350-601 Network Practice Test 19 — 15 Questions

Question 1

A network engineer is configuring a Cisco Nexus 9000 leaf switch running NX-OS in a VXLAN EVPN fabric. The engineer wants the switch to advertise and learn Layer 2 MAC addresses and Layer 3 host routes through the fabric's BGP control plane. Which BGP address family must be explicitly enabled under the neighbor configuration to accomplish this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

address-family l2vpn evpn. VXLAN EVPN relies on the L2VPN EVPN NLRI to distribute MAC and IP reachability between VTEPs. Enabling the EVPN address family under the BGP neighbor is what activates this exchange on Nexus 9000. Without it, BGP may form but never advertise Type 2 or Type 5 routes, so remote hosts stay unknown.

Answer

address-family vpnv4 unicast

Answer

address-family link-state

Answer

address-family ipv4 unicast

Question 2

A network administrator is configuring a Cisco Nexus 9000 switch in standalone NX-OS mode. The administrator needs to enable VXLAN functionality on the switch. Which feature must be enabled first?

Accepted Answer

feature nv overlay. To enable VXLAN on a Cisco Nexus 9000 switch in standalone NX-OS mode, the 'feature nv overlay' command must be enabled first. This feature activates the VXLAN overlay functionality, allowing the switch to create NVE interfaces and perform VXLAN encapsulation. Other features like 'vn-segment-vlan-based' and 'bgp' are configured afterward to complete the VXLAN EVPN setup.

Answer

feature vn-segment-vlan-based

Answer

feature interface-vlan

Answer

feature bgp

Question 3

A Cisco Nexus 9000 switch is deployed in a vPC domain with two peer switches. The vPC peer-link is operational, but the vPC peer-keepalive link is down. The engineer notices that the secondary vPC peer switch has suspended all vPC member ports. Which action will restore vPC member port operation on the secondary switch while maintaining loop prevention?

Accepted Answer

Restore connectivity on the peer-keepalive link so the secondary peer can determine primary peer health and bring vPC member ports out of suspension.. The vPC peer-keepalive link is a heartbeat that confirms peer liveness. If it fails while the peer-link remains up, the secondary peer suspends its vPC member ports to avoid forwarding loops and dual-active behavior. Restoring the peer-keepalive link re-establishes heartbeat communication, allowing the secondary to verify the primary is healthy and safely bring its vPC member ports back into service.

Answer

Remove the vPC configuration from the secondary switch and reconfigure the member ports as standalone access ports.

Answer

Shut down the vPC peer-link on the primary switch, which forces the secondary to become primary and re-enable its vPC member ports.

Answer

Configure the secondary switch with a higher vPC role priority so it becomes the operational primary and activates its vPC member ports.

Question 4

An engineer is troubleshooting a VXLAN EVPN fabric where a leaf switch is not learning remote MAC addresses for a specific VLAN. The underlay is OSPF, and the overlay is iBGP EVPN. The engineer verifies that the BGP EVPN session is established and that Type-2 routes are being received from the spines. However, the MAC addresses are not programmed in the hardware. Which action should the engineer take to resolve this issue?

Accepted Answer

Verify that the VLAN is mapped to the correct VNI using the 'vlan configuration' or 'vn-segment' command under the VLAN, and that the VNI is included in the NVE interface's VNI list.. In a VXLAN EVPN fabric, receiving EVPN Type-2 routes is not sufficient for remote MAC addresses to be programmed in hardware. The leaf must have a local VLAN-to-VNI mapping and that VNI must be configured under the NVE interface. Without this mapping, the switch cannot associate the remote MAC addresses with the correct VXLAN network identifier, and they will not be installed in the MAC address table. This is a frequent oversight when adding new VLANs to an existing VXLAN EVPN fabric.

Answer

Verify that the BGP EVPN session is using the correct source interface by checking the 'update-source' configuration under the BGP neighbor.

