350-601 Practice Test 42 — 15 Questions

Question 1

Refer to the exhibit. An administrator updates template-B but its associated profile SP2 shows 'unassigned'. The administrator wants SP2 to reflect the changes. What should be done first?

Accepted Answer

Associate SP2 with template-B using the 'bind' operation. In Cisco UCS Manager, a service profile (SP2) must be explicitly bound to a template (template-B) to inherit updates. The 'bind' operation associates the profile with the template, allowing changes made to the template to propagate to the profile. Simply disabling and re-enabling the template or waiting for automatic association does not establish this binding; the profile remains 'unassigned' until it is bound.

Answer

Disable and re-enable template-B

Answer

Wait for the automatic association to occur

Answer

Rebind all profiles to template-B

Question 2

A company is deploying a multi-tenant environment with several virtualized hosts using NPIV. Each virtual machine requires its own WWPN. During testing, some VMs cannot log into the SAN. The MDS switch logs show 'FLOGI rejected: no available resources'. What is the most likely cause?

Accepted Answer

The NPIV limit or the number of allowed logins has been exceeded on the upstream switch. The error 'FLOGI rejected: no available resources' on an MDS switch in an NPIV environment indicates that the switch has exhausted its allocated resources for handling fabric logins (FLOGIs) from N_Port ID Virtualization (NPIV) initiators. NPIV allows multiple virtual WWPNs to share a single physical FC port, but each virtual login consumes a login resource on the upstream switch. When the NPIV limit or the maximum number of allowed logins per interface or per VSAN is exceeded, the switch rejects new FLOGIs, preventing VMs from logging into the SAN.

Answer

The maximum FC frame size is set incorrectly on the switch

Answer

The VSAN maximum number of devices has been reached

Answer

The zone set is full and cannot accept more members

Question 3

An engineer needs to isolate storage traffic for different departments using Fibre Channel switches. Which technology should be used?

Accepted Answer

VSAN (Virtual SAN). VSAN (Virtual SAN) is the correct technology because it allows the engineer to create multiple isolated virtual SANs on a single physical Fibre Channel fabric. Each VSAN operates as an independent SAN with its own fabric services, security policies, and traffic isolation, enabling different departments to have dedicated storage traffic without interference.

Answer

Zoning

Answer

Trunking

Answer

NPV (N-Port Virtualization)

Question 4

Which THREE are characteristics of Cisco TrustSec? (Select exactly 3)

Accepted Answer

Uses SGTs to enforce policy. Cisco TrustSec uses Security Group Tags (SGTs) to enforce policy based on identity rather than IP addresses. It requires Cisco ISE as the policy server to assign SGTs and enforce access control. TrustSec operates at Layer 2 by embedding SGTs in Ethernet frames. The CTS auth-proxy is a mechanism for legacy devices but is not a core characteristic; likewise, MACsec encryption is optional and not required.

Answer

Uses CTS auth-proxy

Answer

Requires MACsec encryption

Question 5

Refer to the exhibit. A new host is connected to interface fc1/3. It is not appearing in the flogi database. The switch is in NPV mode. What is the most likely reason?

Accepted Answer

The interface is configured as an NP port.. In NPV mode, a switch operates as a proxy for FLOGI requests, forwarding them upstream to the core switch. For an interface to accept a host FLOGI, it must be configured as an F port. If the interface is configured as an NP port (which is intended for uplink to the core), it will not accept or forward FLOGI frames from the host. Therefore, the host never appears in the flogi database.

Answer

The FCID is already allocated.

Answer

The host's WWPN is already in use by another device.

Answer

The interface is in a different VSAN than the host's FLOGI.

Answer

The host's HBA is not compatible with NPV.

Question 6

An engineer is configuring zoning on a Cisco MDS switch. The requirement is to allow a single host HBA to access two storage array ports. Which zone configuration meets this requirement?

Accepted Answer

Create one zone with the host's WWPN and one storage port WWPN, and another zone with the host's WWPN and the second storage port WWPN.. The recommended practice for Fibre Channel zoning is to use single-initiator zones, where each zone contains one host WWPN and one storage port WWPN. To allow a single host HBA to access two storage array ports, two zones should be created: the first zone includes the host's WWPN and the first storage port's WWPN, and the second zone includes the same host's WWPN and the second storage port's WWPN. This prevents direct communication between storage ports (which could cause issues) and follows Cisco best practices for MDS zoning. Option C correctly implements this configuration. Options A and B use port IDs or a single zone with multiple targets, which are less secure and not recommended. Option D creates a single zone with all three WWPNs, which allows the storage ports to communicate with each other, potentially leading to errors or instability.

Answer

Create a zone with the host's port ID and both storage port IDs.

Answer

Create one zone with all three WWPNs.

Answer

Create a zone with the host's WWPN and both storage ports as a single zone.

Question 7

An engineer is configuring VXLAN bridging and routing on a Cisco Nexus 9000 switch. Which configuration is required to enable inter-VNI routing?

Accepted Answer

Configure anycast gateway MAC.. Inter-VNI routing requires a shared anycast gateway MAC address across all VTEPs in the same VXLAN fabric. This allows the switch to respond to ARP requests for the gateway IP and forward traffic between different VNIs without relying on a traditional routed interface. The anycast gateway MAC is configured under the VLAN interface (SVI) using the 'fabric forwarding anycast-gateway-mac' command.

