350-601 Network — 10 Questions

Question 1

A network engineer is configuring a VPC on a pair of Nexus 9000 switches. Which command is required to synchronize the configuration between the VPC peers?

Accepted Answer

vpc domain .. The `vpc domain ` command creates the VPC domain, which enables VPC functionality and allows configuration synchronization between peers via Cisco Fabric Services (CFS) over the peer-link. Without defining the VPC domain, there is no VPC context, and synchronization cannot occur. The peer-keepalive (B) is for liveness detection, not synchronization. The other options are related but not directly responsible for synchronizing configurations.

Answer

auto-recovery.

Answer

peer-keepalive destination <ip>.

Answer

role preempt.

Question 2

Which three components are part of the Cisco ACI policy model for defining a tenant's network? (Choose three.)

Accepted Answer

Bridge Domain. In the Cisco ACI policy model, a tenant's network is defined by a hierarchical construct that includes the Tenant itself as the top-level container, the VRF (also called a Private Network) which provides Layer 3 isolation and routing context, and the Bridge Domain which represents a Layer 2 forwarding domain with a unique MAC address table and optional subnet(s). These three components work together to create a complete network segment within a tenant, while EPGs and Contracts are used for policy and connectivity rather than defining the network itself.

Answer

EPG

Answer

Contract

Question 3

An engineer is configuring MST (Multiple Spanning Tree) on a Nexus switch. Which three statements about MST are correct? (Choose three.)

Accepted Answer

VLAN-to-instance mapping is configured using the 'instance' command under MST configuration.. The 'instance' command under MST configuration mode (e.g., 'instance 1 vlan 10-20') explicitly maps VLANs to a specific MST instance. Option B is correct: The Internal Spanning Tree (IST), which is instance 0, carries all VLANs that are not explicitly mapped to any other MST instance. Option D is correct: MST BPDUs use the standard spanning-tree destination MAC address 01-80-C2-00-00-00, not the PVST+ MAC. Option C is false because MST supports multiple spanning-tree instances. Option E is false because it only mentions revision number and name; forming an MST region also requires a consistent VLAN-to-instance mapping across all switches.

Answer

MST supports only a single spanning-tree instance per switch.

Answer

MST BPDUs are sent with a destination MAC address of 01-80-C2-00-00-00.

Question 4

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

Accepted Answer

The VLAN-to-VNI mapping is missing under the VLAN configuration. The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

Answer

MTU mismatch on the underlay network

Answer

Anycast gateway is not configured on the leaf

Answer

BGP EVPN peers are not established

Question 5

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

Accepted Answer

VRF. The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default. This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Answer

Context (default)

Answer

Application-profile

Answer

Global

Question 6

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

Accepted Answer

Set OSPF priority to 0 on the interface. Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

Answer

Set OSPF priority to 255 on the interface

Answer

Change the OSPF network type to point-to-point

Answer

Configure the interface as passive under OSPF

Question 7

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

Accepted Answer

Upgrade the secondary vPC peer first, then the primary. In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

Answer

Upgrade both switches simultaneously using ISSU

Answer

Reload both switches to a previous version, then upgrade

Answer

Upgrade the primary vPC peer first, then the secondary

Question 8

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

Accepted Answer

The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract. In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.

Answer

The contract is applied but not enforced due to a configuration error

Answer

The VRF has a default route that bypasses contract enforcement

Answer

A preferred group contract is applied to the VRF

Question 9

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

Accepted Answer

The underlay network provides IP connectivity between VTEPs. The VXLAN underlay network (typically an IP-based fabric using protocols like OSPF or IS-IS) provides IP connectivity between VTEPs, enabling them to encapsulate and decapsulate VXLAN packets. Without this underlay reachability, VTEPs cannot communicate, making it a foundational requirement for VXLAN operation.

Answer

VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

Answer

VXLAN uses a 32-bit network identifier (VNI)

Answer

The control plane is responsible for actual data forwarding

Question 10

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Accepted Answer

Both switches must run the same NX-OS software version. Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.

Answer

Both switches must use the same routing protocol

Answer

The peer-keepalive link must be carried over the peer-link