350-601 Network Practice Test 17 — 15 Questions

Question 1

What does the oversubscription ratio in a spine-leaf fabric represent?

Accepted Answer

Ratio of server bandwidth to leaf uplink bandwidth. In a spine-leaf fabric, the oversubscription ratio specifically compares the total bandwidth available from the servers (leaf southbound ports) to the total uplink bandwidth from the leaf to the spine (leaf northbound ports). This ratio determines how much potential congestion exists when multiple servers contend for uplink capacity, directly impacting performance in a non-blocking or oversubscribed design.

Answer

Ratio of spine to leaf bandwidth

Answer

Ratio of total fabric bandwidth to total server bandwidth

Answer

Number of spine switches per leaf

Question 2

Which TWO statements are true about VPC consistency checks? (Choose two.)

Accepted Answer

The 'show vpc consistency-parameters' command displays the status.. Option C is correct because the 'show vpc consistency-parameters' command is the standard NX-OS command used to display the consistency status of global, interface, and VLAN-level parameters across vPC peers, showing which parameters are consistent or inconsistent. Option E is correct because when a type-1 (critical) parameter is inconsistent between vPC peers, the affected vPC member port is suspended (brought down) to prevent traffic loops or black-holing, while type-2 inconsistencies only trigger a warning. Option A is incorrect because not all parameters must match exactly — only type-1 parameters must match, whereas type-2 parameters can differ and merely generate a warning. Option B is incorrect because vPC consistency checking is always enabled and runs automatically; it is not an optional feature that is disabled by default. Option D is incorrect because consistency checks run continuously (periodically and on configuration changes), not solely when the peer-link comes up.

Answer

All configuration parameters must match exactly on both peers.

Answer

Consistency check is optional and disabled by default.

Answer

Consistency check is performed only when the peer-link comes up.

Question 3

A data center spine-leaf architecture is designed to ensure low latency and high bandwidth. Which of the following best describes the role of the leaf switches in this topology?

Accepted Answer

Leaf switches connect to servers and provide access to the network, while spine switches provide the aggregation and routing fabric.. In a spine-leaf architecture, leaf switches serve as the access layer that connects directly to servers, storage, and other endpoints. They forward traffic to spine switches, which provide the Layer 3 routing fabric and ensure any-to-any connectivity with predictable latency. This design eliminates the need for Spanning Tree Protocol (STP) and allows for efficient east-west traffic flow.

Answer

Leaf switches are used only for management traffic and do not forward data-plane traffic.

Answer

Leaf switches provide the Layer 3 routing core and connect to external networks.

Answer

Leaf switches interconnect all spine switches to provide any-to-any connectivity.

Question 4

A network engineer is planning to implement VPC in a Cisco Nexus data center. Which two statements about VPC components are true? (Choose two.)

Accepted Answer

VPC consistency checks ensure that both peers have identical configurations for VPC member ports.. Option B is correct because vPC consistency checks (Type 1 and Type 2) verify that both vPC peers have matching configurations for vPC member ports, such as VLANs, allowed VLAN lists, MTU, and STP settings, preventing forwarding inconsistencies. Option C is correct because the vPC peer-keepalive link is a dedicated Layer 3 path (typically over a management or out-of-band network) used to monitor peer liveness and detect peer failure, allowing the surviving peer to take over if the peer-link fails. Option A is incorrect because vPC member ports must be configured on both vPC peers, not just one, to form the port channel. Option D is incorrect because vPC does not require an IGP between peers to exchange MAC addresses; MAC address synchronization occurs over the vPC peer-link via CFS. Option E is incorrect because the vPC peer-link carries both control-plane traffic and data-plane traffic for orphan ports and for traffic that must traverse the peer link when a member link fails.

Answer

VPC member ports can be configured on only one of the VPC peers to avoid loops.

Answer

VPC requires an IGP routing protocol between the peers to exchange MAC addresses.

Answer

The VPC peer-link carries only control-plane traffic between the VPC peers.

Question 5

Which three components are part of the VXLAN overlay architecture? (Choose three.)

Accepted Answer

VTEP (Virtual Tunnel Endpoint). Option A (VTEP, Virtual Tunnel Endpoint) is correct because VTEPs are the devices that perform VXLAN encapsulation and de-encapsulation, mapping frames into VXLAN packets with a VXLAN header and outer UDP/IP transport. Option D (IP transport network, underlay) is correct because VXLAN requires an IP-routed underlay to carry the encapsulated UDP packets between VTEPs, providing reachability for the overlay tunnels. Option E (VNI, VXLAN Network Identifier) is correct because the VNI is the 24-bit field in the VXLAN header that identifies the specific overlay segment, allowing up to roughly 16 million logical networks. Option B (VPC peer-link) is not a VXLAN overlay component; it is a Cisco vPC mechanism for multichassis link aggregation and does not define the overlay architecture. Option C (spine switches only in VXLAN) is incorrect because VXLAN can be deployed in various topologies and is not limited to spine switches only; leaf switches and other VTEP-capable devices also participate.

