350-601 Practice Test 48 — 15 Questions

Question 1

Which statement accurately describes the APIC REST API?

Accepted Answer

It uses JSON over HTTPS and interacts with the MIT.. APIC REST API is a RESTful API that uses JSON over HTTPS and allows management of the ACI fabric.

Answer

It uses XML over SSH for communication.

Answer

It is only used for monitoring, not configuration.

Answer

It requires the use of the Cobra SDK.

Question 2

A network team is troubleshooting a vPC issue where one of the member ports is not coming up. Which TWO conditions can cause a vPC member port to fail consistency checks? (Select two.)

Accepted Answer

Different STP port type (edge vs network). VPC performs consistency checks on member ports to ensure both peers have identical configurations for certain parameters. A mismatch in STP port type (e.g., one peer configured as 'edge' and the other as 'network') will cause the vPC member port to fail the consistency check and remain down, as STP port type affects BPDU handling and loop prevention.

Answer

Spanning-tree guard root configured on one peer

Answer

Incorrect peer keepalive IP

Answer

Different MTU settings on the peer-link

Question 3

A network engineer wants to send NX-OS CLI commands via HTTP/HTTPS to a Nexus switch programmatically. Which API should be used?

Accepted Answer

NX-API CLI. NX-API CLI allows sending NX-OS CLI commands via HTTP/HTTPS using XML or JSON.

Answer

NETCONF

Answer

NX-API REST

Answer

RESTCONF

Question 4

A network administrator wants to send NX-OS CLI commands to a Nexus switch via HTTP/HTTPS. Which API should be used?

Accepted Answer

NX-API CLI. NX-API CLI allows sending NX-OS commands via HTTP/HTTPS in either XML or JSON format.

Answer

NETCONF

Answer

RESTCONF

Answer

APIC REST API

Question 5

Which three components are part of the ACI Management Information Tree (MIT)? (Choose three.)

Accepted Answer

Tenant. MIT includes objects like tenants, application profiles, EPGs, and bridge domains.

Answer

Interface

Answer

VLAN

Question 6

Which two statements about the Cisco NX-API REST interface are true? (Choose two.)

Accepted Answer

It can be used to send CLI commands.. NX-API REST supports JSON and XML over HTTP/HTTPS, and can be used to send CLI commands (via NX-API CLI) as well as structured data.

Answer

It only supports GET operations.

Answer

It requires the use of YANG models.

Answer

It uses SSH for transport.

Question 7

An engineer is writing a Python script using the cisco_nxapi library to configure a Nexus switch. Which of the following is a valid step to establish a connection using NX-API?

Accepted Answer

Instantiate an `NXAPI` object with the switch IP, username, password, and transport (http/https).. The cisco_nxapi library provides an NXAPI class that can be instantiated with switch IP, username, password, and transport protocol to connect.

Answer

Use the `Netmiko` library to connect via SSH and then invoke NX-API commands.

Answer

Import `nxos` module from Ansible and use it in the script.

Answer

Use the `requests` library to send CLI commands directly to the switch's NX-API endpoint.

Question 8

An engineer is automating ACI configuration using Terraform. Which provider and resource should be used to create an Application Profile under a Tenant?

Accepted Answer

provider = cisco.aci and resource = aci_application_profile. terraform-provider-aci is the correct provider for ACI automation. The resource for an application profile in ACI is 'aci_application_profile' which is part of the provider. 'aci_tenant' is for tenants, 'aci_epg' for EPGs, and 'aci_bridge_domain' for bridge domains.

Answer

provider = cisco.aci and resource = aci_tenant

Answer

provider = cisco.aci and resource = aci_epg

Answer

provider = cisco.nxos and resource = nxos_vlan

Question 9

Which TWO of the following are components of the Cisco ACI Management Information Tree (MIT)? (Choose two.)

Accepted Answer

fvAp. The MIT includes objects like tenants, application profiles (AP), EPGs, and bridge domains (BD). VRF is also part of MIT. 'fvTenant', 'fvAp', 'fvAEPg', 'fvBD' are object classes. 'l3extOut' is for L3 out, not part of the core MIT hierarchy for tenant networking.

Answer

l3extOut

Answer

vlan

Answer

interface

Question 10

A financial services company operates a multi-site data center with Cisco ACI. The automation team uses Ansible Tower to manage configurations. They have a playbook that configures EPGs using the 'aci_epg' module. The playbook runs successfully for most sites but fails on one site with the error 'Object 'uni/tn-Tenant1/ap-AP1/epg-EPG1' doesn't exist'. The engineer checks the ACI fabric and confirms that the tenant, application profile, and EPG exist on that site. The playbook uses the same credentials and variables across all sites. What is the most likely cause of the failure?

Accepted Answer

The fabric name in the Ansible inventory is incorrect for that site. The error 'Object doesn't exist' despite the EPG being present on the ACI fabric indicates that Ansible is targeting the wrong fabric or APIC. Since the playbook uses the same credentials and variables across all sites, the most likely cause is an incorrect fabric name in the Ansible inventory for that specific site, causing the module to query a different APIC cluster where the object does not exist.

Answer

The Ansible Tower job runs with a different user that lacks permissions on that site

Answer

The ACI APIC version is incompatible with the Ansible module

Answer

The EPG name in the playbook has a typo that only affects this site

Question 11

An engineer is configuring a new Cisco MDS 9148 switch to connect to an existing Fibre Channel fabric. The switch will be used at the edge of the SAN and must not participate in fabric services. Which port mode should be used for the ports connecting to the core switches?

Accepted Answer

NP-port. NPV mode allows an edge switch to forward traffic to the core without participating in fabric services, reducing domain IDs and simplifying management.

Answer

F-port

Answer

E-port

Answer

N-port

Question 12

A data center architect is designing a spine-leaf network with 40 leaf switches and 8 spine switches. Each leaf has 40x25G downlinks to servers and 8x100G uplinks to spines. The oversubscription ratio from server to spine is calculated as (total downlink bandwidth) / (total uplink bandwidth). What is the oversubscription ratio for each leaf?

Accepted Answer

1.25:1. The oversubscription ratio for each leaf is calculated by dividing the total downlink bandwidth by the total uplink bandwidth. Each leaf has 40 downlinks at 25 Gbps each, totaling 1000 Gbps, and 8 uplinks at 100 Gbps each, totaling 800 Gbps. Thus, 1000 / 800 = 1.25, giving a 1.25:1 ratio.

Answer

1.5:1

Answer

2:1

Answer

0.8:1

Question 13

Which Nexus security feature validates ARP packets to prevent ARP spoofing attacks?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) intercepts and validates ARP packets based on DHCP snooping bindings.

Answer

Port Security

Answer

IP Source Guard

Answer

DHCP Snooping

Question 14

A network engineer is hardening a Nexus switch. Which two security best practices should be applied? (Choose two.)

Accepted Answer

Disable unused services. Disabling unused services reduces attack surface; enabling SSH only provides secure remote access.

Answer

Use default SNMP community strings

Answer

Enable HTTP server for management

Answer

Enable Telnet for remote access

Question 15

In Cisco TrustSec, which technology is used to enforce east-west traffic policies based on identity without relying on IP addresses?

Accepted Answer

SGACL. SGACLs enforce policies based on SGTs, not IP addresses.

Answer

SGT

Answer

ACLs

Answer

VLAN ACLs