350-601 Practice Exam 64 — 20 Questions

Question 1

An engineer notices that after a reboot of one UCS fabric interconnect (FI-A), the server traffic fails over to FI-B but never fails back to FI-A even after FI-A is fully operational. Which configuration change would ensure automatic failback?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the 'Backup Link' policy to 'Active/Active'. The 'Backup Link' policy in UCS determines how uplink ports behave during failover and failback. Setting it to 'Active/Active' allows both FIs to actively forward traffic, and when the failed FI recovers, the server traffic automatically fails back because the policy does not designate a permanent primary or standby role. This ensures symmetric traffic flow without manual intervention.

Answer

Change the 'Backup Link' policy to 'Primary/Secondary'

Answer

Change the 'Backup Link' policy to 'Active/Standby'

Answer

Change the 'Backup Link' policy to 'Failover Only'

Question 2

An engineer is configuring a Cisco UCS Manager deployment. The goal is to enforce the organization's security policy by limiting administrative access based on job roles. Which two actions should the engineer take? (Select two.)

Accepted Answer

Implement role-based access control using LDAP groups mapped to roles.. C is correct because integrating LDAP groups with RBAC allows the organization to enforce security policies by mapping directory groups to UCS roles, centralizing authentication and authorization. This approach ensures that administrative access is limited based on job roles without managing local users, aligning with the goal of role-based access control.

Answer

Disable the default password policy for all local users.

Answer

Use the default maintenance policy for all service profiles.

Answer

Create a local user with the admin role and assign it to all service profiles.

Question 3

A company wants to automate backup of running-configurations for 200 Nexus switches. Which solution provides the best combination of reliability and version history?

Accepted Answer

Ansible playbook with the nxos_config backup option. An Ansible playbook with the nxos_config backup option is the best solution because it provides idempotent, version-controlled backups of running-configurations across 200 Nexus switches. The nxos_config module automatically creates a timestamped backup file on the Ansible control node, ensuring both reliability through automated, consistent execution and a built-in version history via the backup files. This approach scales efficiently without requiring manual intervention or fragile scripting.

Answer

Manual backup via CLI

Answer

Custom Python script using TFTP

Answer

A cron job that SCPs config to a server

Question 4

A network engineer needs to replace a failed UCS B-Series blade server with a new blade of the same model. The original blade had a custom service profile with specific vNIC and vHBA settings. What is the most efficient method to apply the same configuration to the new blade without manual reconfiguration?

Accepted Answer

Disassociate the existing service profile from the failed blade and associate it with the new blade.. UCS service profiles abstract hardware configuration. By disassociating the profile from the failed blade and associating it with the new blade, all settings (vNICs, vHBAs, policies) are automatically applied, supporting stateless computing.

Answer

Create a new service profile from scratch for the new blade.

Answer

Use Cisco IMC Supervisor to import the configuration from the failed blade.

Answer

Manually configure the new blade using UCS Manager GUI with the same settings as the original blade.

Question 5

A network engineer is troubleshooting inter-VLAN routing on a Cisco Nexus 9000 switch. The switch is configured with VLAN 10 and VLAN 20. Hosts in VLAN 10 cannot ping hosts in VLAN 20. The engineer checks the VLAN ACL (VACL) applied to VLAN 10 and finds the following configuration:

ip access-list VACL-FILTER
  10 permit ip any any
...
vlan access-map VACL-MAP 10
  match ip address VACL-FILTER
  action forward
vlan filter VACL-MAP vlan-list 10

What is the most likely reason for the connectivity failure?

Accepted Answer

The VACL does not apply to traffic routed through the SVI; a Router ACL (RACL) must be used instead.. VACLs filter traffic at the ingress of a VLAN, but they only apply to traffic that is bridged within the same VLAN. When traffic is routed between VLANs (inter-VLAN routing), it passes through the SVI (Switch Virtual Interface), and VACLs do not inspect routed traffic. To filter inter-VLAN routed traffic, a Router ACL (RACL) must be applied to the SVI. Since the hosts in VLAN 10 cannot ping VLAN 20, the VACL on VLAN 10 is not blocking the traffic; rather, the traffic is being routed and is not subject to the VACL, so the failure is likely due to a missing or misconfigured RACL or routing issue.

Answer

The access-list permits all, so the VACL should work; perhaps the access-map is missing a default action.

Answer

The 'vlan filter' command is applied to VLAN 10 only, but the access-map is misconfigured.

Answer

The VACL is applied only to VLAN 10, so traffic from VLAN 20 to VLAN 10 is not filtered, but this should not cause a failure.

Question 6

Refer to the exhibit. A UCS B-Series blade shows a failed power supply. The blade is currently running. Which action should the engineer take to replace the power supply without causing service disruption?

Accepted Answer

Replace the failed power supply while the blade remains powered on.. UCS B-Series blades use a shared chassis power infrastructure with N+1 redundancy. The failed power supply can be hot-swapped while the blade remains powered on, as the remaining power supplies in the chassis will continue to provide power without interruption. No blade isolation or shutdown is required, as the chassis power subsystem is designed for concurrent maintenance.

