350-601 Network Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A network engineer notices that the VPC peer status is down, and the peer-keepalive is not reachable. Based on the configuration, what is the likely issue?

Accepted Answer

The peer-keepalive destination must be on the management VRF.. The peer-keepalive link must be routed via the management VRF to ensure it remains independent of the data-plane and peer-link state. If the peer-keepalive destination is not in the management VRF, the keepalive packets may be dropped or unreachable, causing the VPC peer status to remain down. The configuration shown likely omits the 'vrf member management' under the peer-keepalive configuration, or the destination IP is not reachable through the management interface.

Answer

The peer-link port-channel10 has VLAN 100-110 allowed, but the peer-keepalive uses a separate VLAN.

Answer

The VPC domain priority should be lower.

Answer

The peer-keepalive source and destination are swapped.

Question 2

Refer to the exhibit. A network administrator configured VXLAN EVPN as above. The VTEP can communicate with neighbors on VNI 5001, but cannot reach the default gateway for VNI 5002. What is the problem?

Accepted Answer

The route-target for VNI 5002 is missing.. The VXLAN EVPN configuration for VNI 5002 is missing the route-target import/export statements under the VRF TenantA address-family l2vpn evpn. Without the route-target, the VTEP cannot import EVPN type-2 and type-3 routes for VNI 5002, preventing it from learning the default gateway's MAC/IP or the IMET route needed for BUM traffic. This explains why the VTEP can communicate on VNI 5001 (which has route-targets) but not reach the gateway on VNI 5002.

Answer

The default route in VRF TenantA is not exported.

Answer

The VNI 5002 does not have an associated VLAN.

Answer

The NVE interface does not have ingress-replication configured.

Question 3

During a network upgrade, an engineer applies a new OSPF configuration on a Nexus 9000 spine. After the change, several leaf switches lose connectivity to each other. The engineer examines the logs and sees OSPF adjacency flapping. What is the most likely cause?

Accepted Answer

Duplicate router IDs.. Duplicate router IDs cause OSPF adjacency flapping because OSPF uses the Router ID (RID) to uniquely identify each router in the OSPF domain. When two routers share the same RID, they reject each other's Hello packets, leading to repeated adjacency resets. In a Nexus 9000 spine-leaf topology, this often occurs when the spine's RID is accidentally configured to match an existing leaf's RID, disrupting the entire fabric's OSPF convergence.

Answer

OSPF hello timer mismatch.

Answer

MTU mismatch on the fabric links.

Answer

Incorrect area configuration.

Question 4

An administrator is deploying a new application in a Cisco ACI fabric. The application requires multicast traffic between end hosts. Which configuration is necessary for multicast in ACI?

Accepted Answer

Create a multicast policy in the bridge domain.. In Cisco ACI, multicast forwarding is enabled at the bridge domain level using a multicast policy. This policy configures the necessary IGMP snooping and multicast group membership for the fabric, allowing end hosts to receive multicast traffic without requiring PIM on the leaf switches. Option C is correct because the bridge domain multicast policy is the required configuration for multicast in ACI.

Answer

Enable PIM on the leaf switches.

Answer

Configure a multicast group in the EPG.

Answer

Use IGMP snooping only.

Question 5

A network engineer is configuring a VPC on a pair of Nexus 9000 switches. Which command is required to synchronize the configuration between the VPC peers?

Accepted Answer

vpc domain .. The `vpc domain ` command creates the VPC domain, which enables VPC functionality and allows configuration synchronization between peers via Cisco Fabric Services (CFS) over the peer-link. Without defining the VPC domain, there is no VPC context, and synchronization cannot occur. The peer-keepalive (B) is for liveness detection, not synchronization. The other options are related but not directly responsible for synchronizing configurations.

Answer

auto-recovery.

Answer

peer-keepalive destination <ip>.

Answer

role preempt.

Question 6

A financial services company is migrating its core banking application to a new data center built on Cisco Nexus 9000 switches with VXLAN EVPN. The application requires active-active multihoming for its servers, which are dual-homed to two leaf switches. The network team has configured vPC on the leaf switches for the server connections. After the migration, the application team reports that some packets are being dropped during failover events when one of the vPC member links goes down. The network team confirms that vPC is properly configured and the peer-keepalive is functioning. What is the most likely cause of packet drops during failure?

