350-601 Network Practice Test 13 — 15 Questions

Question 1

In ACI, which object defines the logical separation of traffic within a tenant, analogous to a VLAN in traditional networking, and is associated with a VRF?

Accepted Answer

Bridge Domain. In Cisco ACI, a Bridge Domain (BD) defines the Layer 2 boundary and provides logical separation of traffic within a tenant, analogous to a VLAN in traditional networking. Each BD is associated with a VRF (Layer 3 context) to enable IP forwarding, and it encapsulates traffic using VXLAN (VNID) rather than 802.1Q VLAN tags.

Answer

VRF

Answer

Application Profile

Answer

EPG

Question 2

A network engineer is designing a spine-leaf fabric with oversubscription ratio 3:1. Each leaf switch has 48x10G host-facing ports and 4x40G uplinks to spines. What is the oversubscription ratio per leaf?

Accepted Answer

3:1. The oversubscription ratio per leaf is calculated by dividing the total host-facing bandwidth by the total uplink bandwidth. Each leaf has 48x10G host ports (480G total) and 4x40G uplinks (160G total). 480G / 160G = 3:1, matching the design target.

Answer

2:1

Answer

4:1

Answer

1.2:1

Question 3

Which NX-OS feature ensures that vPC member ports on both peers are configured identically to prevent inconsistencies that could lead to traffic black-holing?

Accepted Answer

vPC consistency check. The vPC consistency check ensures that critical parameters (e.g., VLAN configuration, STP settings, interface properties) are identical on both vPC peer switches. If a mismatch is detected, the vPC member port is suspended to prevent traffic black-holing caused by asymmetric forwarding. This mechanism is enforced by the Cisco NX-OS vPC Type-1 and Type-2 consistency checks.

Answer

vPC peer-link

Answer

vPC peer-keepalive

Answer

vPC auto-recovery

Question 4

In an ACI fabric, a contract between two EPGs uses a filter that permits TCP port 443. The provider EPG is configured with a VMM domain integration. Which statement about the contract's effect is true?

Accepted Answer

Traffic from the consumer EPG to the provider EPG on TCP 443 is allowed.. In Cisco ACI, contracts define unidirectional communication from the consumer EPG to the provider EPG. The filter permitting TCP port 443 allows traffic from the consumer to the provider. The VMM domain integration does not alter this contract behavior; it only manages virtual machine connectivity. Therefore, only traffic from the consumer EPG to the provider EPG on TCP 443 is permitted.

Answer

Both directions are allowed for TCP 443.

Answer

Traffic from the provider EPG to the consumer EPG on TCP 443 is allowed.

Answer

The VMM domain overrides the contract and permits all traffic.

Question 5

An engineer needs to enable equal-cost multipath (ECMP) routing in a spine-leaf fabric using OSPF. Which OSPF feature allows load balancing across multiple equal-cost paths?

Accepted Answer

maximum-paths command. The maximum-paths command is the OSPF feature that directly controls the number of equal-cost routes installed in the routing table, enabling ECMP load balancing across multiple equal-cost paths. By default, OSPF installs only one best path, but increasing the maximum-paths value allows the router to use up to that many equal-cost routes simultaneously.

Answer

OSPF network type

Answer

OSPF area type

Answer

OSPF cost metric

Question 6

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets for transport over the IP network?

Accepted Answer

VTEP. The VXLAN Tunnel Endpoint (VTEP) is the component responsible for performing encapsulation and decapsulation of Ethernet frames into UDP packets for transport over the IP network. It sits at the edge of the VXLAN overlay and maps tenant traffic to VXLAN segments by adding a VXLAN header (including the VNI) and an outer UDP/IP header. This process allows Layer 2 frames to traverse a Layer 3 underlay network.

Answer

VXLAN Gateway

Answer

VXLAN Tunnel

Answer

VNI

Question 7

In the context of ACI L3Out, which object is used to advertise external networks into the ACI fabric and is associated with a VRF?

Accepted Answer

L3Out. In ACI, an L3Out is the logical construct that provides connectivity from the ACI fabric to external Layer 3 networks. It is associated with a VRF to define the routing context, and it is the object under which external networks are advertised into the fabric via route redistribution or static routes. The L3Out contains the external EPGs and the protocol profiles (e.g., OSPF, BGP, EIGRP) that control the advertisement.

Answer

Bridge Domain

Answer

Contract

Answer

External EPG

Question 8

A data center network uses MST to interoperate with a legacy switch that supports only RSTP. Which MST configuration parameter must match between the MST region and the legacy switch?

