350-601 Practice Exam 52 — 20 Questions

Question 1

A network administrator implements the ACL shown. After verifying the ACL statistics, all counters show 0 matches. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface.. If the ACL is applied to the wrong interface, traffic never traverses that interface, so the ACL counters remain at 0. ACLs must be applied to the interface where traffic enters (inbound) or exits (outbound) the device; applying to an interface that does not carry the relevant traffic results in no matches.

Answer

The ACL entries are in the wrong order.

Answer

The 'permit ip any any' entry causes all traffic to be permitted before inspection.

Answer

The ACL is applied outbound instead of inbound.

Question 2

Refer to the exhibit. A network engineer notices that the VPC peer status is down, and the peer-keepalive is not reachable. Based on the configuration, what is the likely issue?

Accepted Answer

The peer-keepalive destination must be on the management VRF.. The peer-keepalive link must be routed via the management VRF to ensure it remains independent of the data-plane and peer-link state. If the peer-keepalive destination is not in the management VRF, the keepalive packets may be dropped or unreachable, causing the VPC peer status to remain down. The configuration shown likely omits the 'vrf member management' under the peer-keepalive configuration, or the destination IP is not reachable through the management interface.

Answer

The peer-link port-channel10 has VLAN 100-110 allowed, but the peer-keepalive uses a separate VLAN.

Answer

The VPC domain priority should be lower.

Answer

The peer-keepalive source and destination are swapped.

Question 3

A CCNP engineer is troubleshooting a UCS environment where a server is stuck in 'Discovery: In Progress' state. The chassis has been power-cycled, but the issue persists. FEX fabric port is configured correctly. What is the most likely cause?

Accepted Answer

Firmware version mismatch between the server's CIMC and the Fabric Interconnect.. When a server is stuck in 'Discovery: In Progress' state and the chassis has been power-cycled with correct FEX fabric port configuration, the most likely cause is a firmware version mismatch between the server's Cisco Integrated Management Controller (CIMC) and the Fabric Interconnect (FI). During discovery, the FI attempts to inventory and manage the server via CIMC; if the firmware versions are incompatible, the discovery process cannot complete, leaving the server in a perpetual 'In Progress' state.

Answer

Incorrect IP address on the Fabric Interconnect management interface.

Answer

The chassis is not connected to the FI via a valid fabric cable.

Answer

The server's service profile is not associated.

Question 4

An organization is deploying a HyperFlex cluster for a database workload requiring low latency and high IOPS. Which node type should be selected?

Accepted Answer

All-flash nodes. All-flash nodes use only SSDs for both caching and persistent storage, delivering the lowest latency and highest IOPS required for demanding database workloads. In a HyperFlex cluster, all-flash configurations eliminate the rotational latency of HDDs, ensuring consistent sub-millisecond response times critical for OLTP databases.

Answer

Hybrid HDD/SSD nodes

Answer

Compute-only nodes

Answer

Witness VM nodes

Question 5

What is the purpose of the vPC peer keepalive link in a vPC domain?

Accepted Answer

To provide a keepalive mechanism to detect peer failure. The vPC peer keepalive link is a dedicated Layer 3 link used to detect a failure of the vPC peer switch. It sends periodic UDP-based keepalive messages (default every second) to ensure the peer is still operational, allowing the surviving switch to take over the vPC forwarding role. This mechanism is critical for preventing dual-active scenarios where both switches would incorrectly forward traffic for the same vPC VLAN.

Answer

To synchronize MAC address tables

Answer

To carry BPDUs for STP

Answer

To forward data traffic between vPC peers

Question 6

Which of the following is a required characteristic of an FCoE SAN?

Accepted Answer

Lossless Ethernet (PFC) must be enabled.. FCoE (Fibre Channel over Ethernet) requires a lossless Ethernet fabric to prevent frame drops, which would corrupt Fibre Channel frames. Priority Flow Control (PFC), defined in IEEE 802.1Qbb, enables lossless operation by pausing traffic on individual CoS queues, ensuring no-drop behavior for FCoE traffic. Without PFC, standard Ethernet's best-effort delivery would cause frame loss, breaking FCoE's reliability requirements.

Answer

Jumbo frames must be enabled.

Answer

Spanning Tree Protocol must be disabled.

Answer

Link aggregation (LACP) is required.

Question 7

In a Cisco ACI fabric, the administrator notices that traffic between two endpoints in different EPGs but on the same leaf switch is being dropped when a contract is applied. The endpoints are in the same VRF but different bridge domains. What is the likely cause?

Accepted Answer

The contract does not allow communication between those EPGs.. In Cisco ACI, inter-EPG communication is governed by contracts. Even when endpoints reside on the same leaf switch, same VRF, and different bridge domains, traffic is dropped unless a contract explicitly permits the communication between the source and destination EPGs. The contract defines the filter (e.g., IP protocol, ports) and the direction (provider/consumer) required for traffic to flow.

