350-601 Practice Exam 59 — 20 Questions

Question 1

In a Cisco ACI fabric, which component is responsible for managing the policy repository, fault monitoring, and API endpoints?

Accepted Answer

APIC controller. The APIC (Application Policy Infrastructure Controller) is the centralized management and policy engine in Cisco ACI. It maintains the policy repository (the logical and physical policy model), aggregates faults and events from all fabric nodes, and exposes northbound REST API endpoints for automation and integration. Without the APIC, the fabric cannot enforce policies or provide a single point of management.

Answer

DCNM

Answer

Spine switch

Answer

Leaf switch

Question 2

An engineer is deploying a new UCS chassis with two Fabric Interconnects. The design requires that server traffic can fail over to the secondary FI if the primary FI fails, without requiring any changes to the server's network configuration. Which technology must be enabled on the uplink ports of the Fabric Interconnects to the upstream switches to ensure transparent failover of server traffic?

Accepted Answer

Enable pin groups with 'failover' mode on the server ports.. Pin groups with 'failover' mode enable transparent server traffic failover by pinning server vNICs to a specific Fabric Interconnect (FI) and automatically repinning them to the secondary FI upon primary FI failure, without requiring any changes to the server's network configuration. This ensures that the server's MAC and IP addresses remain active on the secondary FI, maintaining connectivity without manual intervention.

Answer

Configure a virtual PortChannel (vPC) between the Fabric Interconnects and upstream switches.

Answer

Apply QoS policies to prioritize failover traffic.

Answer

Implement Private VLANs on the uplink ports to isolate traffic.

Question 3

A data center engineer is configuring 802.1X authentication on Cisco Nexus switches for wired endpoints. The requirement is to allow traffic on the port even if no EAPOL packet is received from the endpoint (e.g., a printer). Which authentication method should be used?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct method because it allows a port to authenticate endpoints that do not send EAPOL frames, such as printers or other legacy devices. When no EAPOL is received within a configurable timeout, the switch falls back to using the source MAC address of the first frame as the authentication credential, sending it to the RADIUS server for verification. This satisfies the requirement to permit traffic even without 802.1X supplicant capability.

Answer

802.1X using RADIUS server

Answer

Port security with sticky MAC addresses

Answer

Local authentication with a predefined list of users

Question 4

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

Accepted Answer

Enable DHCP snooping globally and configure uplink ports as trusted.. DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.

Answer

Enable dynamic ARP inspection on all VLANs.

Answer

Enable IP source guard on all access ports.

Answer

Enable MAC port security on all access ports.

Question 5

A company runs a multi-tenant data center using Cisco ACI with multiple tenants. Each tenant has its own VRF and EPGs. The security policy requires that tenant A's web servers (EPG web_tenantA) be accessible from tenant B's application servers (EPG app_tenantB) only via HTTPS (TCP 443). The ACI fabric is configured with contracts. The administrator has created a contract with a filter for HTTPS (tcp dstPort 443) and applied it as a provider contract on EPG web_tenantA and as a consumer contract on EPG app_tenantB. However, traffic from tenant B's app servers to tenant A's web servers is being dropped. The administrator has verified that the contracts are applied correctly and the filter is correct. What is the most likely cause of the traffic drop?

Accepted Answer

The contract is not marked as 'shared' between tenants; a shared contract must be created and both EPGs must be in the same VRF or use a shared VRF.. In Cisco ACI, contracts are local to a VRF by default. For inter-tenant communication where each tenant has its own VRF, the contract must be explicitly marked as 'shared' and both EPGs must either be in the same VRF or use a shared VRF that allows cross-VRF policy enforcement. Without this, the contract filter is not applied across VRFs, causing traffic to be dropped even though the contract and filter are correctly configured.

Answer

The EPGs are not in the same bridge domain; they must be in the same bridge domain to communicate.

Answer

The VRF of tenant A and tenant B must have route leaking configured to allow inter-VRF routing.

Answer

The filter for HTTPS must also include the source port range 49152-65535 for ephemeral ports.

Question 6

Arrange the steps to configure a vPC domain on a pair of Cisco Nexus switches.

Accepted Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports. vPC requires feature vPC, then domain creation, keepalive link, peer-link, and member ports.

Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure peer-link, Step 4: Configure keepalive link, Step 5: Add member ports

Answer

Step 1: Create vPC domain, Step 2: Enable feature vPC, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports

Answer

Step 1: Enable feature vPC, Step 2: Configure keepalive link, Step 3: Create vPC domain, Step 4: Configure peer-link, Step 5: Add member ports

Question 7

A large enterprise data center has a disaster recovery site 100 km away. The SAN uses two MDS 9700 series switches at each site, connected via a dedicated dark fiber. Each link operates at 16 Gbps with a round-trip time of 2 ms. Recently, backup jobs to the remote storage array have been failing with timeout errors. The backup server is local to Site A, but the backup target is in Site B. The link utilization never exceeds 40%, and no errors are reported on the interfaces. The engineer suspects the issue is related to buffer credits. The current buffer credit count on the ISL is 16. The engineer calculates that for 16 Gbps over 100 km (2 ms RTT), they need at least 200 credits to maintain full throughput. Which action is most appropriate to resolve the issue?