Accepted Answer

The vPC consistency parameters are not identical between the peer switches.. In a vPC setup, if the consistency parameters (such as STP, VLAN, or interface configurations) are not identical between the two vPC peer switches, the vPC will not forward traffic correctly during a link failure. This mismatch can cause packet drops during failover events, even though the peer-keepalive is functioning. The Cisco Nexus 9000 series requires strict consistency checks to ensure loop-free and seamless failover in VXLAN EVPN environments.

Answer

The vPC peer-gateway feature is not enabled.

Answer

The vPC orphan port configuration is missing.

Answer

The vPC role is not configured with preempt.

Question 7

A large enterprise uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric. The underlay is OSPF. Each leaf switch has a loopback0 interface as the source interface for VXLAN tunnel endpoints. After a maintenance window, an engineer modifies the IP address of loopback0 on leaf-5 from 10.1.1.5/32 to 10.1.1.105/32. Subsequently, all VXLAN tunnels to leaf-5 go down. OSPF adjacencies between leaf-5 and the spines are still FULL. The engineer checks the NVE interface on leaf-5 and sees the source-interface is loopback0 but the interface status is up/up. However, pings from other leaves to 10.1.1.105 fail. What is the most likely cause?

Accepted Answer

The new loopback IP 10.1.1.105 is not included in the OSPF network statement under router ospf. After changing the loopback0 IP address on leaf-5, the new IP 10.1.1.105/32 must be explicitly advertised into OSPF for other leaves to reach it. If the OSPF network statement under router ospf still references the old subnet or does not include 10.1.1.105/32, the route for this new loopback IP will not be installed in the OSPF database. Consequently, other leaves cannot route to the new VTEP IP, causing VXLAN tunnels to fail even though OSPF adjacencies remain FULL (since adjacencies are formed over physical interfaces, not the loopback).

Answer

The OSPF process on leaf-5 was not restarted after the IP change

Answer

The MTU on loopback0 is set too low causing OSPF hello drops

Answer

The VXLAN source-interface was automatically changed to a different loopback

Question 8

An engineer is troubleshooting a VXLAN network where traffic between two VTEPs in the same VNI is not being forwarded. The underlay network is operational and IP connectivity exists between the VTEPs. Which two actions should the engineer take to verify the VXLAN configuration?

Accepted Answer

Verify that the NVE interface is configured with the correct source-interface.. The NVE interface's source-interface (typically a loopback) defines the local VTEP IP address used for VXLAN encapsulation. If this source-interface is misconfigured or not reachable from the remote VTEP, VXLAN packets will not be sourced from the correct IP, breaking traffic forwarding even when underlay IP connectivity exists.

Answer

Verify that the multicast group for BUM traffic is reachable.

Answer

Verify that the VXLAN tunnel endpoint IP addresses are in the same subnet.

Answer

Verify that the VXLAN routing table is populated correctly.

Question 9

Refer to the exhibit. An engineer configured a VXLAN tunnel endpoint (VTEP) but the VXLAN tunnel is not operational. The underlay OSPF adjacency is established. What is the missing configuration?

Accepted Answer

The loopback0 interface is not included in the OSPF process.. The loopback0 interface is not included in the OSPF process. For VXLAN underlay routing, the VTEP source interface (typically loopback0) must be advertised via the underlay IGP (OSPF) so that remote VTEPs can reach it. Without this, the NVE interface cannot form a VXLAN tunnel even though OSPF adjacency is established, as the source IP is unreachable.

Answer

The NVE interface must be enabled with the no shutdown command.

Answer

The multicast group must be reachable via the underlay.

Answer

The VNI must be mapped to a VLAN.

Question 10

An organization has deployed a pair of Nexus 93180YC-EX switches as vPC peers in a data center. The switches are connected to a server with two 10GbE interfaces configured as an LACP port-channel. The vPC configuration has been verified and was working correctly for months. After a scheduled maintenance window that included upgrading the NX-OS software from version 7.0(3)I7(1) to 7.0(3)I7(5), the server begins experiencing frequent link flaps on the port-channel. The server administrator reports that every 5-10 minutes, the link goes down for about 2 seconds and then recovers. The network team checks the logs on the Nexus switches and sees repeated messages: 'LACP-3-MISCONFIG: Port-channel <channel> is misconfigured: partner not on same aggregator.' The 'show vpc brief' output shows all vPCs in the 'up' state. The 'show port-channel summary' shows the port-channel is up with both member ports in the bundle. What is the most likely root cause?

