350-601 Practice Questions 2 — 50 Questions

Question 1

A storage administrator reports that a new host cannot log into the SAN. The host is connected to a Cisco MDS switch. The switch interface shows up/up but the host is not in the active zone. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The zone set is not activated.. The host cannot log into the SAN despite the interface showing up/up because the zone set is not activated. In Cisco MDS Fibre Channel SANs, zone configurations are stored in the zone database but only take effect when the zone set is activated (using the 'zone activate' command). Without an active zone set, no zoning is enforced, and the host's WWPN is effectively invisible to other devices, preventing login even though the physical link is operational.

Answer

The switch port is in an isolated state.

Answer

The FC cable is faulty.

Answer

The host's WWPN is not in the zone configuration.

Answer

The host's driver is not installed.

Question 2

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 3

Based on the exhibited FLOGI database, what is the state of the interface fc1/1?

Accepted Answer

It is an NP port (proxy FW) because multiple FCIDs appear on the same interface.. The FLOGI database shows multiple FCIDs (0x010000, 0x010001) associated with the same interface fc1/1, which is characteristic of an NP port (proxy FW) in NPV mode. An NP port acts as a proxy for multiple end devices behind it, such as in a Fibre Channel NPV switch or a converged network adapter (CNA) in FCoE NPV mode, allowing multiple FCIDs to share a single physical link.

Answer

It is an F port with a hub attached.

Answer

It is a trunking E port.

Answer

It is a disabled port because there are two WWNs.

Question 4

Which ECMP load-balancing method is recommended for data center spine-leaf fabrics to ensure optimal traffic distribution?

Accepted Answer

Per-flow load balancing based on src-dst IP. Per-flow load balancing based on src-dst IP ensures that all packets belonging to the same flow (identified by source and destination IP addresses) follow the same path, preventing packet reordering while still distributing different flows across multiple equal-cost paths. In spine-leaf fabrics, this method provides optimal traffic distribution because it leverages the IP header information that is consistently available across Layer 3 boundaries, aligning with the fabric's routing-based forwarding model.

Answer

Per-packet load balancing

Answer

Weighted load balancing

Answer

Per-flow load balancing based on src-dst MAC

Question 5

An administrator configures 'aaa authentication login default group tacacs+ local'. What happens if the TACACS+ server is unreachable?

Accepted Answer

Local username database is used. The command 'aaa authentication login default group tacacs+ local' configures a method list where the first method is TACACS+ and the second is local. If the TACACS+ server is unreachable (not responding, not rejecting), the switch falls back to the next method in the list, which is local authentication using the local username database. This fallback behavior is defined by Cisco IOS/IOS-XE authentication method lists, where 'local' acts as a backup when the primary method is unavailable.

Answer

The switch uses no authentication

Answer

Authentication fails

Answer

The switch tries the next method in the group

Question 6

An engineer needs to ensure that only authorized servers can connect to a specific switch port in a data center. The port connects to a critical database server with fixed MAC address 00:1a:2b:3c:4d:5e. Which configuration is most appropriate?

Accepted Answer

switchport port-security
switchport port-security mac-address 001a.2b3c.4d5e
switchport port-security violation shutdown. It explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.

Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown

Answer

no switchport port-security
spanning-tree portfast

Answer

switchport port-security
switchport port-security maximum 2
switchport port-security violation protect

Question 7

What is the primary function of the Cisco Integrated Management Controller (CIMC) on UCS C-series rack servers?

Accepted Answer

To provide out-of-band management with KVM, virtual media, and remote firmware update. CIMC provides out-of-band management capabilities such as remote KVM, virtual media, and firmware updates, allowing administrators to manage the server independently of the host OS.

Answer

To manage the server's power and cooling via IPMI

Answer

To provide in-band management through the host OS

Answer

To integrate the rack server into UCS Manager fabric

Question 8

Match each Cisco data center technology to its primary purpose.

