350-601 Practice Test 44 — 15 Questions

Question 1

An organization is deploying UCS B-series blades in a 5108 chassis connected to Fabric Interconnects A and B. Each blade has two vNICs. How should the vNICs be connected to the fabric to ensure maximum redundancy and bandwidth?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vNIC0 to FI A, vNIC1 to FI B, both active-active. For redundancy, vNICs should be connected to separate fabric interconnects (A and B) and active-active failover is recommended.

Answer

vNIC0 to FI A, vNIC1 to FI A via different ports

Answer

vNIC0 to FI A, vNIC1 to FI B with active-standby

Answer

Both vNICs connected to Fabric Interconnect A with active-standby failover

Question 2

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Accepted Answer

Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.. The Cisco UCS Manager XML API allows operations to be idempotent by using the 'dn' (distinguished name) attribute to target a specific managed object. When you include the 'dn' in an XML request, the operation applies only to that exact object, so repeating the same request produces the same result without side effects. This is a key design principle of the management information model (MIT) that ensures predictable and safe automation.

Answer

The API uses SNMP for configuration changes.

Answer

The UCS Manager XML API uses RESTful JSON format.

Question 3

A company wants to consolidate multiple physically separate Fibre Channel SANs into one switch infrastructure while keeping each SAN's traffic isolated. Which technology best achieves this?

Accepted Answer

Virtual SANs (VSANs). VSANs (Virtual SANs) allow multiple physically separate Fibre Channel SANs to be consolidated onto a single switch infrastructure by creating isolated virtual fabrics. Each VSAN maintains its own fabric services, such as name server and zone server, ensuring traffic isolation without requiring separate physical switches or cabling.

Answer

Reduce the number of switches by using a single director

Answer

Use a single VSAN with extensive zoning

Answer

Deploy separate physical cabling for each SAN

Question 4

An engineer is designing a Fibre Channel fabric with two Cisco MDS switches for redundancy. The switches are connected via two ISLs. The engineer wants to aggregate the ISLs for higher throughput and load balancing. Which feature should be used?

Accepted Answer

PortChannel. PortChannel (also known as Port Channel or EtherChannel) is used to aggregate multiple ISLs between Cisco MDS switches into a single logical link, providing higher throughput and load balancing. This is the standard feature for link aggregation in Fibre Channel fabrics.

Answer

EISL trunking

Answer

VSAN load balancing

Answer

NPV mode

Question 5

A data center administrator needs to manage multiple UCS domains from a single pane of glass, including the ability to push global service profile policies. Which Cisco management tool should be used?

Accepted Answer

Cisco UCS Central. Cisco UCS Central is the multi-domain management platform that provides a single pane of glass across multiple UCS Manager domains. It supports global service profile policies, global service profiles, and centralized firmware and identity management, which is exactly what the administrator needs to push policies across domains.

Answer

Cisco UCS Director

Answer

Cisco IMC Supervisor

Answer

Cisco UCS Manager

Question 6

A storage administrator has deployed a Fibre Channel fabric with two MDS switches. Each host has a single HBA. Which port type is used to connect the HBA to the switch?

Accepted Answer

N-port. An N-port (Node port) is the port type on an end device, such as a host HBA, that connects to a switch. In this scenario, the HBA is the node, so it uses an N-port to connect to the switch's F-port. Therefore, the port type used on the HBA is N-port.

Answer

F-port

Answer

E-port

Answer

NP-port

Question 7

A data center engineer is implementing Fibre Channel over IP (FCIP) between two Cisco MDS 9000 switches across a WAN link. The engineer wants to ensure that the FCIP tunnel remains operational even if the primary WAN path fails, and that traffic is load-balanced across multiple TCP connections. Which feature should be configured on the FCIP tunnel?

Accepted Answer

FCIP multi-path. FCIP multi-path enables the use of multiple TCP connections for a single FCIP tunnel, providing both redundancy and load balancing. If one WAN link fails, the tunnel remains up using other connections. This is essential for high availability across WAN links. The other options (compression, write acceleration, tape acceleration) are performance optimizations but do not provide path redundancy or load balancing.

