350-601 Practice Test 49 — 15 Questions

Question 1

In UCS Manager, which feature provides role-based access control for managing the fabric interconnects?

Accepted Answer

Role-Based Access Control (RBAC). UCS Manager includes RBAC with roles and privileges.

Answer

Cisco ISE integration

Answer

CoPP

Answer

AAA with TACACS+

Question 2

An engineer applies an IPv4 ACL to a Nexus switch interface. The ACL must permit traffic from host 10.1.1.1 to host 10.2.2.2 on TCP port 443 and deny all other traffic. Which configuration is correct?

Accepted Answer

ip access-list WEB; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443. ACLs are processed top-down; a permit statement for the desired traffic followed by an implicit deny all other traffic.

Answer

ip access-list WEB; permit ip 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0

Answer

ip access-list WEB; deny ip any any; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443

Answer

ip access-list WEB; permit tcp any any eq 443

Question 3

Which security feature on a Nexus switch prevents a rogue DHCP server from assigning invalid IP addresses to clients?

Accepted Answer

DHCP Snooping. DHCP snooping filters DHCP messages and blocks unauthorized DHCP servers.

Answer

Port Security

Answer

IP Source Guard

Answer

Dynamic ARP Inspection

Question 4

A Nexus switch is configured with port security. Which violation action will cause the switch to shut down the interface when a security violation occurs?

Accepted Answer

shutdown. The 'shutdown' violation mode disables the interface, preventing further traffic.

Answer

restrict

Answer

log

Answer

protect

Question 5

A UCS administrator needs to ensure that only the fabric interconnect management plane is accessible from the management network. Which feature should be implemented?

Accepted Answer

Management plane isolation. Management plane isolation ensures that management traffic is separate from data traffic, often using dedicated management interfaces or VRFs.

Answer

SED encryption

Answer

CoPP

Answer

RBAC

Question 6

In a Cisco ACI fabric, a new EPG is created and associated with a bridge domain that has 'Unicast Routing' enabled. However, endpoints in that EPG cannot communicate with endpoints in other EPGs in the same VRF. What is missing?

Accepted Answer

A contract between the EPGs. In Cisco ACI, communication between EPGs within the same VRF is not allowed by default; it requires a contract. A contract defines the policies (allow/deny) and filters for traffic between EPGs. Without a contract, all traffic is dropped, even if the bridge domain has unicast routing enabled. Option C is correct because the missing element is the contract that explicitly permits inter-EPG communication.

Answer

The EPG must be attached to a Layer 3 outside

Answer

The bridge domain must have 'L3 Unknown Multicast Flooding' set

Answer

A route leak between bridge domains

Question 7

A network administrator must enforce security policies for east-west traffic in a Cisco TrustSec-enabled data center without using IP-based ACLs. Which technology should be used?

Accepted Answer

SGACL. TrustSec uses SGTs for identity-based tagging and SGACLs to enforce policy without IP addresses.

Answer

VLAN ACLs

Answer

CoPP

Answer

ACI contracts

Question 8

A Nexus switch is configured with DHCP snooping. Which switchport mode is required for trusted ports to prevent rogue DHCP server attacks?

Accepted Answer

ip dhcp snooping trust. DHCP snooping treats ports as untrusted by default. Trusted ports are explicitly configured, typically on uplink interfaces.

Answer

trunk

Answer

access

Answer

spanning-tree portfast

Question 9

Refer to the exhibit. The server in slot 2 is associated and working. A new server is inserted into slot 1, but after 30 minutes it remains in 'Unassigned' state. What is the most likely reason?

Accepted Answer

The server's CIMC firmware is not compatible with the Fabric Interconnect firmware.. The server in slot 1 remains in 'Unassigned' state because its CIMC firmware is incompatible with the Fabric Interconnect firmware. In Cisco UCS, the CIMC on each blade must match a supported firmware version for the Fabric Interconnect to discover and manage the server. When firmware versions are mismatched, the server cannot transition to the 'Associated' state and stays 'Unassigned'.

Answer

The service profile is already associated with another server.

Answer

The server is not powered on.

Answer

The Fabric Interconnect ports are not configured as server ports.

Question 10

In Cisco TrustSec, what is used to tag traffic based on identity or group membership?

