350-601 Practice Exam 57 — 20 Questions

Question 1

An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?

Accepted Answer

It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.. The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.

Answer

It carries data traffic between vPC peers.

Answer

It is used to synchronize MAC address tables between peers.

Answer

It provides a Layer 3 keepalive to detect peer failure and should be on a separate VLAN.

Question 2

Refer to the exhibit. An engineer is configuring a server-facing interface on a Nexus switch. The server is running VMware ESXi with multiple virtual machines in VLANs 10, 20, and 30. After applying the configuration, the ESXi host reports that it cannot communicate on VLAN 30. Which configuration change should be made?

Accepted Answer

Create VLAN 30 in the global VLAN database. VLAN 30 must exist in the global VLAN database before it can be used on any interface. Even though the interface configuration allows VLAN 30 as a trunked VLAN, the switch will not forward traffic for a VLAN that has not been created globally. Without the 'vlan 30' command in global configuration mode, the VLAN is not present in the switch's VLAN database, and the interface will not pass traffic for that VLAN.

Answer

Remove the 'spanning-tree port type edge trunk' command

Answer

Change the native VLAN to 30

Answer

Configure the port as an access port in VLAN 30

Question 3

A data center architect is designing a spine-leaf fabric with OSPF as the underlay routing protocol. Which two statements about OSPF in this design are correct? (Choose two.)

Accepted Answer

OSPF neighbors are formed between leaf and spine switches over the fabric links.. In a spine-leaf fabric using OSPF as the underlay, OSPF neighbors are formed directly between leaf and spine switches over the physical fabric links. Option B is correct because OSPF supports ECMP by default, enabling load balancing across multiple equal-cost paths in the fabric. Option C is incorrect: while passive interfaces are often configured on server-facing ports to prevent OSPF neighbor formation with servers, the question asks for two correct statements about OSPF in the design, and the other two options (A and B) are more fundamental to OSPF operation in the underlay. Options D and E are clearly incorrect; OSPF can coexist with BGP in VXLAN EVPN, and OSPF areas can be the same across leaf and spine switches.

Answer

Passive interfaces are configured on the server-facing ports of leaf switches.

Answer

OSPF must be replaced by BGP in a VXLAN EVPN fabric.

Answer

OSPF areas must be different for leaf and spine switches to prevent routing loops.

Question 4

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

Accepted Answer

Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.. When the vPC peer link fails, the peer-keepalive link is used by the secondary switch to detect that the primary is still alive and to avoid becoming the primary (which would cause a split-brain scenario). Using a dedicated management interface or a separate VRF ensures the keepalive messages are isolated from the data plane and remain reachable even if the peer link goes down, allowing the secondary to correctly keep its vPC member ports in a suspended state and maintain convergence.

Answer

Disable vPC on both switches and reconfigure the port channels.

Answer

Reconfigure the vPC domain with a lower priority on the secondary switch.

Answer

Increase the vPC peer-keepalive hold timeout to 5 seconds.

Question 5

Which THREE of the following are valid methods to secure the control plane on a Cisco Nexus 9000 switch?

Accepted Answer

Enable control plane policing (CoPP) to rate-limit control plane traffic.. Control plane policing (CoPP) is a valid method to secure the control plane on a Cisco Nexus 9000 switch. CoPP uses a policy map applied to the control plane to rate-limit or drop traffic destined to the supervisor module, protecting the CPU from excessive or malicious traffic. This is a direct control plane security mechanism defined in Cisco NX-OS.

Answer

Enable Bidirectional Forwarding Detection (BFD) on all interfaces.

Answer

Implement routing protocol authentication (e.g., OSPF MD5).

Question 6

A UCS administrator needs to update the firmware on a UCS 5108 chassis that contains eight B-Series blades. The firmware update must be performed with minimal downtime. Which update method should be used?

Accepted Answer

User Acknowledged update with a maintenance policy that reboots blades sequentially. The User Acknowledged update method, combined with a maintenance policy that reboots blades sequentially, allows the firmware update to proceed blade by blade with minimal downtime. This approach ensures that only one blade is offline at a time, while the remaining blades continue to serve traffic, making it ideal for a chassis with eight B-Series blades where service continuity is critical.

Answer

Fast-Impact update

Answer

Non-Impactful update with a forced reboot

Answer

System-Impactful update with a single reboot

Question 7

An ACI administrator is configuring external connectivity using L3Out. Which THREE components must be defined for a successful L3Out deployment? (Select three.)

