350-601 Practice Exam 52 — 20 Questions

Question 1

A data center engineer is configuring Cisco Intersight to manage a new Cisco UCS C-Series server. The server is not yet associated with any Intersight account. Which action must be taken first to allow Intersight to manage the server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the Intersight Device Connector and enable it on the server.. To allow Cisco Intersight to manage a UCS C-Series server, the Intersight Device Connector must be installed and enabled on the server. This connector establishes a secure connection to Intersight, enabling the server to be claimed and managed. Only after the connector is active can the server be claimed using the device ID and claim code, and then organized within Intersight.

Answer

Create a new organization in Intersight and assign the server to it.

Answer

Claim the device using the device ID and claim code.

Answer

Configure a DNS server and NTP server on the server.

Question 2

A security team is implementing Cisco TrustSec in a data center to enforce segmentation based on user identity. They have deployed 802.1X for authentication and are now configuring Security Group Tags (SGTs). Which two components are required to enable SGT propagation and enforcement across the network? (Choose two.)

Accepted Answer

A Cisco Identity Services Engine (ISE) for centralized policy management and SGT assignment.. The correct answers are SGA-capable switches and Cisco ISE. SGA-capable switches are needed to carry and enforce SGTs, either through inline tagging or SXP. Cisco ISE is required to assign SGTs to users during authentication. Together, they form the core of a TrustSec deployment. Other components like DNA Center or IPsec are not mandatory.

Answer

IPsec encryption enabled on all links to secure SGT tags in transit.

Answer

A Cisco DNA Center appliance to orchestrate the TrustSec policies.

Answer

A dedicated VLAN for SGT traffic to separate it from user data.

Question 3

A network automation team is using Cisco DNA Center to manage a large data center fabric. They need to programmatically retrieve a list of all network devices and their health scores. Which API should they use?

Accepted Answer

Cisco DNA Center Intent API. The Cisco DNA Center Intent API is the correct interface for retrieving device inventory and health scores in a DNA Center-managed fabric. It offers REST endpoints specifically designed for network automation, including device lists and health monitoring. Other APIs mentioned are for different platforms and cannot fulfill this requirement.

Answer

Cisco APIC REST API

Answer

Cisco NX-API REST

Answer

Cisco UCS Manager XML API

Question 4

An engineer is deploying a VXLAN EVPN fabric with an OSPF underlay on Cisco Nexus 9000 switches. After adding a new spine switch, some leaf switches experience routing instability. The engineer suspects that the OSPF hello and dead timers are mismatched between the new spine and the leaf switches. Which action should be taken to resolve this issue?

Accepted Answer

Configure the same OSPF hello and dead timers on all interfaces.. OSPF neighbor adjacencies require matching hello and dead timers. If the new spine has different timers than the leaf switches, adjacencies will not form or will flap, leading to routing instability. The correct action is to configure identical timers on all interfaces involved. Changing network type, enabling authentication, or adjusting cost does not fix a timer mismatch.

Answer

Change the OSPF network type to point-to-point on the spine interfaces.

Answer

Enable OSPF authentication on all interfaces.

Answer

Adjust the OSPF cost on the leaf interfaces.

Question 5

A network engineer is configuring a Cisco Nexus 9000 switch as a VTEP in a VXLAN EVPN fabric. The engineer must define the loopback interface used as the NVE source and map VLANs into the VXLAN overlay. Which two configuration elements are required on the leaf switch to accomplish this? (Choose two.)

Accepted Answer

A loopback interface with an IP address in the underlay routing domain that is advertised so remote VTEPs can reach it.. Bringing up a leaf as a VTEP requires an NVE interface that references the VTEP loopback as its source and maps VLANs to VNIs, plus a reachable loopback advertised in the underlay. Together these let the leaf encapsulate traffic and be reached by remote VTEPs. Per-peer tunnels and static flood lists are not part of the NX-OS VXLAN model.

Answer

A VXLAN tunnel interface configured with a unique IP address per remote VTEP for point-to-point encapsulation.

Answer

An anycast gateway MAC address configured globally with a unique value on every leaf switch in the fabric.

Answer

A static VXLAN flood list entry for every remote VTEP in the fabric to handle BUM traffic.

Question 6

A data center engineer is configuring first-hop security on a Cisco Nexus 9000 switch. The requirement is to prevent rogue DHCP servers from assigning IP addresses to hosts on a VLAN. The engineer enables DHCP snooping and wants to ensure that only trusted ports can send DHCP server messages. Which additional configuration is necessary?

