350-601 Practice Exam 60 — 20 Questions

Question 1

In a vPC domain, a consistency check failure is observed for the vPC keepalive link. What is the impact on the vPC domain operation?

Accepted Answer

The vPC domain will continue to operate but with reduced reliability.. The vPC keepalive link is used as a secondary heartbeat to detect dual-active scenarios when the peer link fails. A consistency check failure on the keepalive link does not directly affect data forwarding; the vPC domain continues to operate, but the loss of this redundancy mechanism reduces reliability because the switches can no longer reliably detect a split-brain condition without the peer link.

Answer

The vPC peer link will be suspended.

Answer

The secondary switch will shutdown its vPC member ports.

Answer

Both switches will independently forward traffic via the vPC peer link.

Question 2

When troubleshooting a VXLAN EVPN fabric with Cisco Nexus 9000 switches, which three commands provide information about the EVPN operation? (Choose three.)

Accepted Answer

show bgp l2vpn evpn summary.. The 'show bgp l2vpn evpn summary' command is correct because it displays the BGP session status for the L2VPN address family, which is the control plane protocol for VXLAN EVPN. This command shows neighbor states, prefixes received, and route table statistics, directly indicating whether EVPN route exchange is operational.

Answer

show running-config interface nve1.

Answer

show ip interface brief.

Question 3

Refer to the exhibit. A server with vNIC eth0 is experiencing packet drops on its Ethernet interface. The server is sending jumbo frames (MTU 9000) on VLAN 100. The QoS system class 'Class-Platinum' has an MTU of 9216 and is configured with 'Drop'. The vNIC is not assigned to any QoS policy. What is the most likely reason for the drops?

Accepted Answer

The vNIC is not mapped to a QoS policy, so it uses the default best-effort class which has an MTU of 1500 and drops jumbo frames.. When a vNIC is not assigned to a QoS policy, it defaults to the best-effair class, which typically has an MTU of 1500 bytes. Since the server is sending jumbo frames (MTU 9000) on VLAN 100, these frames exceed the default MTU and are dropped at the Ethernet interface. The 'Class-Platinum' system class with MTU 9216 is irrelevant because the vNIC is not mapped to it.

Answer

The QoS system class for jumbo frames requires a 'No Drop' policy to avoid drops.

Answer

The server is sending frames larger than 9216 bytes.

Answer

The native VLAN setting on the vNIC causes the QoS system class to be ignored.

Question 4

An OSPF router in a broadcast network has not formed a neighbor relationship. What are three possible causes? (Choose three.)

Accepted Answer

MTU mismatch. In OSPF, an MTU mismatch prevents the formation of a neighbor relationship because OSPF routers compare the MTU value in Database Description (DBD) packets. If the receiving router's interface MTU is smaller than the DBD packet size, the packet is dropped, and the neighbor state remains stuck in EXSTART/EXCHANGE. This is a common issue on broadcast networks where different link types or misconfigured interfaces exist.

Answer

Authentication incorrect

Answer

Area ID mismatch

Question 5

A Cisco MDS switch is configured in NPV mode. A host connected to this switch fails to log into the SAN. Which command should be used to verify the host's FLOGI status?

Accepted Answer

show flogi database module . In NPV mode, the MDS switch acts as a passthrough and does not maintain its own FLOGI database; instead, it forwards FLOGI requests to the upstream NPIV-capable switch. The 'show flogi database module ' command is used on the NPV switch to verify the host's FLOGI status because it displays the FLOGI entries learned from the upstream switch for the specific module where the host is connected, which is essential for troubleshooting login failures.

Answer

show zone

Answer

show fcns database

Answer

show flogi database

Answer

show port-channel summary

Question 6

A storage administrator notices that a host is unable to see a LUN after zoning is configured. The zone contains the host WWPN and the target WWPN. The LUN is not masked at the storage array. What is the most likely cause?

Accepted Answer

LUN masking is not configured on the storage array.. The host cannot see the LUN because LUN masking is not configured on the storage array. Even with correct zoning (host WWPN to target WWPN), the storage array must explicitly grant access to specific LUNs for a given initiator WWPN. Without LUN masking, the target will not present the LUN to the host, regardless of zone membership.

Answer

The host requires NPIV to be enabled.

Answer

The host is in a different VSAN.

Answer

The zone is incorrectly configured.

Question 7

Based on the exhibited output, what is the status of the interface?

