350-601 Practice Test 43 — 15 Questions

Question 1

An engineer needs to connect a new server to an existing FC SAN. The server is located 50 km away from the data center. Which technology should be used to extend the FC SAN over this distance?

Accepted Answer

FCIP. FCIP (Fibre Channel over IP) is the correct choice because it encapsulates Fibre Channel frames inside TCP/IP packets, enabling the extension of FC SANs over long distances (beyond the 10 km limit of standard optics) by leveraging existing IP WAN infrastructure. This allows the 50 km connection while preserving native Fibre Channel semantics and fabric services.

Answer

iSCSI

Answer

FCoE

Answer

Direct FC connection with 10km optics

Question 2

Which YANG model is commonly used for vendor-neutral network configuration and operations?

Accepted Answer

OpenConfig YANG models. OpenConfig is a vendor-neutral YANG model initiative. Cisco native YANG models are vendor-specific. NETCONF and RESTCONF are protocols, not models.

Answer

NETCONF

Answer

Cisco native YANG models

Answer

RESTCONF

Question 3

An MDS switch is configured with VSANs 100 and 200. The engineer wants to isolate traffic between two storage arrays on the same physical fabric. Which best practice should be applied?

Accepted Answer

Place each array in a different VSAN.. VSANs provide complete isolation of traffic at Layer 2, creating separate fabric topologies within the same physical infrastructure. Placing each storage array in a different VSAN ensures that Fibre Channel frames from one array never reach the other, even though they share the same MDS switch hardware. This is the recommended best practice for separating storage traffic that must not interact.

Answer

Use zones within the same VSAN to separate arrays.

Answer

Enable QoS to prioritize storage traffic.

Answer

Configure a port channel between the switches.

Question 4

An engineer is writing a Python script to automate ACI fabric discovery using the APIC SDK. The script needs to wait until the fabric formation is complete before proceeding. Which approach is most reliable?

Accepted Answer

Periodically poll the fabric membership state via REST API. The most reliable method to wait for ACI fabric formation to complete is to periodically poll the fabric membership state via the REST API. The APIC SDK provides access to the fabric membership endpoint (e.g., /api/node/class/fabricNode.json), which returns the current state of each node. By polling this endpoint until all expected nodes report an 'active' or 'in-pod' status, the script can accurately determine when the fabric is fully formed, avoiding race conditions or incomplete discovery.

Answer

Implement asynchronous callbacks using the SDK

Answer

Use the configExportP object to monitor discovery

Answer

Use time.sleep() for a fixed duration

Question 5

Which encryption technology is used to secure Fibre Channel traffic in flight between storage and switches?

Accepted Answer

FC-SP-2. FC-SP-2 (Fibre Channel Security Protocol) provides authentication and encryption for Fibre Channel frames.

Answer

SSL

Answer

SED

Answer

IPsec

Question 6

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

Accepted Answer

RADIUS. 802.1X uses RADIUS for communication between the authenticator and the authentication server.

Answer

TACACS+

Answer

LDAP

Answer

DIAMETER

Question 7

Which TWO of these are best practices for securing the Cisco ACI fabric?

Accepted Answer

Use security domains to control RBAC.. Option A is correct because Cisco ACI security domains are the mechanism that scopes RBAC roles to specific tenants, so assigning users to security domains with least-privilege roles limits what each account can view or change in the fabric. Option C is correct because enabling certificate-based authentication for APIC access replaces simple username/password logins with X.509 client certificates validated against a trusted CA, providing stronger, phishing-resistant authentication for fabric administrators. Option B is not a best practice because in-band management exposes the APIC management interface to the data-plane network; out-of-band management on a dedicated management network is preferred. Option D is wrong because default credentials must always be changed during fabric discovery to prevent unauthorized access. Option E is wrong because placing APICs in a DMZ exposes the fabric's management plane to untrusted networks; APICs belong on a protected out-of-band management network.

Answer

Use in-band management for APIC connectivity.

Answer

Leave default passwords for fabric discovery.

Answer

Place APIC controllers in a DMZ.

Question 8

In ACI, when integrating with VMware vSphere, which component is used to automatically push port group configurations to virtual switches?

Accepted Answer

VMM domain. The VMM (Virtual Machine Manager) domain in ACI is the integration point with VMware vSphere. It automatically pushes port group configurations to virtual switches by leveraging the VMware vCenter API, ensuring that ACI network policies are consistently applied to the hypervisor's virtual switches without manual intervention.

Answer

APIC

Answer

Tenant

Answer

L3Out

Question 9

Which of the following is a benefit of using OpenConfig YANG models for network automation?

Accepted Answer

They provide a standard, vendor-neutral data model.. OpenConfig YANG models are vendor-neutral, allowing consistent configuration across multi-vendor environments.

Answer

They replace the need for NETCONF or RESTCONF.

Answer

They only support read-only operations.