Answer

FCIP write acceleration

Answer

FCIP compression

Answer

FCIP tape acceleration

Question 8

A Cisco UCS Manager administrator is configuring a service profile for a new blade server. The server must be able to boot from a SAN LUN that is presented via Fibre Channel. The administrator has already created a VSAN and a SAN connectivity policy. Which additional configuration is required to ensure the server can boot from the SAN?

Accepted Answer

Create a boot policy that includes a SAN boot option and associate it with the service profile.. To boot from a SAN LUN, the service profile must have a boot policy that explicitly includes a SAN boot option. The boot policy defines the order in which the server attempts to boot, and the SAN boot option references the vHBA that connects to the SAN. Other configurations like VSAN and SAN connectivity policy are prerequisites but do not by themselves enable SAN boot. Therefore, creating and associating a boot policy with a SAN boot entry is the required step.

Answer

Configure a local disk configuration policy with RAID 1 and set it as the first boot device.

Answer

Assign a WWPN pool to the service profile and enable NPV mode on the fabric interconnects.

Answer

Enable Fibre Channel zoning on the upstream MDS switch and set the VSAN to native mode.

Question 9

A network security engineer is configuring first-hop security on a Cisco Nexus 9000 switch to prevent rogue DHCP servers and mitigate DHCP starvation attacks. The engineer enables DHCP snooping globally and on the server-facing VLAN, then configures the uplink port towards the legitimate DHCP server as trusted. However, clients on the VLAN still receive IP addresses from an unauthorized DHCP server connected to an access port. What is the most likely cause of this issue?

Accepted Answer

DHCP snooping is not enabled on the VLAN that contains the client ports, so DHCP packets are not being inspected.. DHCP snooping must be enabled on the specific VLANs where protection is desired. The command ip dhcp snooping vlan <vlan-id> activates inspection on that VLAN. Without it, the switch does not examine DHCP messages, and rogue servers on untrusted ports can successfully offer leases. The trusted port configuration only takes effect when snooping is active on the VLAN. Therefore, the missing VLAN enablement is the most likely cause.

Answer

The trusted port configuration is applied to the wrong interface, allowing DHCP offers from the rogue server to be forwarded.

Answer

DHCP snooping requires the DHCP relay agent to be configured on the switch, which is missing.

Answer

The access port where the rogue DHCP server is connected has not been configured as untrusted and is therefore allowed to send DHCP offers.

Question 10

An engineer is configuring a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The underlay uses OSPF, and the overlay uses BGP EVPN. The engineer notices that MAC addresses are not being advertised between leaf switches. Which action should be taken to allow the exchange of MAC reachability information?

Accepted Answer

Enable the BGP EVPN address family under the neighbor configuration on each leaf switch.. In a VXLAN EVPN fabric, BGP EVPN is the control plane that distributes MAC and IP reachability information. Each leaf must activate the L2VPN EVPN address family for its BGP neighbors to exchange EVPN routes. Without this, MAC addresses learned locally are not advertised, and remote leaf switches cannot populate their forwarding tables, causing overlay connectivity failures.

Answer

Configure the NVE interface with a source-interface loopback and enable ingress replication.

Answer

Configure a route reflector to reflect EVPN routes between leaf switches.

Answer

Enable OSPF on the loopback interfaces used for VXLAN tunnel sources.

Question 11

An engineer is deploying a VXLAN EVPN fabric with a pair of Nexus 9000 leaf switches acting as VTEPs. The design requires that the fabric support Layer 2 extension for a VLAN that must be stretched between two racks. The engineer wants to minimize the size of the MAC address table on the leaf switches by avoiding flooding of unknown unicast traffic. Which EVPN route type should be used to advertise MAC address reachability so that remote leaf switches can install MAC addresses without data-plane learning?

Accepted Answer

Type-2 MAC/IP Advertisement route. Type-2 MAC/IP Advertisement routes are the EVPN mechanism for advertising host MAC addresses. When a leaf learns a MAC, it generates a Type-2 route that remote leaves use to program their MAC tables. This eliminates the need for data-plane learning and unknown unicast flooding, directly addressing the requirement to minimize MAC table size and control L2 extension.