Answer

VPC peer-link

Answer

Spine switches only in VXLAN

Question 6

An engineer is deploying a VXLAN EVPN fabric with a pair of Nexus 9000 leaf switches acting as VTEPs. The design requires that the fabric support Layer 2 extension for a VLAN that must be stretched between two racks. The engineer wants to minimize the size of the MAC address table on the leaf switches by avoiding flooding of unknown unicast traffic. Which EVPN route type should be used to advertise MAC address reachability so that remote leaf switches can install MAC addresses without data-plane learning?

Accepted Answer

Type-2 MAC/IP Advertisement route. Type-2 MAC/IP Advertisement routes are the EVPN mechanism for advertising host MAC addresses. When a leaf learns a MAC, it generates a Type-2 route that remote leaves use to program their MAC tables. This eliminates the need for data-plane learning and unknown unicast flooding, directly addressing the requirement to minimize MAC table size and control L2 extension.

Answer

Type-3 Inclusive Multicast Ethernet Tag route

Answer

Type-5 IP Prefix route

Answer

Type-4 Ethernet Segment route

Question 7

A network engineer is implementing a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer wants to optimize BUM (Broadcast, Unknown Unicast, Multicast) traffic replication by using the fabric's native multicast capabilities. Which VXLAN control plane approach should be used to achieve this?

Accepted Answer

EVPN control plane with multicast underlay. The combination of EVPN for control-plane learning and a multicast underlay for BUM traffic replication provides an efficient and scalable solution. EVPN eliminates the need for flood-and-learn, while multicast replication reduces bandwidth consumption compared to ingress replication. This approach is widely adopted in large data center fabrics.

Answer

Flood-and-learn with multicast underlay

Answer

Static VXLAN tunnels with head-end replication

Answer

EVPN control plane with ingress replication

Question 8

A data center engineer is deploying a Cisco Nexus 9000 series switch pair as a vPC domain. The peer link is formed between the two switches, but the engineer wants to ensure that the vPC peer keepalive link remains operational even if the peer link fails. The engineer configures the peer keepalive link on a dedicated management interface. Which statement accurately describes the behavior of the vPC peer keepalive link in this scenario?

Accepted Answer

The peer keepalive link is used to detect peer switch liveness and trigger role election when the peer link fails.. The peer keepalive link is a dedicated heartbeat connection that allows each vPC peer to detect whether the other is still alive. When the peer link fails, the keepalive link determines if the failure is isolated or if the peer switch itself is down. This prevents split-brain scenarios and ensures proper role election, keeping the vPC domain stable.

Answer

The peer keepalive link carries user data traffic when the peer link fails, ensuring no disruption.

Answer

The peer keepalive link synchronizes MAC address tables and ARP entries between the vPC peers.

Answer

The peer keepalive link is required for VXLAN tunnel establishment between the vPC peers.

Question 9

An engineer is troubleshooting a Cisco Nexus 9000 vPC domain that uses a dedicated peer keepalive link over a routed path. The vPC peer link is up and the vPC member ports are forwarding, but the vPC role election shows both switches in a primary role. Which action resolves this condition?

Accepted Answer

Verify that the peer keepalive link is reachable in the correct VRF and that the peer-keepalive destination is configured with the correct source address.. The peer keepalive link is a separate heartbeat path used to detect when a vPC peer is alive but the peer link has failed, preventing both switches from becoming primary. When both switches show primary despite an up peer link, the keepalive path is typically broken or misconfigured. Verifying reachability in the correct VRF and the source/destination addresses restores the heartbeat and allows correct role election.

Answer

Configure the peer keepalive link on the management interface of both switches and set the destination to the peer's management IP address.

Answer

Remove the peer keepalive configuration entirely and rely on the peer link to carry keepalive messages.

Answer

Shut down the vPC peer link and reconfigure the system-priority on both switches to force a new primary election.

Question 10

An engineer is configuring a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The underlay uses OSPF, and the overlay uses BGP EVPN. The engineer notices that MAC addresses are not being advertised between leaf switches. Which action should be taken to allow the exchange of MAC reachability information?

Accepted Answer

Enable the BGP EVPN address family under the neighbor configuration on each leaf switch.. In a VXLAN EVPN fabric, BGP EVPN is the control plane that distributes MAC and IP reachability information. Each leaf must activate the L2VPN EVPN address family for its BGP neighbors to exchange EVPN routes. Without this, MAC addresses learned locally are not advertised, and remote leaf switches cannot populate their forwarding tables, causing overlay connectivity failures.

