350-601 Network Practice Test 3 — 15 Questions

Question 1

In a spine-leaf architecture, the oversubscription ratio between leaf switches and spine switches is 3:1. Each leaf has 48 x 10G server ports and 4 x 40G uplinks to the spine. What is the oversubscription ratio at the leaf level?

Accepted Answer

3:1. The oversubscription ratio at the leaf level is calculated by comparing the total bandwidth of the server-facing ports to the total bandwidth of the uplink ports. Each leaf has 48 x 10G server ports (480 Gbps) and 4 x 40G uplinks (160 Gbps). The ratio is 480:160, which simplifies to 3:1. This matches the given spine-leaf oversubscription ratio, confirming that the leaf-level ratio is 3:1.

Answer

1:1

Answer

4:1

Answer

2:1

Question 2

Which NX-OS command is used to display the consistency status of Virtual Port Channel (vPC) parameters across both vPC peers?

Accepted Answer

show vpc consistency-parameters. Option D is correct because the 'show vpc consistency-parameters' command is specifically designed to verify that all required VPC configuration parameters (such as allowed VLANs, STP settings, and port-channel modes) are identical on both VPC peers. Inconsistent parameters can cause VPC traffic disruption or failover issues, and this command provides a detailed per-interface or global consistency check.

Answer

show vpc peer-keepalive

Answer

show vpc brief

Answer

show running-config vpc

Question 3

A network engineer is configuring OSPF on a Nexus switch. To ensure fast convergence in case of a link failure, which OSPF feature should be enabled?

Accepted Answer

OSPF Fast Hello. OSPF Fast Hello (B) is the correct feature to enable for fast convergence on a Nexus switch because it reduces the dead interval to less than one second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF neighbors to detect a link failure much faster than the default 40-second dead interval on broadcast networks, triggering quicker SPF recalculation and route convergence.

Answer

OSPF authentication

Answer

OSPF stub area

Answer

OSPF route summarization

Question 4

In a VXLAN EVPN fabric, which component is responsible for encapsulating and decapsulating VXLAN packets?

Accepted Answer

VTEP. The VTEP (VXLAN Tunnel Endpoint) is the component responsible for encapsulating Ethernet frames in VXLAN packets and decapsulating them at the destination. It performs the UDP encapsulation with a VXLAN header, using the VNI to identify the Layer 2 segment, and forwards traffic over the underlay network. In an EVPN fabric, the VTEP also participates in the control plane to learn remote MAC and IP addresses via MP-BGP.

Answer

NVE

Answer

VNI

Answer

VXLAN gateway

Question 5

An engineer is configuring BGP EVPN for VXLAN in a spine-leaf fabric. The leaf switches must advertise host IP-to-MAC mappings to the control plane. Which BGP address family should be enabled on the leaf switches?

Accepted Answer

address-family l2vpn evpn. In a VXLAN BGP EVPN fabric, leaf switches must advertise host IP-to-MAC mappings using the BGP EVPN address family. This is enabled with the command 'address-family l2vpn evpn' under the BGP configuration, which carries Type-2 routes (MAC/IP advertisement routes) that contain both the MAC address and the associated IP address of the host.

Answer

address-family vpnv4 unicast

Answer

address-family ipv4 unicast

Answer

address-family link-state

Question 6

An ACI fabric has multiple tenants and the requirement to allow only HTTP traffic from the web EPG to the app EPG. The contract must restrict traffic to TCP port 80. Which ACI object defines that specific port?

Accepted Answer

Filter. In ACI, filters define the L4/L5 parameters such as protocol and port. The filter for TCP port 80 is created and then used in the subject.

Answer

EPG

Answer

Subject

Answer

Contract

Question 7

What is the purpose of the vPC peer keepalive link in a vPC domain?

Accepted Answer

To provide a keepalive mechanism to detect peer failure. The vPC peer keepalive link is a dedicated Layer 3 link used to detect a failure of the vPC peer switch. It sends periodic UDP-based keepalive messages (default every second) to ensure the peer is still operational, allowing the surviving switch to take over the vPC forwarding role. This mechanism is critical for preventing dual-active scenarios where both switches would incorrectly forward traffic for the same vPC VLAN.

Answer

To synchronize MAC address tables

Answer

To carry BPDUs for STP

Answer

To forward data traffic between vPC peers

Question 8

Which STP variant provides per-VLAN load balancing and is commonly used in data center networks with Cisco Nexus switches?

Accepted Answer

Rapid PVST+. Rapid PVST+ (Per-VLAN Spanning Tree Plus) is the correct answer because it provides per-VLAN load balancing by running a separate instance of RSTP (802.1w) for each VLAN. This allows different VLANs to use different root bridges and forwarding paths, enabling traffic load sharing across redundant links. Cisco Nexus switches support Rapid PVST+ as a default or commonly configured STP variant in data center environments, offering fast convergence and VLAN-based traffic engineering.

