350-601 Practice Exam 62 — 20 Questions

Question 1

An engineer needs to enable equal-cost multipath (ECMP) routing in a spine-leaf fabric using OSPF. Which OSPF feature allows load balancing across multiple equal-cost paths?

Accepted Answer

maximum-paths command. The maximum-paths command is the OSPF feature that directly controls the number of equal-cost routes installed in the routing table, enabling ECMP load balancing across multiple equal-cost paths. By default, OSPF installs only one best path, but increasing the maximum-paths value allows the router to use up to that many equal-cost routes simultaneously.

Answer

OSPF network type

Answer

OSPF area type

Answer

OSPF cost metric

Question 2

In VXLAN, which method of handling BUM traffic replicates packets to remote VTEPs only when there is a known receiver behind that VTEP?

Accepted Answer

Ingress replication. Ingress replication is the correct method because in VXLAN, the ingress VTEP replicates BUM (Broadcast, Unknown unicast, Multicast) traffic and sends a copy to each remote VTEP only if that VTEP has at least one receiver (i.e., a host or VM) that has joined the relevant multicast group or is reachable via the VNI. This avoids unnecessary replication to VTEPs with no interested receivers, optimizing bandwidth and reducing load on the underlay network.

Answer

Egress replication

Answer

Multicast-based replication

Answer

Head-end replication

Question 3

An engineer is configuring a new VLAN on a Nexus switch that is part of a vPC pair. Which step is mandatory to ensure the VLAN is created on both vPC peers?

Accepted Answer

Create the VLAN on both peers manually.. In a vPC domain, VLANs are not automatically synchronized between peers. The engineer must manually create the VLAN on both vPC peers to ensure it is present in the local VLAN database on each switch. This is because vPC relies on consistent local configuration on both devices for proper operation, and there is no built-in mechanism to propagate VLAN definitions from one peer to the other.

Answer

Use vPC peer-gateway to propagate VLANs.

Answer

Create the VLAN on the secondary peer only; the primary will learn via STP.

Answer

Create the VLAN on the primary peer only; it will sync automatically.

Question 4

What is the purpose of a witness VM in a HyperFlex cluster?

Accepted Answer

To break ties in cluster quorum decisions. In a HyperFlex cluster, the witness VM provides a tie-breaking vote for cluster quorum decisions when the cluster experiences a network partition or node failure. It ensures that the surviving side can maintain a majority and continue operating, preventing split-brain scenarios where both sides would independently write data.

Answer

To act as a management node for the cluster

Answer

To provide additional storage capacity

Answer

To replicate data across sites

Question 5

Which two mechanisms are used by Dynamic ARP Inspection to prevent ARP spoofing? (Choose two.)

Accepted Answer

DHCP snooping binding table. Dynamic ARP Inspection (DAI) validates ARP packets by comparing the sender MAC and IP addresses against the DHCP snooping binding table. If an ARP packet's MAC-IP binding does not match an entry in the binding table, DAI drops the packet, preventing ARP spoofing attacks. Additionally, DAI can use ARP access lists (ARP ACLs) to statically define valid MAC-IP bindings for hosts that do not use DHCP, providing an alternative validation mechanism.

Answer

Port security

Answer

ARP rate limiting

Answer

ARP inspection VLAN configuration

Question 6

A network engineer is planning a VXLAN EVPN fabric. Which two statements about VXLAN Network Identifiers (VNIs) are correct? (Choose two.)

Accepted Answer

VXLAN encapsulates Layer 2 frames in UDP packets. VXLAN encapsulates Layer 2 Ethernet frames inside UDP packets (typically UDP destination port 4789). This allows Layer 2 segments to be extended over a Layer 3 IP network, which is the fundamental purpose of VXLAN in a data center fabric.

Answer

VNI values range from 1 to 4096

Answer

VXLAN uses TCP for encapsulation

Answer

VNI is used only for Layer 3 routing

Question 7

A UCS administrator is deploying a 3-node HyperFlex cluster with vSphere. Each node has a single vNIC for management and two vNICs for storage data traffic. During the cluster creation, the storage vNIC MTU must be configured. What is the recommended MTU value for the storage data vNICs in HyperFlex?

Accepted Answer

9000. C is correct because HyperFlex storage data vNICs require jumbo frame support to optimize storage traffic performance. The recommended MTU value for these vNICs is 9000, which allows larger packet sizes and reduces CPU overhead for storage I/O operations. This value is consistent with Cisco's best practices for HyperFlex cluster deployments.