Accepted Answer

External routed network (L3Out). The external routed network (L3Out) is the fundamental construct that defines the Layer 3 connectivity from the ACI fabric to an external router or network. It specifies the routing protocol (e.g., OSPF, BGP, or static), the external interfaces, and the protocol policies required for the ACI spine switches to exchange routes with external devices. Without defining the L3Out object, the fabric has no configured path or policy to reach external destinations.

Answer

VMM domain

Answer

Service graph

Question 8

A network administrator wants to prevent IP spoofing attacks on a data center access switch. The switch has IP Source Guard enabled on the client-facing ports. Which condition must be met for IP Source Guard to work properly?

Accepted Answer

DHCP snooping must be enabled on the VLAN and the port must be untrusted.. IP Source Guard uses a binding table created by DHCP snooping to validate the source IP address of packets received on a port. For IP Source Guard to work, DHCP snooping must be enabled on the VLAN, and the client-facing port must be configured as an untrusted port so that DHCP snooping can populate the binding table with valid DHCP lease information. Without this binding table, IP Source Guard has no source IP-to-MAC mapping to enforce.

Answer

DHCP snooping must be disabled on the VLAN.

Answer

All clients must use DHCP; static IPs are not supported.

Answer

Dynamic ARP Inspection must be enabled first.

Question 9

Refer to the exhibit. The Fabric Interconnect cannot ping its default gateway. The management interface is configured and up. What is the most likely cause?

Accepted Answer

The default route is missing from the routing table.. The Fabric Interconnect cannot ping its default gateway despite the management interface being up and configured, which indicates that the device lacks a route to reach the gateway subnet. A default route is required to forward traffic destined for networks not directly connected; without it, the Fabric Interconnect will drop packets to the gateway even if the interface is operational. This is the most likely cause because the exhibit shows no default route in the routing table, and the interface status confirms Layer 1 and Layer 2 connectivity.

Answer

The management VLAN is not allowed on the upstream switch.

Answer

The management interface is configured as DHCP instead of static.

Answer

The IP address is a duplicate on the network.

Question 10

Match each Cisco UCS component to its function.

Accepted Answer

Fabric Interconnect: Manages network connectivity and provides management access.. The correct matches are: Fabric Interconnect provides network connectivity and management; UCS Manager provides unified management; Blade Chassis houses servers and provides power/cooling. Common confusions include swapping functions with I/O Module or between chassis and interconnect.

Answer

Fabric Interconnect: Houses blade servers and provides power and cooling.

Answer

UCS Manager: Connects blade chassis to fabric interconnects.

Answer

Blade Chassis: Provides network connectivity and management.

Question 11

Match each Cisco NX-OS feature to its description.

Accepted Answer

VDC: Allows partitioning a single physical switch into multiple logical switches.. The correct matches are VDC with logical partitioning, VRF with multiple routing tables, FEX with remote line card, and Port Channel with link bundling. Common confusion is between VDC and VRF.

Answer

VDC: Enables multiple independent routing tables within a single switch.

Answer

VRF: Allows partitioning a single physical switch into multiple logical switches.

Question 12

Match each Cisco ACI component to its role.

Accepted Answer

APIC: Centralized controller for policy and fabric management. Correct matches: APIC is the central policy controller; Spine switches connect leaves; Leaf switches connect endpoints. Common confusions include mistaking APIC as a forwarding switch and associating EPG with spine switches.

Answer

APIC: Physical switch that forwards traffic

Answer

Spine: Endpoint group (EPG) concept

Question 13

Match each Cisco MDS FC switch feature to its purpose.

Accepted Answer

VSAN: Allows creation of virtual SANs to isolate traffic within a physical SAN. VSAN, Zoning, and NPV are correctly matched. FCoE encapsulates Fibre Channel over Ethernet, and DCNM provides centralized management. Common confusions include mixing VSAN with FCoE or DCNM with FCoE.

Answer

FCoE: Allows creation of virtual SANs to isolate traffic within a physical SAN

Answer

DCNM: Encapsulates Fibre Channel frames over Ethernet networks

Question 14

Based on the exhibited output, what can be concluded about the fabric?

Accepted Answer

The device with FCID 0x010003 is a loop-attached device.. The output shows that the device with FCID 0x010003 has an 'NLP' (Node Loop Port) state, which indicates it is attached to a loop (e.g., via an FL_Port). This is a key characteristic of a loop-attached device, as opposed to a point-to-point fabric-attached device. Therefore, option D is correct.