Answer

Replace the power supply only after the blade is isolated from the fabric.

Answer

Replace the failed power supply in the chassis without affecting the blade.

Answer

Shut down the blade, replace the power supply, then power on.

Question 7

A Nexus switch configured with 'feature nxapi' and 'nxapi https port 443' fails to respond to REST API calls from a monitoring system. The engineer can ping the management IP. Which troubleshooting step should be taken first?

Accepted Answer

Verify that the NX-API process is running with 'show nxapi'. The first step when NX-API is configured but not responding is to verify that the NX-API process is actually running. The 'feature nxapi' command enables the feature, but the NX-API service may not have started due to a configuration error, resource issue, or process crash. The 'show nxapi' command displays the operational status of the NX-API service, including whether it is listening on the configured port (443 in this case). Since the engineer can ping the management IP, basic network connectivity exists, so the issue is likely at the application layer.

Answer

Check if the monitoring system is using the correct HTTP method

Answer

Review the switch's ACL for the management VRF

Answer

Confirm that the SSL certificate is trusted

Question 8

An administrator is deploying a new application in a Cisco ACI fabric. The application requires multicast traffic between end hosts. Which configuration is necessary for multicast in ACI?

Accepted Answer

Create a multicast policy in the bridge domain.. In Cisco ACI, multicast forwarding is enabled at the bridge domain level using a multicast policy. This policy configures the necessary IGMP snooping and multicast group membership for the fabric, allowing end hosts to receive multicast traffic without requiring PIM on the leaf switches. Option C is correct because the bridge domain multicast policy is the required configuration for multicast in ACI.

Answer

Enable PIM on the leaf switches.

Answer

Configure a multicast group in the EPG.

Answer

Use IGMP snooping only.

Question 9

Which THREE statements accurately describe FCIP (Fibre Channel over IP) configurations on Cisco MDS switches?

Accepted Answer

FCIP uses VE_port (Virtual E_port) interfaces to connect to the FC fabric. FCIP encapsulates Fibre Channel frames into IP packets and uses VE_ports (Virtual E_ports) to connect separate FC fabrics over an IP network. VE_ports behave like standard E_ports but operate over an FCIP tunnel, allowing Fibre Channel fabric services to extend across the IP link.

Answer

FCIP requires IPsec for security over public networks

Answer

FCIP compression reduces the latency of the IP transport

Question 10

A network engineer is configuring VLAN ACLs on a Cisco Nexus 9000 switch to enforce traffic filtering between VLANs. Which configuration step is required to apply a VACL to a VLAN?

Accepted Answer

Use the 'vlan filter' command in global configuration mode.. VACLs on Cisco Nexus 9000 switches are applied using the 'vlan filter' command in global configuration mode, which references a VLAN access-map. This command binds the access-map to a specific VLAN, enabling Layer 2 traffic filtering between VLANs without requiring a Layer 3 interface.

Answer

Apply the VACL to a Layer 3 interface using 'ip access-group'.

Answer

Apply the VACL to a physical port using 'mac access-group'.

Answer

Define a VLAN access-map and then apply it under the VLAN configuration.

Question 11

In an ACI fabric, an EPG is configured with a contract that allows HTTP traffic to an external network. The external network is reachable via a Layer 3 Outside. However, HTTP traffic from the EPG fails. What is the most likely cause?

Accepted Answer

The L3Out and the EPG are in different VRFs. In Cisco ACI, communication between an EPG and an external network via a Layer 3 Outside requires both to be in the same VRF. If the EPG and the L3Out are in different VRFs, the contract cannot be enforced, and traffic will fail even if the contract allows HTTP. The VRF provides the routing and policy enforcement boundary for the contract.

Answer

The subject action is set to deny

Answer

The filter uses the wrong direction

Answer

The contract is applied to the consumer EPG instead of the provider

Question 12

Which TWO are important considerations when using Cisco UCS Central for multi-domain management? (Select TWO.)

Accepted Answer

Global policies can be defined in UCS Central and applied per domain with local overrides.. Cisco UCS Central allows administrators to define global policies that can be applied across multiple UCS domains, while still permitting local overrides at the UCS Manager level. This hierarchical policy model provides centralized control without sacrificing the flexibility needed for domain-specific configurations, such as unique VLANs or boot policies.

Answer

UCS Central requires separate licensing per managed server.

Answer

All domains must have identical hardware and firmware versions.

Answer

Local UCS Manager policies are always overridden by UCS Central policies.

Question 13

A data center architect is designing a SAN with two MDS switches using VSANs. Which method ensures traffic isolation between departments while allowing sharing of a tape library?

Accepted Answer

Create separate VSANs for each department and a shared VSAN for the tape library with inter-VSAN routing (IVR).. It uses separate VSANs to isolate each department's traffic at Layer 2, while inter-VSAN routing (IVR) selectively allows the tape library to be shared across VSANs without merging them. IVR enables controlled communication between specific initiators and targets in different VSANs, preserving isolation for all other traffic.

