350-601 Practice Questions 2 — 50 Questions

Question 1

Match each Cisco data center security feature to its purpose.

Question 2

Match each Cisco UCS Manager CLI command to its function.

Question 3

Match each Cisco data center high availability feature to its description.

Question 4

Which THREE factors should be considered when determining the number of upstream Ethernet uplinks from a UCS Fabric Interconnect to the core network? (Choose THREE.)

Accepted Answer

The number of vNICs per service profile and their bandwidth limits.. Option C is correct because the number of vNICs per service profile and their bandwidth limits directly determine the aggregate traffic that must be carried by the upstream Ethernet uplinks. Each vNIC is assigned a specific bandwidth cap (e.g., via QoS policy or vNIC template), and the sum of these caps across all service profiles on a Fabric Interconnect dictates the minimum uplink capacity required to avoid oversubscription.

Answer

Number of VLANs defined on the Fabric Interconnect.

Answer

Server CPU oversubscription ratio.

Question 5

Which TWO options are correct regarding Cisco UCS server profiles? (Select TWO.)

Accepted Answer

Resource pools, such as UUID pools, can be shared across service profile templates.. Option B is correct because resource pools like UUID pools, MAC pools, and WWN pools are global objects in Cisco UCS Manager that can be shared across multiple service profile templates. This allows administrators to define a pool once and reference it from any template, ensuring consistent allocation and avoiding conflicts.

Answer

Service profiles can be updated while the server is in OS configuration.

Answer

A vHBA in a service profile inherits the boot policy automatically.

Answer

A service profile can be associated with multiple servers simultaneously to provide load balancing.

Question 6

An organization is deploying a new leaf-spine fabric with Cisco ACI. The requirement is to allow inter-tenant communication between two EPGs in different tenants. Which configuration object is necessary to enable this communication?

Accepted Answer

A shared contract between the two EPGs.. In Cisco ACI, inter-tenant communication between EPGs in different tenants requires a shared contract. A contract defines the rules (filters) that permit traffic between EPGs, and when it is marked as 'shared,' it can be consumed by EPGs across tenant boundaries. This allows the provider EPG in one tenant to expose services to a consumer EPG in another tenant without merging the tenants' VRFs or bridge domains.

Answer

A common VRF that spans both tenants.

Answer

A filter that permits the required traffic.

Answer

A bridge domain that connects both EPGs.

Question 7

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

Accepted Answer

The VLAN-to-VNI mapping is missing under the VLAN configuration. The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

Answer

MTU mismatch on the underlay network

Answer

Anycast gateway is not configured on the leaf

Answer

BGP EVPN peers are not established

Question 8

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

Accepted Answer

Priority Flow Control (PFC) with a no-drop queue for iSCSI.. Option C is correct because Priority Flow Control (PFC) is the IEEE 802.1Qbb mechanism designed to provide lossless behavior for specific traffic classes, such as iSCSI storage traffic, on Nexus 9000 switches. By creating a no-drop queue for iSCSI, PFC uses pause frames on a per-priority basis to prevent buffer overflow, ensuring zero packet loss required by storage protocols.

Answer

Tail drop with DSCP-based classification.

Answer

Weighted Round Robin (WRR) with three queues.

Answer

Policing at the ingress and marking at the egress.

Question 9

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

Accepted Answer

Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.. Option C is correct because Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

Answer

Assign the 'read-only' role to the user within the tenant.

Answer

Create a separate VRF for each tenant and assign admin to that VRF.

Answer

Assign the 'tenant-admin' role to the user globally.

Question 10

An organization is deploying Cisco ACI in a brownfield data center. They have existing VLANs that need to be mapped to ACI EPGs. The network team notices that some VLANs are used across multiple tenants. How should the engineer design the VLAN pool to support overlapping VLANs?

Accepted Answer

Create separate VLAN pools per tenant, each containing the required VLANs.. Option B is correct because in Cisco ACI, VLAN pools are scoped to a physical domain, and overlapping VLANs across tenants require separate VLAN pools per tenant. Each tenant's EPG is statically bound to its own VLAN pool, ensuring isolation and preventing VLAN conflicts. This design aligns with ACI's multi-tenant architecture where VLAN IDs must be unique within a domain but can be reused across different domains.

Answer

Configure the VLANs as part of the EPG static binding without a pool.

Answer

Create one VLAN pool per physical domain and assign tenants to that domain.

Answer

Create a global VLAN pool with all VLANs and assign it to all tenants.

Question 11

A data center architect is designing security for a Cisco ACI fabric that must comply with PCI DSS. The requirement is to encrypt all traffic between EPGs within the same tenant. Which solution should be used?

Accepted Answer

Use a contract with the 'encrypt' flag enabled between the EPGs.. Option B is correct because Cisco ACI supports encryption of traffic between EPGs within the same tenant using a contract with the 'encrypt' flag enabled. This leverages the ACI fabric's built-in capability to apply AES-based encryption (e.g., AES-256-GCM) at the leaf switch level, ensuring data confidentiality for PCI DSS compliance without requiring external devices or complex routing changes.