Answer

The VRF is not configured correctly.

Answer

The bridge domains are not in the same network.

Answer

The leaf switch is missing a route to the destination.

Question 8

An organization uses UCS Central to manage multiple UCS domains. They need to create a global VLAN policy that applies to all domains. How is this achieved?

Accepted Answer

Create a global VLAN policy in UCS Central and apply it to the service profile templates. UCS Central provides centralized management for multiple UCS domains. A global VLAN policy created in UCS Central is automatically propagated to all managed UCS domains, ensuring consistent VLAN definitions across the infrastructure. Applying this policy to service profile templates enforces the VLAN configuration on all associated service profiles, eliminating the need for per-domain configuration.

Answer

Use Cisco IMC Supervisor to distribute VLANs

Answer

Configure VLANs on the Fabric Interconnects directly

Answer

Define the VLAN policy locally in each UCS domain

Question 9

In ACI, what is the purpose of a contract?

Accepted Answer

Allow or deny traffic between EPGs. In Cisco ACI, a contract is a policy construct that defines how communication is allowed or denied between Endpoint Groups (EPGs). Contracts specify the subjects, filters, and actions (permit or deny) that govern traffic flows, enabling granular security and segmentation within the fabric. Without a contract, EPGs in different bridge domains or VRFs cannot communicate by default.

Answer

Isolate tenants

Answer

Define routing between VRF

Answer

Provide external connectivity

Question 10

Refer to the exhibit. The configuration is intended to provide Layer 2 isolation within VLAN 100 while allowing the promiscuous port (Ethernet 1/1) to communicate with all ports in the community VLAN. However, hosts in VLAN 100 cannot communicate with each other. What is the most likely misconfiguration?

Accepted Answer

The 'switchport private-vlan association trunk' command on Ethernet 1/1 is incorrect; it should be 'switchport private-vlan association mapping' or similar.. The command 'switchport private-vlan association trunk' is invalid for configuring a promiscuous port in a private VLAN. The correct command is 'switchport private-vlan mapping primary-vlan-id secondary-vlan-id' to map the promiscuous port to the primary VLAN and the secondary community VLAN. Without this correct mapping, the promiscuous port cannot forward traffic to hosts in the community VLAN, causing Layer 2 isolation to fail.

Answer

The SVI interface needs 'ip address' to be removed.

Answer

The SVI interface should have 'private-vlan mapping' to the primary VLAN, not the community VLAN.

Answer

The command 'no ip redirects' should not be applied to the SVI.

Question 11

A data center uses VPC between two Nexus switches. Which statement is true about the VPC peer-link?

Accepted Answer

It carries both data and control traffic.. The VPC peer-link is a critical component in a vPC domain, carrying both data traffic (e.g., traffic from orphan ports or traffic that must traverse the peer-link for forwarding) and control traffic (e.g., vPC keepalive messages and Cisco Fabric Services (CFS) synchronization). This dual role ensures that the two Nexus switches operate as a single logical entity for the downstream devices, providing loop-free Layer 2 multipathing.

Answer

It must be a single link.

Answer

It carries only control traffic.

Answer

It is used only for orphan ports.

Question 12

Which TWO commands are used on NX-OS to verify vPC status and consistency? (Choose two.)

Accepted Answer

show vpc consistency-parameters. The 'show vpc' command displays the overall vPC status, including peer link and keepalive status, while 'show vpc consistency-parameters' verifies that both peers have matching configurations (e.g., STP, VLAN, MTU) to prevent traffic disruption. These two commands are essential for validating vPC operational health and configuration consistency.

Answer

show port-channel summary

Answer

show running-config vpc

Answer

show vpc role

Question 13

An engineer is troubleshooting a SAN that uses FCoE. The FCoE Initialization Protocol (FIP) discovery phase is failing for one server. The server is connected to a Cisco Nexus switch configured for FCoE. Which command should be checked first?

Accepted Answer

show vlan fcoe. The FCoE Initialization Protocol (FIP) discovery phase relies on FCoE VLANs being properly configured and active on the switch. The 'show vlan fcoe' command displays the FCoE VLANs and their status, which is the first place to check when FIP discovery fails because the server must be in the correct FCoE VLAN to discover the FCF (FCoE Forwarder). If the FCoE VLAN is missing or not mapped correctly, FIP discovery will fail.

Answer

show npv status

Answer

show dcbx parameters

Answer

show priority-flow-control

Question 14

Match each Cisco data center high availability feature to its description.