Accepted Answer

Increase the buffer-to-buffer credit count to 300 on the ISL interfaces.. The timeout errors during backup are caused by buffer credit starvation, as the current credit count of 16 is insufficient for the 100 km distance (2 ms RTT) at 16 Gbps. Increasing the buffer-to-buffer credit count to 300 ensures enough credits to maintain full throughput, preventing credit starvation and associated timeouts. Option B is correct because it directly addresses the insufficient credit count. Option A (NPIV) is unrelated to buffer credits; NPIV allows multiple N-port logins, not credit management. Option C (reducing speed to 8 Gbps) would lower throughput and is not optimal. Option D (FCIP) is unnecessary because the existing dark fiber provides a direct Fibre Channel link; FCIP is for IP-based transport and does not help with buffer credit issues.

Answer

Enable NPIV on the ISL ports to allow multiple logins.

Answer

Configure the ISL to operate at 8 Gbps to reduce the buffer credit requirement.

Answer

Implement FCIP over the existing dark fiber to offload buffer credit management.

Question 8

A Python script using NX-API returns HTTP 401. What is the most likely cause?

Accepted Answer

Invalid credentials. HTTP 401 Unauthorized indicates that the server understood the request but authentication is required and has failed or has not been provided. In the context of NX-API, this error is most directly caused by providing invalid or missing credentials (Option D). If NX-API is not enabled on the switch, the endpoint is unavailable and typically results in an HTTP 404 Not Found or a connection error, not a 401.

Answer

Wrong NX-API version in URL

Answer

Firewall blocking port 443

Answer

NX-API not enabled on the switch

Question 9

You are a network engineer at a financial institution. The company has two data centers: DC1 and DC2, connected via a dark fiber link. Each data center has a pair of Nexus 7000 switches in a vPC configuration. The dark fiber link connects to a port on each Nexus 7000 pair using a Layer 2 port-channel. The requirement is to extend VLAN 100 between the two data centers for a critical application that requires a stretched Layer 2 domain. The current configuration has the port-channel on both sides set to mode 'active' with LACP. VLAN 100 is allowed on the trunk. The application servers report intermittent connectivity issues, with some packets being dropped. Upon inspection, you notice that the MAC address table on the Nexus 7000 in DC1 shows the MAC address of the server in DC2 on the dark fiber port-channel interface, but also on a local access port connected to a different server in the same VLAN. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Spanning Tree Protocol is not blocking one of the redundant paths, creating a loop.. The MAC address table showing the same MAC address on both the dark fiber port-channel and a local access port indicates a Layer 2 loop. In a vPC environment with a Layer 2 extension between data centers, Spanning Tree Protocol (STP) should block one of the redundant paths to prevent loops. If STP fails to block the appropriate port, frames loop, causing MAC address flapping and intermittent packet drops.

Answer

The dark fiber link is experiencing high latency, causing MAC address timeouts.

Answer

LACP is misconfigured on one side, causing the port-channel to operate as individual links.

Answer

There is an asymmetric routing issue between the data centers.

Question 10

In an EVPN-VXLAN fabric, a network engineer notices that MAC addresses learned from an external router are not being advertised as EVPN type-2 routes. The external router is connected to a leaf switch via a Layer 3 port. Which additional configuration is needed on the leaf switch?

Accepted Answer

Configure `ip arp evpn` on the Layer 3 interface.. When an external router is connected via a Layer 3 port, the leaf switch learns the router's MAC address through ARP, not through a VLAN. To advertise this MAC as an EVPN type-2 route, the `ip arp evpn` command must be configured on the Layer 3 interface. This command enables the switch to synchronize ARP entries into the EVPN BGP control plane, allowing MAC/IP advertisement for directly connected hosts on routed interfaces.

Answer

Configure `redistribute host-routes` under the BGP address-family l2vpn evpn.

Answer

Configure `evpn` under the VLAN interface associated with the external router's VLAN.

Answer

Configure `routing-config` under BGP to enable both MAC-VRF and IP-VRF.

Question 11

Which THREE of the following are valid UCS Manager RBAC roles?

Accepted Answer

Storage Administrator. All five options are built-in RBAC roles in UCS Manager. The roles are: Storage Administrator, Network Administrator, UCS Administrator, Operations Administrator, and Server Administrator. Each role provides specific administrative privileges within the UCS environment.

Question 12

Which THREE factors should be considered when determining the number of upstream Ethernet uplinks from a UCS Fabric Interconnect to the core network? (Choose THREE.)

Accepted Answer

The number of vNICs per service profile and their bandwidth limits.. The number of vNICs per service profile and their bandwidth limits directly determine the aggregate traffic that must be carried by the upstream Ethernet uplinks. Each vNIC is assigned a specific bandwidth cap (e.g., via QoS policy or vNIC template), and the sum of these caps across all service profiles on a Fabric Interconnect dictates the minimum uplink capacity required to avoid oversubscription.

Answer

Number of VLANs defined on the Fabric Interconnect.