Answer

Enable port security on the leaf switch interfaces.

Answer

Create separate VRFs for each EPG and route traffic through a firewall.

Answer

Configure a site-to-site VPN between the leaf switches.

Question 12

An engineer is configuring a new data center leaf switch to enforce micro-segmentation using Cisco ACI. The requirement is to permit traffic from web servers to application servers on TCP port 8080, but deny all other traffic. The web servers are in EPG 'web_EPG' and application servers in EPG 'app_EPG'. Which contract configuration should be applied?

Accepted Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer.. Option C is correct because in Cisco ACI, contracts define the rules for communication between EPGs. The provider EPG offers a service, and the consumer EPG accesses it. By setting the filter direction to 'both', the contract enforces bidirectional traffic on TCP port 8080, which is necessary for web-to-application communication (e.g., HTTP responses). This configuration ensures that only traffic matching the filter is permitted, while all other traffic is implicitly denied by ACI's default deny behavior.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Use vzAny for both EPGs.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Assign web_EPG as provider and app_EPG as consumer.

Answer

Create a contract with subject 'web_to_app' and apply filter 'ip'. Assign web_EPG as provider and app_EPG as consumer.

Question 13

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

Accepted Answer

show authentication interface ethernet 1/1. Option C is correct because the 'show authentication interface ethernet 1/1' command displays the 802.1X authentication status, including the state machine, authorized status, and method list for a specific interface. This command is part of the Identity-Based Networking Services (IBNS) framework and provides a comprehensive view of all authentication methods (802.1X, MAB, WebAuth) configured on the port, which is essential for troubleshooting authentication failures on edge ports.

Answer

show aaa authentication

Answer

show dot1x

Answer

show port-security interface ethernet 1/1

Question 14

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

Accepted Answer

Upgrade the secondary vPC peer first, then the primary. In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

Answer

Upgrade both switches simultaneously using ISSU

Answer

Reload both switches to a previous version, then upgrade

Answer

Upgrade the primary vPC peer first, then the secondary

Question 15

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

Accepted Answer

VRF. The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default. This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Answer

Context (default)

Answer

Application-profile

Answer

Global

Question 16

Which TWO statements correctly describe the use of Cisco UCS Manager service profiles for server deployment?

Accepted Answer

Service profiles decouple server identity from hardware, enabling rapid provisioning.. Service profiles decouple the logical server identity (UUID, MAC addresses, WWPNs) from the physical hardware. This allows an administrator to rapidly provision or repurpose a server by simply associating the profile with a different blade or rack server, without reconfiguring the OS or SAN/NIC settings. This abstraction is the core value of Cisco UCS Manager for scalable, stateless computing.

Answer

Service profiles can only be applied to servers of the same model.

Answer

A service profile can be associated with multiple servers simultaneously.

Answer

Service profiles are stored locally on the server's boot drive.

Question 17

Which THREE of the following are valid methods to secure the control plane on a Cisco Nexus 9000 switch?

Accepted Answer

Enable control plane policing (CoPP) to rate-limit control plane traffic.. Control plane policing (CoPP) is a valid method to secure the control plane on a Cisco Nexus 9000 switch. CoPP uses a policy map applied to the control plane to rate-limit or drop traffic destined to the supervisor module, protecting the CPU from excessive or malicious traffic. This is a direct control plane security mechanism defined in Cisco NX-OS.

Answer

Enable Bidirectional Forwarding Detection (BFD) on all interfaces.

Answer

Implement routing protocol authentication (e.g., OSPF MD5).

Question 18

Refer to the exhibit. A VXLAN VNI (10030) is operationally down. What is the most likely cause?

Accepted Answer

The VLAN associated with VNI 10030 is not configured or mapped. VXLAN VNI 10030 is operationally down because the VLAN that maps to this VNI is either not created or not associated with the VNI under the NVE interface. In Cisco NX-OS, a VNI becomes operationally up only when the corresponding VLAN exists and is properly mapped via the `member vni 10030 associate-vrf` or `member vni 10030` command under the NVE interface. Without this mapping, the NVE cannot forward traffic for that VNI, leaving it in a down state.

Answer

The source interface loopback0 is not up

Answer

The NVE mode should be L2VPN instead of L3VPN

Answer

The multicast group 239.1.1.1 is not reachable

Question 19

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

Accepted Answer

Enable DHCP snooping globally and configure uplink ports as trusted.. DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.

Answer

Enable dynamic ARP inspection on all VLANs.

Answer

Enable IP source guard on all access ports.

Answer

Enable MAC port security on all access ports.

Question 20

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 1 is not allowed on the trunk, so untagged frames are dropped.. The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1. This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Answer

The spanning-tree port type edge trunk is causing BPDU guard to block the port.

Answer

The port is in err-disabled state due to a loop.

Answer

The port is administratively down.