350-601 Network Practice Test 16 — 15 Questions

Question 1

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets for transport over the IP network?

Accepted Answer

VTEP. The VXLAN Tunnel Endpoint (VTEP) is the component responsible for performing encapsulation and decapsulation of Ethernet frames into UDP packets for transport over the IP network. It sits at the edge of the VXLAN overlay and maps tenant traffic to VXLAN segments by adding a VXLAN header (including the VNI) and an outer UDP/IP header. This process allows Layer 2 frames to traverse a Layer 3 underlay network.

Answer

VXLAN Gateway

Answer

VXLAN Tunnel

Answer

VNI

Question 2

In the context of ACI L3Out, which object is used to advertise external networks into the ACI fabric and is associated with a VRF?

Accepted Answer

L3Out. In ACI, an L3Out is the logical construct that provides connectivity from the ACI fabric to external Layer 3 networks. It is associated with a VRF to define the routing context, and it is the object under which external networks are advertised into the fabric via route redistribution or static routes. The L3Out contains the external EPGs and the protocol profiles (e.g., OSPF, BGP, EIGRP) that control the advertisement.

Answer

Bridge Domain

Answer

Contract

Answer

External EPG

Question 3

A data center network uses MST to interoperate with a legacy switch that supports only RSTP. Which MST configuration parameter must match between the MST region and the legacy switch?

Accepted Answer

No parameters need to match; the boundary port runs RSTP.. When an MST region connects to a legacy switch running only RSTP, the boundary port on the MST switch automatically runs RSTP to interoperate. No MST-specific parameters (region name, revision number, or VLAN-to-instance mapping) need to match because the legacy switch is not part of the MST region; it simply runs RSTP on the link.

Answer

Region name

Answer

Revision number

Answer

VLAN-to-instance mapping

Question 4

An engineer is configuring a new VLAN on a Nexus switch that is part of a vPC pair. Which step is mandatory to ensure the VLAN is created on both vPC peers?

Accepted Answer

Create the VLAN on both peers manually.. In a vPC domain, VLANs are not automatically synchronized between peers. The engineer must manually create the VLAN on both vPC peers to ensure it is present in the local VLAN database on each switch. This is because vPC relies on consistent local configuration on both devices for proper operation, and there is no built-in mechanism to propagate VLAN definitions from one peer to the other.

Answer

Use vPC peer-gateway to propagate VLANs.

Answer

Create the VLAN on the secondary peer only; the primary will learn via STP.

Answer

Create the VLAN on the primary peer only; it will sync automatically.

Question 5

Which TWO statements are true regarding VXLAN BUM traffic handling? (Choose two.)

Accepted Answer

Ingress replication requires the ingress VTEP to maintain a list of remote VTEPs.. Option A is correct because with ingress replication the ingress VTEP itself must perform the head-end replication, so it needs to know the full list of remote VTEPs participating in the VXLAN VNI and send a copy of each BUM frame to every one of them. Option B is correct because multicast-based replication relies on the underlay delivering BUM traffic to a multicast group, which requires a multicast routing protocol such as PIM (typically PIM-SM) in the underlay, along with IGMP for group membership. Option C is not correct because ingress replication does not scale better than multicast in large fabrics; it consumes more ingress VTEP bandwidth and requires larger VTEP lists, whereas multicast offloads replication to the network. Option D is not correct because IGMP snooping is a Layer 2 optimization for constraining multicast flooding, not the mechanism that builds the remote VTEP replication list; multicast-based VXLAN uses a configured multicast group per VNI. Option E is not correct because ingress replication is independent of the underlay routing protocol and can run over OSPF, IS-IS, BGP, or static routing.

Answer

Ingress replication scales better than multicast in large fabrics.

Answer

Multicast-based replication uses IGMP snooping to build replication lists.

Answer

Ingress replication is only supported with OSPF underlay.

Question 6

Which TWO commands are used on NX-OS to verify vPC status and consistency? (Choose two.)

Accepted Answer

show vpc consistency-parameters. Option A, 'show vpc consistency-parameters', is correct because it displays the consistency parameters (such as STP, MTU, and VLAN settings) that must match between vPC peer switches, and it flags any type-1 or type-2 mismatches that would prevent the vPC from coming up. Option C, 'show vpc', is correct because it gives the overall vPC status, including the vPC domain ID, peer status, peer-link status, and the state of each vPC (up/down) along with the consistency status. Option B, 'show port-channel summary', only shows port-channel and member-link states and does not report vPC peer or consistency information. Option D, 'show running-config vpc', merely displays the vPC configuration in the running configuration rather than verifying operational status or consistency. Option E, 'show vpc role', shows the role (primary/secondary) and priority but does not verify vPC status or consistency parameters.

Answer

show port-channel summary

Answer

show running-config vpc

Answer

show vpc role

Question 7

Which VPC component is used to send Layer 2 control plane traffic between peer switches?

