350-601 Practice Exam 55 — 20 Questions

Question 1

Refer to the exhibit. A VXLAN VNI (10030) is operationally down. What is the most likely cause?

Accepted Answer

The VLAN associated with VNI 10030 is not configured or mapped. VXLAN VNI 10030 is operationally down because the VLAN that maps to this VNI is either not created or not associated with the VNI under the NVE interface. In Cisco NX-OS, a VNI becomes operationally up only when the corresponding VLAN exists and is properly mapped via the `member vni 10030 associate-vrf` or `member vni 10030` command under the NVE interface. Without this mapping, the NVE cannot forward traffic for that VNI, leaving it in a down state.

Answer

The source interface loopback0 is not up

Answer

The NVE mode should be L2VPN instead of L3VPN

Answer

The multicast group 239.1.1.1 is not reachable

Question 2

A data center administrator reports that traffic from a specific UCS server is not flowing through the expected Fabric Interconnect (FI) A. The pin group is configured, but traffic is still sent to FI B. What should the administrator check?

Accepted Answer

Ensure the vNIC's fabric ID is set to match the pin group's preferred fabric.. The pin group configuration determines which Fabric Interconnect a vNIC should use for upstream traffic. If the vNIC's fabric ID is not set to match the pin group's preferred fabric, the server will ignore the pin group and send traffic to the other FI. Option D is correct because the fabric ID mismatch causes the pin group to be ineffective, and verifying this alignment ensures traffic flows through the expected FI A.

Answer

Verify that the server is associated with the correct service profile.

Answer

Reboot the Fabric Interconnect.

Answer

Check if the pin group is deleted.

Question 3

An engineer wants to automate the configuration of VLANs on a Nexus switch using Ansible. Which module from the cisco.nxos collection should be used?

Accepted Answer

nxos_vlan. The nxos_vlan module is specifically designed to manage VLANs on Cisco NX-OS devices.

Answer

nxos_config

Answer

nxos_bgp

Answer

nxos_interface

Question 4

A UCS B-Series blade server shows high CPU latency when processing network I/O. The engineer suspects a bottleneck in the I/O subsystem. Which metric in UCS Manager should be examined first?

Accepted Answer

Fabric port error counts. Fabric port error counts directly reflect physical-layer issues (e.g., CRC errors, alignment errors, link flaps) that cause retransmissions and backpressure, leading to high CPU latency on the blade server. In UCS Manager, these counters are the first place to check when suspecting an I/O subsystem bottleneck because they pinpoint problems in the fabric interconnect or cabling before examining higher-layer metrics.

Answer

vNIC utilization percentage

Answer

Memory usage statistics

Answer

Power consumption per server

Question 5

Which NX-OS command is used to display the current OSPF neighbor states?

Accepted Answer

show ip ospf neighbors. The 'show ip ospf neighbors' command is the correct NX-OS command to display the current OSPF neighbor states, including the neighbor ID, interface, state (e.g., FULL, 2WAY, DOWN), and adjacency details. This command directly queries the OSPF process for the neighbor state machine, which is essential for verifying OSPF adjacency formation and troubleshooting Layer 3 connectivity.

Answer

show ip route ospf

Answer

show ospf database

Answer

show ip ospf interface

Question 6

A UCS B-Series blade server (blade 5) has been running a database application for months. Recently, the storage team upgraded the SAN firmware. Since then, the blade experiences intermittent 'SCSI command timeout' errors in the system logs. The application performance degrades periodically. You check the UCS Manager performance data and see that the vHBA statistics show a high number of 'Link Reset' events. The storage array logs show no errors. The fibre channel cables are new. Which step should you take to resolve the issue?

Accepted Answer

Update the HBA firmware on the blade to match the SAN compatibility matrix. The SAN firmware upgrade likely introduced a change in the Fibre Channel protocol behavior (e.g., link initialization or error recovery) that is incompatible with the current HBA firmware on the blade. The high 'Link Reset' events indicate that the vHBA is repeatedly reinitializing the link, which directly causes SCSI command timeouts. Updating the HBA firmware to match the SAN compatibility matrix ensures the HBA can properly negotiate and interoperate with the upgraded SAN fabric, resolving the intermittent timeouts.

Answer

Delete and recreate the vHBA in the service profile

Answer

Replace the fibre channel cables between the IOM and storage

Answer

Rezone the SAN fabric to use a different target port

Question 7

A storage administrator is troubleshooting a Fibre Channel SAN where initiators cannot log in to a target. The administrator verifies that the VSAN is configured correctly and that zoning is in place. Which two additional checks should be performed to resolve the issue?

Accepted Answer

Confirm that FCID persistence is not enabled with invalid static FCIDs.. In a Fibre Channel SAN, FCID persistence assigns a specific FCID to a device each time it logs in. If an invalid static FCID is configured (e.g., an FCID that conflicts with another device or is outside the allowed range), the initiator may fail to log in because the switch cannot assign the requested address. This is a common cause of login failures even when VSAN and zoning are correctly configured.

