350-601 Practice Test 50 — 15 Questions

Question 1

An administrator is configuring Cisco UCS Manager to manage a new Cisco UCS C-Series rack server. The server is not yet discovered by UCS Manager. Which action must be taken first to allow UCS Manager to manage the server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Cisco Integrated Management Controller (CIMC) and configure it with an IP address.. To integrate a Cisco UCS C-Series rack server into UCS Manager, the first step is to enable and configure the Cisco Integrated Management Controller (CIMC) with an IP address. This allows UCS Manager to discover the server over the management network. Once discovered, the server can be managed and service profiles can be applied. Other actions like creating templates or configuring Fabric Interconnects are subsequent steps.

Answer

Create a service profile template for the server in UCS Manager.

Answer

Install a VIC adapter in the server and configure it for UCS Manager integration.

Answer

Configure the Fabric Interconnects to allow C-Series server integration.

Question 2

A data center engineer is configuring Cisco UCS Manager for a new deployment. The engineer must ensure that the UCS domain can be managed by Cisco Intersight. Which two actions are required to claim the UCS domain in Intersight? (Choose two.)

Accepted Answer

Configure a device connector on the UCS Manager.. To claim a UCS domain in Intersight, you must configure the device connector in UCS Manager and enter a valid claim code obtained from Intersight. The device connector enables communication, and the claim code authenticates the device. Other options are not required; a physical appliance is not needed, HTTPS is typically already enabled, and a proxy is only necessary in restricted networks.

Answer

Enable HTTPS on the UCS Manager management interface.

Answer

Configure a proxy server for Intersight communication.

Answer

Install a physical Intersight appliance in the data center.

Question 3

A data center engineer is configuring a Cisco UCS service profile for a blade server that will run a vSphere ESXi host. The requirement is to provide redundant connectivity to the SAN and LAN. The engineer has created two vHBAs and two vNICs. How should these be placed to ensure redundancy?

Accepted Answer

Place one vHBA and one vNIC on Fabric A, and the other vHBA and vNIC on Fabric B.. To ensure redundant connectivity for both SAN and LAN in a Cisco UCS service profile, each fabric interconnect should have one vHBA and one vNIC. This way, if one fabric fails, the other fabric provides continued connectivity for both SAN and LAN traffic. Distributing adapters across fabrics is a standard best practice for high availability. The other options either concentrate adapters on one fabric or separate traffic types without providing redundancy.

Answer

Place one vHBA on Fabric A and one vHBA on Fabric B, and place both vNICs on Fabric A.

Answer

Place both vHBAs and both vNICs on Fabric A to simplify cabling.

Answer

Place both vHBAs on Fabric A and both vNICs on Fabric B.

Question 4

A data center engineer is configuring a Cisco HyperFlex cluster with six nodes. The cluster is running mission-critical workloads that require high availability. The engineer sets the replication factor to 3 (RF3). After a node failure, the cluster remains operational. How many additional node failures can the cluster tolerate while still maintaining data availability?

Accepted Answer

1 additional node failure.. With a replication factor of 3, each data block has three copies. The cluster can tolerate up to two node failures without losing data. Since one node has already failed, the cluster can tolerate exactly one more node failure. Any further failure would result in data unavailability. Therefore, the correct answer is one additional node failure.

Answer

2 additional node failures.

Answer

3 additional node failures.

Answer

0 additional node failures.

Question 5

A data center engineer is configuring Cisco UCS Manager to support a new blade server that requires two vNICs for redundancy and two vHBAs for SAN connectivity. The engineer must ensure that the vNICs and vHBAs are evenly distributed across both Fabric Interconnects. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Create two vNICs and assign one to Fabric A and one to Fabric B.. To achieve redundancy and even distribution across both Fabric Interconnects, the engineer must create two vNICs and assign one to each fabric, and create two vHBAs and assign one to each fabric. This ensures that both network and SAN traffic have redundant paths and can survive the failure of a single Fabric Interconnect. Distributing vNICs and vHBAs across fabrics is a best practice for high availability in Cisco UCS.

Answer

Create two vNICs and assign both to Fabric A to simplify configuration.

Answer

Create one vNIC on Fabric A and one vHBA on Fabric B.

