350-601 Network Practice Test 4 — 15 Questions

Question 1

In an ACI fabric, an EPG is configured with a contract that provides a service to another EPG. The contract has a filter for TCP port 80. Which component defines the directionality of the communication between the provider and consumer EPG?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The provider and consumer labels in the contract. In Cisco ACI, the provider and consumer labels in the contract define the directionality of communication. The provider EPG offers a service, and the consumer EPG initiates the request; the contract's provider/consumer relationship determines which EPG can start the conversation and in which direction the filter (e.g., TCP port 80) applies. This is fundamental to ACI's policy model, where the contract is unidirectional from consumer to provider by default.

Answer

The filter direction specified in the contract

Answer

The BD subnets

Answer

The subject of the contract

Question 2

An engineer is designing a VXLAN EVPN fabric with multicast-based BUM replication. Which two components are required to support this? (Choose two.)

Accepted Answer

A multicast group address per VNI. Option A is correct because multicast-based BUM (Broadcast, Unknown unicast, Multicast) replication in a VXLAN EVPN fabric requires a unique multicast group address mapped per VNI, so that each VNI's BUM traffic is delivered only to VTEPs participating in that VNI via the underlay multicast tree. Option D is correct because the underlay transport network must run PIM (typically PIM Sparse Mode) to build the multicast distribution trees that carry the VXLAN-encapsulated BUM frames between VTEPs. Option B is not required in this form: the NVE interface is configured with a multicast group only when using the older flood-and-learn VXLAN multicast mode, whereas in a BGP EVPN fabric the VNI-to-multicast-group mapping is signaled via EVPN, not statically bound to the NVE interface. Option C, while needed for an EVPN control plane, is not specific to multicast-based BUM replication and does not itself enable multicast forwarding. Option E is incorrect because ingress replication is the alternative unicast-based BUM replication method, not a component of multicast-based replication.

Answer

NVE interface with multicast group

Answer

BGP EVPN address family

Answer

Ingress replication configured

Question 3

Which three checks are part of the vPC type-1 consistency check? (Choose three.)

Accepted Answer

STP mode. The vPC type-1 consistency check verifies parameters that must match exactly on both vPC peers, and STP mode (B) is one of them because a mismatch in spanning-tree mode (for example, Rapid PVST+ versus MST) would cause inconsistent forwarding behavior across the vPC domain. VLAN interface state (C) is also a type-1 check, since the operational state of VLAN SVIs must be identical on both peers to avoid traffic black-holing for those VLANs. MST region name (E) is a type-1 parameter as well, because differing MST region names would place the peers in different MST regions and break the expected topology. Port-channel load-balancing method (A) is not a type-1 check, as it is a local forwarding decision that does not need to match between peers. MTU on the peer-link (D) is not part of the type-1 consistency check; peer-link MTU is a transport requirement rather than a vPC consistency parameter.

Answer

Port-channel load-balancing method

Answer

MTU on the peer-link

Question 4

An engineer is deploying a new application in an ACI fabric. Which two objects must be created to define a network policy? (Choose two.)

Accepted Answer

Bridge Domain. In Cisco ACI, a network policy is defined within a Tenant (option D), which is the top-level logical container that holds all policy objects such as VRFs, bridge domains, and application profiles; without a tenant, no network policy can exist. Within that tenant, a Bridge Domain (option C) is required as it defines the Layer 2 forwarding domain, including subnets, gateway addresses, and its association with a VRF, which together constitute the network policy for the application. Option A (VRF) is a supporting object for Layer 3 isolation but is not itself one of the two objects that define the network policy in this context. Option B (External routed network) is only needed for connecting the fabric to outside networks via L3Out, not for defining the internal network policy. Option E (VMM domain) is used to integrate virtualized environments with ACI and is not required to define a network policy.

Answer

VRF

Answer

External routed network

Answer

VMM domain

Question 5

An engineer is deploying a VXLAN overlay network in a data center using Cisco Nexus 9000 series switches. The network must handle BUM traffic efficiently across the fabric. Which method for BUM traffic handling requires the VTEP to maintain a list of all remote VTEPs and replicate packets individually?

Accepted Answer

Ingress replication. Ingress replication (Option D) is the correct method because it requires the ingress VTEP to maintain a list of all remote VTEPs in the VXLAN segment and replicate each BUM packet individually to each remote VTEP. This is a unicast-based replication approach that does not rely on multicast in the underlay, making it suitable for networks where multicast is not enabled or desired.

Answer

Multicast-based replication

Answer

Suppression of BUM traffic

Answer

Head-end replication

Question 6

In a Cisco ACI fabric, a tenant has multiple bridge domains with different subnets. The administrator wants to allow traffic between two EPGs in the same tenant but different bridge domains. Which ACI construct is required to enable communication?

Accepted Answer

Contracts with filters and subjects. In Cisco ACI, EPGs in different bridge domains are isolated by default. To enable communication between them, a contract must be applied that defines the allowed traffic. Contracts use filters and subjects to specify permitted protocols and ports, and are the only native ACI mechanism for inter-EPG communication across bridge domains within the same tenant.

Answer

Shared L3Out

Answer

VRF route leaking

Answer

VMM domain integration

Question 7

A data center architect is designing a spine-leaf network with 40 leaf switches and 8 spine switches. Each leaf has 40x25G downlinks to servers and 8x100G uplinks to spines. The oversubscription ratio from server to spine is calculated as (total downlink bandwidth) / (total uplink bandwidth). What is the oversubscription ratio for each leaf?