Answer

Configure the NVE interface with a source-interface loopback and enable ingress replication.

Answer

Configure a route reflector to reflect EVPN routes between leaf switches.

Answer

Enable OSPF on the loopback interfaces used for VXLAN tunnel sources.

Question 11

An engineer is configuring a Cisco Nexus 9000 switch to participate in a VXLAN EVPN fabric. The underlay uses OSPF and the overlay uses iBGP with EVPN. The engineer notices that remote MAC addresses are not being learned. Which action should be taken to allow MAC address learning over the EVPN control plane?

Accepted Answer

Enable the EVPN address family under the BGP routing process and activate it toward the BGP EVPN peers.. In a VXLAN EVPN fabric, the BGP EVPN address family is responsible for exchanging MAC and IP reachability information between VTEPs. Even if the underlay and BGP peering are up, the EVPN address family must be enabled and activated for the peers. Without it, remote MAC addresses are not learned, and traffic relies on flooding. Enabling the address family and activating it toward the EVPN peers restores control-plane MAC learning.

Answer

Configure the NVE interface with a source-interface loopback and enable ingress replication for all BUM traffic.

Answer

Enable OSPF on the NVE interface and advertise the loopback address into OSPF.

Answer

Configure a route-map on the BGP peer to allow only IPv4 unicast routes and set the next-hop to the NVE loopback.

Question 12

An engineer is configuring a Cisco Nexus 9000 switch running NX-OS 9.3. The switch will be used in a VXLAN EVPN fabric. The engineer needs to enable the feature that allows the switch to act as a VTEP and support VXLAN encapsulation. Which command should be used to enable this functionality?

Accepted Answer

feature nv overlay. On Cisco Nexus 9000 switches, VXLAN functionality is enabled with 'feature nv overlay'. This command allows the switch to act as a VTEP and perform VXLAN encapsulation. It is a prerequisite for configuring VXLAN and EVPN. Other features like BGP are used for the control plane but do not enable VXLAN itself.

Answer

feature bgp

Answer

feature interface-vlan

Answer

feature vxlan

Question 13

An engineer is deploying Cisco ACI and needs to ensure that traffic between two EPGs is permitted. The EPGs are in different tenants, and the engineer wants to apply a contract that allows only HTTP traffic. Which configuration is required to allow the communication?

Accepted Answer

Create a contract with a filter for TCP port 80, and apply it as a provider contract to one EPG and a consumer contract to the other.. In Cisco ACI, communication between EPGs is governed by contracts. A contract contains filters that define permitted traffic. To allow HTTP between two EPGs, one EPG must provide the contract and the other must consume it. This establishes a directional relationship where the consumer can initiate traffic to the provider on the specified ports.

Answer

Create a contract with a filter for TCP port 80, and apply it as a provider contract to both EPGs.

Answer

Create a contract with a filter for TCP port 80, and apply it as a consumer contract to both EPGs.

Answer

Create a taboo contract with a filter for TCP port 80, and apply it to both EPGs.

Question 14

An engineer is deploying a new Cisco Nexus 9000 switch in a data center and needs to configure the management interface. The switch will be managed out-of-band on a dedicated management VLAN. Which interface must be configured with an IP address to allow remote management access?

Accepted Answer

The mgmt0 interface. The mgmt0 interface is the dedicated out-of-band management port on Cisco Nexus switches. It is isolated from the data plane and is designed for management traffic. Configuring an IP address on mgmt0 allows remote access via SSH, SNMP, or other management protocols without affecting production traffic. Other interfaces like Ethernet ports or SVIs are used for in-band management and do not provide the same level of separation and security.

Answer

The Ethernet1/1 interface

Answer

The loopback0 interface

Answer

The Vlan1 interface

Question 15

A network engineer is configuring an ACI fabric and needs to allow traffic between two EPGs that are in different VRFs. The engineer has already created a contract with the appropriate filters. What must be configured to enable communication between these EPGs?

Accepted Answer

Configure a shared L3Out or a VRF leak to allow route exchange between the VRFs.. In ACI, contracts define policy between EPGs, but they do not override VRF isolation. When EPGs are in different VRFs, you must provide routing between those VRFs. This can be done by configuring a shared L3Out that both VRFs use, or by configuring VRF route leaking to exchange routes. Once routing is established, the contract can be applied to allow the specific traffic. Without this routing, the contract will not enable communication.

Answer

Configure the contract as a provider and consumer on the respective EPGs.

Answer

Configure the EPGs in the same bridge domain and change the VRF.

Answer

Configure a taboo contract between the EPGs.