Accepted Answer

The interface is up but has no license.. The interface is up (line protocol is up) but the output shows 'license not installed' or similar, meaning the port is administratively up but lacks the required license for full functionality. In Cisco MDS/Nexus storage networks, interfaces can be in an 'up' state without a license, but they will not pass traffic or operate in the licensed mode until the license is installed.

Answer

The interface is in trunk mode and licensed.

Answer

The interface is operational and licensed.

Answer

The interface is down due to no license.

Question 8

A network engineer is verifying VPC configuration on a pair of Nexus switches. Which two commands should be used to check VPC status and consistency? (Choose two.)

Accepted Answer

show vpc consistency-parameters. (show vpc) is correct because it displays the overall VPC status, including the local and peer VPC system MAC, role, and the operational state of each VPC member port. Option B (show vpc consistency-parameters) is correct because it verifies that critical parameters (e.g., STP mode, VLAN interfaces, MTU) are consistent between the two VPC peers, which is essential for VPC to function correctly and avoid traffic black-holing.

Answer

show vpc role

Answer

show vpc peer-keepalive

Answer

show vpc statistics

Question 9

Which TWO characteristics are true about Cisco VPC? (Choose two)

Accepted Answer

VPC allows dual-homing of a server to two different switches.. Cisco Virtual PortChannel (vPC) allows a server to be dual-homed to two different switches, enabling active-active load balancing and link redundancy. This is achieved by making the two switches appear as a single logical switch to the downstream device using the vPC protocol, which synchronizes state and forwarding information across the peer link.

Answer

VPC keepalive uses Layer 2 connectivity.

Answer

VPC requires a dedicated management VLAN.

Answer

VPC member ports can be on different VLANs on each peer.

Question 10

Which FCoE feature allows multiple VLANs to be carried over a single physical link when using FIP snooping?

Accepted Answer

FIP snooping. FIP snooping is the correct answer because it is the FCoE feature that enables multiple VLANs to be carried over a single physical link by snooping FIP (FCoE Initialization Protocol) frames. FIP snooping builds a forwarding table that maps FCoE sessions to specific VLANs, allowing the switch to forward FCoE traffic for different VLANs on the same physical interface while maintaining isolation and security.

Answer

NPV

Answer

VSANs

Answer

Port channels

Question 11

Which THREE factors should be considered when sizing buffer credits for a long-haul FC link?

Accepted Answer

Link speed. Link speed (A) is a critical factor because higher speeds require more buffer credits to maintain full throughput over a given distance. The buffer credit requirement scales linearly with link speed, as each credit represents the ability to send one frame before receiving an acknowledgment. For example, a 16 Gbps link needs twice as many buffer credits as an 8 Gbps link for the same distance.

Answer

Number of targets

Answer

Buffer-to-buffer credit pool size

Question 12

A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?

Accepted Answer

Set Ethernet 1/1 as a trusted port. DHCP snooping uses the concept of trusted and untrusted ports. By default, all ports are untrusted. Setting Ethernet 1/1, where the legitimate DHCP server is connected, as a trusted port allows DHCP server messages (OFFER, ACK, etc.) from that port to be forwarded. All other ports, including Ethernet 1/2, remain untrusted, so any DHCP server messages received on them are dropped, effectively blocking the unauthorized DHCP server.

Answer

Enable the DHCP snooping information option

Answer

Set Ethernet 1/2 as a trusted port

Answer

Disable DHCP snooping globally

Question 13

In a Cisco HyperFlex cluster, a new ESXi host is being added. The host is discovered, but the cluster health status shows 'Degraded'. What should be the first troubleshooting step?

Accepted Answer

Verify that the new host's controller VM has the same firmware version as the cluster.. When adding a new ESXi host to a Cisco HyperFlex cluster, the controller VM (CVM) firmware version must match the cluster's version. A mismatch causes the cluster health status to show 'Degraded' because the CVMs cannot properly synchronize storage operations. Verifying and aligning the firmware version is the first troubleshooting step, as it directly impacts cluster stability.

Answer

Reboot the new ESXi host.

Answer

Check if the vCenter Server is in maintenance mode.

Answer

Delete and re-create the cluster.

Question 14

An engineer is designing a SAN to connect hosts to two storage arrays for redundancy. The hosts are dual-attached to two MDS switches. Each storage array has two controllers, each with a single FC port. The engineer wants to avoid a single point of failure and ensure that each host can reach both storage controllers. Which design should be used?

