350-601 Practice Test 43 — 15 Questions

Question 1

An engineer is troubleshooting a BGP EVPN session between a leaf and a spine. The 'show bgp l2vpn evpn summary' output shows the peer state as 'Active'. What does this indicate?

Accepted Answer

The TCP connection is not established.. In BGP EVPN, the 'Active' state indicates that the BGP speaker is actively trying to establish a TCP connection with the peer but has not yet completed the three-way handshake. This means the TCP session is not established, which is a prerequisite for BGP session establishment. The peer remains in 'Active' until the TCP connection is successfully formed.

Answer

The session is in the process of being established.

Answer

The session is up and exchanging prefixes.

Answer

There is a configuration mismatch.

Question 2

An administrator is configuring zoning on a Cisco MDS switch to ensure that two servers can only communicate with their assigned storage arrays. Which three statements about Fibre Channel zoning are correct? (Choose three.)

Accepted Answer

Zoning is configured within a VSAN.. Zoning in Fibre Channel is configured within a VSAN, providing logical isolation. Hard zoning based on WWN enforces security by permitting only specific WWNs to communicate, offering strong access control. A zone can contain multiple devices, including both initiators and targets, allowing flexibility. Soft zoning based on port numbers is less secure than hard zoning, and active zone sets can be modified only when activated, but zone sets can be created or modified without activation. Therefore, statements A, C, and E are correct.

Answer

Only active zone sets can be modified.

Answer

Soft zoning based on port numbers is more secure than hard zoning.

Question 3

In a VXLAN EVPN fabric, BUM traffic can be handled by ingress replication or multicast. Which statement about ingress replication is accurate?

Accepted Answer

The ingress VTEP replicates the BUM packet and sends unicast copies to each remote VTEP.. In ingress replication, the ingress VTEP (VXLAN Tunnel Endpoint) receives a BUM (Broadcast, Unknown unicast, Multicast) packet and creates multiple unicast-encapsulated copies, sending one copy to each remote VTEP in the same VXLAN network identifier (VNI) segment. This method does not rely on any multicast protocol in the underlay; instead, it leverages the VTEP's knowledge of all remote VTEPs (typically learned via the EVPN control plane, such as Type 3 Inclusive Multicast Ethernet Tag routes) to replicate traffic. Option B correctly describes this behavior.

Answer

It requires PIM in the underlay to replicate packets.

Answer

It reduces replication overhead on the ingress VTEP compared to multicast.

Answer

It uses IGMP snooping to optimize replication.

Question 4

When configuring BGP EVPN on spine switches functioning as route reflectors, which two address families must be configured? (Choose two.)

Accepted Answer

address-family l2vpn evpn. B is correct because BGP EVPN (Ethernet VPN) uses the L2VPN address family (l2vpn evpn) to carry MAC/VXLAN routing information between spine and leaf switches. This address family is mandatory for EVPN control plane operation in a VXLAN fabric, enabling MAC address learning and advertisement via MP-BGP.

Answer

address-family link-state

Answer

address-family ipv6 unicast

Answer

address-family vpnv4

Question 5

A Cisco MDS switch is configured with two VSANs. Hosts in VSAN 1 cannot communicate with hosts in VSAN 2. What is the most likely reason?

Accepted Answer

The VSANs are not connected through an IVR zone.. By default, VSANs are isolated from each other, meaning traffic cannot cross VSAN boundaries. Inter-VSAN Routing (IVR) must be explicitly configured to allow communication between hosts in different VSANs. Without IVR, hosts in VSAN 1 and VSAN 2 remain in separate fabrics and cannot communicate, even if they are connected to the same switch.

Answer

The IVR is not configured.

Answer

The FC domain ID is conflicting.

Answer

The switch does not support multi VSAN.

Answer

The hosts are on different switches.

Question 6

Which three checks are part of the vPC type-1 consistency check? (Choose three.)

Accepted Answer

STP mode. Type-1 consistency parameters are critical and must match on both vPC peers; they include STP mode, MST region, VLAN configuration, and vPC-related parameters like role priority. STP mode, MST region name, and VLAN interface configuration are type-1.

Answer

Port-channel load-balancing method

Answer

MTU on the peer-link

Question 7

An engineer is designing a SAN for a virtualized environment with 20 hosts and 4 storage arrays. Each host requires a separate zone per storage array for security. What is the minimum number of zones required?

Accepted Answer

80. In a Fibre Channel SAN with N_Port ID Virtualization (NPIV), each host requires a separate zone per storage array to enforce strict isolation. With 20 hosts and 4 storage arrays, the minimum number of zones is 20 hosts × 4 arrays = 80 zones. This ensures that each host-array pair is isolated, preventing unauthorized access and aligning with security best practices.