Answer

Verify that the 'feature interface-vlan' and 'feature vn-segment-vlan-based' commands are enabled globally on the leaf switch.

Answer

Verify that the OSPF cost on the leaf's uplinks is lower than the cost on other leaf switches to ensure it becomes the designated forwarder.

Question 5

An engineer is deploying a Cisco ACI fabric and needs to enforce that traffic from an application EPG to a database EPG is permitted only on specific TCP ports while all other traffic is denied. The fabric is in application-centric mode with a single VRF. Which configuration achieves this requirement?

Accepted Answer

Create a contract that contains a filter with the required TCP ports, attach the contract as a provider to the database EPG and as a consumer to the application EPG.. ACI contracts are directional: the provider EPG offers the service and the consumer EPG initiates the connection. The filter inside the contract lists the permitted TCP ports, and the fabric's default deny ensures everything else is blocked. Correct role assignment is essential; reversing provider and consumer inverts the permitted direction.

Answer

Create a contract with a filter for the required TCP ports, attach it as a provider to the application EPG and as a consumer to the database EPG.

Answer

Create a taboo contract with a filter denying all TCP traffic and attach it to both EPGs.

Answer

Create a contract with a filter for the required TCP ports and attach it as a provider to both the application EPG and the database EPG.

Question 6

An engineer is deploying a Cisco Nexus 9000 Series switch pair as a vPC domain using the default vPC peer link configuration. The peer link is a port channel of two 40-Gbps interfaces. During a maintenance window, both peer link member interfaces are shut down simultaneously. Which behavior should the engineer expect?

Accepted Answer

The vPC secondary peer device suspends all vPC member ports, and the primary peer device continues forwarding traffic for all vPC VLANs.. When the vPC peer link fails but the peer keepalive link remains up, the vPC primary device keeps its vPC member ports operational and forwards traffic, while the vPC secondary device suspends its vPC member ports to prevent duplicate forwarding. This behavior avoids a split-brain scenario and maintains connectivity through the primary device. The peer keepalive link is used to detect peer liveness and does not trigger a re-election.

Answer

The vPC domain enters a dual-active state, and both peer devices elect a new primary using the peer keepalive link.

Answer

Both peer devices suspend all vPC member ports until the peer link is restored, causing a complete outage for vPC VLANs.

Answer

Both peer devices keep their vPC member ports up, and traffic is load-balanced across both devices as during normal operation.

Question 7

An engineer is configuring a Cisco Nexus 9000 switch to participate in a VXLAN EVPN fabric. The switch must support a distributed anycast gateway so that all leaf switches can act as the default gateway for the same subnet. Which two configurations are required on each leaf to implement distributed anycast gateway? (Choose two.)

Accepted Answer

Configure the same virtual MAC address and the same virtual IP address on the SVI for the VLAN across all leaf switches.. Distributed anycast gateway on Cisco Nexus 9000 requires a globally defined anycast gateway MAC and per-SVI activation using fabric forwarding mode anycast-gateway. Every leaf uses the same virtual IP and virtual MAC for the subnet, so hosts can use any leaf as their default gateway without re-ARPing after mobility. The Layer 3 VNI and VRF mapping are separate requirements for VXLAN routing, not for the anycast gateway feature itself.

Answer

Enable VXLAN routing by configuring a dedicated Layer 3 VNI for each VLAN and mapping it to a unique VRF on every leaf.

Answer

Configure a unique virtual MAC address on each leaf SVI and enable Proxy ARP to resolve remote gateway addresses.

Answer

Configure the SVI with a secondary IP address that matches the primary gateway address on the spine switches.