Answer

Create two vHBAs and assign both to Fabric A for higher bandwidth.

Question 6

A UCS Manager administrator needs to allow a blade server to boot from a SAN LUN using Fibre Channel. The fabric interconnects are in Fibre Channel switching mode, and the SAN switch is zoned by WWPN. Which UCS Manager configuration is required to present the LUN to the blade?

Accepted Answer

Create a vHBA under a SAN connectivity policy, assign a WWPN pool, and attach the policy to the service profile.. To present a SAN LUN to a blade over Fibre Channel in switching mode, UCS Manager requires a vHBA defined in a SAN connectivity policy with a WWPN pool, attached to the service profile. This provides a persistent initiator identity that the SAN switch can zone, allowing the LUN to be presented and used for boot.

Answer

Create a vNIC under a LAN connectivity policy with a MAC pool and enable FCoE on the fabric interconnect uplink.

Answer

Configure a boot policy that references a local RAID volume and set the SAN LUN as a secondary boot device.

Answer

Zone the SAN switch against the mezzanine adapter's factory-burned WWPN and set the boot policy to SAN boot.

Question 7

An automation engineer is using the Cisco ACI APIC REST API to manage configuration. The engineer needs to perform a query that returns only specific properties of a class and also filter the results based on a property value. Which two APIC REST API query parameters should be used to achieve this? (Choose two.)

Accepted Answer

query-target-filter. To return only specific properties, use rsp-prop. To filter results based on a property value, use query-target-filter. Together, these parameters allow the engineer to retrieve a subset of properties for objects that match a condition. The other parameters control subtree inclusion, target class, or pagination, but do not provide property selection or value-based filtering.

Answer

rsp-subtree

Answer

query-target

Answer

page-size

Question 8

An engineer is troubleshooting a Cisco UCS B-Series blade server that fails to boot from SAN. The service profile is configured with a vHBA, and the WWPN is assigned from a pool. The SAN administrator confirms that the zone is correctly configured. Which UCS Manager setting should the engineer verify to ensure that the vHBA is presented to the fabric with the correct WWPN?

Accepted Answer

The WWPN pool used by the vHBA. The WWPN pool is the source of the WWPN assigned to the vHBA. If the pool is misconfigured or exhausted, the vHBA will not have a valid WWPN, and the SAN will not recognize the initiator. The Fibre Channel adapter policy and LAN connectivity policy do not affect WWPN assignment, and the boot policy order is secondary to the WWPN issue.

Answer

The boot policy order in the service profile

Answer

The Fibre Channel adapter policy attached to the vHBA

Answer

The LAN connectivity policy for the server

Question 9

A network security team is implementing Cisco TrustSec on a Cisco Nexus 9000 series switch. They need to assign an SGT to IP phones that connect to a specific switchport. The phones are already authenticated via 802.1X and are assigned to a VLAN dynamically. Which method should they use to assign the SGT based on the authenticated user or device identity?

Accepted Answer

Configure the Cisco Identity Services Engine (ISE) to return the SGT as part of the authorization result, and enable SGT assignment on the switchport.. The scenario requires dynamic SGT assignment based on authenticated identity. Cisco ISE can return an SGT as part of the authorization result during 802.1X authentication. When the switchport is configured to trust the SGT from the authentication server, the switch applies that SGT to traffic from the phone. This approach integrates with existing authentication and scales without manual per-port configuration.

Answer

Use Security Group Tag Exchange Protocol (SXP) to map the IP address of the phone to an SGT.

Answer

Enable Cisco TrustSec on the switchport and configure a static SGT using the 'cts manual' interface command.

Answer

Configure SGT propagation using inline tagging on the switchport and define a static mapping from VLAN to SGT.

Question 10

A Cisco ACI fabric is configured with a contract between EPG 'web' and EPG 'db'. The contract has a subject with a filter that permits TCP port 3306. A network engineer notices that traffic from 'web' to 'db' on port 3306 is being dropped. The engineer verifies that the contract is applied to both EPGs and that the filter is correctly configured. Which additional configuration is required for the contract to allow traffic?

