350-601 Practice Exam 54 — 20 Questions

Question 1

A Fibre Channel switch port is experiencing high latency due to insufficient buffer credits. What is the most likely cause?

Accepted Answer

Long-distance link between switches. In Fibre Channel (FC) networks, buffer credits are a flow control mechanism that allows a sender to transmit frames without waiting for an acknowledgment. Long-distance links require more buffer credits to keep the link fully utilized because the round-trip time (RTT) is higher. If insufficient buffer credits are allocated, the port will experience high latency as it must wait for credits to be returned before sending more frames.

Answer

CRC errors on the fibre optic cable

Answer

High oversubscription ratio on the port

Answer

VSAN ID mismatch between end devices

Question 2

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 1 is not allowed on the trunk, so untagged frames are dropped.. The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1. This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Answer

The spanning-tree port type edge trunk is causing BPDU guard to block the port.

Answer

The port is in err-disabled state due to a loop.

Answer

The port is administratively down.

Question 3

Ansible playbook that deploys VLANs on NX-OS fails on a particular switch with 'privilege escalation required'. What should be checked first?

Accepted Answer

The 'ansible_become_password' or 'enable' password in the playbook. The error 'privilege escalation required' indicates that Ansible cannot execute commands with the necessary elevated privileges on the NX-OS switch. In Ansible, privilege escalation is handled via the 'become' mechanism, and for network devices like NX-OS, the 'ansible_become_password' (or 'enable' password) is required to enter privileged EXEC mode. Without this password, Ansible remains in user EXEC mode, which lacks the authority to apply VLAN configurations.

Answer

The 'host_key_checking' setting

Answer

The 'ansible_user' variable

Answer

The inventory file syntax

Question 4

In a Cisco NX-OS environment, which command is used to verify the operational state of a virtual Port Channel (vPC) peer link?

Accepted Answer

show vpc brief. The 'show vpc brief' command displays the operational state of the vPC peer link, including whether the peer link is up, the role of the switch (primary/secondary), and the status of the vPC domain. This command is specifically designed to verify the health and operational status of the vPC peer link and member ports in a Cisco NX-OS environment.

Answer

show port-channel summary

Answer

show running-config vpc

Answer

show vpc consistency-parameters

Question 5

During a security audit, you discover that a Cisco Nexus 9000 switch is allowing traffic between two ports in the same VLAN despite having a VLAN ACL that should deny it. The VACL is applied correctly, and the ACL entries are properly configured. What is the most likely reason for this behavior?

Accepted Answer

VACLs only filter traffic between VLANs, not within the same VLAN.. VLAN ACLs (VACLs) operate at Layer 2 and filter traffic entering or leaving a VLAN, but they only apply to traffic that crosses VLAN boundaries (i.e., inter-VLAN routing). Traffic between two ports within the same VLAN is bridged at Layer 2 and never traverses the VACL enforcement point, so the ACL entries have no effect on intra-VLAN communication. This is a fundamental design limitation of VACLs on Cisco Nexus switches.

Answer

The VACL requires Layer 3 inspection to be enabled.

Answer

The switch does not support hardware VACL processing.

Answer

Spanning-tree is bypassing the VACL for PortFast ports.

Question 6

A data center uses FCoE on Nexus 9000 switches. The storage team reports inconsistent performance during peak times. Queuing drops are seen on the FCoE-enabled interfaces. Which QoS configuration change would best address the issue?

Accepted Answer

Ensure sufficient buffer allocation for the no-drop class. In FCoE networks, lossless behavior is required for storage traffic, which is enforced by priority flow control (PFC) on the no-drop class. Queuing drops on FCoE-enabled interfaces indicate that the no-drop class is experiencing buffer exhaustion under congestion. Increasing buffer allocation for the no-drop class ensures that FCoE frames are not dropped, maintaining the lossless fabric required by Fibre Channel over Ethernet.

Answer

Enable WRED on the FCoE class

Answer

Increase MTU on the FCoE VLAN

Answer

Increase the number of pause frames on the no-drop class

Question 7

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Accepted Answer

Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.. The Cisco UCS Manager XML API allows operations to be idempotent by using the 'dn' (distinguished name) attribute to target a specific managed object. When you include the 'dn' in an XML request, the operation applies only to that exact object, so repeating the same request produces the same result without side effects. This is a key design principle of the management information model (MIT) that ensures predictable and safe automation.

Answer

The API uses SNMP for configuration changes.