Answer

Use FCIP tunnels for each department.

Answer

Create separate VSANs and merge them for the tape library.

Answer

Use one VSAN for all departments and one zone for each department.

Question 14

An engineer needs to collect streaming telemetry from a Nexus 9000 switch. Which two protocols can be used to transmit telemetry data to a collector? (Choose two.)

Accepted Answer

gNMI. gNMI (gRPC Network Management Interface) and gRPC are both correct because they are the primary protocols used for streaming telemetry on Nexus 9000 switches. gNMI defines a standard model-driven telemetry subscription mechanism over gRPC, while gRPC provides the underlying high-performance transport for streaming telemetry data to collectors.

Answer

NETCONF

Answer

HTTP

Answer

SNMP traps

Question 15

A Cisco MDS switch is configured with fabric binding to restrict which switches can join the fabric. A new switch is added, but it fails to establish an E-port connection. What is the most likely cause?

Accepted Answer

The new switch's WWN is not included in the fabric binding configuration. Fabric binding on a Cisco MDS switch uses the fabric-binding database to enforce a whitelist of allowed switch WWNs. When a new switch attempts to bring up an E-port, the principal switch checks the new switch's WWN against this database. If the WWN is not present, the E-port is automatically isolated, preventing the switch from joining the fabric. This is the most direct cause of the failure described.

Answer

Incompatible SFP modules between the switches

Answer

Incorrect zoning configuration on the existing switch

Answer

The new switch has a higher priority than the principal switch

Question 16

Which Cisco Data Center Network Manager component is used for centralized fabric management and automation of Nexus switches?

Accepted Answer

DCNM. Cisco Data Center Network Manager (DCNM) is the centralized management platform specifically designed for fabric management, provisioning, and automation of Nexus switches in data center environments. It provides a single pane of glass for configuring, monitoring, and troubleshooting Nexus-based fabrics, including VXLAN EVPN, Cisco ACI, and traditional SAN/Nexus environments.

Answer

Cisco ISE

Answer

Prime Infrastructure

Answer

APIC

Question 17

Which TWO statements about Cisco TrustSec in a data center environment are true? (Choose two.)

Accepted Answer

Cisco ISE can dynamically assign SGTs to endpoints during authentication.. Cisco ISE can dynamically assign Security Group Tags (SGTs) to endpoints during authentication via 802.1X or MAB, enabling role-based access control. This is a core TrustSec feature where the SGT is propagated to the network infrastructure to enforce policies.

Answer

TrustSec requires MACsec encryption on all links to function.

Answer

SGTs are assigned based on the source IP address of the traffic.

Answer

TrustSec policies are enforced at Layer 3 only.

Question 18

Refer to the exhibit. A server connected to interface fc1/3 on the MDS switch cannot log in to the fabric. The server's HBA WWPN is 10:00:00:00:c9:2b:1a:62. What is the most likely reason for the login failure?

Accepted Answer

Interface fc1/3 is not assigned to VSAN 100. Interface fc1/3 is not assigned to VSAN 100, as shown in the exhibit (the interface is in VSAN 1 by default or another VSAN). Without being in the correct VSAN, the server's FLOGI (Fabric Login) request is processed in the wrong VSAN context, preventing it from logging into the fabric and accessing the intended storage targets. Assigning the interface to the correct VSAN is mandatory for successful fabric login.

Answer

NPIV is disabled on the port

Answer

The server's WWPN is not in the active zone set

Answer

The link speed is mismatched between switch and HBA

Question 19

An organization has deployed Cisco UCS Central to manage multiple UCS domains. A global service profile template is created in UCS Central. When a local UCS domain administrator tries to modify the service profile derived from this global template in UCS Manager, what happens?

Accepted Answer

The local administrator cannot modify the profile; it is read-only.. Global service profiles from UCS Central are read-only in local UCS Manager. They can only be modified in UCS Central, ensuring consistency across domains.

Answer

The local administrator can modify the profile if granted specific RBAC permissions.

Answer

The local administrator can modify the profile, but changes are overwritten by UCS Central after 5 minutes.

Answer

The local administrator can modify the profile, and changes sync back to UCS Central.

Question 20

An engineer is configuring a UCS service profile for PXE boot. The server must obtain an IP address from a DHCP server and then download the OS image from a TFTP server. Which boot policy parameters must be configured?

Accepted Answer

Add a LAN boot entry and select the appropriate vNIC for PXE.. PXE boot requires specifying the LAN boot option with the appropriate vNIC. In UCS, the boot policy can include a PXE boot entry that references a vNIC. DHCP and TFTP servers are configured externally; the boot policy just needs to enable PXE on the correct interface.

Answer

Configure the boot policy to use iSCSI boot.

Answer

Specify the DHCP server IP and TFTP server IP in the boot policy.

Answer

Select the SAN boot option and specify the WWPN.