Accepted Answer

The contract must be applied as a provider contract on EPG 'db' and as a consumer contract on EPG 'web'.. In Cisco ACI, a contract must be applied as a provider contract on the EPG that offers the service and as a consumer contract on the EPG that uses the service. For EPG 'web' to communicate with EPG 'db' on TCP port 3306, the contract should be applied as a provider contract on EPG 'db' and as a consumer contract on EPG 'web'. This establishes the correct direction and allows the filter to be enforced. Without this role assignment, traffic is dropped.

Answer

The contract must be applied as a consumer contract on both EPGs.

Answer

The contract must be applied as a consumer contract on EPG 'db' and as a provider contract on EPG 'web'.

Answer

The contract must be applied as a provider contract on both EPGs.

Question 11

An administrator is working with Cisco UCS Manager and needs to create a service profile that will be used as a template for multiple servers. The administrator wants to ensure that any changes made to the template are automatically applied to all service profiles derived from it. What should the administrator configure?

Accepted Answer

Create an updating service profile template and modify it as needed.. To automatically propagate changes to all derived service profiles, the administrator should create an updating service profile template. When this type of template is modified, UCS Manager automatically updates all service profiles created from it. Initial templates only apply settings at creation time, and other options are not valid settings.

Answer

Create a service profile template and set the 'Updating Template' option to 'Enable'.

Answer

Create a service profile template and set the 'Update Derived Profiles' option to 'Auto'.

Answer

Create an initial service profile template and then manually update each derived service profile.

Question 12

A data center technician is troubleshooting a Cisco UCS B-Series blade server that fails to boot. The technician suspects a hardware issue and wants to check the blade's power status and sensor readings. Which UCS Manager component provides this information?

Accepted Answer

Equipment tab. The Equipment tab in UCS Manager provides detailed information about the physical hardware, including power status and sensor readings for blades. By navigating to the specific blade within the Equipment tab, the technician can view its health and troubleshoot the boot failure. Other tabs focus on logical configuration rather than physical hardware status.

Answer

LAN tab

Answer

Servers tab

Answer

Storage tab

Question 13

A network security team is deploying Cisco TrustSec in a data center. They have already enabled CTS on all switches and configured device authentication using 802.1X. They now need to assign Security Group Tags (SGTs) to traffic based on user identity. Which Cisco TrustSec component is responsible for classifying packets with the appropriate SGT?

Accepted Answer

Inline tagging at the ingress switch. The classification of packets with SGTs is performed by inline tagging at the ingress switch. When an endpoint authenticates via 802.1X, the switch receives the SGT from the authentication server and inserts it into the frame. This tag is then used for enforcement by SGACLs on egress switches. Other components like SXP or NDAC support the TrustSec architecture but do not perform the initial tagging.

Answer

Security Group Access Control List (SGACL)

Answer

Network Device Admission Control (NDAC)

Answer

Security Group Tag Exchange Protocol (SXP)

Question 14

A security engineer is configuring Cisco TrustSec on a Cisco Nexus 9000 series switch to enforce role-based access control. The engineer needs to enable SGACL enforcement on the switch and ensure that the switch can participate in the TrustSec domain. Which two commands must be configured on the switch to meet these requirements? (Choose two.)

Accepted Answer

cts role-based enforcement. To enforce SGACLs and participate in the TrustSec domain, the switch must enable role-based enforcement and provide credentials to authenticate with ISE. The command 'cts role-based enforcement' activates SGACL enforcement, while 'cts credentials' allows the switch to join the domain and download policies. Other commands are either for 802.1X integration or static assignment, which are not required here.

Answer

cts dot1x pae authenticator

Answer

cts sgt <sgt-number>

Answer

cts authorization list <list-name>

Question 15

A network administrator is configuring a Cisco Nexus switch to use TACACS+ for authentication of management users. The TACACS+ server is reachable at 10.1.1.100. Which command correctly configures the TACACS+ server?

Accepted Answer

tacacs-server host 10.1.1.100 key MySecret. The correct command to configure a TACACS+ server on a Cisco Nexus switch is 'tacacs-server host key '. This defines the server and the shared secret. After this, you must configure AAA authentication to use TACACS+ for login. The other options either configure RADIUS or use incorrect syntax.

Answer

tacacs host 10.1.1.100 key MySecret

Answer

radius-server host 10.1.1.100 key MySecret

Answer

aaa server tacacs+ 10.1.1.100 key MySecret