved between servers), and they do include network identity settings such as MAC addresses, WWNNs, and WWPNs.

Answer

Service profiles are only supported on B-Series blades.

Answer

Service profiles are tied to specific physical hardware.

Answer

A service profile does not include network identity settings such as MAC addresses.

Question 5

A company uses hard zoning based on World Wide Names (WWNs) to control access between servers and storage arrays. An administrator needs to add a new server with WWPN 50:00:00:00:00:00:01:23 to the zone. What is an advantage of hard zoning over soft zoning?

Accepted Answer

Hard zoning is enforced by the switch hardware and provides better security.. Hard zoning is enforced in the switch hardware (the ASIC) by programming the port's forwarding tables based on the WWN-to-port mapping, so frames from a device in one zone are physically prevented from being forwarded to ports outside its zone. This hardware enforcement makes hard zoning more secure than soft zoning, which only relies on the end device respecting the name server's zone information and can be bypassed by a misbehaving or malicious host.

Answer

Hard zoning requires less configuration effort.

Answer

Hard zoning allows devices to communicate across VSANs.

Answer

Hard zoning prevents unauthorized devices from accessing the fabric even if they spoof a WWN.

Question 6

In VXLAN, what is the role of the VNI in the overlay network?

Accepted Answer

Identifies the overlay network segment. The VNI (VXLAN Network Identifier) is a 24-bit field in the VXLAN header that uniquely identifies a Layer 2 overlay network segment, analogous to a VLAN ID in traditional networking. It allows multiple tenants or broadcast domains to coexist over a shared underlay network by isolating traffic at the overlay level.

Answer

Identifies the VTEP

Answer

Encapsulation type

Answer

Specifies the underlay VRF

Question 7

An engineer is designing a SAN for a virtualized environment. Which two best practices should be followed for Fibre Channel zoning?

Accepted Answer

Use single-initiator zoning.. Option A is correct because single-initiator zoning (one initiator per zone with its target(s)) is the recommended Fibre Channel best practice: it limits the number of devices that can see each other, reduces the size of the name-server and RSCN (Registered State Change Notification) propagation domain, and prevents disruptive interactions between hosts in a virtualized environment where many VMs share HBAs. Option E is correct because zoning should be performed using WWPNs (World Wide Port Names), which uniquely identify a specific HBA port, rather than WWNNs (World Wide Node Names), which identify the node and can be shared across multiple ports, making port-level access control ambiguous. Option B is not recommended because placing multiple initiators in one zone increases the visibility domain, RSCN storms, and the risk of one host's misbehavior affecting others. Option C is wrong because soft zoning relies only on name-server filtering and does not enforce isolation in the fabric hardware, so hard (port-level) zoning is preferred for security and determinism. Option D is wrong because disabling zoning removes access control and fabric isolation entirely, which is never a performance best practice.

Answer

Use multiple initiators in a single zone.

Answer

Use soft zoning exclusively.

Answer

Disable zoning for performance.

Question 8

A network engineer is configuring a UCS service profile for a B-series blade server. The goal is to allow the blade to be replaced without requiring reconfiguration of network identities. Which UCS feature enables this capability?

Accepted Answer

Stateless computing via service profile. Stateless computing via service profiles decouples the server's identity (UUID, MAC addresses, WWNN/WWPN, firmware, BIOS settings) from the physical blade, storing it in UCS Manager. When a blade is replaced, the same service profile is associated with the new blade, and all network identities and policies are reapplied automatically, eliminating reconfiguration.

Answer

Fabric Interconnect failover

Answer

CIMC out-of-band management

Answer

UCS Central global policies

Question 9

An engineer is configuring a storage network with FCoE and must ensure that the FCoE traffic does not interfere with standard LAN traffic. Which two mechanisms should be implemented?

Accepted Answer

Enable PFC on the FCoE VLAN.. Option C is correct because Priority Flow Control (PFC, defined in IEEE 802.1Qbb) provides per-priority, lossless behavior on the FCoE VLAN, which is required so that FCoE frames (which are not retransmitted by the Fibre Channel stack) are not dropped during congestion. Option D is correct because placing FCoE traffic on a dedicated VLAN isolates it from standard LAN traffic, preventing broadcast storms, congestion, and other LAN behavior from affecting storage traffic. Options A, B, and E do not belong: sharing one VLAN for FCoE and LAN (A) defeats the isolation requirement, disabling flow control (B) removes the lossless guarantee FCoE needs, and using jumbo frames only for LAN traffic (E) is irrelevant and would actually be backwards, since FCoE typically benefits from jumbo frames on the storage path.