Accepted Answer

VDC: Enables partitioning a single physical switch into multiple logical switches.. VDC partitions switches; VPC provides redundant LAG; FEX extends fabric ports; OTV extends Layer 2 over Layer 3.

Answer

VPC: Enables partitioning a single physical switch into multiple logical switches.

Answer

FEX: Allows a link aggregation group to terminate on two upstream switches for redundancy.

Question 9

An engineer is configuring a storage network with FCoE and must ensure that the FCoE traffic does not interfere with standard LAN traffic. Which two mechanisms should be implemented?

Accepted Answer

Enable PFC on the FCoE VLAN.. FCoE requires lossless transport to prevent frame drops that would corrupt Fibre Channel frames. Priority Flow Control (PFC), defined by IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured as lossless while standard LAN traffic remains best-effort. This ensures FCoE traffic does not interfere with LAN traffic by isolating the flow control behavior.

Answer

Use the same VLAN for FCoE and LAN.

Answer

Disable flow control on FCoE VLAN.

Answer

Use jumbo frames for LAN traffic only.

Question 10

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.

Answer

RADIUS

Answer

LDAP

Answer

SSH

Question 11

During a network upgrade, an engineer applies a new OSPF configuration on a Nexus 9000 spine. After the change, several leaf switches lose connectivity to each other. The engineer examines the logs and sees OSPF adjacency flapping. What is the most likely cause?

Accepted Answer

Duplicate router IDs.. Duplicate router IDs cause OSPF adjacency flapping because OSPF uses the Router ID (RID) to uniquely identify each router in the OSPF domain. When two routers share the same RID, they reject each other's Hello packets, leading to repeated adjacency resets. In a Nexus 9000 spine-leaf topology, this often occurs when the spine's RID is accidentally configured to match an existing leaf's RID, disrupting the entire fabric's OSPF convergence.

Answer

OSPF hello timer mismatch.

Answer

MTU mismatch on the fabric links.

Answer

Incorrect area configuration.

Question 12

Which TWO statements correctly describe the difference between synchronous and asynchronous replication?

Accepted Answer

Asynchronous replication has lower impact on application performance. Synchronous replication has zero RPO but can impact performance due to latency, while asynchronous replication has a lower performance impact but may have some data loss (nonzero RPO).

Answer

Asynchronous replication requires dedicated links

Answer

Synchronous replication is more tolerant of high latency links

Answer

Asynchronous replication guarantees zero data loss

Question 13

Match each Cisco data center automation tool to its primary use.

Accepted Answer

Intersight: Cloud-based management platform. Automation tools streamline data center operations. UCS Manager handles server management, ACI automates network policy, Intersight offers cloud management, and Nexus Dashboard provides monitoring. The distractors swap these roles.

Answer

UCS Manager: Automates network policy management

Answer

ACI: Manages Cisco UCS blade and rack servers

Question 14

An engineer is designing a Layer 3 network for a data center using OSPF. The core switches are connected to aggregation switches. To optimize convergence, which OSPF network type should be used on the links between core and aggregation?

Accepted Answer

point-to-point. In a data center spine-leaf architecture, the links between core (spine) and aggregation (leaf) switches are typically point-to-point Layer 3 links. Configuring OSPF network type point-to-point (option D) on these interfaces eliminates the need for DR/BDR election, reduces hello and dead timers (default 10s/40s vs 30s/120s for broadcast), and allows faster convergence because OSPF immediately forms a neighbor adjacency without waiting for election delays.

Answer

broadcast

Answer

non-broadcast

Answer

point-to-multipoint

Question 15

Arrange the steps to configure a port-channel (LAG) on a Cisco Nexus switch.

Accepted Answer

Step 1: Create the port-channel interface. Step 2: Configure the port-channel interface (e.g., switchport mode). Step 3: Assign physical interfaces to the port-channel using the channel-group command. Step 4: Verify the port-channel status.. Port-channel creation involves interface creation, mode setting, member addition, and verification.