Answer

The UCS Manager XML API uses RESTful JSON format.

Question 8

A data center architect is designing security for a Cisco ACI fabric that must comply with PCI DSS. The requirement is to encrypt all traffic between EPGs within the same tenant. Which solution should be used?

Accepted Answer

Use a contract with the 'encrypt' flag enabled between the EPGs.. Cisco ACI supports encryption of traffic between EPGs within the same tenant using a contract with the 'encrypt' flag enabled. This leverages the ACI fabric's built-in capability to apply AES-based encryption (e.g., AES-256-GCM) at the leaf switch level, ensuring data confidentiality for PCI DSS compliance without requiring external devices or complex routing changes.

Answer

Enable port security on the leaf switch interfaces.

Answer

Create separate VRFs for each EPG and route traffic through a firewall.

Answer

Configure a site-to-site VPN between the leaf switches.

Question 9

You are a data center engineer at a financial company. The production environment uses UCS B-Series blades with fabric interconnects in a clustered configuration. One of the blades (blade 3) is running a critical trading application. The server is associated with a service profile that boots from SAN using a single HBA path. During a routine network upgrade, the storage administrator reports that LUN 0 on the primary storage array is no longer accessible from blade 3. The server is still powered on, but the application is unresponsive. You check UCS Manager and see that the vHBA for blade 3 is in an 'Unavailable' state. The fabric interconnect ports show no errors. The storage array logs show that the target port is active. Which action should you take to restore connectivity with minimal downtime?

Accepted Answer

Unassign and reassign the vHBA's WWPN from the pool in the service profile. The vHBA being in an 'Unavailable' state while the fabric interconnect ports and storage target are healthy indicates a WWPN (World Wide Port Name) conflict or corruption at the fabric level. Unassigning and reassigning the vHBA's WWPN from the pool forces UCS Manager to generate a new WWPN and re-login to the SAN fabric, re-establishing the Fibre Channel session without requiring a server reboot or service profile re-association, minimizing downtime for the critical trading application.

Answer

Change the boot policy to use a secondary LUN on the same array

Answer

Reset the fabric interconnect to restore cluster state

Answer

Reboot the server to force re-initialization of the HBA

Question 10

Refer to the exhibit. The TACACS+ server at 10.1.1.1 is unreachable. What will happen when a user tries to authenticate to the switch using SSH?

Accepted Answer

Authentication will use the local user database as a fallback.. When the TACACS+ server at 10.1.1.1 is unreachable, the switch will fall back to the local user database for authentication because the 'fallback-to-local' feature is enabled by default in Cisco IOS/IOS-XE for TACACS+ configurations. This behavior ensures that administrative access is not completely blocked if the remote AAA server becomes unavailable, allowing authentication against locally configured usernames and passwords.

Answer

Authentication will be denied immediately.

Answer

Authentication will be attempted against the TACACS+ server repeatedly until timeout.

Answer

Authentication will be attempted against the TACACS+ server without fallback because 'fallback-to-local' is not configured.

Question 11

Which TWO are valid methods to configure a Cisco UCS service profile for stateless computing? (Choose two.)

Accepted Answer

Create a service profile from a template. Creating a service profile from a template is a core method for stateless computing in Cisco UCS. Stateless computing abstracts hardware identity (e.g., WWPNs, MAC addresses, UUIDs) from physical blades, allowing a service profile to be applied to any compatible blade without reconfiguration. Templates enable rapid, consistent deployment of these stateless profiles across multiple servers.

Answer

Use boot from SAN to store OS images

Answer

Assign persistent WWPNs to vHBAs

Answer

Configure local storage on the blade

Question 12

In a Cisco ACI fabric, which object represents a collection of endpoints that share the same forwarding behavior and security policies?

Accepted Answer

Endpoint Group (EPG). In Cisco ACI, an Endpoint Group (EPG) is a logical object that groups endpoints (e.g., servers, VMs) with identical forwarding behavior and security policies. EPGs are the fundamental unit for applying contracts (security policies) and defining communication rules within the fabric, ensuring consistent traffic handling across all members.

Answer

VRF

Answer

Tenant

Answer

Bridge Domain (BD)

Question 13

An engineer is configuring iSCSI multipath I/O (MPIO) for a storage array. The initiator has two NICs connected to two different switches, and the target has two iSCSI ports on different subnets. Which condition must be met for MPIO to function correctly?