Answer

They are specific to Cisco devices only.

Question 10

Which TWO statements are true regarding VXLAN BUM traffic handling? (Choose two.)

Accepted Answer

Ingress replication requires the ingress VTEP to maintain a list of remote VTEPs.. Option A is correct because with ingress replication the ingress VTEP itself must perform the head-end replication, so it needs to know the full list of remote VTEPs participating in the VXLAN VNI and send a copy of each BUM frame to every one of them. Option B is correct because multicast-based replication relies on the underlay delivering BUM traffic to a multicast group, which requires a multicast routing protocol such as PIM (typically PIM-SM) in the underlay, along with IGMP for group membership. Option C is not correct because ingress replication does not scale better than multicast in large fabrics; it consumes more ingress VTEP bandwidth and requires larger VTEP lists, whereas multicast offloads replication to the network. Option D is not correct because IGMP snooping is a Layer 2 optimization for constraining multicast flooding, not the mechanism that builds the remote VTEP replication list; multicast-based VXLAN uses a configured multicast group per VNI. Option E is not correct because ingress replication is independent of the underlay routing protocol and can run over OSPF, IS-IS, BGP, or static routing.

Answer

Ingress replication scales better than multicast in large fabrics.

Answer

Multicast-based replication uses IGMP snooping to build replication lists.

Answer

Ingress replication is only supported with OSPF underlay.

Question 11

Which TWO commands are used on NX-OS to verify vPC status and consistency? (Choose two.)

Accepted Answer

show vpc consistency-parameters. Option A, 'show vpc consistency-parameters', is correct because it displays the consistency parameters (such as STP, MTU, and VLAN settings) that must match between vPC peer switches, and it flags any type-1 or type-2 mismatches that would prevent the vPC from coming up. Option C, 'show vpc', is correct because it gives the overall vPC status, including the vPC domain ID, peer status, peer-link status, and the state of each vPC (up/down) along with the consistency status. Option B, 'show port-channel summary', only shows port-channel and member-link states and does not report vPC peer or consistency information. Option D, 'show running-config vpc', merely displays the vPC configuration in the running configuration rather than verifying operational status or consistency. Option E, 'show vpc role', shows the role (primary/secondary) and priority but does not verify vPC status or consistency parameters.

Answer

show port-channel summary

Answer

show running-config vpc

Answer

show vpc role

Question 12

In a spine-leaf architecture, what is the primary advantage of having multiple spine switches?

Accepted Answer

Redundancy and load balancing. In a spine-leaf architecture, multiple spine switches provide redundancy by ensuring that if one spine fails, traffic can still flow through other spines. They also enable load balancing because leaf switches can use equal-cost multipath (ECMP) routing to distribute traffic across all available spine uplinks, maximizing bandwidth utilization and preventing congestion on any single path.

Answer

Lower latency

Answer

Simplified management

Answer

Increased oversubscription

Question 13

In a VXLAN BGP EVPN fabric, which component is responsible for handling BUM traffic using ingress replication, and how does the VTEP learn the list of remote VTEPs to replicate to?

Accepted Answer

The ingress VTEP learns remote VTEPs via MP-BGP EVPN Type 3 routes.. In a VXLAN BGP EVPN fabric, ingress replication is the default method for handling BUM traffic, where the ingress VTEP replicates packets and sends unicast copies to each remote VTEP. The ingress VTEP learns the list of remote VTEPs from MP-BGP EVPN Type 3 routes (Inclusive Multicast routes), which advertise the VNI and the originating VTEP's IP address, allowing the ingress VTEP to build its replication list.

Answer

The ingress VTEP learns remote VTEPs via IGMP snooping.

Answer

The egress VTEP sends unicast copies to all other VTEPs.

Answer

The spine switch performs replication to all leaf VTEPs.

Question 14

A network engineer needs to retrieve the operational state of interfaces from a Nexus switch using a YANG-based protocol. Which protocol should be used to get structured data via REST?

Accepted Answer

RESTCONF. RESTCONF is a protocol that provides a RESTful interface for accessing YANG-modeled data. It uses HTTP methods (GET, POST, PUT, DELETE) to retrieve and manipulate configuration and operational state. NETCONF is also YANG-based but uses SSH and XML RPC, not REST.

Answer

NETCONF

Answer

NX-API CLI

Answer

SNMP

Question 15

In a UCS 5108 chassis, which component provides the connectivity between the blade servers and the Fabric Interconnects?

Accepted Answer

IOM (FEX). In a UCS 5108 chassis, the IOM (also called a Fabric Extender or FEX) is the component that aggregates blade server traffic and uplinks it to the Fabric Interconnects. Each blade connects to the midplane, and the IOMs sit at the back of the chassis to forward that traffic northbound to the FIs. This makes the IOM the actual connectivity bridge between blades and FIs.

Answer

Midplane

Answer

Chassis management controller

Answer

Fabric Interconnect