350-601 Network — 20 Questions

Question 1

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VRF. The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default. This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Answer

Context (default)

Answer

Application-profile

Answer

Global

Question 2

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

Accepted Answer

The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract. In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.

Answer

The contract is applied but not enforced due to a configuration error

Answer

The VRF has a default route that bypasses contract enforcement

Answer

A preferred group contract is applied to the VRF

Question 3

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Accepted Answer

Both switches must run the same NX-OS software version. Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.

Answer

Both switches must use the same routing protocol

Answer

The peer-keepalive link must be carried over the peer-link

Question 4

A data center design requires Layer 2 extension between two sites using OTV. The network engineer notices that MAC addresses from Site A are not learned at Site B. OTV adjacency is up, and both sites have the same overlay interface configured. Which configuration issue is most likely the cause?

Accepted Answer

The site VLAN is not allowed on the OTV join interface.. D is correct because the OTV join interface must have the site VLAN allowed; if the site VLAN is not permitted on the join interface, the OTV edge device cannot send or receive encapsulated traffic for that VLAN, preventing MAC address learning between sites even though the OTV adjacency is up.

Answer

The OTV control group is misconfigured on one side.

Answer

The spanning tree root bridge is different at each site.

Answer

The multicast group range for the overlay does not match.

Question 5

Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?

Accepted Answer

Enable the address-family l2vpn evpn under the BGP configuration.. In VXLAN EVPN, BGP is used as the control plane to exchange MAC and IP reachability information. Enabling the address-family l2vpn evpn under BGP configuration is mandatory to advertise EVPN routes (type-2 and type-3) between VTEPs, which is the foundation of the centralized anycast gateway model.

Answer

Enable IGMP snooping on all VLANs extended over VXLAN.

Answer

Set the VXLAN destination UDP port to 8472.

Answer

Create an NVE interface with a loopback interface as the source.

Question 6

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 1 is not allowed on the trunk, so untagged frames are dropped.. The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1. This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Answer

The spanning-tree port type edge trunk is causing BPDU guard to block the port.

Answer

The port is in err-disabled state due to a loop.

Answer

The port is administratively down.

Question 7

You are a network engineer at a financial institution. The company has two data centers: DC1 and DC2, connected via a dark fiber link. Each data center has a pair of Nexus 7000 switches in a vPC configuration. The dark fiber link connects to a port on each Nexus 7000 pair using a Layer 2 port-channel. The requirement is to extend VLAN 100 between the two data centers for a critical application that requires a stretched Layer 2 domain. The current configuration has the port-channel on both sides set to mode 'active' with LACP. VLAN 100 is allowed on the trunk. The application servers report intermittent connectivity issues, with some packets being dropped. Upon inspection, you notice that the MAC address table on the Nexus 7000 in DC1 shows the MAC address of the server in DC2 on the dark fiber port-channel interface, but also on a local access port connected to a different server in the same VLAN. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Spanning Tree Protocol is not blocking one of the redundant paths, creating a loop.. The MAC address table showing the same MAC address on both the dark fiber port-channel and a local access port indicates a Layer 2 loop. In a vPC environment with a Layer 2 extension between data centers, Spanning Tree Protocol (STP) should block one of the redundant paths to prevent loops. If STP fails to block the appropriate port, frames loop, causing MAC address flapping and intermittent packet drops.

Answer

The dark fiber link is experiencing high latency, causing MAC address timeouts.

Answer

LACP is misconfigured on one side, causing the port-channel to operate as individual links.

Answer

There is an asymmetric routing issue between the data centers.

Question 8

Arrange the steps to configure a vPC domain on a pair of Cisco Nexus switches.

Accepted Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports. vPC requires feature vPC, then domain creation, keepalive link, peer-link, and member ports.

Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure peer-link, Step 4: Configure keepalive link, Step 5: Add member ports

Answer

Step 1: Create vPC domain, Step 2: Enable feature vPC, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports

Answer

Step 1: Enable feature vPC, Step 2: Configure keepalive link, Step 3: Create vPC domain, Step 4: Configure peer-link, Step 5: Add member ports

Question 9

Match each Cisco data center technology to its primary purpose.

