350-601 Practice Test 50 — 15 Questions

Question 1

An engineer is deploying an ACI fabric with VMM integration for VMware vSphere. Which THREE components must be configured to enable dynamic EPG assignment based on VM attributes? (Choose three.)

Accepted Answer

VMM domain. The VMM domain (Option B) is the core integration object that defines the VMware vCenter connection and policy enforcement boundary. It must be configured to enable the APIC to discover VMs and their attributes, which is the prerequisite for dynamic EPG assignment based on VM properties such as VM name, OS type, or custom tags.

Answer

APIC cluster IP

Answer

L3Out configuration

Question 2

A team is configuring FCoE on a Cisco Nexus switch. Which TWO steps are mandatory to establish a lossless FCoE link?

Accepted Answer

Enable FCoE on the interface using the 'fcoe' command. The 'fcoe' interface command is mandatory to enable FCoE processing on a specific interface. Without this command, the interface will not participate in FCoE traffic. Option C is correct because a VSAN must be created and mapped to an FCoE VLAN for the Fibre Channel fabric to recognize the FCoE link. This mapping allows the switch to associate the Ethernet VLAN with a VSAN for FC forwarding. Options B and D are not mandatory because Priority Flow Control (PFC) and Data Center Bridging eXchange (DCBX) are automatically enabled when FCoE is configured on the interface. Option E is not mandatory because although FCoE requires jumbo frames, the MTU can be set globally or is often already set to support FCoE, and it is not a separate mandatory step for link establishment.

Answer

Enable Priority Flow Control (PFC) as a separate CLI

Answer

Configure DCBX to advertise and negotiate FCoE capabilities

Answer

Set the MTU to 9216 bytes to accommodate FCoE frames

Question 3

Which TWO conditions require the use of NPIV in a Fibre Channel SAN? (Choose two.)

Accepted Answer

Connecting a tape library that uses multiple LUNs to a single host.. NPIV (N_Port ID Virtualization) allows a single physical Fibre Channel N_Port to register multiple unique WWPNs (World Wide Port Names), enabling a tape library with multiple LUNs to present each LUN as a separate target to the host. Without NPIV, the host would see only one WWPN for the tape library, limiting LUN access and management flexibility.

Answer

Connecting an NPV switch to an upstream switch.

Answer

Enabling FCoE transit over a lossless Ethernet network.

Answer

Connecting two switches over an ISL.

Question 4

An FCoE link between a Nexus switch and a storage array fails to come up. The switch is configured as an FCF. The administrator runs 'show interface ethernet 1/1' and sees the interface is up/up. Which command will most likely reveal the root cause?

Accepted Answer

show fcoe database. The FCoE link failing to come up despite the interface being up/up indicates a Layer 2 or FCoE-specific issue, not a physical or basic connectivity problem. The 'show fcoe database' command displays the FCoE login information and the state of virtual links (VFCs) mapped to the physical interface, which is essential for diagnosing why the FCF-to-storage array FCoE session is not established.

Answer

show vlan id 100

Answer

show lldp neighbors interface ethernet 1/1

Answer

show spanning-tree interface ethernet 1/1

Question 5

A network team is planning to automate configuration management of a brownfield Nexus 9000 fabric using YANG data models and NETCONF. Which consideration is critical when implementing this solution?

Accepted Answer

The operational state must be modeled against the device-specific YANG model to avoid configuration drift.. In a brownfield Nexus 9000 fabric, the operational state (e.g., interface status, routing table) must be modeled against the device-specific YANG model to detect and correct configuration drift. NETCONF uses YANG models to define both configuration and operational data, but only the device-specific native model accurately reflects the actual running state. Without this alignment, automated remediation may push incorrect configurations, leading to network instability.

Answer

NETCONF replaces CLI entirely; no fallback necessary.

Answer

Using NETCONF for configuration ensures zero touch provisioning.

Answer

All NX-OS versions support the same YANG models; no compatibility check needed.

Question 6

A Cisco MDS switch has the above configuration on two 16 Gbps FC interfaces. An engineer connects an initiator to fc1/2 and a target to fc1/1. The initiator cannot discover the target. What is the most likely cause?

Accepted Answer

The fc1/1 interface is configured as an E-port but is connected to a storage target.. The configuration shows interface fc1/1 with the command 'switchport mode E', which explicitly configures it as an E-port (expansion port). E-ports are used to interconnect two Fibre Channel switches, not to connect a storage target. When a target is connected to an E-port, the link will not come up properly because the target expects to be connected to an F-port (fabric port) or FL-port, preventing discovery by the initiator.

Answer

The fc1/2 interface is configured as an F-port but the initiator requires an FL-port.

Answer

The fc1/1 interface is configured as dedicated rate-mode but the target expects shared.

Answer

The fc1/2 interface is configured as shared rate-mode which prevents F-port operation.

Question 7

Which two statements correctly describe VXLAN BUM traffic handling? (Choose two.)