Answer

Configure a VLAN interface under the bridge domain.

Answer

Enable ip routing under VRF.

Answer

Configure a VRF and associate the VLAN interface to it.

Question 8

In an ACI fabric, which THREE components are required to define a policy that allows communication between two EPGs?

Accepted Answer

Contract. A contract is required because it defines the rules (filters, subjects, and actions) that govern traffic between EPGs. Without a contract, no communication is allowed between EPGs, even within the same tenant. The consumer EPG initiates the communication and the provider EPG hosts the service, so both are mandatory endpoints of the contract relationship.

Answer

L3Out

Answer

Tenant

Question 9

Which statement about RSTP (802.1w) is true?

Accepted Answer

RSTP reduces convergence time by using a proposal/agreement handshake. RSTP (802.1w) significantly reduces convergence time compared to legacy STP by using a proactive proposal/agreement handshake mechanism. Instead of relying on timers (like STP's 30-50 second convergence), RSTP switches immediately negotiate port roles and transition to forwarding by exchanging proposal and agreement BPDUs, enabling sub-second convergence in a properly designed network.

Answer

RSTP uses a timer-based convergence similar to STP

Answer

RSTP requires explicit configuration of edge ports to prevent loops

Answer

RSTP elects the root bridge based on the highest MAC address

Question 10

A storage array is configured with RAID 10 across 8 disks. How many disks can fail without data loss, assuming optimal configuration?

Accepted Answer

4. RAID 10 mirrors data across two sets and stripes. In a configuration of 8 disks (4 mirrors), one disk per mirror can fail, so up to 4 disks can fail as long as no mirror loses both disks.

Answer

8

Answer

1

Answer

2

Question 11

Match each Cisco data center security feature to its purpose.

Accepted Answer

Port Security: Limits the number of MAC addresses allowed on a port.. Port Security limits MAC addresses per port; DHCP Snooping filters DHCP messages and builds a binding database; Dynamic ARP Inspection validates ARP packets; IP Source Guard filters traffic based on binding table. Common confusions include mixing DHCP Snooping with DAI and Port Security with DHCP Snooping.

Answer

Port Security: Filters DHCP messages to prevent rogue servers.

Answer

DHCP Snooping: Validates ARP packets to prevent spoofing.

Question 12

A data center has 100 Nexus switches in a fabric managed by Cisco Nexus Dashboard Orchestrator (NDO). The network team needs to automate the creation of a new network template that includes multiple VLANs and VRF configurations. They want to ensure that the template is applied consistently across all leaf switches without manual intervention. The engineer writes a Python script using the NDO REST API to create the template and deploy it. However, the deployment fails with an error 'Template validation failed: overlapping IP subnets'. Upon reviewing the template, the engineer notices that two VLANs have overlapping subnet definitions. Which action should the engineer take to resolve this issue efficiently?

Accepted Answer

Manually correct the overlapping subnets in the template and re-run the deployment script. The root cause of the deployment failure is overlapping IP subnets in the template definition. Manually correcting the overlapping subnets in the template and re-running the deployment script directly resolves the validation error without introducing unnecessary complexity or risk. This approach ensures the template is valid before deployment, maintaining consistency across all leaf switches.

Answer

Use the NDO GUI to edit the template and then re-run the script

Answer

Create separate templates for each VLAN to avoid overlaps

Answer

Modify the Python script to ignore validation errors and force the deployment

Question 13

An engineer is hardening a Nexus switch. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Disable unused services like HTTP and Telnet. Disabling unused services, enabling SSH only, and configuring CoPP are standard hardening practices.

Answer

Use SNMPv1 for monitoring

Answer

Enable LLDP on all interfaces

Question 14

An engineer notices that the CPU utilization on a Cisco Nexus 5548UP switch is consistently above 80%. The switch is used for FCoE storage traffic. Which action is most likely to reduce CPU utilization?

Accepted Answer

Reduce the number of FCoE VLANs. High CPU utilization on a Cisco Nexus switch handling FCoE storage traffic is often caused by excessive FCoE Initialization Protocol (FIP) keepalive processing. Reducing the number of FCoE VLANs directly decreases the number of FIP sessions and associated control-plane overhead, lowering CPU load. This is the most effective action because each FCoE VLAN requires separate FIP keepalive handling, and consolidating storage traffic into fewer VLANs reduces the control-plane burden.

Answer

Configure DCBx will-say mode

Answer

Enable FCoE NPV mode

Answer

Disable FIP snooping

Question 15

A Python script using the pyATS framework to parse 'show interface' output on a Nexus 9000 switch fails with a parsing error, even though the CLI command runs successfully. What is the most likely missing component?

Accepted Answer

The Genie parser for the specific NX-OS version is not installed or imported.. The pyATS framework relies on Genie parsers to convert raw CLI output into structured data. If the Genie parser for the specific NX-OS version is missing or not imported, the script cannot parse the 'show interface' output, resulting in a parsing error even though the CLI command itself runs successfully. This is the most likely missing component because pyATS/Genie parsers are version-specific and must be installed for the exact platform and OS version.

Answer

The script does not include the correct authentication method.

Answer

The script uses the wrong device type (e.g., iosxe instead of nxos).

Answer

The switch is not configured with NETCONF.