Answer

The fabric contains a domain ID conflict.

Answer

The device with FCID 0x010002 is a disk array.

Answer

There are three initiators and one target.

Question 15

Which TWO statements are true about Cisco ACI contracts? (Choose two)

Accepted Answer

Contracts can be reused across multiple EPGs.. Cisco ACI contracts are designed as reusable policy constructs. Once a contract is defined, it can be applied to multiple EPGs (Endpoint Groups) without redefining the rules, promoting consistency and reducing administrative overhead. This reusability is a core principle of ACI's policy-based networking model.

Answer

Contracts are unidirectional from consumer to provider.

Answer

Subjects within a contract specify only the destination ports.

Answer

Contracts are always bidirectional.

Question 16

An engineer is connecting a Cisco UCS C-Series rack server to the network. The server must be managed by UCS Manager alongside existing B-Series blades. Which mode should the C-Series server be configured in?

Accepted Answer

UCS Manager mode. C-Series rack servers can be integrated into UCS Manager using UCS Manager mode (sometimes called C-Series Integrated mode), where they are managed through the Fabric Interconnects.

Answer

Direct Connect mode

Answer

Standalone mode

Answer

Cisco IMC Supervisor mode

Question 17

A data center engineer is configuring VLANs in a Cisco UCS domain. Which TWO statements are true regarding VLAN configuration?

Accepted Answer

Each vNIC must have a native VLAN specified for untagged traffic on that vNIC.. In a Cisco UCS environment, each vNIC must have a native VLAN specified to handle untagged traffic on that interface. The native VLAN is used for traffic that does not have an 802.1Q tag, and it must be explicitly defined in the vNIC configuration within the service profile to ensure proper handling of untagged frames.

Answer

VLANs can be created directly within a service profile without prior global definition.

Answer

VLANs can be created only through the CLI of UCS Manager.

Answer

Service profiles can override the VLAN ID of a global VLAN definition.

Question 18

A network engineer is configuring 802.1Q trunking between a Nexus switch and a server. Which TWO statements are true regarding 802.1Q trunking?

Accepted Answer

The VLAN ID is 12 bits long. 802.1Q trunking uses a 4-byte tag to carry VLAN information, but the native VLAN is sent untagged, so not all frames receive the tag. The VLAN ID field is 12 bits (B), and after tagging, the FCS must be recalculated (E). Option A is false because the native VLAN is untagged. Option C is false because only non-native VLAN frames are tagged. Option D is false because trunks can carry multiple VLANs.

Answer

The native VLAN is tagged by default

Answer

A 4-byte tag is inserted into the Ethernet frame

Answer

Trunks can only carry one VLAN

Question 19

A UCS administrator notices that a service profile associated with a vNIC template that uses 'fabric failover' is not failing over to the secondary Fabric Interconnect when the primary link goes down. The vNIC template is set to 'fabric failover' enabled, and both Fabric Interconnects are in the same VLAN. What is the most likely cause?

Accepted Answer

The 'Primary Fabric' setting is not defined in the vNIC template.. When 'fabric failover' is enabled on a vNIC template, the UCS Manager requires the 'Primary Fabric' setting to be explicitly defined to determine which Fabric Interconnect (FI-A or FI-B) should be the active path. Without this setting, the system cannot properly orchestrate the failover behavior, causing the vNIC to remain pinned to the primary FI even when its link goes down. This is a common misconfiguration because the 'fabric failover' checkbox alone does not imply a primary fabric assignment.

Answer

The server is pinned to the primary Fabric Interconnect via a pin group.

Answer

The MTU size on the secondary Fabric Interconnect is set to 1500 instead of 9000.

Answer

The 'MAC Address' policy is set to 'pool-based' instead of 'static'.

Question 20

Which command is used to verify the OSPF neighbor state in NX-OS?

Accepted Answer

show ip ospf neighbors. In NX-OS, the correct command to verify OSPF neighbor state is 'show ip ospf neighbors'. This command displays the OSPF neighbor table, including neighbor ID, priority, state (e.g., FULL, 2WAY), and dead timer. The 'ip' keyword is mandatory in NX-OS to specify the IPv4 address family, distinguishing it from other protocols like OSPFv3 for IPv6.

Answer

show ospf neighbors

Answer

show running-config ospf

Answer

show ip route ospf