Accepted Answer

The LACP system priority is not configured consistently between the vPC peers, causing the LACP system identifier to differ.. In a vPC setup, both peer switches must have the same LACP system identifier (derived from system priority and MAC address) so the server sees a single logical partner. If the LACP system priority is not consistent across the peers, the system identifiers will differ, causing the server to detect multiple partners, leading to the 'partner not on same aggregator' error and link flaps. Option A is incorrect because the LACP rate timer mismatch would cause constant timeout issues, not intermittent flaps with the specific log message. Option B is incorrect because VLAN mismatch would cause persistent connectivity failures, not intermittent flaps. Option C is incorrect because delay-restore timer affects recovery after link failure, not during steady-state operation.

Answer

The LACP fast rate timer default changed to slow in the new software, causing a timeout mismatch with the server.

Answer

The vPC delay-restore timer is set too low, causing the vPC to prematurely come up before LACP is fully up.

Answer

The vPC peer-link VLAN allowed list does not include the server's VLAN, causing intermittent drops.

Question 11

An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?

Accepted Answer

It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.. The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.

Answer

It carries data traffic between vPC peers.

Answer

It is used to synchronize MAC address tables between peers.

Answer

It provides a Layer 3 keepalive to detect peer failure and should be on a separate VLAN.

Question 12

An engineer is designing a spine-leaf fabric using eBGP for the underlay. The spine switches are in AS 65000 and each leaf switch uses a different private AS from 65001 to 65010. For optimal convergence and to avoid BGP path hunting, which BGP feature should be configured on the spines?

Accepted Answer

allowas-in 1. In a BGP underlay with a common spine AS (65000) and unique leaf AS, each leaf may receive routes from multiple spines. Without 'allowas-in', when a spine receives a route from a leaf that already contains the spine's own AS in the AS_PATH (because another spine previously advertised it), the spine would reject the update due to AS loop detection. Configuring 'allowas-in 1' on spines allows them to accept routes containing their own AS once, enabling them to consider all available paths and avoid path hunting. Options B, C, and D are incorrect: 'disable-peer-as-check' would ignore AS checks altogether, potentially causing loops; 'multipath-relax' allows multipath with different AS_PATHs but doesn't address the path-hunting issue; 'maxas-limit' limits the maximum AS number but is not relevant to this scenario.

Answer

disable-peer-as-check

Answer

bestpath as-path multipath-relax

Answer

maxas-limit 10

Question 13

A data center network uses MST with multiple instances. Different VLANs are mapped to different MST instances to utilize multiple spanning tree paths. Which MST parameter must be identical on all switches in the same region to ensure proper operation?

Accepted Answer

MST region name and revision number. In MST, all switches within the same region must agree on the region name and revision number to form a consistent MST region. If these parameters differ, switches will treat each other as being in different regions, causing the MST instances to be recalculated as separate CST (Common Spanning Tree) regions, which can lead to suboptimal or broken load balancing across VLANs.

Answer

Port path cost

Answer

Bridge priority

Answer

Max age timer

Question 14

An engineer is configuring OSPF in a data center fabric with multiple Nexus 9000 switches. To ensure fast convergence after a link failure, which OSPF feature should be enabled?

Accepted Answer

OSPF Fast Hello. OSPF Fast Hello reduces the dead interval to less than 1 second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF to detect a link failure in milliseconds rather than the default 40 seconds, significantly improving convergence time in a data center fabric where rapid failover is critical.

Answer

OSPF authentication

Answer

OSPF LSA throttling

Answer

OSPF stub area

Question 15

Which Cisco Data Center Network Manager component is used for centralized fabric management and automation of Nexus switches?

Accepted Answer

DCNM. Cisco Data Center Network Manager (DCNM) is the centralized management platform specifically designed for fabric management, provisioning, and automation of Nexus switches in data center environments. It provides a single pane of glass for configuring, monitoring, and troubleshooting Nexus-based fabrics, including VXLAN EVPN, Cisco ACI, and traditional SAN/Nexus environments.

Answer

Cisco ISE

Answer

Prime Infrastructure

Answer

APIC