Answer

Type-3 Inclusive Multicast Ethernet Tag route

Answer

Type-5 IP Prefix route

Answer

Type-4 Ethernet Segment route

Question 12

An engineer is deploying Cisco ACI and needs to ensure that traffic between two EPGs is permitted. The EPGs are in different tenants, and the engineer wants to apply a contract that allows only HTTP traffic. Which configuration is required to allow the communication?

Accepted Answer

Create a contract with a filter for TCP port 80, and apply it as a provider contract to one EPG and a consumer contract to the other.. In Cisco ACI, communication between EPGs is governed by contracts. A contract contains filters that define permitted traffic. To allow HTTP between two EPGs, one EPG must provide the contract and the other must consume it. This establishes a directional relationship where the consumer can initiate traffic to the provider on the specified ports.

Answer

Create a contract with a filter for TCP port 80, and apply it as a provider contract to both EPGs.

Answer

Create a contract with a filter for TCP port 80, and apply it as a consumer contract to both EPGs.

Answer

Create a taboo contract with a filter for TCP port 80, and apply it to both EPGs.

Question 13

A network engineer is implementing a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer wants to optimize BUM (Broadcast, Unknown Unicast, Multicast) traffic replication by using the fabric's native multicast capabilities. Which VXLAN control plane approach should be used to achieve this?

Accepted Answer

EVPN control plane with multicast underlay. The combination of EVPN for control-plane learning and a multicast underlay for BUM traffic replication provides an efficient and scalable solution. EVPN eliminates the need for flood-and-learn, while multicast replication reduces bandwidth consumption compared to ingress replication. This approach is widely adopted in large data center fabrics.

Answer

Flood-and-learn with multicast underlay

Answer

Static VXLAN tunnels with head-end replication

Answer

EVPN control plane with ingress replication

Question 14

A data center engineer is deploying a Cisco Nexus 9000 series switch pair as a vPC domain. The peer link is formed between the two switches, but the engineer wants to ensure that the vPC peer keepalive link remains operational even if the peer link fails. The engineer configures the peer keepalive link on a dedicated management interface. Which statement accurately describes the behavior of the vPC peer keepalive link in this scenario?

Accepted Answer

The peer keepalive link is used to detect peer switch liveness and trigger role election when the peer link fails.. The peer keepalive link is a dedicated heartbeat connection that allows each vPC peer to detect whether the other is still alive. When the peer link fails, the keepalive link determines if the failure is isolated or if the peer switch itself is down. This prevents split-brain scenarios and ensures proper role election, keeping the vPC domain stable.

Answer

The peer keepalive link carries user data traffic when the peer link fails, ensuring no disruption.

Answer

The peer keepalive link synchronizes MAC address tables and ARP entries between the vPC peers.

Answer

The peer keepalive link is required for VXLAN tunnel establishment between the vPC peers.

Question 15

An engineer is troubleshooting a Cisco Nexus 9000 vPC domain that uses a dedicated peer keepalive link over a routed path. The vPC peer link is up and the vPC member ports are forwarding, but the vPC role election shows both switches in a primary role. Which action resolves this condition?

Accepted Answer

Verify that the peer keepalive link is reachable in the correct VRF and that the peer-keepalive destination is configured with the correct source address.. The peer keepalive link is a separate heartbeat path used to detect when a vPC peer is alive but the peer link has failed, preventing both switches from becoming primary. When both switches show primary despite an up peer link, the keepalive path is typically broken or misconfigured. Verifying reachability in the correct VRF and the source/destination addresses restores the heartbeat and allows correct role election.

Answer

Configure the peer keepalive link on the management interface of both switches and set the destination to the peer's management IP address.

Answer

Remove the peer keepalive configuration entirely and rely on the peer link to carry keepalive messages.

Answer

Shut down the vPC peer link and reconfigure the system-priority on both switches to force a new primary election.