350-601 Practice Questions 1 — 50 Questions

Question 1

Refer to the exhibit. An engineer configured NX-API on a Nexus 9000 switch. The REST API client receives 'SSL_ERROR_BAD_CERT_DOMAIN'. What is the most likely cause?

Accepted Answer

The certificate does not match the switch's hostname. The SSL_ERROR_BAD_CERT_DOMAIN error indicates that the certificate presented by the Nexus 9000 switch does not match the hostname used in the REST API client's request. When NX-API uses HTTPS, the client validates the server's certificate against the requested domain; a mismatch triggers this error. This is a common TLS/SSL certificate validation issue, not a problem with HTTP conflicts, missing keys, or corrupted files.

Answer

HTTP is enabled which conflicts with HTTPS

Answer

The key file is missing

Answer

The certificate file is corrupted

Question 2

During an FCoE deployment, the server team reports that hosts can reach the storage array but performance is intermittent with periodic timeouts. The network team sees no errors on the FCoE VLAN. The DCB configuration on the upstream switch shows that PFC is enabled for CoS 3. What should the engineer check next?

Accepted Answer

Check if the PFC configuration matches on both ends and that PFC is enabled on the FCoE VLAN interfaces. D is correct because PFC (Priority Flow Control) must be consistently configured on both ends of an FCoE link to prevent frame loss. If PFC is enabled for CoS 3 on the upstream switch but not on the server's vNIC or the FCoE VLAN interfaces, the lack of lossless behavior causes intermittent timeouts and performance degradation, even if the FCoE VLAN shows no errors.

Answer

Verify that jumbo frames are enabled on the storage array

Answer

Confirm that the VSAN is appropriately sized for the number of hosts

Answer

Ensure that the FCoE VLAN is enabled for FCoE on the server's vNIC

Question 3

In a Cisco ACI fabric, a tenant has multiple bridge domains in the same VRF all with 'Unicast Routing' enabled and hardware proxy mode. However, endpoints in different BDs within the same VRF cannot communicate even with a contract. What is a possible reason?

Accepted Answer

The 'ARP Flooding' is enabled.. When 'Unicast Routing' is enabled on a bridge domain (BD) in hardware proxy mode, the ACI fabric relies on hardware proxy for forwarding. In this mode, ARP flooding should be disabled to prevent excessive flooding and allow the fabric to properly resolve ARP via the COOP database. If 'ARP Flooding' is enabled, the fabric floods ARP requests across all BDs, which can cause ARP resolution to fail for endpoints in different BDs because the hardware proxy expects ARP to be handled differently. This prevents inter-BD communication even with a contract in place. Therefore, having 'ARP Flooding' enabled is a possible reason for the communication failure.

Answer

The 'L3 Unknown Multicast Flooding' is set to flood.

Answer

The contracts are unidirectional.

Answer

The bridge domains are in different subnets.

Question 4

Which component in a UCS 5108 blade chassis provides the connectivity between the blade servers and the Fabric Interconnects?

Accepted Answer

I/O Module (IOM). The I/O Module (IOM) in the UCS 5108 chassis provides the uplink ports that connect to the Fabric Interconnects and the downlink ports that connect to the blade servers.

Answer

Chassis management controller (CMC)

Answer

Midplane

Answer

Fabric Extender (FEX)

Question 5

In a VXLAN EVPN fabric, which protocol is used to exchange MAC and IP address reachability information among VTEPs?

Accepted Answer

BGP. In a VXLAN EVPN fabric, BGP (Border Gateway Protocol) is used as the control plane protocol to exchange MAC and IP address reachability information among VTEPs. Specifically, MP-BGP (Multiprotocol BGP) with EVPN address family (AFI L2VPN / SAFI EVPN) carries Type-2 routes (MAC/IP advertisement) to distribute host reachability across the overlay network, enabling efficient MAC learning and ARP suppression.

Answer

IS-IS

Answer

EIGRP

Answer

OSPF

Question 6

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 7

Refer to the exhibit. A network engineer notices that traffic for VNI 10000 is not being encapsulated. What is the most likely reason?

Accepted Answer

VNI 10000 is not configured under the nve interface.. VNI 10000 must be explicitly mapped to an NVE interface under the 'interface nve1' configuration using the 'member vni 10000' command. Without this mapping, the NVE interface does not know which VNI to encapsulate traffic for, even if the VNI exists in the network. Option B correctly identifies this missing configuration as the most likely cause.