Accepted Answer

VPC peer-link. The VPC peer-link is the special port channel that carries Layer 2 control plane traffic (such as BPDUs, HSRP hellos, and IGMP queries) between the two VPC peer switches. It ensures that both peers have a consistent view of the Layer 2 topology and can synchronize state for protocols like STP and vPC. Without the peer-link, control plane traffic would not be exchanged, breaking the VPC domain's ability to operate as a single logical switch.

Answer

VPC consistency check

Answer

VPC peer keepalive

Answer

VPC member port

Question 8

An engineer is configuring a VXLAN EVPN fabric. Which address family must be enabled under BGP to exchange MAC/VTEP reachability information?

Accepted Answer

address-family l2vpn evpn. In a VXLAN EVPN fabric, BGP is used as the control plane to exchange MAC and VTEP reachability information. The correct address family for this is 'l2vpn evpn' (address-family l2vpn evpn), which carries EVPN NLRI (Network Layer Reachability Information) as defined in RFC 7432. This enables the distribution of MAC addresses, IP-to-MAC bindings, and VTEP endpoints across the overlay network.

Answer

address-family ipv4 unicast

Answer

address-family l2vpn vpls

Answer

address-family vpnv4

Question 9

In ACI, which construct defines the set of endpoints that can communicate based on contracts?

Accepted Answer

EPG. In Cisco ACI, an Endpoint Group (EPG) is the logical grouping of endpoints (such as servers, VMs, or storage) that share the same policy requirements. Contracts define the rules for communication between EPGs, specifying which EPGs can talk to each other and what services (e.g., HTTP, SSH) are allowed. Thus, the EPG construct directly defines the set of endpoints that can communicate based on contracts.

Answer

VRF

Answer

Bridge Domain

Answer

Tenant

Question 10

Which of the following is a requirement for VPC peer keepalive to function correctly?

Accepted Answer

Must be a Layer 3 interface with unique VRF. VPC peer keepalive requires a Layer 3 interface with a unique VRF to ensure that keepalive messages are sent over a dedicated, isolated path that is independent of the peer-link. This prevents the keepalive from being disrupted by issues on the peer-link and allows the VPC peers to detect failures even when the peer-link is down. The keepalive uses UDP port 3200 and must be routed through a separate VRF to avoid conflicts with the management or default routing tables.

Answer

Must use the same IP subnet as peer-link

Answer

Must be a direct Layer 2 connection

Answer

Must be in the same VLAN as peer-link

Question 11

In ACI, when integrating with VMware vSphere, which component is used to automatically push port group configurations to virtual switches?

Accepted Answer

VMM domain. The VMM (Virtual Machine Manager) domain in ACI is the integration point with VMware vSphere. It automatically pushes port group configurations to virtual switches by leveraging the VMware vCenter API, ensuring that ACI network policies are consistently applied to the hypervisor's virtual switches without manual intervention.

Answer

APIC

Answer

Tenant

Answer

L3Out

Question 12

Which MST configuration parameter must match across all switches in the same MST region?

Accepted Answer

Region name, revision, and VLAN mapping. In MST (Multiple Spanning Tree) protocol, switches in the same MST region must share the same region name, revision number, and VLAN-to-instance mapping. These parameters define the region boundary; if any differ, switches will treat each other as being in different regions, breaking MST interoperability and causing them to run separate spanning trees (e.g., PVST+).

Answer

Port cost

Answer

Root bridge

Answer

Bridge priority

Question 13

In VXLAN, what is the role of the VNI in the overlay network?

Accepted Answer

Identifies the overlay network segment. The VNI (VXLAN Network Identifier) is a 24-bit field in the VXLAN header that uniquely identifies a Layer 2 overlay network segment, analogous to a VLAN ID in traditional networking. It allows multiple tenants or broadcast domains to coexist over a shared underlay network by isolating traffic at the overlay level.

Answer

Identifies the VTEP

Answer

Encapsulation type

Answer

Specifies the underlay VRF

Question 14

In ACI, what is the purpose of a contract?

Accepted Answer

Allow or deny traffic between EPGs. In Cisco ACI, a contract is a policy construct that defines how communication is allowed or denied between Endpoint Groups (EPGs). Contracts specify the subjects, filters, and actions (permit or deny) that govern traffic flows, enabling granular security and segmentation within the fabric. Without a contract, EPGs in different bridge domains or VRFs cannot communicate by default.

Answer

Isolate tenants

Answer

Define routing between VRF

Answer

Provide external connectivity

Question 15

Which VXLAN EVPN route type is used for discovering VTEPs and building the BUM forwarding tree?

Accepted Answer

Type 3. B is correct because VXLAN EVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route) is specifically used to advertise the VXLAN tunnel endpoint (VTEP) IP addresses and the VNI (VXLAN Network Identifier) for BUM (Broadcast, Unknown unicast, Multicast) traffic. This route type enables the discovery of remote VTEPs and builds the multicast forwarding tree (either via ingress replication or PIM-based multicast) necessary for BUM traffic delivery in a VXLAN EVPN fabric.

Answer

Type 1

Answer

Type 2

Answer

Type 5