Accepted Answer

1.25:1. The oversubscription ratio for each leaf is calculated by dividing the total downlink bandwidth by the total uplink bandwidth. Each leaf has 40 downlinks at 25 Gbps each, totaling 1000 Gbps, and 8 uplinks at 100 Gbps each, totaling 800 Gbps. Thus, 1000 / 800 = 1.25, giving a 1.25:1 ratio.

Answer

1.5:1

Answer

2:1

Answer

0.8:1

Question 8

An engineer is configuring OSPF on a Cisco Nexus switch in a data center. The network consists of multiple point-to-point links. To improve convergence, the engineer wants to reduce the dead interval to 10 seconds. Which command sets the dead interval correctly?

Accepted Answer

ip ospf dead-interval 10. The 'ip ospf dead-interval 10' command directly sets the OSPF dead interval to 10 seconds on a Cisco Nexus switch. The dead interval is the time a router waits without receiving a hello packet before declaring the neighbor down, and reducing it to 10 seconds speeds up convergence on point-to-point links.

Answer

ip ospf dead-interval 30

Answer

ip ospf hello-interval 10

Answer

ip ospf dead-interval 40

Question 9

A network administrator is troubleshooting a vPC pair and needs to verify the operational status of the vPC peer-link. Which NX-OS command displays vPC status including peer-link and member port states?

Accepted Answer

show vpc. The 'show vpc' command (without any keyword) is the correct choice because it displays comprehensive vPC operational status, including the peer-link state (up/down), member port states, and vPC consistency status. This single command provides a high-level summary of all vPC components, making it the go-to command for initial troubleshooting of vPC peer-link and member port health.

Answer

show vpc brief

Answer

show vpc consistency-parameters

Answer

show vpc peer-keepalive

Question 10

An engineer is implementing VXLAN in a data center. The network must handle BUM traffic without relying on IP multicast in the underlay. Which BUM handling method should be chosen?

Accepted Answer

Ingress replication. In VXLAN environments that must avoid IP multicast in the underlay, ingress replication is the correct BUM handling method. It replicates broadcast, unknown unicast, and multicast (BUM) traffic at the ingress VTEP and sends a copy to each remote VTEP via unicast encapsulation, eliminating the need for multicast group membership in the underlay.

Answer

ARP suppression

Answer

Head-end replication

Answer

Multicast group

Question 11

In a spine-leaf architecture, the oversubscription ratio between leaf switches and spine switches is 3:1. Each leaf has 48 x 10G server ports and 4 x 40G uplinks to the spine. What is the oversubscription ratio at the leaf level?

Accepted Answer

3:1. The oversubscription ratio at the leaf level is calculated by comparing the total bandwidth of the server-facing ports to the total bandwidth of the uplink ports. Each leaf has 48 x 10G server ports (480 Gbps) and 4 x 40G uplinks (160 Gbps). The ratio is 480:160, which simplifies to 3:1. This matches the given spine-leaf oversubscription ratio, confirming that the leaf-level ratio is 3:1.

Answer

1:1

Answer

4:1

Answer

2:1

Question 12

In a VXLAN EVPN fabric, which component is responsible for encapsulating and decapsulating VXLAN packets?

Accepted Answer

VTEP. The VTEP (VXLAN Tunnel Endpoint) is the component responsible for encapsulating Ethernet frames in VXLAN packets and decapsulating them at the destination. It performs the UDP encapsulation with a VXLAN header, using the VNI to identify the Layer 2 segment, and forwards traffic over the underlay network. In an EVPN fabric, the VTEP also participates in the control plane to learn remote MAC and IP addresses via MP-BGP.

Answer

NVE

Answer

VNI

Answer

VXLAN gateway

Question 13

Which STP variant provides per-VLAN load balancing and is commonly used in data center networks with Cisco Nexus switches?

Accepted Answer

Rapid PVST+. Rapid PVST+ (Per-VLAN Spanning Tree Plus) is the correct answer because it provides per-VLAN load balancing by running a separate instance of RSTP (802.1w) for each VLAN. This allows different VLANs to use different root bridges and forwarding paths, enabling traffic load sharing across redundant links. Cisco Nexus switches support Rapid PVST+ as a default or commonly configured STP variant in data center environments, offering fast convergence and VLAN-based traffic engineering.

Answer

MST

Answer

RSTP

Answer

STP

Question 14

A data center architect is designing an ACI fabric with VMM integration to VMware vSphere. The goal is to allow dynamic policy assignment to virtual machines. What is the correct configuration hierarchy to enable this?

Accepted Answer

Create a VMM domain under the tenant, integrate with vCenter, and map EPGs to port groups.. VMM integration in ACI requires creating a VMM domain under a tenant (or common tenant), integrating it with vCenter, and then mapping EPGs to vSphere port groups. This allows dynamic policy assignment to VMs based on their port group membership, enabling micro-segmentation and automated policy enforcement as VMs move across hosts.

Answer

Create a VMM domain under the infra tenant and associate it with the physical domain.

Answer

Use a Layer 4-Layer 7 service graph to connect VMs directly.

Answer

Configure VXLAN directly on the vSphere distributed switch.

Question 15

Which command is used on a Cisco Nexus switch to display the VXLAN network identifier (VNI) associated with a specific VLAN?

Accepted Answer

show vxlan vni. The 'show vxlan vni' command on Cisco Nexus switches displays the VXLAN network identifier (VNI) and its mapping to VLANs, including the associated VLAN ID and segment state. This command directly answers the question by showing the VNI-to-VLAN binding, which is essential for verifying VXLAN overlay configurations.

Answer

show vlan id 100

Answer

show interface nve 1

Answer

show running-config vxlan