350-601 Practice Exam 61 — 20 Questions

Question 1

In a Fibre Channel SAN, a technique is used to allow multiple initiators to share a single physical FC port by assigning multiple N-port IDs. What is this technique called?

Accepted Answer

N_Port ID Virtualization (NPIV). NPIV (N_Port ID Virtualization) allows a single physical Fibre Channel port to register multiple N_Port IDs (FCIDs), enabling multiple initiators (e.g., virtual machines or logical partitions) to share that port while each appears as a unique entity to the fabric. This is achieved by the HBA requesting additional FCIDs from the fabric switch via the FLOGI and FDISC processes. The technique is defined in the FC-FS and FC-LS standards and is widely used in virtualized server environments to reduce the number of physical ports needed.

Answer

NPIV is exclusive to FCoE environments

Answer

NPIV is only available on initiator HBAs

Answer

N_Port Virtualization (NPV)

Question 2

An organization is deploying Ansible for network automation across multiple Nexus 9000 leaf switches. They need to ensure that configuration tasks are idempotent and only apply changes when necessary. Which best practice should be followed when using the cisco.nxos.nxos_config module?

Accepted Answer

Use the 'replace' option with a provided configuration file to enforce desired state.. The 'replace' option in the cisco.nxos.nxos_config module allows you to provide a configuration file that defines the desired state, and the module will only apply changes if the current configuration does not match, ensuring idempotency. This is a best practice for network automation with Ansible on Nexus switches.

Answer

Write idempotent playbooks by checking 'show running-config' before each task.

Answer

Set 'always_run' parameter to 'yes' to force execution.

Answer

Use the 'backup' option to always restore previous configuration.

Question 3

A UCS administrator is planning to deploy stateless computing using service profiles. Which three components are abstracted from the physical hardware and defined in the service profile? (Choose three.)

Accepted Answer

Boot order. Service profiles abstract the server identity, including UUID, MAC addresses, WWPNs, and boot order, allowing the profile to be applied to any compatible blade.

Answer

Physical disk serial numbers

Answer

CPU model

Question 4

A data center designer is evaluating oversubscription ratios in a spine-leaf topology with 40 leaf switches and 4 spine switches. Each leaf has 4x100G uplinks to spines, and each spine has 40x100G downlinks. The leaf switches have 48x25G server ports. What is the oversubscription ratio from the server ports to the spine uplinks?

Accepted Answer

3:1. The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48x25G server ports = 1200G, and 4x100G uplinks = 400G, giving a leaf-level ratio of 3:1 (1200:400). Since all leaves are identical and the spine count doesn't affect the leaf-level ratio, the overall ratio remains 3:1.

Answer

2:1

Answer

4:1

Answer

5:1

Question 5

An organization is deploying Cisco Nexus 9000 switches with NX-OS and needs to prevent ARP spoofing attacks. The network engineer enables Dynamic ARP Inspection (DAI) on all VLANs. However, some legitimate hosts are unable to obtain IP addresses via DHCP. What is the most likely reason?

Accepted Answer

DHCP snooping is not enabled, so DAI lacks the DHCP snooping binding table.. DAI relies on the DHCP snooping binding table to validate ARP packets. Without DHCP snooping enabled, the binding table is empty, so DAI cannot determine which ARP packets are legitimate, causing it to drop all ARP packets, including DHCP discovery and request messages. This prevents hosts from obtaining IP addresses via DHCP.

Answer

The ARP rate limit on the port is too low, causing all ARP requests to be dropped.

Answer

IP Source Guard is enabled and is blocking ARP packets.

Answer

An ARP ACL is not configured to allow static IP bindings.

Question 6

Which THREE components are part of an EVPN VXLAN fabric? (Choose three)

Accepted Answer

MP-BGP. MP-BGP is the control plane protocol for EVPN VXLAN fabrics. It advertises MAC/VPN reachability information using EVPN address families (L2VPN AFI/SAFI 70/128) and enables overlay route distribution between VTEPs. Without MP-BGP, the fabric cannot dynamically learn remote MAC addresses or maintain a scalable, loop-free control plane.

Answer

IS-IS

Answer

VPC

Question 7

Which two commands are used to verify Spanning Tree Protocol (STP) status on a Cisco Nexus switch? (Choose two.)

Accepted Answer

show spanning-tree. On Cisco Nexus switches, the correct command to verify Spanning Tree Protocol status is 'show spanning-tree'. This command displays the STP state for all VLANs, including root bridge, port roles, and port states. Option C is correct because it is the standard Cisco command for viewing STP information across all VLANs.