Accepted Answer

VDC: Enables partitioning a single physical switch into multiple logical switches.. VDC partitions switches; VPC provides redundant LAG; FEX extends fabric ports; OTV extends Layer 2 over Layer 3.

Answer

VPC: Enables partitioning a single physical switch into multiple logical switches.

Answer

FEX: Allows a link aggregation group to terminate on two upstream switches for redundancy.

Question 10

After adding a new spine switch to a VXLAN EVPN fabric with OSPF underlay, some leaf switches experience routing instability. Which action could resolve the instability?

Accepted Answer

Increase the OSPF cost on the leaf-to-spine links.. When a new spine switch is added to a VXLAN EVPN fabric with an OSPF underlay, the leaf switches may experience routing instability because the new spine advertises routes with a lower cost, causing traffic to shift abruptly. Increasing the OSPF cost on the leaf-to-spine links makes those paths less preferred, stabilizing the routing table by preventing flapping and ensuring a more gradual convergence.

Answer

Configure OSPF neighbor authentication.

Answer

Decrease the OSPF hello timer.

Answer

Enable OSPF route summarization on the leaves.

Question 11

In a VXLAN EVPN multi-tier design, which feature ensures traffic between leaf switches takes the optimal path without hair-pinning through a spine?

Accepted Answer

ECMP. C is correct because Equal-Cost Multipath (ECMP) in a VXLAN EVPN multi-tier design allows leaf switches to load-balance traffic across multiple equal-cost spine paths, ensuring that traffic between leaf switches takes the most direct route without being forced to hair-pin through a spine. ECMP leverages the underlying IP fabric's routing to forward VXLAN-encapsulated packets over any available spine, avoiding suboptimal forwarding that would occur if a single spine were used as a relay.

Answer

Anycast gateway

Answer

Type-2 routes

Answer

ARP suppression

Question 12

Which three EVPN route types are essential for VXLAN EVPN operation in a typical data center fabric? (Choose three.)

Accepted Answer

Type-3 (Inclusive Multicast Ethernet Tag). Type-3 (Inclusive Multicast Ethernet Tag) routes are essential for VXLAN EVPN because they enable BUM traffic replication across the underlay network by advertising the VNI and multicast group mapping, allowing VTEPs to join the correct multicast tree for flooding unknown unicast, broadcast, and multicast frames.

Answer

Type-4 (Ethernet Segment)

Answer

Type-1 (Ethernet Auto-Discovery)

Question 13

When configuring BGP EVPN on spine switches functioning as route reflectors, which two address families must be configured? (Choose two.)

Accepted Answer

address-family l2vpn evpn. B is correct because BGP EVPN (Ethernet VPN) uses the L2VPN address family (l2vpn evpn) to carry MAC/VXLAN routing information between spine and leaf switches. This address family is mandatory for EVPN control plane operation in a VXLAN fabric, enabling MAC address learning and advertisement via MP-BGP.

Answer

address-family link-state

Answer

address-family ipv6 unicast

Answer

address-family vpnv4

Question 14

Refer to the exhibit. Which VLANs are allowed on the VPC peer-link?

Accepted Answer

VLANs 1-100 only. In a vPC domain, the peer-link carries only specific VLANs that are allowed on the trunk. By default, the peer-link is configured as a trunk allowing VLANs 1-100, and the native VLAN is not included in this allowed list because the peer-link uses a dedicated VLAN for control traffic (typically VLAN 4094) and does not forward native VLAN traffic. Option C is correct because the default allowed VLAN list on a vPC peer-link is VLANs 1-100, as shown in the exhibit.

Answer

VLANs 1-100 and native VLAN

Answer

Only VLAN 1

Answer

All VLANs (1-4094)

Question 15

A network engineer is troubleshooting VXLAN connectivity between two VTEPs. The source VTEP is configured with `nve1` and member VNI 10000. The `show nve peers` command shows the remote VTEP IP but the status is 'Init'. What is a likely cause?

Accepted Answer

The multicast group is not reachable.. The 'Init' status in the output of 'show nve peers' indicates that the VXLAN tunnel endpoint (VTEP) has learned the remote VTEP IP address (likely via BGP EVPN or static configuration) but is unable to complete the tunnel establishment. In VXLAN multicast mode, the underlay multicast group is used for BUM traffic and for VTEP discovery. If the multicast group is not reachable (e.g., due to missing PIM configuration, incorrect RP, or firewall filtering), the source VTEP cannot receive the multicast join or data from the remote VTEP, leaving the peer stuck in 'Init' state.

