350-601 Network — 20 Questions

Question 1

A network engineer is configuring a VPC on a pair of Nexus 9000 switches. Which command is required to synchronize the configuration between the VPC peers?

Accepted Answer

vpc domain .. The `vpc domain ` command creates the VPC domain, which enables VPC functionality and allows configuration synchronization between peers via Cisco Fabric Services (CFS) over the peer-link. Without defining the VPC domain, there is no VPC context, and synchronization cannot occur. The peer-keepalive (B) is for liveness detection, not synchronization. The other options are related but not directly responsible for synchronizing configurations.

Answer

auto-recovery.

Answer

peer-keepalive destination <ip>.

Answer

role preempt.

Question 2

Which three components are part of the Cisco ACI policy model for defining a tenant's network? (Choose three.)

Accepted Answer

Bridge Domain. In the Cisco ACI policy model, a tenant's network is defined by a hierarchical construct that includes the Tenant itself as the top-level container, the VRF (also called a Private Network) which provides Layer 3 isolation and routing context, and the Bridge Domain which represents a Layer 2 forwarding domain with a unique MAC address table and optional subnet(s). These three components work together to create a complete network segment within a tenant, while EPGs and Contracts are used for policy and connectivity rather than defining the network itself.

Answer

EPG

Answer

Contract

Question 3

An engineer is configuring MST (Multiple Spanning Tree) on a Nexus switch. Which three statements about MST are correct? (Choose three.)

Accepted Answer

VLAN-to-instance mapping is configured using the 'instance' command under MST configuration.. The 'instance' command under MST configuration mode (e.g., 'instance 1 vlan 10-20') explicitly maps VLANs to a specific MST instance. Option B is correct: The Internal Spanning Tree (IST), which is instance 0, carries all VLANs that are not explicitly mapped to any other MST instance. Option D is correct: MST BPDUs use the standard spanning-tree destination MAC address 01-80-C2-00-00-00, not the PVST+ MAC. Option C is false because MST supports multiple spanning-tree instances. Option E is false because it only mentions revision number and name; forming an MST region also requires a consistent VLAN-to-instance mapping across all switches.

Answer

MST supports only a single spanning-tree instance per switch.

Answer

MST BPDUs are sent with a destination MAC address of 01-80-C2-00-00-00.

Question 4

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

Accepted Answer

The VLAN-to-VNI mapping is missing under the VLAN configuration. The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

Answer

MTU mismatch on the underlay network

Answer

Anycast gateway is not configured on the leaf

Answer

BGP EVPN peers are not established

Question 5

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

Accepted Answer

VRF. The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default. This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Answer

Context (default)

Answer

Application-profile

Answer

Global

Question 6

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

Accepted Answer

Set OSPF priority to 0 on the interface. Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

Answer

Set OSPF priority to 255 on the interface

Answer

Change the OSPF network type to point-to-point

Answer

Configure the interface as passive under OSPF

Question 7

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

Accepted Answer

Upgrade the secondary vPC peer first, then the primary. In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

Answer

Upgrade both switches simultaneously using ISSU

Answer

Reload both switches to a previous version, then upgrade

Answer

Upgrade the primary vPC peer first, then the secondary

Question 8

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

Accepted Answer

The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract. In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.

Answer

The contract is applied but not enforced due to a configuration error

Answer

The VRF has a default route that bypasses contract enforcement

Answer

A preferred group contract is applied to the VRF

Question 9

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

Accepted Answer

The underlay network provides IP connectivity between VTEPs. The VXLAN underlay network (typically an IP-based fabric using protocols like OSPF or IS-IS) provides IP connectivity between VTEPs, enabling them to encapsulate and decapsulate VXLAN packets. Without this underlay reachability, VTEPs cannot communicate, making it a foundational requirement for VXLAN operation.

Answer

VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

Answer

VXLAN uses a 32-bit network identifier (VNI)

Answer

The control plane is responsible for actual data forwarding

Question 10

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Accepted Answer

Both switches must run the same NX-OS software version. Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.

Answer

Both switches must use the same routing protocol

Answer

The peer-keepalive link must be carried over the peer-link

Question 11

Refer to the exhibit. An engineer is configuring a server-facing interface on a Nexus switch. The server is running VMware ESXi with multiple virtual machines in VLANs 10, 20, and 30. After applying the configuration, the ESXi host reports that it cannot communicate on VLAN 30. Which configuration change should be made?

Accepted Answer

Create VLAN 30 in the global VLAN database. VLAN 30 must exist in the global VLAN database before it can be used on any interface. Even though the interface configuration allows VLAN 30 as a trunked VLAN, the switch will not forward traffic for a VLAN that has not been created globally. Without the 'vlan 30' command in global configuration mode, the VLAN is not present in the switch's VLAN database, and the interface will not pass traffic for that VLAN.

Answer

Remove the 'spanning-tree port type edge trunk' command

Answer

Change the native VLAN to 30

Answer

Configure the port as an access port in VLAN 30

Question 12

Refer to the exhibit. A VXLAN VNI (10030) is operationally down. What is the most likely cause?

Accepted Answer

The VLAN associated with VNI 10030 is not configured or mapped. VXLAN VNI 10030 is operationally down because the VLAN that maps to this VNI is either not created or not associated with the VNI under the NVE interface. In Cisco NX-OS, a VNI becomes operationally up only when the corresponding VLAN exists and is properly mapped via the `member vni 10030 associate-vrf` or `member vni 10030` command under the NVE interface. Without this mapping, the NVE cannot forward traffic for that VNI, leaving it in a down state.