Answer

show stp brief

Answer

show vlan spanning-tree

Answer

show running-config spanning-tree

Question 8

An organization has deployed a pair of Nexus 93180YC-EX switches as vPC peers in a data center. The switches are connected to a server with two 10GbE interfaces configured as an LACP port-channel. The vPC configuration has been verified and was working correctly for months. After a scheduled maintenance window that included upgrading the NX-OS software from version 7.0(3)I7(1) to 7.0(3)I7(5), the server begins experiencing frequent link flaps on the port-channel. The server administrator reports that every 5-10 minutes, the link goes down for about 2 seconds and then recovers. The network team checks the logs on the Nexus switches and sees repeated messages: 'LACP-3-MISCONFIG: Port-channel <channel> is misconfigured: partner not on same aggregator.' The 'show vpc brief' output shows all vPCs in the 'up' state. The 'show port-channel summary' shows the port-channel is up with both member ports in the bundle. What is the most likely root cause?

Accepted Answer

The LACP system priority is not configured consistently between the vPC peers, causing the LACP system identifier to differ.. In a vPC setup, both peer switches must have the same LACP system identifier (derived from system priority and MAC address) so the server sees a single logical partner. If the LACP system priority is not consistent across the peers, the system identifiers will differ, causing the server to detect multiple partners, leading to the 'partner not on same aggregator' error and link flaps. Option A is incorrect because the LACP rate timer mismatch would cause constant timeout issues, not intermittent flaps with the specific log message. Option B is incorrect because VLAN mismatch would cause persistent connectivity failures, not intermittent flaps. Option C is incorrect because delay-restore timer affects recovery after link failure, not during steady-state operation.

Answer

The LACP fast rate timer default changed to slow in the new software, causing a timeout mismatch with the server.

Answer

The vPC delay-restore timer is set too low, causing the vPC to prematurely come up before LACP is fully up.

Answer

The vPC peer-link VLAN allowed list does not include the server's VLAN, causing intermittent drops.

Question 9

Refer to the exhibit. Two Nexus switches are connected via Ethernet1/1. MKA does not initiate. What is the issue?

Accepted Answer

The policy is not applied to the interface. The exhibit shows that the MACsec policy is defined but not applied to interface Ethernet1/1. Without applying the policy using the `macsec policy` command under the interface configuration, MKA (MACsec Key Agreement) cannot initiate because the switch does not know which security policy to enforce on that link.

Answer

The interface is not administratively up

Answer

The cipher-suite is not supported

Answer

The MACsec key chain is missing

Question 10

Refer to the exhibit. An engineer sees this error on a Cisco MDS switch. What is the best action to resolve the issue?

Accepted Answer

Assign a different domain ID to one of the switches.. The error indicates a domain ID conflict between two switches in the same VSAN. In Fibre Channel fabrics, each switch must have a unique domain ID to build a correct forwarding table. Assigning a different domain ID to one of the switches resolves the conflict without disrupting the fabric.

Answer

Reload both switches to reset domain IDs.

Answer

Shut and no shut the ISL between the switches.

Answer

Change the VSAN on one of the switches.

Question 11

Which TWO are benefits of using the Cisco NX-API for network automation compared to traditional SSH-based scripting?

Accepted Answer

Enables batching multiple CLI commands in a single HTTP request. The Cisco NX-API allows batching multiple CLI commands into a single HTTP request, which reduces the number of round trips and improves automation efficiency. This is a key advantage over traditional SSH-based scripting, where each command typically requires a separate connection or session.

Answer

Supports direct configuration of IPSec and SSL VPNs

Answer

Eliminates the need for any authentication

Answer

Allows for real-time streaming of syslog messages

Question 12

In VXLAN, what is the role of the VNI in the overlay network?

Accepted Answer

Identifies the overlay network segment. The VNI (VXLAN Network Identifier) is a 24-bit field in the VXLAN header that uniquely identifies a Layer 2 overlay network segment, analogous to a VLAN ID in traditional networking. It allows multiple tenants or broadcast domains to coexist over a shared underlay network by isolating traffic at the overlay level.

Answer

Identifies the VTEP

Answer

Encapsulation type

Answer

Specifies the underlay VRF

Question 13

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Accepted Answer

Both switches must run the same NX-OS software version. Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.

Answer

Both switches must use the same routing protocol

Answer

The peer-keepalive link must be carried over the peer-link

Question 14

A data center switch is experiencing high CPU due to excessive BGP updates. Which action can mitigate this without affecting legitimate BGP traffic?

Accepted Answer

Apply a CoPP policy that rate-limits BGP traffic. Control Plane Policing (CoPP) protects the control plane by rate-limiting specific traffic classes. Applying a CoPP policy that rate-limits BGP traffic (option A) reduces CPU load from excessive BGP updates while still allowing legitimate BGP sessions to function, as the rate-limit only drops packets exceeding a configured threshold. This preserves BGP neighbor reachability and route exchange, unlike dropping all BGP traffic.