Accepted Answer

Configure the trusted ports using the 'ip dhcp snooping trust' command on the interfaces connected to the legitimate DHCP server.. DHCP snooping drops DHCP server messages on untrusted ports by default. To allow a legitimate DHCP server to respond, its port must be explicitly trusted with the 'ip dhcp snooping trust' command. This ensures that only the designated server can assign IP addresses, preventing rogue servers.

Answer

Enable IP Source Guard on all host ports to filter DHCP server messages.

Answer

Enable DHCP relay on the VLAN interface and specify the DHCP server IP address.

Answer

Configure Dynamic ARP Inspection (DAI) on the VLAN and trust the DHCP server port.

Question 7

An engineer is configuring a Cisco UCS B-Series blade server in a service profile. The blade must boot from SAN using two independent Fibre Channel paths, and the boot order must ensure that if both primary and secondary LUNs are unavailable, the server falls back to the local disk. The engineer has already created two vHBA interfaces and a SAN boot policy with two LUNs. Which additional configuration is required to meet the boot order requirement?

Accepted Answer

Modify the boot policy to include a local disk as the third boot device after the two SAN LUNs.. A UCS boot policy defines an ordered list of boot devices. To attempt SAN LUNs first and then fall back to local disk, the local disk must be included as a later entry in the same boot policy. This ensures the server tries the specified SAN targets in order before considering local storage, meeting the fallback requirement.

Answer

Set the vHBA interfaces to use 'boot' as the primary function and disable the local disk in the server BIOS.

Answer

Create a separate boot policy for each vHBA and assign them as primary and secondary boot policies in the service profile.

Answer

Configure the boot policy to use 'Any' for the SAN LUNs and enable local disk as the first boot device.

Question 8

An engineer is troubleshooting a VXLAN EVPN fabric where hosts in the same subnet on different leaf switches cannot communicate, although the underlay is healthy and EVPN routes are present. The engineer observes that the leaf switches have the correct VNI-to-VLAN mappings and the NVE interfaces are up. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the anycast gateway MAC address is identical on all leaf switches hosting the subnet. A distributed anycast gateway must present an identical virtual MAC and virtual IP on every leaf switch that hosts the subnet. When the MAC differs, hosts on different leaves receive inconsistent ARP information and Layer 3 forwarding breaks even though the EVPN control plane and underlay are healthy. Verifying and aligning the anycast gateway MAC and IP restores consistent forwarding and resolves the intra-subnet connectivity failure.

Answer

Change the BGP EVPN route target on the leaf switches to match the remote VTEP

Answer

Increase the MTU on the underlay uplinks to accommodate the VXLAN header overhead

Answer

Disable ingress replication and rely solely on multicast underlay for BUM traffic

Question 9

A network administrator is configuring a Cisco Nexus 9000 switch in standalone NX-OS mode. The administrator needs to enable VXLAN functionality on the switch. Which feature must be enabled first?

Accepted Answer

feature nv overlay. To enable VXLAN on a Cisco Nexus 9000 switch in standalone NX-OS mode, the 'feature nv overlay' command must be enabled first. This feature activates the VXLAN overlay functionality, allowing the switch to create NVE interfaces and perform VXLAN encapsulation. Other features like 'vn-segment-vlan-based' and 'bgp' are configured afterward to complete the VXLAN EVPN setup.

Answer

feature vn-segment-vlan-based

Answer

feature interface-vlan

Answer

feature bgp

Question 10

A network automation engineer is using the Cisco ACI REST API to create a new tenant. The engineer writes a Python script that sends a POST request to the APIC with a JSON payload. The APIC returns a 400 Bad Request error. Which of the following is the most likely cause?

Accepted Answer

The JSON payload contains an invalid attribute or incorrect data type for a tenant property.. A 400 Bad Request from the APIC usually means the request payload is invalid. Common causes include incorrect attribute names, wrong data types, or missing required properties. The engineer should check the JSON against the ACI object model, ensuring that the tenant name is valid and that all properties are correctly typed. The APIC returns detailed error messages in the response body that can help diagnose the issue.

Answer

The APIC's REST API requires XML payloads and does not accept JSON.

Answer

The HTTP method used is POST instead of PUT for creating a new object.

Answer

The JSON payload is missing the required 'dn' (distinguished name) attribute for the tenant object.