Answer

BGP EVPN is not configured.

Answer

The VRF association is incorrect.

Answer

The source-interface is not reachable.

Question 8

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

Accepted Answer

Add 'spanning-tree bpdufilter enable' on the interface.. Enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Answer

Add 'spanning-tree guard loop' to the interface.

Answer

Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.

Answer

Change the port type to 'spanning-tree port type network trunk'.

Question 9

A data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?

Accepted Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit ip any any. ACLs are processed top-down, and the first match wins. The explicit permit for SSH from the jump host (10.10.1.100) must come before the deny for the entire 10.10.0.0/16 range to ensure the exception is honored. The final permit ip any any allows all other non-management traffic, which is necessary to avoid dropping legitimate traffic on the management interface.

Answer

permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22

Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255

Answer

deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any

Question 10

In ACI, which model is used for micro-segmentation to allow traffic between EPGs?

Accepted Answer

Whitelist model using contracts. ACI uses a whitelist model via contracts to permit traffic between EPGs.

Answer

Blacklist model using taboo contracts

Answer

IP-based ACLs on leaf switches

Answer

VRF leaking

Question 11

A large financial institution has a Cisco ACI fabric with multiple tenants. The security team requires that all management access to the APIC controllers be authenticated via multi-factor authentication (MFA) using a RADIUS server. The RADIUS server is configured to send a One-Time Password (OTP) challenge during authentication. The current configuration uses local authentication. The engineer needs to implement RADIUS authentication with MFA for APIC GUI and CLI access. The RADIUS server is reachable at 10.10.10.10, shared secret 'SecureSecret123'. The APIC is running software version 4.2(3). The engineer must ensure that local authentication is used as fallback if the RADIUS server is unreachable. Which of the following actions should the engineer take?

Accepted Answer

Add a RADIUS provider with IP 10.10.10.10 and secret 'SecureSecret123', create a login domain with realm 'radius', set fallback to 'local', and assign the domain to users.. It follows the required steps to configure RADIUS authentication with MFA on Cisco APIC: adding a RADIUS provider with the correct IP and shared secret, creating a login domain with realm 'radius', setting fallback to 'local', and assigning the domain to users. This ensures that the APIC sends authentication requests to the RADIUS server, which can issue an OTP challenge for MFA, and falls back to local authentication if the RADIUS server is unreachable.

Answer

Configure TACACS+ as the authentication protocol and set the server IP and secret.

Answer

Enable local authentication only and require strong passwords.

Answer

Configure LDAP authentication with the RADIUS server acting as an LDAP proxy.

Question 12

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets?

Accepted Answer

VTEP. The VTEP (VXLAN Tunnel Endpoint) is the device that performs encapsulation and decapsulation of Ethernet frames into UDP packets. It is the edge component in a VXLAN network that maps tenant traffic to VXLAN segments and handles the actual tunneling by adding the VXLAN header (including VNI) and outer UDP/IP headers.

Answer

VNI

Answer

VXLAN tunnel

Answer

VXLAN gateway

Question 13

Which TWO statements about Cisco UCS service profiles are correct? (Choose TWO.)

Accepted Answer

Service profiles can include policies for firmware management.. Cisco UCS service profiles can include firmware management policies that specify the firmware versions to be applied to the associated server components, such as adaptors, BIOS, and storage controllers. This allows administrators to enforce consistent firmware levels across the infrastructure without manual intervention.

Answer

Service profiles are only supported on B-Series blades.

Answer

Service profiles are tied to specific physical hardware.

Answer

A service profile does not include network identity settings such as MAC addresses.

Question 14

A data center uses NPV to connect edge switches to a core Fibre Channel switch. The edge switches report that some servers cannot log in. What is a likely cause?

Accepted Answer

NPIV not enabled on the core switch. In an NPV environment, the edge switch (NPV mode) relies on the core Fibre Channel switch to handle fabric login (FLOGI) and name server registration. NPIV (N_Port ID Virtualization) must be enabled on the core switch to allow multiple N_Port IDs to be assigned to a single physical N_Port, which is essential for NPV to function. If NPIV is not enabled on the core, the core switch cannot accept FLOGI requests from the NPV edge switch, preventing servers from logging into the fabric.

Answer

Overlapping VSAN IDs between edge and core

Answer

F port binding on the edge switch

Answer

Trunking mode not enabled on the core switch

Question 15

A storage administrator wants to ensure that only designated initiators can access a specific target in a Fibre Channel SAN. Which mechanism enforces this policy?