Answer

40

Answer

20

Answer

100

Question 8

Which TWO statements are true regarding VXLAN BUM traffic handling? (Choose two.)

Accepted Answer

Ingress replication requires the ingress VTEP to maintain a list of remote VTEPs.. In ingress replication, the ingress VTEP must know all remote VTEPs in the VXLAN segment to unicast-encapsulate and send BUM traffic to each one individually. This list is typically learned via the control plane (e.g., BGP EVPN) or statically configured. Without this list, the ingress VTEP cannot replicate BUM frames to the correct remote destinations.

Answer

Ingress replication scales better than multicast in large fabrics.

Answer

Multicast-based replication uses IGMP snooping to build replication lists.

Answer

Ingress replication is only supported with OSPF underlay.

Question 9

In ACI, a contract is defined between two EPGs. Which component specifies the type of traffic allowed?

Accepted Answer

Subject. A contract contains subjects, which include filters that define traffic types.

Answer

VRF

Answer

Filter

Answer

Tenant

Question 10

Refer to the exhibit. An engineer is troubleshooting poor FCoE performance. The exhibit shows output from the FCoE interface. Which observation indicates a potential issue?

Accepted Answer

PFC frames received is high compared to PFC frames sent. A high count of PFC frames received compared to PFC frames sent indicates that the local interface is receiving many pause frames from the peer, which suggests the peer is experiencing congestion and is forcing the local interface to pause its transmission. This asymmetry is a classic symptom of a buffer congestion or credit starvation issue in the FCoE SAN fabric, leading to poor FCoE performance.

Answer

The CRC error count is zero

Answer

Data frames are 1500 bytes, which is too small for FCoE

Answer

The admin port mode is F instead of NP

Question 11

In an FCoE deployment, a storage administrator needs to ensure that FCoE traffic is carried over a dedicated VLAN. Which configuration is required on a Cisco Nexus switch?

Accepted Answer

Enable FIP snooping and map the FCoE VLAN to a VSAN.. In an FCoE deployment, FIP snooping is required on the Cisco Nexus switch to enforce that only FCoE traffic is carried over a dedicated VLAN. The FCoE VLAN must be mapped to a VSAN to ensure proper isolation and forwarding of storage traffic. This configuration prevents unauthorized devices from injecting FCoE frames and maintains the integrity of the storage network.

Answer

Configure the VLAN as a private VLAN.

Answer

Assign the VLAN as an access VLAN to the interface.

Answer

Configure the VLAN as a native VLAN on the FCoE interface.

Question 12

Which TWO of these are best practices for securing the Cisco ACI fabric?

Accepted Answer

Use security domains to control RBAC.. Security domains in Cisco ACI provide role-based access control (RBAC) by partitioning the fabric into logical groups, allowing administrators to restrict user permissions to specific tenants, EPGs, or policies. This is a core best practice to enforce least-privilege access and prevent unauthorized configuration changes across the fabric.

Answer

Use in-band management for APIC connectivity.

Answer

Leave default passwords for fabric discovery.

Answer

Place APIC controllers in a DMZ.

Question 13

For consistent multi-data-center automation, which tool is best suited to orchestrate both NX-OS and ACI across sites?

Accepted Answer

Cisco NSO. Cisco NSO (Network Services Orchestrator) is the correct tool because it provides multi-domain, multi-vendor orchestration with native support for both NX-OS and ACI through its Network Element Drivers (NEDs). NSO uses a model-driven approach with YANG data models and NETCONF/RESTCONF protocols to manage configuration consistency across distributed data centers, enabling service-level abstraction and closed-loop automation that other tools lack.

Answer

Puppet

Answer

Ansible

Answer

Chef

Question 14

Which THREE components are required to configure a Cisco UCS Direct-attached storage environment using SAS expanders?

Accepted Answer

SAS cables connecting the storage enclosure to the server's storage controller.. In a Cisco UCS Direct-attached storage environment using SAS expanders, SAS cables are required to physically connect the storage enclosure to the server's storage controller (typically an LSI-based SAS HBA). This direct cabling enables the SAS protocol to carry SCSI commands and data between the server and the drives without any intervening network fabric.

Answer

Fibre Channel over Ethernet (FCoE) uplinks from the storage enclosure to the Fabric Interconnect.

Answer

Fibre Channel switch for SAN connectivity.

Question 15

A UCS B-series blade has two vHBAs configured for Fibre Channel SAN connectivity. The engineer wants to ensure that if one vHBA fails, the other can take over. What must be configured in the service profile?

Accepted Answer

vHBA failover policy. vHBA failover policy allows a secondary vHBA to assume the WWPN of the primary if it fails.

Answer

FC zone configuration

Answer

Boot policy

Answer

vNIC failover policy