Question 11

A data center uses Cisco HyperFlex with a 4-node cluster configured with RF2. The administrator needs to perform a rolling upgrade of the HyperFlex software. Which statement accurately describes the impact on the cluster during the upgrade?

Accepted Answer

The cluster will remain online, but performance may be reduced during the upgrade as data is rebuilt or re-replicated.. A rolling upgrade in HyperFlex upgrades one node at a time, keeping the cluster online. With RF2, data is replicated across nodes, so the loss of one node during upgrade does not cause data loss. However, the cluster may need to re-replicate data, which can impact performance. The replication factor remains unchanged.

Answer

The cluster will experience a complete outage because all nodes must be upgraded simultaneously.

Answer

The cluster will automatically switch to RF3 during the upgrade to maintain data availability.

Answer

The cluster will be fully operational, and data will remain available because RF2 ensures two copies of data.

Question 12

A network automation engineer is using the Cisco NX-OS Guest Shell to run a Python script that configures VLANs on a Nexus 9000 switch. The script needs to execute NX-OS CLI commands and capture the output. Which Python library should the engineer use to interact with the underlying NX-OS CLI from within the Guest Shell?

Accepted Answer

Cisco NX-OS Python API (cisco) module. The Cisco NX-OS Python API module (cisco) is designed for scripts running in the Guest Shell to execute CLI commands and retrieve output locally. It provides a simple interface to interact with the NX-OS CLI without needing SSH or external connections.

Answer

Paramiko

Answer

Netmiko

Answer

Requests

Question 13

A storage administrator is configuring a Cisco MDS 9000 switch to present a LUN to a host through a specific target port. The administrator wants to ensure that the host can access the LUN only through that target port and no other port on the same storage array. Which zoning configuration should be used?

Accepted Answer

Create a zone that contains the host port WWN and the specific target port WWN.. To restrict a host to a single target port, the zone must contain the host port WWN and that specific target port WWN. Port WWN zoning provides the finest granularity and, when enforced in hardware, prevents the host from communicating with any other port on the storage array. Node WWN, fabric WWN, and domain/area identifiers do not provide this per-port restriction.

Answer

Create a zone that contains the host port WWN and the storage array's fabric WWN.

Answer

Create a zone that contains the host port WWN and the storage array's node WWN.

Answer

Create a zone that contains the host port WWN and the storage array's domain ID and area ID.

Question 14

A network engineer is troubleshooting a Cisco MDS 9000 switch where a host is unable to access a storage array. The engineer runs the command 'show flogi database' and sees the host's WWPN, but the storage array's WWPN is missing. The engineer verifies that the storage array is powered on and connected to a different switch in the same fabric. What is the most likely cause?

Accepted Answer

The storage array is connected to a different switch, so it will not appear in the local switch's FLOGI database.. The 'show flogi database' command on a switch displays only devices that have performed fabric login with that specific switch. If the storage array is connected to a different switch in the fabric, it will not appear in the local switch's FLOGI database. To see all devices in the fabric, the engineer should use 'show fcns database', which shows the name server entries for the entire fabric.

Answer

The host's WWPN is in the FLOGI database, so the storage array must be zoned incorrectly.

Answer

The storage array's port is not logged in to the fabric due to a zoning misconfiguration.

Answer

The storage array's port is configured as an N-port but should be an F-port.

Question 15

A network engineer is using Terraform to automate the configuration of a Cisco ACI fabric. They need to define a tenant, application profile, and EPG in a declarative manner. Which Terraform provider should they use?

Accepted Answer

Cisco ACI provider. The Cisco ACI provider for Terraform is designed to manage ACI objects declaratively. It allows engineers to define tenants, application profiles, and EPGs in Terraform configuration files, and it applies them via the APIC REST API. This provider supports state tracking and idempotency, ensuring consistent deployments.

Answer

Cisco UCS provider

Answer

Cisco NX-OS provider

Answer

Cisco DNA Center provider

Question 16

A data center architect is designing a Fibre Channel SAN with two Cisco MDS switches. The architect wants to ensure that if one switch fails, the other switch can continue to provide access to storage without manual intervention. Which technology should be implemented?

Accepted Answer

Multipathing with MPIO or DM-Multipath. To ensure continuous access to storage if a switch fails, the host must use multipathing software that can detect path failures and switch to an alternate path. This is typically implemented with MPIO or DM-Multipath. While other technologies like VSAN trunking, PortChannel, and FSPF contribute to a resilient fabric, they do not provide the end-to-end failover needed at the host level.