Accepted Answer

Ingress replication sends unicast copies of the BUM traffic to each remote VTEP.. In VXLAN, BUM traffic (Broadcast, Unknown unicast, Multicast) can be handled using ingress replication, where the ingress VTEP creates multiple unicast copies of the packet and sends them directly to each remote VTEP. This is the default mode in many VXLAN implementations, especially in EVPN-based fabrics, and does not require a multicast group in the underlay. Option A correctly describes this behavior.

Answer

BUM traffic is dropped by default.

Answer

Ingress replication sends a single multicast packet to all VTEPs.

Answer

Multicast is required for VXLAN BUM handling.

Question 8

In a spine-leaf architecture with 40 leaf switches and 4 spine switches, each leaf has four 40G uplinks to the spines. What is the oversubscription ratio if each leaf has 48 ports of 10G for servers?

Accepted Answer

3:1. The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48 ports × 10G = 480G of server-facing bandwidth, and 4 uplinks × 40G = 160G of spine-facing bandwidth. The ratio is 480:160 = 3:1, meaning three times as much server bandwidth as uplink bandwidth, which is a common design target in Cisco ACI and NX-OS spine-leaf fabrics.

Answer

2:1

Answer

5:1

Answer

4:1

Question 9

An organization is deploying Cisco ISE for 802.1X authentication on Cisco Nexus switches. Some endpoints fail authentication and fall back to the MAB. The security policy requires that endpoints failing both 802.1X and MAB be placed in a restricted VLAN. Which configuration is needed on the switch port?

Accepted Answer

authentication failed action authorize vlan 999. The 'authentication failed action authorize vlan 999' command configures the switch port to place endpoints that fail both 802.1X and MAB into a restricted VLAN (VLAN 999). This directly meets the security policy requirement for endpoints that cannot authenticate via either method.

Answer

authentication order dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication event server dead action authorize vlan 999

Question 10

An attacker attempts to spoof a legitimate client's IP address to intercept traffic. DHCP snooping is enabled. Which feature prevents this spoofing by validating source IP in data packets?

Accepted Answer

IP Source Guard. IP Source Guard (IPSG) uses the DHCP snooping binding database to validate the source IP address in data packets received on untrusted ports. If a packet's source IP does not match an entry in the binding table, IPSG drops the packet, preventing IP spoofing attacks.

Answer

Port security

Answer

Dynamic ARP Inspection

Answer

DHCP Snooping binding database

Question 11

An engineer is deploying a new application in an ACI fabric. Which two objects must be created to define a network policy? (Choose two.)

Accepted Answer

Bridge Domain. In Cisco ACI, a network policy is defined by the combination of a Tenant and a Bridge Domain. The Tenant is the top-level container that isolates policies and configurations, while the Bridge Domain defines the Layer 2 forwarding boundary and associates the subnet, enabling communication within the fabric. Without these two objects, a network policy cannot be fully realized.

Answer

VRF

Answer

External routed network

Answer

VMM domain

Question 12

What is the purpose of FIP (FCoE Initialization Protocol) in an FCoE network?

Accepted Answer

To discover FCoE-capable devices and establish virtual links. FIP is used to discover and initialize FCoE devices and establish virtual links before FCoE data frames can be sent.

Answer

To provide flow control for FCoE traffic

Answer

To negotiate DCB parameters

Answer

To encapsulate FC frames into Ethernet frames

Question 13

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

Accepted Answer

Upgrade the secondary vPC peer first, then the primary. In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

Answer

Upgrade both switches simultaneously using ISSU

Answer

Reload both switches to a previous version, then upgrade

Answer

Upgrade the primary vPC peer first, then the secondary

Question 14

Which TWO UCS components are part of the unified fabric architecture?

Accepted Answer

Fabric Interconnect. The Fabric Interconnect (A) is the core switching component in Cisco UCS, providing both network and storage connectivity over a unified fabric, typically using Fibre Channel over Ethernet (FCoE) to consolidate LAN and SAN traffic. The I/O Module (IOM) (C) connects blade servers to the Fabric Interconnects, extending the unified fabric by aggregating traffic from the chassis and forwarding it to the Fabric Interconnects, thereby eliminating the need for separate network and storage switches.

Answer

Storage Array

Answer

Control Plane

Answer

Blade Server

Question 15

Which TWO troubleshooting steps should be taken when a UCS blade server fails to discover during the initial discovery process?

Accepted Answer

Verify the physical cabling between the IOM and fabric interconnect. The initial discovery process relies on the IOM (Fabric Interconnect) establishing a link to the blade server through the chassis midplane. If the physical cabling between the IOM and the fabric interconnect is faulty, loose, or using incorrect transceivers, the discovery will fail. Verifying this cabling is a fundamental first step in troubleshooting discovery failures.

Answer

Immediately replace the blade server

Answer

Power cycle the chassis

Answer

Reset the fabric interconnect to factory defaults