Answer

MST

Answer

RSTP

Answer

STP

Question 9

A data center architect is designing an ACI fabric with VMM integration to VMware vSphere. The goal is to allow dynamic policy assignment to virtual machines. What is the correct configuration hierarchy to enable this?

Accepted Answer

Create a VMM domain under the tenant, integrate with vCenter, and map EPGs to port groups.. Option B is correct because VMM integration in ACI requires creating a VMM domain under a tenant (or common tenant), integrating it with vCenter, and then mapping EPGs to vSphere port groups. This allows dynamic policy assignment to VMs based on their port group membership, enabling micro-segmentation and automated policy enforcement as VMs move across hosts.

Answer

Create a VMM domain under the infra tenant and associate it with the physical domain.

Answer

Use a Layer 4-Layer 7 service graph to connect VMs directly.

Answer

Configure VXLAN directly on the vSphere distributed switch.

Question 10

Which command is used on a Cisco Nexus switch to display the VXLAN network identifier (VNI) associated with a specific VLAN?

Accepted Answer

show vxlan vni. The 'show vxlan vni' command on Cisco Nexus switches displays the VXLAN network identifier (VNI) and its mapping to VLANs, including the associated VLAN ID and segment state. This command directly answers the question by showing the VNI-to-VLAN binding, which is essential for verifying VXLAN overlay configurations.

Answer

show vlan id 100

Answer

show interface nve 1

Answer

show running-config vxlan

Question 11

An engineer is troubleshooting a BGP EVPN issue where leaf switches are not learning remote MAC addresses. The underlay is reachable and BGP sessions are established. What is a likely cause?

Accepted Answer

Missing 'address-family l2vpn evpn' under the BGP neighbor configuration. Even when the underlay is reachable and BGP sessions are established, the BGP EVPN control plane requires the 'address-family l2vpn evpn' to be explicitly activated under the BGP neighbor configuration. Without this, the leaf switch will not exchange EVPN routes (Type-2 MAC/IP advertisement routes) with its peers, so remote MAC addresses are never learned. This is a common misconfiguration because BGP sessions may appear up but are not carrying the necessary EVPN address family.

Answer

NVE interface not enabled

Answer

Incorrect VNI configuration

Answer

MTU mismatch on the underlay

Question 12

Which ECMP load-balancing method is recommended for data center spine-leaf fabrics to ensure optimal traffic distribution?

Accepted Answer

Per-flow load balancing based on src-dst IP. Per-flow load balancing based on src-dst IP ensures that all packets belonging to the same flow (identified by source and destination IP addresses) follow the same path, preventing packet reordering while still distributing different flows across multiple equal-cost paths. In spine-leaf fabrics, this method provides optimal traffic distribution because it leverages the IP header information that is consistently available across Layer 3 boundaries, aligning with the fabric's routing-based forwarding model.

Answer

Per-packet load balancing

Answer

Weighted load balancing

Answer

Per-flow load balancing based on src-dst MAC

Question 13

An engineer is deploying a new VXLAN fabric and must ensure that the control plane can handle MAC advertisement without flooding. Which TWO protocols can be used for control plane learning in VXLAN? (Select two.)

Accepted Answer

OpenFlow. MP-BGP EVPN (Option D) is the primary control plane protocol for VXLAN, defined in RFC 7432, enabling MAC address advertisement without flooding. OpenFlow (Option B) is used in SDN controllers to manage forwarding tables, and in some VXLAN implementations (e.g., VMware NSX), it can serve as the control plane for MAC learning. IGMP Snooping (A) handles multicast group management, not MAC advertisement. VXLAN data plane learning (C) is the flood-and-learn method, which the question explicitly wants to avoid. OSPF (E) is a routing protocol, not a VXLAN control plane.

Answer

IGMP Snooping

Answer

VXLAN data plane learning

Answer

OSPF

Question 14

An ACI administrator is configuring external connectivity using L3Out. Which THREE components must be defined for a successful L3Out deployment? (Select three.)

Accepted Answer

External routed network (L3Out). The external routed network (L3Out) is the fundamental construct that defines the Layer 3 connectivity from the ACI fabric to an external router or network. It specifies the routing protocol (e.g., OSPF, BGP, or static), the external interfaces, and the protocol policies required for the ACI spine switches to exchange routes with external devices. Without defining the L3Out object, the fabric has no configured path or policy to reach external destinations.

Answer

VMM domain

Answer

Service graph

Question 15

A network team is troubleshooting a vPC issue where one of the member ports is not coming up. Which TWO conditions can cause a vPC member port to fail consistency checks? (Select two.)

Accepted Answer

Different STP port type (edge vs network). Option A is correct because vPC performs consistency checks on member ports to ensure both peers have identical configurations for certain parameters. A mismatch in STP port type (e.g., one peer configured as 'edge' and the other as 'network') will cause the vPC member port to fail the consistency check and remain down, as STP port type affects BPDU handling and loop prevention.

Answer

Spanning-tree guard root configured on one peer

Answer

Incorrect peer keepalive IP

Answer

Different MTU settings on the peer-link