Answer

PortChannel

Answer

VSAN trunking

Answer

FSPF

Question 17

A network administrator is configuring Cisco TrustSec on a Cisco Nexus 9000 series switch in a data center. The requirement is to classify ingress traffic with Security Group Tags (SGTs) based on the source IP address of the packets, without relying on 802.1X or any authentication protocol. The administrator wants to apply a static mapping that assigns an SGT to all traffic from a specific subnet. Which Cisco TrustSec feature should be configured to accomplish this?

Accepted Answer

Static SGT mapping using a layer 3 subnet to SGT binding. Static SGT mapping allows a Cisco Nexus switch to assign an SGT to traffic based on configured IP-subnet-to-SGT bindings. This is done without any authentication protocol, making it suitable for environments where endpoints cannot authenticate. SGACLs enforce policies but do not classify; SXP propagates tags but does not assign them locally; MACsec encrypts but does not tag. Thus, static mapping is the correct feature.

Answer

Security Group Access Control List (SGACL)

Answer

Security Group Tag Exchange Protocol (SXP)

Answer

MACsec encryption

Question 18

A network administrator is deploying a Cisco Nexus 9000 switch in a data center and needs to verify that the switch has successfully formed a vPC with its peer. The administrator runs the show vpc command and sees that the vPC peer-link is up but the vPC role shows as secondary. Which statement describes the expected behavior of the secondary vPC peer in a healthy vPC domain?

Accepted Answer

The secondary peer forwards traffic for vPC member ports and participates in the vPC domain, but the primary peer handles control-plane functions such as BPDU processing for vPC VLANs.. In a healthy vPC domain, both peers actively forward traffic for vPC member ports, providing active-active forwarding. The primary peer takes on control-plane duties such as BPDU generation and processing for vPC VLANs, while the secondary peer suppresses its BPDUs to avoid loops. This division of labor maintains loop-free topology while maximizing bandwidth utilization across both switches.

Answer

The secondary peer operates only as a standby control plane and does not forward any data traffic until the primary peer fails.

Answer

The secondary peer forwards traffic for all vPC member ports and also handles all BPDUs for the vPC VLANs.

Answer

The secondary peer blocks all vPC member ports until the primary peer fails, at which point it takes over forwarding.

Question 19

An engineer is troubleshooting a Cisco ACI fabric where a leaf switch is not receiving traffic from an endpoint in a different EPG. The endpoint's EPG is associated with a contract that provides a filter allowing TCP port 443. The engineer confirms that the contract is applied to both EPGs and that the filter is correct. Which additional step should the engineer verify to ensure traffic is permitted?

Accepted Answer

Ensure that the VRF associated with both EPGs is the same or that a contract is configured to allow inter-VRF communication.. In Cisco ACI, contracts control communication between EPGs. If the EPGs reside in different VRFs, a standard contract is not sufficient; an inter-VRF contract or a shared L3Out is required to allow traffic. Verifying the VRF association ensures that the contract can actually permit the traffic, even when the filter and contract application are correct.

Answer

Verify that the bridge domain associated with each EPG has unicast routing enabled.

Answer

Confirm that the contract is set to 'deny' by default and that the filter is applied in the correct direction.

Answer

Check that the endpoint group is associated with a physical domain and that the VLAN is correctly mapped.

Question 20

A UCS Manager administrator needs a new service profile for a blade server that must always boot from a specific SAN LUN with the exact same WWPN every time. The fabric interconnects are in end-host mode, and the SAN is zoned by WWPN. Which configuration approach ensures the blade keeps identical Fibre Channel identity across reseats and firmware upgrades?

Accepted Answer

Create a vHBA under a SAN connectivity policy and assign a WWPN pool to the vHBA, then attach the policy to the service profile.. Persistent Fibre Channel identity in UCS Manager comes from a vHBA defined inside a SAN connectivity policy, with a WWPN pool supplying the address. Because the WWPN is stored in the service profile rather than on the adapter, the blade retains the same identity through reseats, slot changes, and firmware updates, which keeps pre-existing SAN zoning intact.

Answer

Create a LAN connectivity policy with a MAC pool and map the vNIC to the SAN LUN via FCoE on the same fabric interconnect.

Answer

Use the default WWPN burned into the mezzanine adapter and zone the SAN against that hardcoded address.

Answer

Configure the vHBA with a user-defined WWPN and leave the SAN connectivity policy unbound to the service profile.