350-601 Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. The interface shows CRC errors. What is the most likely cause of these errors?

Accepted Answer

Faulty SFP or fiber cable.. CRC errors indicate that frames are being received with invalid checksums, which is typically caused by physical-layer issues such as a faulty SFP module or damaged fiber cable. These errors occur when the cyclic redundancy check computed by the receiver does not match the CRC appended by the sender, pointing to corruption during transmission. In Fibre Channel storage networks, a faulty SFP or cable is the most common root cause of CRC errors, as they directly affect signal integrity.

Answer

Insufficient buffer credits for the distance.

Answer

The port is configured as F port but should be E port.

Answer

Speed mismatch between the ports.

Question 2

A Nexus switch experiences high CPU utilization due to excessive ICMP traffic. An engineer applies a CoPP policy that includes a class matching ICMP with a drop action. After applying, legitimate OSPF hello packets are also being dropped. What is the most likely cause?

Accepted Answer

OSPF packets match the default class which has a drop action. When a CoPP policy is applied, traffic that does not match any explicit class-map falls into the default class. If the default class has a drop action, all unmatched traffic—including OSPF hello packets (which use IP protocol 89)—will be dropped. The class-map matching ICMP (typically based on protocol or DSCP) does not match OSPF, so OSPF packets are handled by the default class, causing the observed behavior.

Answer

The CoPP policy is applied to the wrong interface

Answer

The CoPP policy rate-limits all traffic including OSPF below its needed rate

Answer

The class-map matches multiple protocols including OSPF

Question 3

On a Cisco MDS 9700, an engineer configures an FC port channel with 4 member interfaces. The connected storage array also supports port channels. Which load-balancing algorithm provides the best distribution of I/O when the array uses multiple LUNs per target?

Accepted Answer

Source FC ID (OXID) and destination FC ID (RXID). The OXID (Originator Exchange ID) and RXID (Responder Exchange ID) provide per-exchange granularity, which distributes I/O across all member links in the FC port channel. When multiple LUNs are presented under a single target (same DID), algorithms based on SID/DID or WWPN would hash all traffic to the same link, causing imbalance. The OXID/RXID algorithm ensures that each Fibre Channel exchange (e.g., each SCSI command) can be load-balanced independently, maximizing throughput.

Answer

Source ID (SID) and Destination ID (DID)

Answer

Source and destination port ID

Answer

Source and destination WWPN

Question 4

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions.

Answer

LDAP

Answer

RADIUS

Answer

Kerberos

Question 5

A storage array supports RAID-5, RAID-6, and RAID-10. The array has 12 disks of equal size. The requirement is to maximize usable capacity while tolerating up to two simultaneous disk failures without data loss. Which RAID level should be chosen?

Accepted Answer

RAID-6. RAID-6 can tolerate two disk failures with parity overhead of 2 disks, providing high usable capacity. RAID-5 tolerates only one failure; RAID-10 tolerates multiple failures but capacity is 50%.

Answer

RAID-10

Answer

RAID-5

Answer

RAID-0

Question 6

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

Accepted Answer

Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.. Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

Answer

Assign the 'read-only' role to the user within the tenant.

Answer

Create a separate VRF for each tenant and assign admin to that VRF.

Answer

Assign the 'tenant-admin' role to the user globally.

Question 7

A company uses Cisco TrustSec in its data center to enforce segmentation. Servers in VLAN 10 (Finance) should only communicate with servers in VLAN 20 (ERP) via an application gateway. Which TrustSec component is used to assign a Security Group Tag (SGT) to traffic from the Finance servers?

Accepted Answer

Identity Services Engine (ISE) as the authentication and policy server. In Cisco TrustSec, the Identity Services Engine (ISE) acts as the authentication and policy server that assigns Security Group Tags (SGTs) to endpoints or traffic based on identity and policy. ISE uses 802.1X, MAB, or web authentication to identify the Finance servers and then dynamically assigns the appropriate SGT, which is then used for segmentation enforcement.

Answer

MACsec encryption on the links

Answer

802.1X port-based authentication

Answer

VLAN ACL (VACL) on the switch

Question 8

An engineer is deploying FCoE on a Cisco Nexus 9000v switch in a converged network. The storage array is connected via native Fibre Channel to an MDS switch, and the MDS is connected to the Nexus using an FCoE link. The engineer creates a virtual Fibre Channel (VFC) interface on the Nexus, binds it to an Ethernet interface, and maps VSAN 200 to VLAN 200. The MDS side has an FCoE port configured and enabled. Servers connected to the Nexus with FCoE initiators can successfully log into the storage targets, but performance is very poor and intermittent. The engineer checks for drops on all interfaces and finds none. The engineer also verifies that the FCoE VLAN is not blocked by spanning tree. What is the most likely cause of the performance issue?

Accepted Answer

The Ethernet interface MTU is set to 1500 instead of 2500.. FCoE requires a jumbo MTU (typically 2500 bytes) to encapsulate Fibre Channel frames without fragmentation. An MTU of 1500 forces fragmentation and reassembly, causing retransmissions and poor performance. Option B is incorrect because the engineer verified that the FCoE VLAN is not blocked by spanning tree. Option C is incorrect because servers can log in, indicating FCoE is enabled on the MDS interface. Option D is incorrect because the VFC binding was already verified as correct.

Answer

The FCoE VLAN is blocking spanning tree.

Answer

The MDS has not enabled FCoE on the interface.

Answer

The VFC interface is not bound to the correct port-channel.

Question 9

Which VLAN range is reserved by default on Cisco Nexus switches?

Accepted Answer

VLAN 1. VLAN 1 is the default VLAN on Cisco Nexus switches and cannot be deleted or renamed. It is automatically created on all switches and carries all untagged traffic by default, making it a reserved VLAN that is always present in the VLAN database.

Answer

VLAN 1002-1005

Answer

VLAN 3968-4047

Answer

VLAN 4094

Question 10

An engineer needs to automate a repetitive configuration task on a Nexus switch. Which method is most suitable for programmatic access?

Accepted Answer

NX-API. NX-API provides a RESTful interface that allows programmatic access to Nexus switches using HTTP/HTTPS methods (GET, POST, DELETE) with JSON or XML payloads. This makes it the most suitable method for automating repetitive configuration tasks because it supports modern scripting languages (Python, Ansible) and enables idempotent, structured configuration changes without requiring interactive CLI sessions.

Answer

FTP file transfer

Answer

CLI scripting with Tcl

Answer

SNMP v3