Question 8

A network engineer is configuring a Cisco Nexus 9000 leaf switch running NX-OS in a VXLAN EVPN fabric. The engineer wants the switch to advertise and learn Layer 2 MAC addresses and Layer 3 host routes through the fabric's BGP control plane. Which BGP address family must be explicitly enabled under the neighbor configuration to accomplish this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the VLAN and assign it a VNI using the 'vn-segment' command under the VLAN configuration.. To map a VLAN to the VXLAN overlay in a Cisco Nexus EVPN fabric, the engineer must assign a VNI to the VLAN using the 'vn-segment' command and add that VNI as a member of the NVE interface. These two steps establish the association between the Layer 2 VLAN and the VXLAN network identifier, and enable the NVE interface to encapsulate and decapsulate traffic for that VNI. Without both, the VLAN cannot be extended across the fabric.

Answer

Configure a static VXLAN tunnel to each spine switch using the 'nve peer' command.

Answer

Configure the VNI as a Layer 3 VNI under the VRF configuration.

Answer

Enable the 'feature vn-segment-vlan-based' command globally on the switch.

Question 9

A network engineer is troubleshooting a Cisco Nexus 9000 vPC domain where the peer link is up but the vPC member ports on one switch are suspended. The engineer suspects a configuration mismatch between the two vPC peer switches. Which command should the engineer use to verify that the vPC configuration parameters match on both peers?

Accepted Answer

show vpc consistency-parameters vpc <id>. vPC member ports suspend when type-1 consistency parameters such as MTU, STP mode, or VLAN configuration differ between peers. The consistency-parameters command enumerates each parameter and flags mismatches per vPC, making it the direct tool for identifying the discrepancy. Summary and role commands describe state but not parameter-level differences.

Answer

show vpc role

Answer

show vpc brief

Answer

show vpc peer-keepalive

Question 10

An engineer is troubleshooting a VXLAN EVPN fabric on Cisco Nexus 9000 Series switches. The underlay uses OSPF, and the overlay uses iBGP with EVPN address family. Some leaf switches are not learning remote MAC addresses from other leaf switches, but they can ping the remote VTEP loopback addresses. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the EVPN address family is activated under the BGP neighbor configuration on all spine switches.. In a VXLAN EVPN fabric using iBGP, the EVPN address family must be activated on the BGP sessions between leaf and spine switches. Spines often act as route reflectors, and if the EVPN address family is not enabled, EVPN routes are not exchanged, preventing leaf switches from learning remote MAC addresses. Underlay connectivity (OSPF) and VTEP reachability can still be functional, masking the control plane issue.

Answer

Ensure that the OSPF cost on the leaf uplinks is equal so that traffic is load-balanced across all spines.

Answer

Increase the MTU on all spine-leaf links to accommodate VXLAN encapsulation overhead.

Answer

Configure the NVE interface with a multicast group address to enable BUM traffic replication.

Question 11

A network administrator is deploying a Cisco Nexus 9000 switch in a data center and needs to verify that the switch has successfully formed a vPC with its peer. The administrator runs the show vpc command and sees that the vPC peer-link is up but the vPC role shows as secondary. Which statement describes the expected behavior of the secondary vPC peer in a healthy vPC domain?

Accepted Answer

The secondary peer forwards traffic for vPC member ports and participates in the vPC domain, but the primary peer handles control-plane functions such as BPDU processing for vPC VLANs.. In a healthy vPC domain, both peers actively forward traffic for vPC member ports, providing active-active forwarding. The primary peer takes on control-plane duties such as BPDU generation and processing for vPC VLANs, while the secondary peer suppresses its BPDUs to avoid loops. This division of labor maintains loop-free topology while maximizing bandwidth utilization across both switches.

Answer

The secondary peer operates only as a standby control plane and does not forward any data traffic until the primary peer fails.

Answer

The secondary peer forwards traffic for all vPC member ports and also handles all BPDUs for the vPC VLANs.

Answer

The secondary peer blocks all vPC member ports until the primary peer fails, at which point it takes over forwarding.

Question 12

An engineer is configuring an ACI fabric and needs to allow HTTP traffic between two EPGs in different tenants. The EPGs are in VRFs that are stretched across the fabric. Which ACI construct must be used to permit this traffic?