Accepted Answer

Connect each host HBA to a different switch, and zone each HBA to both storage controller ports.. It provides full redundancy: each host HBA connects to a different MDS switch, and each HBA is zoned to both storage controller ports. This ensures that if a switch, HBA, or storage controller fails, the host can still reach at least one storage controller via the remaining path. The dual-zoning per HBA allows each host to access both controllers without a single point of failure, meeting the requirement for host-to-controller reachability.

Answer

Connect both HBAs of each host to the same switch, and create zones that include both HBAs and both storage ports.

Answer

Connect each host HBA to a separate switch, and zone each HBA to one storage controller port.

Answer

Use NPV mode to simplify connectivity.

Answer

Connect each host HBA to a different switch, and zone each HBA to a specific storage controller, using zones that cross VSANs.

Question 15

Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?

Accepted Answer

IP Source Guard. IP Source Guard uses DHCP snooping binding to validate source IP.

Answer

Port Security

Answer

ACL

Answer

Dynamic ARP Inspection

Question 16

An engineer notices that AAA authentication using RADIUS is failing, and the RADIUS server logs show no incoming authentication requests. Which of the following is the most likely cause?

Accepted Answer

The device has not been configured with any RADIUS server host. If the RADIUS server logs show no incoming authentication requests, the issue is that the device is not sending any traffic to the server. This occurs when no RADIUS server host is configured on the device, meaning the device has no IP address or hostname to which it can send authentication packets. Without a configured server host, the device will not attempt any RADIUS communication, resulting in zero requests reaching the server.

Answer

The device is using TACACS+ instead of RADIUS

Answer

The RADIUS server is not reachable due to a firewall

Answer

The RADIUS shared secret is incorrect

Question 17

What is a key advantage of using structured data (e.g., JSON or XML) from Cisco NX-API responses compared to traditional CLI scraping (e.g., using regular expressions)?

Accepted Answer

It provides machine-readable output that is less prone to parsing errors due to display changes.. Cisco NX-API returns structured data formats like JSON or XML, which are inherently machine-readable and consistent regardless of CLI display changes or software version updates. This eliminates the fragility of traditional CLI scraping with regular expressions, where output formatting changes (e.g., column widths, spacing, or label text) can break parsing logic. Structured data ensures reliable, predictable automation workflows.

Answer

It automatically commits changes to running-config.

Answer

It requires no software libraries to parse.

Answer

It eliminates the need for any authentication.

Question 18

Which Fibre Channel frame field is used to identify the upper-layer protocol being carried?

Accepted Answer

R_CTL. The R_CTL (Routing Control) field in the Fibre Channel frame header is used to identify the upper-layer protocol being carried, such as SCSI-FCP, IP, or VI. It contains the routing bits and information category that specify the frame type and protocol context, enabling the receiver to interpret the payload correctly.

Answer

Source FC ID

Answer

D_ID

Answer

CS_CTL

Question 19

Two data center switches are connected via a fiber link. They need to encrypt all traffic at Layer 2. Which configuration is required on both switches to establish MACsec?

Accepted Answer

Enable MACsec and configure a pre-shared key or CA. MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption between directly connected switches. To establish a MACsec session, both switches must enable MACsec on the interface and either configure a pre-shared key (PSK) or use a CA (Connectivity Association) key agreement protocol like MKA (MACsec Key Agreement, IEEE 802.1X-2010). This ensures all Ethernet frames are encrypted at the data link layer.

Answer

Configure the interface as a trunk

Answer

Enable IPsec on the interface

Answer

Enable 802.1X on the interface

Question 20

Which TWO of the following are characteristics of NPV (N-Port Virtualization) in a Cisco MDS fabric?

Accepted Answer

It enables multiple hosts to share the same physical uplink.. NPV (N-Port Virtualization) allows multiple hosts to share a single physical uplink from an NPV switch to a core NPIV-enabled switch. This is achieved by multiplexing multiple Fibre Channel N-Port IDs over the same physical link, reducing the number of domain IDs required in the fabric because the NPV switch does not participate in principal switch selection or domain ID distribution. The core switch sees each host as a separate virtual N_Port, but the NPV switch itself does not consume a domain ID.

Answer

It allows the edge switch to appear as a virtual host to the core switch.

Answer

It requires FC-SP authentication.

Answer

It is only supported on 8 Gbps or higher ports.