Accepted Answer

Security Group Tag. Security Group Tags (SGTs) are used to classify traffic by identity.

Answer

VLAN ID

Answer

MAC address

Answer

IP address

Question 11

An organization wants to encrypt data at rest in a storage array. Which two technologies can be used? (Choose two.)

Accepted Answer

SAN array encryption. Self-encrypting drives (SEDs) and array-based encryption (e.g., EMC/NetApp) are common methods.

Answer

MACsec

Answer

IPsec

Answer

FC-SP-2

Question 12

In a Cisco UCS environment, which component provides the Fibre Channel connectivity to the SAN switches when using FCoE?

Accepted Answer

UCS Fabric Interconnect. In a Cisco UCS environment, the Fabric Interconnect (FI) is the component that provides Fibre Channel connectivity to SAN switches when using FCoE. The FI integrates both Ethernet and Fibre Channel traffic, performing FCoE encapsulation and forwarding the Fibre Channel frames to the SAN via its native Fibre Channel uplink ports. This allows the UCS domain to connect directly to Fibre Channel SAN fabrics without requiring external FCoE-capable switches.

Answer

IOM (I/O Module)

Answer

Cisco VIC adapter

Answer

UCS Manager

Question 13

In a HyperFlex cluster with replication factor 2 (RF2), what is the minimum number of nodes required to sustain a single node failure?

Accepted Answer

3. In a HyperFlex cluster with replication factor 2 (RF2), each data block is stored on two different nodes. To survive a single node failure, the cluster must have at least three nodes: two nodes to hold the two replicas of the data, and a third node to provide a witness (or tie-breaker) for cluster quorum and to ensure data availability during the failure. With only two nodes, a single failure would leave only one replica, violating the RF2 requirement and potentially causing data loss or cluster unavailability.

Answer

4

Answer

2

Answer

5

Question 14

A company has two data centers connected via a WAN link using an FCIP tunnel between two Cisco MDS 9700 switches. The FCIP link is configured on a GigabitEthernet port with an MTU of 1500 bytes and uses IPSec for encryption. Recently, storage replication traffic has become slow, and the administrator notices high TCP retransmissions on the FCIP interface. The administrator checks the bandwidth utilization and sees it is only 50% of the link capacity. The storage arrays report no errors or performance issues on their local switches. The administrator also verifies that the FCIP profile is configured correctly and that compression is enabled but not causing any errors. What is the most likely cause of the TCP retransmissions?

Accepted Answer

The TCP window size is too small for the latency.. High TCP retransmissions and 50% utilization on an FCIP link over a high-latency WAN are classic symptoms of a TCP window size that is too small for the latency. When the TCP window is insufficient, the sender cannot keep the pipe full, leading to idle periods and retransmissions when the sender's retransmission timer expires while waiting for acknowledgments. In FCIP, the TCP window should be adjusted based on the bandwidth-delay product. A duplex mismatch would cause collisions and errors, but the absence of reported errors and only 50% utilization suggests the issue is not physical layer. IPSec overhead adds processing delay but rarely causes retransmissions. Compression delays are not significant enough to cause retransmissions. Therefore, option D is correct.

Answer

The WAN link has packet loss due to a duplex mismatch.

Answer

IPSec encryption introduces too much overhead.

Answer

The FCIP profile is configured with compression that is causing delays.

Question 15

In a VXLAN EVPN fabric, a new server is connected to a leaf switch and requires Layer 2 connectivity to an existing VM on a different leaf. The engineer notes that the VTEP on the new leaf does not have a Type-2 route for the VM's MAC address. Which EVPN route type is used to advertise MAC addresses?

Accepted Answer

Type-2 (MAC/IP Advertisement). In VXLAN EVPN fabrics, Type-2 (MAC/IP Advertisement) routes are specifically used to advertise MAC addresses and their associated IP addresses between VTEPs. When a new leaf switch needs Layer 2 connectivity to a VM on a different leaf, it must learn the VM's MAC address via a Type-2 route from the remote VTEP. Without this route, the new leaf cannot populate its MAC table for that VM, preventing Layer 2 communication.

Answer

Type-5 (IP Prefix)

Answer

Type-1 (Ethernet Auto-discovery)

Answer

Type-3 (Inclusive Multicast Ethernet Tag)