Accepted Answer

Each path must be on a separate subnet.. MPIO requires that the initiator and target have multiple paths that are not on the same subnet to avoid routing issues. Typically, each path should be on a separate subnet.

Answer

CHAP authentication must be disabled.

Answer

Both paths must be on the same subnet.

Answer

Jumbo frames must be enabled on all interfaces.

Question 14

An engineer is configuring a Fibre Channel PortChannel between two Cisco MDS switches. What is the maximum number of physical links that can be aggregated into a single PortChannel in Fibre Channel?

Accepted Answer

16. Cisco MDS switches support up to 16 physical links per PortChannel for Fibre Channel.

Answer

8

Answer

32

Answer

4

Question 15

An organization is deploying a new leaf-spine fabric with Cisco ACI. The requirement is to allow inter-tenant communication between two EPGs in different tenants. Which configuration object is necessary to enable this communication?

Accepted Answer

A shared contract between the two EPGs.. In Cisco ACI, inter-tenant communication between EPGs in different tenants requires a shared contract. A contract defines the rules (filters) that permit traffic between EPGs, and when it is marked as 'shared,' it can be consumed by EPGs across tenant boundaries. This allows the provider EPG in one tenant to expose services to a consumer EPG in another tenant without merging the tenants' VRFs or bridge domains.

Answer

A common VRF that spans both tenants.

Answer

A filter that permits the required traffic.

Answer

A bridge domain that connects both EPGs.

Question 16

An organization is deploying a new Fibre Channel SAN with Cisco MDS switches. The design requires high availability and load sharing over multiple ISLs. Which three features should be implemented? (Choose three.)

Accepted Answer

Fibre Channel PortChannels. VSAN trunking (EISL) allows multiple VSANs over a single ISL; PortChannels aggregate multiple physical ISLs into a logical link with load balancing; multiple active equal-cost paths (FSPF) provide load sharing and redundancy.

Answer

NPIV

Answer

Hard zoning by WWPN

Question 17

Refer to the exhibit. A host with WWPN 10:00:00:00:c9:29:3b:23 can only see its own WWPN but not the target. What is the likely cause?

Accepted Answer

The target is missing from the zone.. The host can see its own WWPN but not the target, which indicates that the host has successfully logged into the fabric (FLOGI accepted) and is in the correct VSAN. The most likely cause is that the target WWPN is not included in the zone that contains the host. In Fibre Channel zoning, only members within the same zone can communicate; if the target is missing from the zone, the host cannot discover or access it.

Answer

The host is in a different VSAN.

Answer

The zoneset is not the full zoneset.

Answer

The host's FLOGI is rejected.

Answer

The zone is not activated.

Question 18

A network automation engineer is writing an Ansible playbook to configure Nexus switches. Which three modules are available to manage NX-OS configuration? (Choose three.)

Accepted Answer

nxos_config. The `nxos_config` module is the primary Ansible module for managing NX-OS device configurations, allowing you to apply, replace, or merge configuration snippets directly onto Nexus switches. It is part of the `cisco.nxos` collection and is specifically designed for NX-OS, unlike `ios_config` which targets Cisco IOS/IOS-XE devices.

Answer

eos_config

Answer

ios_config

Question 19

A data center uses HyperFlex HX Data Platform with a 3-node cluster configured with replication factor 2 (RF2). One node fails permanently. What is the impact on data availability and cluster operation?

Accepted Answer

All data remains accessible but the cluster is degraded and requires a new node to restore RF2. With RF2, each data block is stored on two nodes. If one node fails, the remaining two nodes have all data, but the cluster becomes degraded. A new node must be added to restore redundancy.

Answer

Data is unavailable until the failed node is replaced

Answer

The witness VM takes over the failed node's storage role

Answer

The cluster automatically changes to RF3 to maintain protection

Question 20

A network administrator is planning a UCS C-Series rack server deployment. Which two statements correctly describe the integration modes with UCS Manager? (Choose two.)

Accepted Answer

In Direct Connect mode, the server must be connected to a Fabric Interconnect via a supported adapter.. Direct Connect mode connects servers directly to FI for management; IMC Supervisor mode manages via IMC Supervisor; standalone mode is independent.

Answer

In Cisco IMC Supervisor mode, the server is managed by the IMC Supervisor but can also be integrated into UCS Manager.

Answer

In Cisco IMC Supervisor mode, the server's CIMC is managed directly by UCS Manager.

Answer

Standalone mode allows the server to be managed by UCS Manager without any additional configuration.