Answer

Step 1: Assign physical interfaces to the port-channel using the channel-group command. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Verify the port-channel status.

Answer

Step 1: Configure the port-channel interface. Step 2: Create the port-channel interface. Step 3: Assign physical interfaces to the port-channel. Step 4: Verify the port-channel status.

Answer

Step 1: Verify the port-channel status. Step 2: Create the port-channel interface. Step 3: Configure the port-channel interface. Step 4: Assign physical interfaces to the port-channel.

Question 16

A data center switch has multiple access ports configured with spanning-tree portfast. A new server is connected to one of these ports and immediately causes a network loop. What is the most likely cause?

Accepted Answer

The port is not configured with BPDUguard.. Spanning Tree Protocol (STP) PortFast immediately transitions a port to the forwarding state, bypassing the listening and learning phases. However, PortFast alone does not protect against loops if a rogue device (like a server) inadvertently connects two switch ports or sends BPDUs. BPDUguard must be explicitly configured on the port to disable it upon receiving any BPDU, preventing a loop. Without BPDUguard, the switch will process the BPDU and may re-enter STP convergence, potentially causing a loop if the server is misconfigured or bridging traffic.

Answer

The portfast feature is disabled by default on the switch.

Answer

The server sends BPDUs.

Answer

The switch is running MSTP instead of PVST+.

Question 17

Which TWO of the following are benefits of using Smart Zoning in Cisco MDS switches?

Accepted Answer

Reduces number of zone objects. Smart Zoning reduces the number of zone objects by automatically grouping initiator-target pairs into a single zone entry, rather than requiring a separate zone for each pair. This minimizes the size of the zone database and reduces the processing overhead on the switch during fabric reconfigurations.

Answer

Provides faster FLOGI processing

Answer

Eliminates the need for VSANs

Answer

Allows automatic LUN masking

Question 18

Order the steps to configure FCoE on a Cisco Nexus switch with NPV mode.

Accepted Answer

Enable feature fcoe, then configure the FCoE VLAN, then configure VSAN mapping, then enable NPV mode, then configure fabric login. FCoE requires feature fcoe, VSAN mapping, VLAN config, NPV mode, and fabric login.

Answer

Configure VSAN mapping, then enable feature fcoe, then configure the FCoE VLAN, then enable NPV mode, then configure fabric login

Answer

Enable NPV mode, then enable feature fcoe, then configure the FCoE VLAN, then configure VSAN mapping, then configure fabric login

Answer

Configure fabric login, then enable feature fcoe, then configure the FCoE VLAN, then configure VSAN mapping, then enable NPV mode

Question 19

An engineer is designing an ACI fabric and needs to provide connectivity to an external Layer 3 network. Which construct must be configured to achieve this?

Accepted Answer

L3Out. To connect an ACI fabric to an external Layer 3 network, you must configure an L3Out. An L3Out defines the external routed connectivity by associating a VRF with external interfaces, routing protocols (e.g., OSPF, BGP, EIGRP), and subnets that are advertised into or from the fabric. This construct allows ACI to exchange routes with the external Layer 3 domain.

Answer

VMM domain

Answer

EPG

Answer

VXLAN tunnel

Question 20

Sequence the steps for configuring OSPF on a Cisco Nexus switch in a data center fabric.

Accepted Answer

First, create the OSPF process with 'router ospf '. Second, configure the router ID with 'router-id '. Third, enable OSPF on interfaces using 'ip router ospf area '. Finally, verify with 'show ip ospf'.. OSPF configuration involves creating the process, setting router ID, enabling on interfaces, and verification.

Answer

First, configure the router ID before creating the OSPF process, then create the process, then enable on interfaces, then verify.

Answer

First, create the OSPF process, then enable OSPF on interfaces, then configure the router ID, then verify.

Answer

First, enable OSPF on interfaces, then create the OSPF process, then set router ID, then verify.