Answer

Server CPU oversubscription ratio.

Question 13

Which statement describes how firmware management works for UCS B-Series blade servers?

Accepted Answer

Firmware is managed through host firmware packages in service profiles. In Cisco UCS Manager, firmware for B-Series blade servers is managed through host firmware packages that are included in service profiles. These packages define the exact firmware versions for components like the BIOS, adapter, storage controller, and CIMC, and are automatically applied to the blade when the service profile is associated. This ensures consistent firmware levels across blades without manual intervention on each server.

Answer

Firmware must be manually upgraded on each blade individually

Answer

Firmware is automatically updated via Cisco TAC

Answer

Firmware is stored on the fabric interconnect and loaded directly to the server

Question 14

A storage administrator wants to implement Fibre Channel zoning to ensure that only specific initiators can access specific targets. The administrator prefers a method that does not require reconfiguration when a host's HBA is replaced with a new one with a different WWPN. Which zoning type meets this requirement?

Accepted Answer

Soft zoning by port. Soft zoning by port uses the physical port number, not the WWPN. If the HBA is replaced but the same port is used, the zoning remains valid. Hard zoning by WWN would require updating the zone if the WWPN changes.

Answer

Hard zoning by port

Answer

Soft zoning by WWN

Answer

Hard zoning by WWN

Question 15

Which Cisco NX-OS feature allows automation and programmatic access to device configuration and monitoring using REST APIs?

Accepted Answer

NX-API. NX-API is the correct answer because it provides a REST-based API interface on Cisco NX-OS devices, allowing automation and programmatic access to configuration and monitoring via HTTP/HTTPS methods (GET, POST, PUT, DELETE). It exposes the device's CLI commands as RESTful API calls, enabling tools like Ansible, Postman, or custom scripts to interact with the switch without requiring SSH or direct CLI access.

Answer

Python scripting

Answer

Bash shell access

Answer

SNMP

Question 16

A large cloud provider is building a new data center using Cisco ACI with multiple leaf and spine switches. They plan to host thousands of tenants with overlapping IP addresses in different VRFs. The network team has deployed the fabric with a common security policy. During testing, they discover that traffic from Tenant A to Tenant B is being allowed even though a contract should deny it. The APIC policy shows the contract is applied to the EPGs and the deny rule is present. What is the most likely cause of the policy not being enforced?

Accepted Answer

The leaf switches have not downloaded the updated policy.. In Cisco ACI, the leaf switches enforce contracts locally based on the policy downloaded from the APIC. If a contract is correctly configured on the APIC but traffic is still permitted, the most likely cause is that the leaf switches have not yet received or applied the updated policy. This can happen due to a delay in policy propagation, a communication issue between the APIC and leaf switches, or the leaf not having completed the policy resolution process.

Answer

The fabric is using VRF leaking that bypasses contracts.

Answer

The contract is not configured with the correct subject.

Answer

The EPGs are in the same bridge domain.

Question 17

Refer to the exhibit. What is the effect of this configuration on traffic in VLAN 10?

Accepted Answer

Telnet traffic is denied; all other traffic is permitted.. The ACL applied to VLAN 10 contains two entries: the first denies TCP traffic destined for port 23 (Telnet), and the second permits all IP traffic (permit ip any any). As a result, Telnet packets are denied by the first entry, while all other traffic (including other TCP, UDP, ICMP, etc.) is permitted by the second entry. Option C correctly states this behavior. Option A incorrectly says Telnet is permitted. Option B incorrectly says all except telnet is denied; actually all other traffic is permitted. Option D incorrectly says all traffic is permitted; telnet is denied.

Answer

Telnet traffic is permitted; all other traffic is denied.

Answer

All traffic is denied except telnet.

Answer

All traffic is permitted.

Question 18

Which management interface is used for out-of-band management of UCS C-Series rack servers, providing features like KVM, virtual media, and remote firmware upgrade?

Accepted Answer

CIMC. The Cisco Integrated Management Controller (CIMC) is the out-of-band management interface for UCS C-Series servers, offering KVM, virtual media, and remote firmware management.

Answer

Cisco IMC Supervisor

Answer

UCS Central

Answer

UCS Manager

Question 19

A VACL is configured to capture traffic between hosts in the same VLAN. The capture port is configured and the VACL is applied to the VLAN. However, no traffic is being captured. What is a likely reason?

Accepted Answer

The VACL does not have a capture action. A VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.

Answer

The VACL is applied in the wrong direction

Answer

The capture port is a SPAN destination port

Answer

The capture port is not in the same VLAN

Question 20

Which protocol is used by Cisco ACI fabric to distribute endpoint information among spines?

Accepted Answer

COOP. D is correct because the Cisco ACI fabric uses the Council of Oracle Protocol (COOP) specifically to distribute endpoint information (such as IP-to-MAC bindings and location) among spine switches. COOP operates as a lightweight, publish-subscribe protocol that runs between leaf and spine switches, ensuring that all spines maintain a consistent endpoint database without the overhead of a full routing protocol.

Answer

IS-IS

Answer

OSPF

Answer

BGP