350-601 Practice Test 6 — 10 Questions

Question 1

A storage administrator reports that a new host cannot log into the SAN. The host is connected to a Cisco MDS switch. The switch interface shows up/up but the host is not in the active zone. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The zone set is not activated.. The host cannot log into the SAN despite the interface showing up/up because the zone set is not activated. In Cisco MDS Fibre Channel SANs, zone configurations are stored in the zone database but only take effect when the zone set is activated (using the 'zone activate' command). Without an active zone set, no zoning is enforced, and the host's WWPN is effectively invisible to other devices, preventing login even though the physical link is operational.

Answer

The switch port is in an isolated state.

Answer

The FC cable is faulty.

Answer

The host's WWPN is not in the zone configuration.

Answer

The host's driver is not installed.

Question 2

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 3

Based on the exhibited FLOGI database, what is the state of the interface fc1/1?

Accepted Answer

It is an NP port (proxy FW) because multiple FCIDs appear on the same interface.. The FLOGI database shows multiple FCIDs (0x010000, 0x010001) associated with the same interface fc1/1, which is characteristic of an NP port (proxy FW) in NPV mode. An NP port acts as a proxy for multiple end devices behind it, such as in a Fibre Channel NPV switch or a converged network adapter (CNA) in FCoE NPV mode, allowing multiple FCIDs to share a single physical link.

Answer

It is an F port with a hub attached.

Answer

It is a trunking E port.

Answer

It is a disabled port because there are two WWNs.

Question 4

Which ECMP load-balancing method is recommended for data center spine-leaf fabrics to ensure optimal traffic distribution?

Accepted Answer

Per-flow load balancing based on src-dst IP. Per-flow load balancing based on src-dst IP ensures that all packets belonging to the same flow (identified by source and destination IP addresses) follow the same path, preventing packet reordering while still distributing different flows across multiple equal-cost paths. In spine-leaf fabrics, this method provides optimal traffic distribution because it leverages the IP header information that is consistently available across Layer 3 boundaries, aligning with the fabric's routing-based forwarding model.

Answer

Per-packet load balancing

Answer

Weighted load balancing

Answer

Per-flow load balancing based on src-dst MAC

Question 5

An administrator configures 'aaa authentication login default group tacacs+ local'. What happens if the TACACS+ server is unreachable?

Accepted Answer

Local username database is used. The command 'aaa authentication login default group tacacs+ local' configures a method list where the first method is TACACS+ and the second is local. If the TACACS+ server is unreachable (not responding, not rejecting), the switch falls back to the next method in the list, which is local authentication using the local username database. This fallback behavior is defined by Cisco IOS/IOS-XE authentication method lists, where 'local' acts as a backup when the primary method is unavailable.

Answer

The switch uses no authentication

Answer

Authentication fails

Answer

The switch tries the next method in the group

Question 6

An engineer needs to ensure that only authorized servers can connect to a specific switch port in a data center. The port connects to a critical database server with fixed MAC address 00:1a:2b:3c:4d:5e. Which configuration is most appropriate?

Accepted Answer

switchport port-security
switchport port-security mac-address 001a.2b3c.4d5e
switchport port-security violation shutdown. It explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.

Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown

Answer

no switchport port-security
spanning-tree portfast

Answer

switchport port-security
switchport port-security maximum 2
switchport port-security violation protect

Question 7

What is the primary function of the Cisco Integrated Management Controller (CIMC) on UCS C-series rack servers?

Accepted Answer

To provide out-of-band management with KVM, virtual media, and remote firmware update. CIMC provides out-of-band management capabilities such as remote KVM, virtual media, and firmware updates, allowing administrators to manage the server independently of the host OS.

Answer

To manage the server's power and cooling via IPMI

Answer

To provide in-band management through the host OS

Answer

To integrate the rack server into UCS Manager fabric

Question 8

Match each Cisco data center technology to its primary purpose.

Accepted Answer

VDC: Enables partitioning a single physical switch into multiple logical switches.. VDC partitions switches; VPC provides redundant LAG; FEX extends fabric ports; OTV extends Layer 2 over Layer 3.

Answer

VPC: Enables partitioning a single physical switch into multiple logical switches.

Answer

FEX: Allows a link aggregation group to terminate on two upstream switches for redundancy.

Question 9

An engineer is configuring a storage network with FCoE and must ensure that the FCoE traffic does not interfere with standard LAN traffic. Which two mechanisms should be implemented?

Accepted Answer

Enable PFC on the FCoE VLAN.. FCoE requires lossless transport to prevent frame drops that would corrupt Fibre Channel frames. Priority Flow Control (PFC), defined by IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured as lossless while standard LAN traffic remains best-effort. This ensures FCoE traffic does not interfere with LAN traffic by isolating the flow control behavior.

Answer

Use the same VLAN for FCoE and LAN.

Answer

Disable flow control on FCoE VLAN.

Answer

Use jumbo frames for LAN traffic only.

Question 10

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.

Answer

RADIUS

Answer

LDAP

Answer

SSH