Accepted Answer

Zoning. Zoning is the correct mechanism because it restricts Fibre Channel (FC) communication to only those initiators and targets that are members of the same zone. By defining a zone that includes only the designated initiator WWPNs and the target WWPN, the switch enforces access control at the fabric level, preventing any unauthorized device from discovering or communicating with the target.

Answer

IVR

Answer

Port channel

Answer

VSAN

Answer

Credit recovery

Question 16

Refer to the exhibit. An administrator notices the blade firmware is outdated. What is the recommended first step to update the blade firmware?

Accepted Answer

Create a firmware management policy to stage the update. Cisco UCS Manager uses firmware management policies to stage firmware updates across blades in a controlled, non-disruptive manner. Staging the update allows the administrator to schedule the activation during a maintenance window, ensuring all blades receive the same firmware version consistently without immediate impact on production traffic.

Answer

Upgrade the fabric interconnects first

Answer

Update each blade individually using the CIMC

Answer

Reboot all blades immediately

Question 17

A HyperFlex cluster uses replication factor 3 (RF3) and consists of 4 all-flash nodes. One node fails permanently. After replacing the node, the cluster re-replicates data. What is the minimum number of additional node failures that can be tolerated without data loss after re-replication completes?

Accepted Answer

2. With RF3 (three copies of data), the cluster can tolerate up to two simultaneous failures (quorum requires at least two copies). After replacing the failed node, the cluster returns to full health, so again can tolerate two failures. However, if the cluster originally had 4 nodes and one fails, only 3 remain; if another fails during re-replication, data could be at risk. But after re-replication, 4 nodes exist, so two failures are tolerable.

Answer

1

Answer

0

Answer

3

Question 18

A network engineer is implementing port security on a Cisco Nexus 9000 switch to limit the number of MAC addresses learned on a single access port. The switchport is configured as follows:

interface Ethernet 1/2
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation shutdown
  switchport port-security mac-address sticky

After connecting two authorized devices, a third unauthorized device is connected, causing the port to enter the err-disabled state. The engineer needs to restore connectivity for the two authorized devices as quickly as possible, while maintaining the security posture. What is the best practice to recover the port automatically in the future?

Accepted Answer

Configure 'errdisable recovery cause psecure-violation' to automatically recover the port after the configured interval.. The 'errdisable recovery cause psecure-violation' command enables automatic recovery from the err-disabled state caused by a port-security violation. This allows the port to come back up after a default or configured interval (typically 300 seconds) without manual intervention, restoring connectivity for the two authorized devices while maintaining the security posture of limiting MAC addresses to two.

Answer

Manually shut down and then no shutdown the interface to recover from err-disabled state.

Answer

Remove port-security configuration entirely to prevent future err-disables.

Answer

Increase the maximum MAC address limit to 3 to accommodate the third device.

Question 19

An engineer needs to extend a Layer 2 VLAN across a VXLAN EVPN fabric. Which construct maps the VLAN to the overlay network?

Accepted Answer

VNI. In a VXLAN EVPN fabric, the VNI (VXLAN Network Identifier) is the construct that maps a Layer 2 VLAN to the overlay network. The VNI uniquely identifies a Layer 2 segment across the underlay, allowing VLAN traffic to be encapsulated and transported over the IP fabric. This mapping is configured on the VTEP (VXLAN Tunnel Endpoint) using commands like 'vlan 100' mapped to 'vn-segment 10100' under the VLAN configuration.

Answer

VLAN ID

Answer

VTEP IP

Answer

VPC

Question 20

A Cisco MDS switch is configured as an NPV switch to connect to a core switch. Which statement about NPV operation is true?

Accepted Answer

The NPV switch uses FDISC to register multiple N-Port IDs from a single physical link.. In N_Port Virtualization (NPV) mode, a Cisco MDS switch acts as a passthrough device that aggregates multiple end-device N_Ports onto a single uplink to a core Fibre Channel switch. The NPV switch uses the Fabric Discovery (FDISC) protocol to register multiple N_Port IDs (NPIV) from a single physical link, allowing each end device to obtain its own FC ID from the core switch. This is correct because NPV does not assign FC IDs itself but relies on the core switch for fabric login and address assignment.

Answer

The NPV switch allocates FC IDs to end devices from its own pool.

Answer

The NPV switch requires at least one VSAN to be defined as a fabric VSAN.

Answer

The NPV switch performs fabric login (FLOGI) on behalf of all attached end devices.