Accepted Answer

No parameters need to match; the boundary port runs RSTP.. When an MST region connects to a legacy switch running only RSTP, the boundary port on the MST switch automatically runs RSTP to interoperate. No MST-specific parameters (region name, revision number, or VLAN-to-instance mapping) need to match because the legacy switch is not part of the MST region; it simply runs RSTP on the link.

Answer

Region name

Answer

Revision number

Answer

VLAN-to-instance mapping

Question 9

An engineer is configuring a new VLAN on a Nexus switch that is part of a vPC pair. Which step is mandatory to ensure the VLAN is created on both vPC peers?

Accepted Answer

Create the VLAN on both peers manually.. In a vPC domain, VLANs are not automatically synchronized between peers. The engineer must manually create the VLAN on both vPC peers to ensure it is present in the local VLAN database on each switch. This is because vPC relies on consistent local configuration on both devices for proper operation, and there is no built-in mechanism to propagate VLAN definitions from one peer to the other.

Answer

Use vPC peer-gateway to propagate VLANs.

Answer

Create the VLAN on the secondary peer only; the primary will learn via STP.

Answer

Create the VLAN on the primary peer only; it will sync automatically.

Question 10

Which TWO statements are true regarding VXLAN BUM traffic handling? (Choose two.)

Accepted Answer

Ingress replication requires the ingress VTEP to maintain a list of remote VTEPs.. In ingress replication, the ingress VTEP must know all remote VTEPs in the VXLAN segment to unicast-encapsulate and send BUM traffic to each one individually. This list is typically learned via the control plane (e.g., BGP EVPN) or statically configured. Without this list, the ingress VTEP cannot replicate BUM frames to the correct remote destinations.

Answer

Ingress replication scales better than multicast in large fabrics.

Answer

Multicast-based replication uses IGMP snooping to build replication lists.

Answer

Ingress replication is only supported with OSPF underlay.

Question 11

An engineer is deploying an ACI fabric with VMM integration for VMware vSphere. Which THREE components must be configured to enable dynamic EPG assignment based on VM attributes? (Choose three.)

Accepted Answer

VMM domain. The VMM domain (Option B) is the core integration object that defines the VMware vCenter connection and policy enforcement boundary. It must be configured to enable the APIC to discover VMs and their attributes, which is the prerequisite for dynamic EPG assignment based on VM properties such as VM name, OS type, or custom tags.

Answer

APIC cluster IP

Answer

L3Out configuration

Question 12

Which TWO commands are used on NX-OS to verify vPC status and consistency? (Choose two.)

Accepted Answer

show vpc consistency-parameters. The 'show vpc' command displays the overall vPC status, including peer link and keepalive status, while 'show vpc consistency-parameters' verifies that both peers have matching configurations (e.g., STP, VLAN, MTU) to prevent traffic disruption. These two commands are essential for validating vPC operational health and configuration consistency.

Answer

show port-channel summary

Answer

show running-config vpc

Answer

show vpc role

Question 13

In a spine-leaf architecture using eBGP, which of the following is the recommended BGP configuration for the spine switches?

Accepted Answer

Unique ASN for each spine switch. In eBGP-based spine-leaf architectures, each spine switch should use a unique ASN to enable BGP’s loop prevention mechanism (the AS_PATH attribute). This ensures that leaf switches can detect and discard routes received from two different spines that originated from the same leaf, preventing routing loops and allowing load balancing across multiple spines. A unique ASN per spine is the recommended design per Cisco’s best practices for data center fabrics.

Answer

No BGP; use OSPF instead

Answer

Single ASN for all spines

Answer

Same ASN as leaves

Question 14

Which VPC component is used to send Layer 2 control plane traffic between peer switches?

Accepted Answer

VPC peer-link. The VPC peer-link is the special port channel that carries Layer 2 control plane traffic (such as BPDUs, HSRP hellos, and IGMP queries) between the two VPC peer switches. It ensures that both peers have a consistent view of the Layer 2 topology and can synchronize state for protocols like STP and vPC. Without the peer-link, control plane traffic would not be exchanged, breaking the VPC domain's ability to operate as a single logical switch.

Answer

VPC consistency check

Answer

VPC peer keepalive

Answer

VPC member port

Question 15

In VXLAN, which method of handling BUM traffic replicates packets to remote VTEPs only when there is a known receiver behind that VTEP?

Accepted Answer

Ingress replication. Ingress replication is the correct method because in VXLAN, the ingress VTEP replicates BUM (Broadcast, Unknown unicast, Multicast) traffic and sends a copy to each remote VTEP only if that VTEP has at least one receiver (i.e., a host or VM) that has joined the relevant multicast group or is reachable via the VNI. This avoids unnecessary replication to VTEPs with no interested receivers, optimizing bandwidth and reducing load on the underlay network.

Answer

Egress replication

Answer

Multicast-based replication

Answer

Head-end replication