Answer

Ensure NPIV is enabled on the F-port.

Answer

Verify the FCoE VLAN ID matches on both ends.

Answer

Check that LUN masking has been applied on the target.

Question 8

An organization has deployed a Cisco UCS B-Series blade server with a Fabric Interconnect pair. The administrator is tasked with deploying a new server for a critical application. The administrator creates a service profile from an existing template that includes vNIC, vHBA, and storage policies. The blade is located in chassis 2, slot 1. The administrator attempts to associate the profile with this blade but fails with the error: 'No suitable compute resource available.' The administrator verifies that the blade's firmware is updated, that the blade is not already associated with another profile, and that it has sufficient memory and CPU. What is the most likely cause?

Accepted Answer

The server pool policy is not assigned to the service profile template.. The error 'No suitable compute resource available' typically occurs when the service profile is configured to use a server pool, but no server pool policy is assigned to the service profile template. Without a server pool, the Fabric Interconnect cannot identify which blades are eligible for association, even if the blade itself is available and meets hardware requirements. Assigning a server pool policy to the template ensures that blades in the specified pool (e.g., chassis 2, slot 1) are considered as valid compute resources.

Answer

The blade's firmware version is incompatible with the service profile.

Answer

The blade is in the wrong chassis slot.

Answer

The vNIC/vHBA policies in the service profile have invalid MAC/WWN assignments.

Question 9

Which two VXLAN control plane options are supported on Cisco Nexus 9000 switches? (Choose two.)

Accepted Answer

Multicast. VXLAN on Cisco Nexus 9000 switches supports both multicast-based control plane (using IGMP/PIM to flood BUM traffic) and MP-BGP EVPN (RFC 7432) as the control plane for distributing MAC/VTEP reachability. Multicast is the traditional method for handling BUM traffic in VXLAN fabrics, while MP-BGP EVPN provides a more scalable, standards-based control plane with host route advertisement and multi-tenancy.

Answer

OTV

Answer

Static VXLAN tunnel

Answer

OpenFlow

Question 10

An engineer needs to secure the management plane on a Cisco Nexus 9000 switch. Which feature should be configured to restrict access to the switch's management interface based on source IP?

Accepted Answer

Configure a management CoPP policy to rate-limit and permit only specific source IPs.. A management Control Plane Policing (CoPP) policy on a Cisco Nexus 9000 switch allows the engineer to explicitly permit or deny traffic destined to the management interface based on source IP addresses. CoPP applies QoS policies to control plane traffic, effectively restricting management plane access by rate-limiting or dropping packets from unauthorized sources before they reach the CPU.

Answer

Enable DHCP snooping on the management VLAN.

Answer

Enable port security on the management interface.

Answer

Configure AAA to require two-factor authentication.

Question 11

A UCS administrator notices that a server in a UCS domain is not booting from SAN after a firmware upgrade. The service profile shows the correct WWPN and boot policy. The SAN switch sees the initiator login. However, the storage array does not see any initiator attempts. What is the most likely issue?

Accepted Answer

The zone alias on the SAN switch does not match the initiator WWPN. The SAN switch sees the initiator login, but the storage array does not see any initiator attempts. This indicates that the Fibre Channel fabric is blocking the initiator's WWPN from reaching the storage target, typically because the zone configuration on the SAN switch does not include the initiator's WWPN or the zone alias does not match the actual WWPN. Since the service profile and boot policy are correct, and the VSAN membership is functional (the switch sees the login), the most likely issue is a zoning mismatch on the SAN switch.

Answer

The boot policy is missing the primary SAN target

Answer

The WWPN is duplicated on another initiator

Answer

The VSAN membership is incorrect on the fabric interconnect

Question 12

An Ansible playbook using the cisco.nxos.nxos_config module fails with the error: 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting'. What is the most likely cause?

Accepted Answer

The playbook includes an invalid parameter 'connection: network_cli' inside the task block.. The error 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting' occurs because the `connection: network_cli` parameter is being passed inside the task block of the playbook. The `cisco.nxos.nxos_config` module does not accept a `connection` parameter at the task level; connection settings must be defined at the play or inventory level. This is a common syntax error when using Ansible network modules.

Answer

The SSH key authentication is misconfigured.

Answer

The module is not installed correctly.

Answer

The playbook is targeting a device running an unsupported NX-OS version.

Question 13

A storage engineer needs to isolate two Fibre Channel fabrics within the same physical infrastructure using Cisco MDS switches. Which feature allows the creation of multiple logical Fibre Channel networks on the same set of switches?

Accepted Answer

VSANs. VSANs (Virtual SANs) provide isolation similar to VLANs in Ethernet, allowing multiple separate FC fabrics to operate on the same physical switches.