Answer

The remote VTEP is not configured with the same VNI.

Answer

The MTU is too low.

Answer

The VRF is mismatched between the VTEPs.

Question 16

In an EVPN-VXLAN fabric, a network engineer notices that MAC addresses learned from an external router are not being advertised as EVPN type-2 routes. The external router is connected to a leaf switch via a Layer 3 port. Which additional configuration is needed on the leaf switch?

Accepted Answer

Configure `ip arp evpn` on the Layer 3 interface.. When an external router is connected via a Layer 3 port, the leaf switch learns the router's MAC address through ARP, not through a VLAN. To advertise this MAC as an EVPN type-2 route, the `ip arp evpn` command must be configured on the Layer 3 interface. This command enables the switch to synchronize ARP entries into the EVPN BGP control plane, allowing MAC/IP advertisement for directly connected hosts on routed interfaces.

Answer

Configure `redistribute host-routes` under the BGP address-family l2vpn evpn.

Answer

Configure `evpn` under the VLAN interface associated with the external router's VLAN.

Answer

Configure `routing-config` under BGP to enable both MAC-VRF and IP-VRF.

Question 17

A data center switch has multiple access ports configured with spanning-tree portfast. A new server is connected to one of these ports and immediately causes a network loop. What is the most likely cause?

Accepted Answer

The port is not configured with BPDUguard.. Spanning Tree Protocol (STP) PortFast immediately transitions a port to the forwarding state, bypassing the listening and learning phases. However, PortFast alone does not protect against loops if a rogue device (like a server) inadvertently connects two switch ports or sends BPDUs. BPDUguard must be explicitly configured on the port to disable it upon receiving any BPDU, preventing a loop. Without BPDUguard, the switch will process the BPDU and may re-enter STP convergence, potentially causing a loop if the server is misconfigured or bridging traffic.

Answer

The portfast feature is disabled by default on the switch.

Answer

The server sends BPDUs.

Answer

The switch is running MSTP instead of PVST+.

Question 18

A network engineer is configuring a Fabric Extender (FEX) to connect to a parent switch. Which best practice should be followed for FEX host interfaces?

Accepted Answer

Enable Virtual Port Channel (vPC) on the parent switch.. Enabling Virtual Port Channel (vPC) on the parent switch is a best practice for FEX host interfaces because it allows the FEX to be dual-homed to two separate parent switches, providing link-level redundancy and active-active forwarding. Without vPC, the FEX would rely on a single parent switch, creating a single point of failure and potentially causing traffic black-holing during a parent switch failure.

Answer

Configure all host interfaces as trunk ports.

Answer

Use the same FEX ID for redundancy.

Answer

Use LACP for the FEX uplinks.

Answer

Disable spanning-tree on FEX host interfaces.

Question 19

In a vPC domain, a consistency check failure is observed for the vPC keepalive link. What is the impact on the vPC domain operation?

Accepted Answer

The vPC domain will continue to operate but with reduced reliability.. The vPC keepalive link is used as a secondary heartbeat to detect dual-active scenarios when the peer link fails. A consistency check failure on the keepalive link does not directly affect data forwarding; the vPC domain continues to operate, but the loss of this redundancy mechanism reduces reliability because the switches can no longer reliably detect a split-brain condition without the peer link.

Answer

The vPC peer link will be suspended.

Answer

The secondary switch will shutdown its vPC member ports.

Answer

Both switches will independently forward traffic via the vPC peer link.

Question 20

A multicast application requires that all receivers join the same group using PIM sparse mode. Which router is responsible for forwarding traffic from the source to the RP?

Accepted Answer

First-hop router. In PIM sparse mode, the first-hop router (the router directly connected to the multicast source) is responsible for encapsulating the source's multicast traffic in unicast PIM register messages and forwarding them to the rendezvous point (RP). This process establishes the initial path and triggers the RP to join the source-specific tree (SPT) toward the source.

Answer

Rendezvous point (RP)

Answer

Last-hop router

Answer

Source-specific router