Accepted Answer

A contract with a filter that permits TCP port 80, exported from one tenant and imported into the other tenant.. To allow traffic between EPGs in different tenants in ACI, a contract must be used. The contract is defined in one tenant (the provider) and exported, then imported into the other tenant (the consumer). The contract contains a filter that permits the desired traffic, such as TCP port 80. This maintains the ACI policy model where communication between EPGs is denied by default unless explicitly allowed by a contract.

Answer

A VRF that is shared between the two tenants, allowing all traffic between the EPGs without a contract.

Answer

A static path binding on the EPGs that maps them to the same leaf switch ports, enabling local switching.

Answer

A bridge domain that includes both EPGs, allowing them to communicate at Layer 2 without a contract.

Question 13

A network engineer is deploying a Cisco Nexus 9000 leaf switch that must forward VXLAN-encapsulated traffic between VXLAN Tunnel Endpoints. The engineer needs to identify which interface type terminates the VXLAN tunnel and performs the encapsulation/decapsulation of frames. Which interface should the engineer configure to serve this role?

Accepted Answer

A Network Virtualization Endpoint (NVE) interface configured with the source-interface command. VXLAN encapsulation and decapsulation on a Cisco Nexus 9000 switch are performed by the logical NVE interface, which is bound to a loopback address through the source-interface command. This interface owns the VTEP IP and the VNI membership, allowing the switch to map VLANs into VNIs and to terminate encapsulated frames from peer VTEPs. Physical uplinks, peer-links, and SVIs support transport or gateway functions but do not perform the tunnel endpoint role.

Answer

A port-channel interface configured with vPC peer-link and trunk allowed VLANs

Answer

A switched virtual interface (SVI) configured for the tenant VLAN with an anycast gateway address

Answer

A Layer 3 routed uplink port configured with an IP address and joined to the underlay routing protocol

Question 14

An engineer is configuring a VXLAN EVPN fabric with Cisco Nexus 9000 switches. The engineer needs to ensure that BUM (Broadcast, Unknown unicast, Multicast) traffic is efficiently replicated across the fabric. Which two statements about the VXLAN BUM traffic replication mechanisms are correct? (Choose two.)

Accepted Answer

Multicast replication uses a multicast group in the underlay to deliver BUM traffic to all VTEPs in the VXLAN segment.. Ingress replication involves the ingress VTEP sending a copy of the BUM packet to each remote VTEP in the VXLAN segment. Multicast replication uses an underlay multicast group to deliver BUM traffic to all VTEPs. These are the two primary mechanisms for BUM traffic replication in VXLAN EVPN fabrics. Ingress replication is simpler but less efficient; multicast replication is more efficient but requires a multicast-enabled underlay.

Answer

Both ingress replication and multicast replication require the underlay to support multicast routing.

Answer

Multicast replication requires the ingress VTEP to know the IP address of every remote VTEP in the VXLAN segment.

Answer

Ingress replication requires PIM-SM to be configured in the underlay to forward BUM traffic.

Question 15

An engineer is troubleshooting a VXLAN EVPN fabric where hosts in the same subnet on different leaf switches cannot communicate, although the underlay is healthy and EVPN routes are present. The engineer observes that the leaf switches have the correct VNI-to-VLAN mappings and the NVE interfaces are up. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the anycast gateway MAC address is identical on all leaf switches hosting the subnet. A distributed anycast gateway must present an identical virtual MAC and virtual IP on every leaf switch that hosts the subnet. When the MAC differs, hosts on different leaves receive inconsistent ARP information and Layer 3 forwarding breaks even though the EVPN control plane and underlay are healthy. Verifying and aligning the anycast gateway MAC and IP restores consistent forwarding and resolves the intra-subnet connectivity failure.

Answer

Change the BGP EVPN route target on the leaf switches to match the remote VTEP

Answer

Increase the MTU on the underlay uplinks to accommodate the VXLAN header overhead

Answer

Disable ingress replication and rely solely on multicast underlay for BUM traffic