Answer

1500

Answer

9216

Answer

4096

Question 8

A SAN administrator notices intermittent connectivity issues between an initiator and target. The Fibre Channel link shows CRC errors. What is the most likely cause?

Accepted Answer

Faulty SFP or fiber optic cable.. CRC errors on a Fibre Channel link indicate physical-layer issues such as signal degradation, dirty connectors, or faulty hardware. The most common cause is a faulty SFP module or damaged fiber optic cable, which introduces bit errors that the CRC check detects. This is the first component to verify when troubleshooting intermittent connectivity with CRC errors.

Answer

Incorrect domain ID.

Answer

Buffer credit starvation.

Answer

Incorrect zone configuration.

Question 9

An engineer has configured a service profile with a WWPN pool that has exhausted its assigned range. The server boots from SAN. What happens when the server is associated?

Accepted Answer

The server associates with a temporary WWPN from the conflict-free range.. When a WWPN pool is exhausted, Cisco UCS automatically assigns a temporary WWPN from the conflict-free range (00:00:00:00:00:00 to 00:00:00:00:00:FF) to allow the server to associate and boot from SAN. This temporary WWPN is used only until a permanent WWPN becomes available from the pool, ensuring the server can still access storage during the interim period.

Answer

The server associates but fails to boot because no WWPN is assigned.

Answer

The administrator is prompted to manually enter a WWPN.

Answer

The association fails until new WWPNs are added to the pool.

Question 10

In a VXLAN overlay network, which component is responsible for encapsulating and decapsulating packets and resides at the edge of the underlay network?

Accepted Answer

VTEP. C is correct because the VXLAN Tunnel Endpoint (VTEP) is the device at the edge of the underlay network that performs encapsulation and decapsulation of VXLAN packets. It adds a VXLAN header (including a 24-bit VNI) and outer UDP/IP headers to original Layer 2 frames, and removes them on the receiving side. This function is defined in RFC 7348 and is essential for extending Layer 2 segments over a Layer 3 underlay.

Answer

VNI

Answer

NSX Controller

Answer

Leaf switch

Question 11

Which TWO statements about NPV (N_Port Virtualization) are correct? (Choose two.)

Accepted Answer

NPV allows a NPV switch to forward traffic from multiple host ports to the core switch via a few uplinks.. NPV (N_Port Virtualization) allows a NPV switch to aggregate traffic from multiple host ports (NP ports) and forward it to the core switch via a few uplinks (NP uplinks). This reduces the number of physical connections required between edge and core switches, simplifying cabling and management.

Answer

NPV uses Inter-VSAN Routing (IVR) to forward traffic between VSANs.

Answer

NPV requires FCoE encapsulation.

Answer

NPV allows a single physical port to have multiple N-port IDs.

Question 12

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

Accepted Answer

The VLAN-to-VNI mapping is missing under the VLAN configuration. The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

Answer

MTU mismatch on the underlay network

Answer

Anycast gateway is not configured on the leaf

Answer

BGP EVPN peers are not established

Question 13

An engineer is troubleshooting a Cisco UCS B-Series blade that fails to boot. The service profile is associated and the boot policy is set to 'SAN Boot'. The storage administrator confirms the LUN is properly mapped to the WWPN. Which check should the engineer perform first?

Accepted Answer

Verify that the UCS Fabric Interconnect is connected to the SAN switches. Since the service profile is associated, the boot policy is set to SAN Boot, and the LUN is properly mapped to the WWPN, the most likely cause is a physical or Layer 2 connectivity issue between the UCS Fabric Interconnect and the SAN switches. Without this link, the fabric interconnect cannot forward FCP frames to the storage array, preventing the blade from discovering the boot LUN. Verifying this connection is the logical first step before investigating other configuration or zoning issues.

Answer

Reboot the chassis to reinitialize the IOM

Answer

Check that the vHBA has a dynamic WWPN assigned

Answer

Ensure the local disk is set as primary boot device

Question 14

Which TWO commands are used to verify Fibre Channel connectivity issues on a Cisco MDS switch? (Choose two.)

Accepted Answer

show interface fc . The 'show interface fc ' command displays detailed status, errors, and operational state of a specific Fibre Channel interface, which is essential for diagnosing physical or link-level connectivity issues on a Cisco MDS switch. Option E is correct because the 'show flogi database' command lists all N-port (host) logins registered with the fabric via the Fabric Login (FLOGI) process, verifying that end devices have successfully established a session with the switch and are visible in the Fibre Channel fabric.

Answer

show ip interface brief

Answer

show mac address-table

Answer

show vlan

Question 15

An administrator needs to configure a Fibre Channel SAN to support two separate departments that must not see each other's storage. Each department has its own set of initiators and targets. Which technology should be used?