Answer

NPV

Answer

PortChannels

Answer

Zoning

Question 14

Which Fibre Channel port type is used to connect a host bus adapter (HBA) to a Fibre Channel switch in a point-to-point topology?

Accepted Answer

N-port. An N-port (Node port) is used on the host side, and an F-port (Fabric port) is used on the switch side. The question asks for the host side port type.

Answer

E-port

Answer

F-port

Answer

NP-port

Question 15

A network administrator is troubleshooting a vPC pair and needs to verify the operational status of the vPC peer-link. Which NX-OS command displays vPC status including peer-link and member port states?

Accepted Answer

show vpc. The 'show vpc' command (without any keyword) is the correct choice because it displays comprehensive vPC operational status, including the peer-link state (up/down), member port states, and vPC consistency status. This single command provides a high-level summary of all vPC components, making it the go-to command for initial troubleshooting of vPC peer-link and member port health.

Answer

show vpc brief

Answer

show vpc consistency-parameters

Answer

show vpc peer-keepalive

Question 16

In a Cisco ACI fabric, an external L3Out is configured to advertise a subnet to the outside. Which object must be created in the tenant to define the Layer 3 outside network connection?

Accepted Answer

L3Out. In Cisco ACI, an L3Out is the object that defines the Layer 3 outside network connection for a tenant. It is created within the tenant to specify the routing protocol (e.g., OSPF, BGP, EIGRP) and the external subnet that will be advertised to the outside world. Without an L3Out, the fabric cannot establish external connectivity or advertise routes.

Answer

External EPG

Answer

Contract

Answer

Bridge Domain

Question 17

An engineer is troubleshooting a SAN performance issue. The MDS switch shows high CRC errors on an F port. The host is connected via a 16 Gbps FC link. The errors increase when the host sends large I/O. What is the most likely cause?

Accepted Answer

The cable length exceeds the supported distance for 16 Gbps.. At 16 Gbps Fibre Channel, signal integrity degrades over long cable distances, causing bit errors that manifest as CRC errors on the F port. The error increase with large I/O is characteristic of marginal signal quality, as larger frames are more likely to encounter corrupted bits. Option E correctly identifies that the cable length exceeds the supported distance for 16 Gbps, typically 10 meters for OM3 multimode fiber or 100 meters for OM4, depending on the transceiver type.

Answer

The host's HBA firmware is outdated.

Answer

The zone configuration is incorrect.

Answer

The host is experiencing buffer credit starvation.

Answer

The switch port is configured for 8 Gbps.

Question 18

A data center engineer notices that a UCS B-Series blade server is failing to boot from a SAN LUN that is correctly mapped to the server's WWPN. The SAN switch shows that the LUN is accessible and the zone is configured correctly. The UCS Manager shows the server's vNIC is associated with a vHBA that has the correct WWPN, but the server's BIOS does not list the Fibre Channel boot target. Which configuration is most likely missing?

Accepted Answer

The boot policy is not defined or not attached to the service profile.. The boot policy defines the boot order and parameters (such as the SAN LUN target WWPN and LUN ID) for the server. If the boot policy is not defined or not attached to the service profile, the UCS Manager will not program the BIOS with the Fibre Channel boot target information, even though the SAN zoning and vHBA WWPN are correct. Without this policy, the server's BIOS has no instruction to attempt a SAN boot, resulting in the failure described.

Answer

The SAN connectivity policy is missing the Fibre Channel uplink pinning.

Answer

The vNIC/vHBA placement policy is incorrectly set to 'Express' mode.

Answer

A QoS policy is not applied to the vHBA.

Question 19

A data center network engineer wants to encrypt all traffic between two top-of-rack (ToR) switches that are connected via a direct link. The encryption should be transparent to upper-layer protocols and operate at Layer 2. Which technology should be used?

Accepted Answer

MACsec (802.1AE). MACsec (802.1AE) is the correct choice because it provides hop-by-hop encryption at Layer 2, encrypting the entire Ethernet frame (excluding the source/destination MAC and VLAN tag) to secure traffic between two directly connected switches. It operates transparently to upper-layer protocols (Layer 3 and above) and requires no IP-level configuration, making it ideal for encrypting a direct link between ToR switches.

Answer

IPsec VPN

Answer

MKA (MACsec Key Agreement)

Answer

TLS/SSL

Question 20

Which TWO options are correct regarding Cisco UCS server profiles? (Select TWO.)

Accepted Answer

Resource pools, such as UUID pools, can be shared across service profile templates.. Resource pools like UUID pools, MAC pools, and WWN pools are global objects in Cisco UCS Manager that can be shared across multiple service profile templates. This allows administrators to define a pool once and reference it from any template, ensuring consistent allocation and avoiding conflicts.

Answer

Service profiles can be updated while the server is in OS configuration.

Answer

A vHBA in a service profile inherits the boot policy automatically.

Answer

A service profile can be associated with multiple servers simultaneously to provide load balancing.