Answer

The source interface loopback0 is not up

Answer

The NVE mode should be L2VPN instead of L3VPN

Answer

The multicast group 239.1.1.1 is not reachable

Question 13

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

Accepted Answer

Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.. When the vPC peer link fails, the peer-keepalive link is used by the secondary switch to detect that the primary is still alive and to avoid becoming the primary (which would cause a split-brain scenario). Using a dedicated management interface or a separate VRF ensures the keepalive messages are isolated from the data plane and remain reachable even if the peer link goes down, allowing the secondary to correctly keep its vPC member ports in a suspended state and maintain convergence.

Answer

Disable vPC on both switches and reconfigure the port channels.

Answer

Reconfigure the vPC domain with a lower priority on the secondary switch.

Answer

Increase the vPC peer-keepalive hold timeout to 5 seconds.

Question 14

A data center design requires Layer 2 extension between two sites using OTV. The network engineer notices that MAC addresses from Site A are not learned at Site B. OTV adjacency is up, and both sites have the same overlay interface configured. Which configuration issue is most likely the cause?

Accepted Answer

The site VLAN is not allowed on the OTV join interface.. D is correct because the OTV join interface must have the site VLAN allowed; if the site VLAN is not permitted on the join interface, the OTV edge device cannot send or receive encapsulated traffic for that VLAN, preventing MAC address learning between sites even though the OTV adjacency is up.

Answer

The OTV control group is misconfigured on one side.

Answer

The spanning tree root bridge is different at each site.

Answer

The multicast group range for the overlay does not match.

Question 15

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

Accepted Answer

Priority Flow Control (PFC) with a no-drop queue for iSCSI.. Priority Flow Control (PFC) is the IEEE 802.1Qbb mechanism designed to provide lossless behavior for specific traffic classes, such as iSCSI storage traffic, on Nexus 9000 switches. By creating a no-drop queue for iSCSI, PFC uses pause frames on a per-priority basis to prevent buffer overflow, ensuring zero packet loss required by storage protocols.

Answer

Tail drop with DSCP-based classification.

Answer

Weighted Round Robin (WRR) with three queues.

Answer

Policing at the ingress and marking at the egress.

Question 16

An organization is deploying a new leaf-spine fabric with Cisco ACI. The requirement is to allow inter-tenant communication between two EPGs in different tenants. Which configuration object is necessary to enable this communication?

Accepted Answer

A shared contract between the two EPGs.. In Cisco ACI, inter-tenant communication between EPGs in different tenants requires a shared contract. A contract defines the rules (filters) that permit traffic between EPGs, and when it is marked as 'shared,' it can be consumed by EPGs across tenant boundaries. This allows the provider EPG in one tenant to expose services to a consumer EPG in another tenant without merging the tenants' VRFs or bridge domains.

Answer

A common VRF that spans both tenants.

Answer

A filter that permits the required traffic.

Answer

A bridge domain that connects both EPGs.

Question 17

Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?

Accepted Answer

Enable the address-family l2vpn evpn under the BGP configuration.. In VXLAN EVPN, BGP is used as the control plane to exchange MAC and IP reachability information. Enabling the address-family l2vpn evpn under BGP configuration is mandatory to advertise EVPN routes (type-2 and type-3) between VTEPs, which is the foundation of the centralized anycast gateway model.

Answer

Enable IGMP snooping on all VLANs extended over VXLAN.

Answer

Set the VXLAN destination UDP port to 8472.

Answer

Create an NVE interface with a loopback interface as the source.

Question 18

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 1 is not allowed on the trunk, so untagged frames are dropped.. The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1. This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Answer

The spanning-tree port type edge trunk is causing BPDU guard to block the port.

Answer

The port is in err-disabled state due to a loop.

Answer

The port is administratively down.

Question 19

You are a network engineer at a financial institution. The company has two data centers: DC1 and DC2, connected via a dark fiber link. Each data center has a pair of Nexus 7000 switches in a vPC configuration. The dark fiber link connects to a port on each Nexus 7000 pair using a Layer 2 port-channel. The requirement is to extend VLAN 100 between the two data centers for a critical application that requires a stretched Layer 2 domain. The current configuration has the port-channel on both sides set to mode 'active' with LACP. VLAN 100 is allowed on the trunk. The application servers report intermittent connectivity issues, with some packets being dropped. Upon inspection, you notice that the MAC address table on the Nexus 7000 in DC1 shows the MAC address of the server in DC2 on the dark fiber port-channel interface, but also on a local access port connected to a different server in the same VLAN. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Spanning Tree Protocol is not blocking one of the redundant paths, creating a loop.. The MAC address table showing the same MAC address on both the dark fiber port-channel and a local access port indicates a Layer 2 loop. In a vPC environment with a Layer 2 extension between data centers, Spanning Tree Protocol (STP) should block one of the redundant paths to prevent loops. If STP fails to block the appropriate port, frames loop, causing MAC address flapping and intermittent packet drops.

Answer

The dark fiber link is experiencing high latency, causing MAC address timeouts.

Answer

LACP is misconfigured on one side, causing the port-channel to operate as individual links.

Answer

There is an asymmetric routing issue between the data centers.

Question 20

Arrange the steps to configure a vPC domain on a pair of Cisco Nexus switches.

Accepted Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports. vPC requires feature vPC, then domain creation, keepalive link, peer-link, and member ports.

Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure peer-link, Step 4: Configure keepalive link, Step 5: Add member ports

Answer

Step 1: Create vPC domain, Step 2: Enable feature vPC, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports

Answer

Step 1: Enable feature vPC, Step 2: Configure keepalive link, Step 3: Create vPC domain, Step 4: Configure peer-link, Step 5: Add member ports