Accepted Answer

VSANs (Virtual SANs). VSANs (Virtual SANs) provide isolation within a single Fibre Channel fabric by partitioning the physical SAN into multiple logical SANs. Each department's initiators and targets are placed in separate VSANs, ensuring they cannot see each other's storage traffic or devices, which meets the requirement for complete separation without additional physical hardware.

Answer

Port channels

Answer

NPV

Answer

IVR (Inter-VSAN Routing)

Question 16

A Fibre Channel switch is experiencing high latency on a specific ISL. The link is operating at 16 Gbps and has high utilization. Which action will most likely reduce latency?

Accepted Answer

Add an additional ISL and configure a port channel.. Adding an additional ISL and configuring a port channel increases the aggregate bandwidth between the two switches, reducing per-link utilization and thus lowering queuing latency. This directly addresses the root cause—high utilization on a single 16 Gbps link—by distributing traffic across multiple physical links, which also provides load balancing and redundancy.

Answer

Reduce the buffer credit count.

Answer

Enable trunking on the ISL.

Answer

Disable flow control on the ISL.

Question 17

A storage administrator notices that a newly deployed Fibre Channel initiator cannot log in to the SAN switch. The switch is configured for NPV mode. Which condition is most likely causing the issue?

Accepted Answer

NPIV is disabled on the upstream switch.. In NPV mode, the switch acts as a transparent proxy, forwarding FLOGI requests from initiators to the upstream NPIV-capable core switch. If NPIV is disabled on the upstream switch, it will reject the FLOGI because it cannot register multiple N-Port IDs on a single physical link, causing the initiator to fail login.

Answer

The initiator is not using a device alias.

Answer

The switch is configured for NPIV mode instead of NPV.

Answer

The switch port is configured as an E port.

Question 18

A large enterprise data center uses Cisco ACI with a spine-leaf architecture. The security team requires that all traffic between the Web and App tiers be inspected by a firewall, but traffic within the same tier should be allowed directly. The Web EPG is in VRF PROD with Bridge Domain WEB-BD, and App EPG is in VRF PROD with Bridge Domain APP-BD. The firewall is connected as a service graph device in a different VRF (FW-VRF). The administrator configures a contract between Web and App EPGs that redirects traffic through the firewall. However, after implementation, traffic from Web to App is not passing through the firewall; instead, it is forwarded directly. The contract is applied correctly. What is the most likely cause?

Accepted Answer

The firewall is in a different VRF; service graphs require the firewall to be in the same VRF as the endpoints or use a shared VRF with appropriate route leaking.. In Cisco ACI, service graphs redirect traffic through firewall devices by inserting the firewall as a Layer 4-Layer 7 device in the traffic path. However, the service graph device must reside in the same VRF as the consumer and provider EPGs, or a shared VRF with proper route leaking must be configured, because ACI uses VRF isolation to enforce policy-based redirect (PBR). Since the firewall is in FW-VRF while both EPGs are in VRF PROD, the leaf switches cannot redirect traffic to the firewall without a common routing context, causing the contract to bypass the firewall and forward traffic directly.

Answer

The firewall is not reachable from the leaf switches due to a routing issue.

Answer

The contract filter is misconfigured, allowing direct communication without redirection.

Answer

The contract is applied only to intra-EPG traffic, not inter-EPG traffic.

Question 19

Which of the following correctly describes the role of Fabric Interconnects A and B in a UCS domain?

Accepted Answer

FI A and FI B provide redundancy and can be configured in an active-active or active-standby manner.. Fabric Interconnects A and B operate in an active-active or active-standby configuration to provide redundancy for both management and data traffic. Each FI connects to all IOMs, but each IOM is associated with one FI (fabric A or B) for failover.

Answer

FI A is for UCS Manager access only, and FI B is for storage traffic only.

Answer

FI A handles all management traffic, while FI B handles all data traffic.

Answer

FI A and FI B are used in a standalone mode, each managing separate sets of blades.

Question 20

Which feature in NX-OS allows for direct API calls to the switch for automation purposes?

Accepted Answer

NX-API. NX-API (option A) is the correct answer because it is the native NX-OS feature that exposes a RESTful API interface, allowing direct HTTP/HTTPS calls (e.g., GET, POST, PUT, DELETE) to the switch for automation and programmability. This enables tools like Ansible, Postman, or custom scripts to send structured data (JSON/XML) to configure, monitor, and manage the switch without requiring CLI parsing or SSH sessions.

Answer

Python scripting

Answer

Bash shell

Answer

SNMP