Accepted Answer

VRRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.. The correct matches are: VRRP is an open standard protocol for router redundancy; GLBP provides load balancing across gateways; NSF allows forwarding to continue during switchover; VPC bundles links from two switches. Common confusions include mistaking HSRP for VRRP (HSRP is proprietary) and confusing SSO (state synchronization) with NSF (forwarding continuity).

Answer

HSRP: Open standard protocol that provides first-hop redundancy with a virtual IP and master/backup routers.

Answer

SSO: Feature that continues packet forwarding during a supervisor switchover.

Question 15

An administrator wants to ensure that a specific initiator can only access a single target LUN. Which zoning approach satisfies this requirement?

Accepted Answer

Use LUN zoning to map the initiator to a specific LUN ID.. LUN zoning (also known as LUN masking) allows the administrator to map a specific initiator to a particular LUN ID on a target, ensuring that the initiator can only access that single LUN. This is achieved by configuring access control at the storage array level, typically using the target's LUN masking feature, which restricts visibility to only the assigned LUN. Unlike WWPN zoning, which controls fabric-level access, LUN zoning provides granular per-LUN access control.

Answer

Implement soft zoning based on domain IDs.

Answer

Configure a zone with the initiator WWPN and the target WWPN.

Answer

Place the initiator and target in different VSANs.

Question 16

Which THREE of the following are required for a successful FCoE deployment on a Cisco MDS switch?

Accepted Answer

Enable the FCoE feature globally. The FCoE feature must be enabled globally on the Cisco MDS switch using the 'feature fcoe' command. This activates the FCoE protocol stack and allows the switch to process FCoE frames, which is a prerequisite for any FCoE deployment.

Answer

Enable FIP snooping on the FCoE VLAN

Answer

Set the MTU to 9216 bytes on all FCoE interfaces

Question 17

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

Accepted Answer

Priority Flow Control (PFC) with a no-drop queue for iSCSI.. Priority Flow Control (PFC) is the IEEE 802.1Qbb mechanism designed to provide lossless behavior for specific traffic classes, such as iSCSI storage traffic, on Nexus 9000 switches. By creating a no-drop queue for iSCSI, PFC uses pause frames on a per-priority basis to prevent buffer overflow, ensuring zero packet loss required by storage protocols.

Answer

Tail drop with DSCP-based classification.

Answer

Weighted Round Robin (WRR) with three queues.

Answer

Policing at the ingress and marking at the egress.

Question 18

A data center runs OSPF as the underlay for an EVPN-VXLAN fabric. The fabric includes two spine switches and eight leaf switches. After adding a new leaf switch, the network team notices that some EVPN routes are missing from the other leaves. The new leaf has established BGP EVPN sessions to both spines and the BGP sessions are up. The spines report receiving all routes from the new leaf, but the other leaves do not receive certain prefixes. The engineer checks the BGP configuration on the new leaf and sees the address-family l2vpn evpn is configured under router bgp. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify the new leaf has the address-family l2vpn evpn activated under the neighbor configuration. The issue is that the new leaf has BGP EVPN sessions to both spines, but other leaves do not receive certain prefixes. Since the spines (acting as route reflectors) receive all routes from the new leaf but do not propagate them to other leaves, the most likely cause is that the address-family l2vpn evpn is not activated under the neighbor configuration on the new leaf. Without this activation, the new leaf does not advertise its EVPN routes to the spines, even though the BGP session is up and the address-family is configured globally under router bgp.

Answer

Check the new leaf's BGP router ID for uniqueness

Answer

Ensure the new leaf's BGP next-hop-self is enabled

Answer

Verify the cluster ID on the route reflectors is consistent

Question 19

Which feature in UCS Manager allows centralized management of firmware policies across multiple chassis without creating a separate policy for each chassis?

Accepted Answer

Firmware Policy. B is correct because a Firmware Policy in UCS Manager allows you to define a single firmware version and package that can be applied to multiple chassis or service profiles. This centralized approach eliminates the need to create a separate firmware policy for each chassis, as the policy is simply associated with the desired chassis or service profile templates.

Answer

Maintenance Policy

Answer

Host Firmware Package

Answer

Adapter Policy

Question 20

A company uses Cisco ISE for 802.1X authentication on data center edge switches. After a recent upgrade, some endpoints that previously authenticated successfully now fail. The ISE logs show the endpoint is in the wrong authorization profile. What is the most likely cause?

Accepted Answer

The endpoint posture assessment is failing. A failing posture assessment can cause ISE to apply a different authorization profile (e.g., a quarantine or remediation profile) instead of the expected one, even though the endpoint previously authenticated successfully. Posture checks occur after 802.1X authentication and can change the authorization result based on endpoint compliance, which aligns with the symptom of the endpoint being in the wrong profile after an upgrade.

Answer

The switch port is in multi-authentication mode

Answer

The switch has incorrect RADIUS shared secret

Answer

The ISE policy is using a different identity source