Answer

Apply a CoPP policy that drops all BGP traffic

Answer

Disable BGP route filtering

Answer

Increase BGP timers globally

Question 15

Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?

Accepted Answer

Enable the address-family l2vpn evpn under the BGP configuration.. In VXLAN EVPN, BGP is used as the control plane to exchange MAC and IP reachability information. Enabling the address-family l2vpn evpn under BGP configuration is mandatory to advertise EVPN routes (type-2 and type-3) between VTEPs, which is the foundation of the centralized anycast gateway model.

Answer

Enable IGMP snooping on all VLANs extended over VXLAN.

Answer

Set the VXLAN destination UDP port to 8472.

Answer

Create an NVE interface with a loopback interface as the source.

Question 16

Refer to the exhibit. A network administrator configured VXLAN EVPN as above. The VTEP can communicate with neighbors on VNI 5001, but cannot reach the default gateway for VNI 5002. What is the problem?

Accepted Answer

The route-target for VNI 5002 is missing.. The VXLAN EVPN configuration for VNI 5002 is missing the route-target import/export statements under the VRF TenantA address-family l2vpn evpn. Without the route-target, the VTEP cannot import EVPN type-2 and type-3 routes for VNI 5002, preventing it from learning the default gateway's MAC/IP or the IMET route needed for BUM traffic. This explains why the VTEP can communicate on VNI 5001 (which has route-targets) but not reach the gateway on VNI 5002.

Answer

The default route in VRF TenantA is not exported.

Answer

The VNI 5002 does not have an associated VLAN.

Answer

The NVE interface does not have ingress-replication configured.

Question 17

During a capacity planning review, an engineer notices that a UCS domain with 8 blades (each with 16 cores) is using 70% CPU average. The environment runs VDI workloads. Each VM requires 2 vCPUs and 4 GB RAM. The hypervisor uses 1:1 CPU oversubscription. How many additional VMs can be deployed before reaching 100% CPU utilization?

Accepted Answer

19. The UCS domain has 8 blades × 16 cores = 128 cores. With 1:1 CPU oversubscription, the hypervisor can allocate 128 vCPUs. Each VM requires 2 vCPUs, so the maximum VMs are 128 / 2 = 64. Currently at 70% CPU, 0.70 × 128 = 89.6 vCPUs are used, meaning 89.6 / 2 = 44.8 VMs (round to 45 VMs). The remaining vCPUs are 128 - 89.6 = 38.4, allowing 38.4 / 2 = 19.2 additional VMs, so 19 VMs can be deployed before hitting 100% CPU utilization.

Answer

23

Answer

17

Answer

21

Question 18

An organization uses FCIP to extend their SAN between two data centers over a 100 Mbps WAN link with 80 ms latency. The storage traffic includes large sequential writes. Which statement best describes the benefit of enabling compression on the FCIP tunnel?

Accepted Answer

Compression improves effective throughput over the WAN link. Enabling compression on an FCIP tunnel reduces the amount of data transmitted over the WAN link by compressing FC frames before encapsulation. For large sequential writes, this directly improves effective throughput because more actual storage data can be sent within the same 100 Mbps bandwidth, compensating for the high latency and low bandwidth.

Answer

Compression reduces end-to-end latency

Answer

Compression is recommended only when the link has high packet loss

Answer

Compression eliminates the need for jumbo frames

Question 19

Which BGP variant is commonly used in data center EVPN fabrics to carry Layer 2 and Layer 3 network information?

Accepted Answer

MP-BGP. MP-BGP (Multiprotocol BGP) is the correct variant because it carries both Layer 2 (MAC/VXLAN) and Layer 3 (IP/VRF) network information in EVPN fabrics via BGP EVPN address families (L2VPN EVPN and IP VPN). It extends BGP with multiprotocol extensions (RFC 4760) to support Network Layer Reachability Information (NLRI) for Ethernet segments, MAC addresses, and IP prefixes, which is essential for VXLAN-based data center fabrics.

Answer

eBGP

Answer

iBGP

Answer

OSPF

Question 20

Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?

Accepted Answer

The DHCP server port is trusted for all VLANs. When a DHCP server is connected to a switch port and clients in different VLANs (like VLAN 10) obtain IP addresses, the switch must trust the DHCP server port for all VLANs. This is typically achieved by configuring the port as a DHCP snooping trusted port or by using an IP helper address on the VLAN interface. Without trust, DHCP snooping would drop server responses on untrusted ports, preventing the client from obtaining an address.

Answer

The DHCP server is in VLAN 20

Answer

The DHCP client is using a static IP address

Answer

The DHCP client MAC address is not verified