Answer

Use the same VLAN for FCoE and LAN.

Answer

Disable flow control on FCoE VLAN.

Answer

Use jumbo frames for LAN traffic only.

Question 10

Which technology provides at-rest encryption for disk drives in UCS servers?

Accepted Answer

SED. Self-encrypting drives (SED) provide at-rest encryption.

Answer

IPsec

Answer

FC-SP-2

Answer

SSL

Question 11

An organization wants to encrypt data at rest in a storage array. Which two technologies can be used? (Choose two.)

Accepted Answer

SAN array encryption. SAN array encryption (A) is correct because it performs encryption at the storage-array level, protecting data at rest on the array's disks regardless of the attached hosts. Self-encrypting drives (SED) (E) are also correct because the drive hardware itself encrypts data as it is written to the media, providing data-at-rest protection at the device level. MACsec (B) is incorrect because it secures Layer 2 Ethernet links in transit, not data at rest. IPsec (C) is incorrect because it protects IP traffic in transit across a network. FC-SP-2 (D) is incorrect because it provides Fibre Channel authentication and security for fabric traffic, not encryption of stored data.

Answer

MACsec

Answer

IPsec

Answer

FC-SP-2

Question 12

An engineer is configuring BGP EVPN for VXLAN in a spine-leaf fabric. The leaf switches must advertise host IP-to-MAC mappings to the control plane. Which BGP address family should be enabled on the leaf switches?

Accepted Answer

address-family l2vpn evpn. In a VXLAN BGP EVPN fabric, leaf switches must advertise host IP-to-MAC mappings using the BGP EVPN address family. This is enabled with the command 'address-family l2vpn evpn' under the BGP configuration, which carries Type-2 routes (MAC/IP advertisement routes) that contain both the MAC address and the associated IP address of the host.

Answer

address-family vpnv4 unicast

Answer

address-family ipv4 unicast

Answer

address-family link-state

Question 13

Which TWO statements are true about VPC consistency checks? (Choose two.)

Accepted Answer

The 'show vpc consistency-parameters' command displays the status.. Option C is correct because the 'show vpc consistency-parameters' command is the standard NX-OS command used to display the consistency status of global, interface, and VLAN-level parameters across vPC peers, showing which parameters are consistent or inconsistent. Option E is correct because when a type-1 (critical) parameter is inconsistent between vPC peers, the affected vPC member port is suspended (brought down) to prevent traffic loops or black-holing, while type-2 inconsistencies only trigger a warning. Option A is incorrect because not all parameters must match exactly — only type-1 parameters must match, whereas type-2 parameters can differ and merely generate a warning. Option B is incorrect because vPC consistency checking is always enabled and runs automatically; it is not an optional feature that is disabled by default. Option D is incorrect because consistency checks run continuously (periodically and on configuration changes), not solely when the peer-link comes up.

Answer

All configuration parameters must match exactly on both peers.

Answer

Consistency check is optional and disabled by default.

Answer

Consistency check is performed only when the peer-link comes up.

Question 14

In a HyperFlex cluster, what is the function of the cluster witness VM when replication factor 3 (RF3) is used?

Accepted Answer

It provides a quorum vote to prevent split-brain scenarios.. In a HyperFlex cluster with RF3, three copies of data are already stored across the three nodes, so no additional replica is needed. The witness VM exists solely to cast a tie-breaking vote in the cluster quorum, preventing a split-brain scenario where two partitions of the cluster each believe they are authoritative. Because RF3 already provides data redundancy, the witness only contributes to quorum decisions, not to data storage or replication.

Answer

It stores a third replica of all data to reduce storage requirements.

Answer

It handles storage replication tasks.

Answer

It serves as a backup node for failover.

Question 15

In an ACI fabric, an automation engineer needs to deploy tenant policies in an idempotent manner. Which approach is most aligned with best practices?

Accepted Answer

Use Ansible with state: present in the cisco.aci collections. Ansible's `state: present` in the `cisco.aci` collection inherently provides idempotency: it checks the current state of the ACI object and only applies changes if the desired state differs, ensuring no duplicate or conflicting configurations. This aligns with best practices for automation, as it avoids manual error handling and guarantees consistent policy deployment without side effects.

Answer

Use the REST API with POST method for each creation

Answer

Write CLI scripts using expect or pexpect

Answer

Use Python SDK with a check-and-create loop