350-601 Network Practice Test 5 — 15 Questions

Question 1

A network engineer is configuring Cisco Nexus VXLAN with BGP EVPN. The VTEPs are using loopback0 as the NVE source. The physical interfaces are up, but the NVE interface remains down. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The loopback0 interface is not reachable via the underlay network.. The NVE interface requires the specified source interface (loopback0) to have IP reachability via the underlay network to establish VXLAN tunnels. If loopback0 is not reachable (e.g., due to missing OSPF/IS-IS routes or incorrect underlay configuration), the NVE interface will remain in a down state even if the physical interfaces are up. This is because the NVE interface depends on the underlay routing to encapsulate and forward VXLAN traffic.

Answer

The NVE interface is not configured with source-interface.

Answer

The VLAN 1 is not associated with the NVE interface.

Answer

The loopback0 interface is not created.

Question 2

In a Cisco ACI fabric, a tenant has multiple bridge domains in the same VRF all with 'Unicast Routing' enabled and hardware proxy mode. However, endpoints in different BDs within the same VRF cannot communicate even with a contract. What is a possible reason?

Accepted Answer

The 'ARP Flooding' is enabled.. When 'Unicast Routing' is enabled on a bridge domain (BD) in hardware proxy mode, the ACI fabric relies on hardware proxy for forwarding. In this mode, ARP flooding should be disabled to prevent excessive flooding and allow the fabric to properly resolve ARP via the COOP database. If 'ARP Flooding' is enabled, the fabric floods ARP requests across all BDs, which can cause ARP resolution to fail for endpoints in different BDs because the hardware proxy expects ARP to be handled differently. This prevents inter-BD communication even with a contract in place. Therefore, having 'ARP Flooding' enabled is a possible reason for the communication failure.

Answer

The 'L3 Unknown Multicast Flooding' is set to flood.

Answer

The contracts are unidirectional.

Answer

The bridge domains are in different subnets.

Question 3

Which TWO characteristics are true about Cisco VPC? (Choose two)

Accepted Answer

VPC allows dual-homing of a server to two different switches.. Cisco Virtual PortChannel (vPC) allows a server to be dual-homed to two different switches, enabling active-active load balancing and link redundancy. This is achieved by making the two switches appear as a single logical switch to the downstream device using the vPC protocol, which synchronizes state and forwarding information across the peer link.

Answer

VPC keepalive uses Layer 2 connectivity.

Answer

VPC requires a dedicated management VLAN.

Answer

VPC member ports can be on different VLANs on each peer.

Question 4

Which THREE components are part of an EVPN VXLAN fabric? (Choose three)

Accepted Answer

MP-BGP. MP-BGP is the control plane protocol for EVPN VXLAN fabrics. It advertises MAC/VPN reachability information using EVPN address families (L2VPN AFI/SAFI 70/128) and enables overlay route distribution between VTEPs. Without MP-BGP, the fabric cannot dynamically learn remote MAC addresses or maintain a scalable, loop-free control plane.

Answer

IS-IS

Answer

VPC

Question 5

Which TWO statements are true about Cisco ACI contracts? (Choose two)

Accepted Answer

Contracts can be reused across multiple EPGs.. Cisco ACI contracts are designed as reusable policy constructs. Once a contract is defined, it can be applied to multiple EPGs (Endpoint Groups) without redefining the rules, promoting consistency and reducing administrative overhead. This reusability is a core principle of ACI's policy-based networking model.

Answer

Contracts are unidirectional from consumer to provider.

Answer

Subjects within a contract specify only the destination ports.

Answer

Contracts are always bidirectional.

Question 6

Refer to the exhibit. A network engineer notices that the NVE1 interface is up but VXLAN traffic is not being encapsulated. What is the most likely cause?

Accepted Answer

The BGP EVPN address-family is not activated.. VXLAN traffic encapsulation on the NVE1 interface requires the BGP EVPN address-family to be activated under the BGP configuration to exchange VNI-to-VTEP mappings. Without this address-family, the NVE interface cannot learn remote VTEPs, so VXLAN packets are never encapsulated with the outer UDP/IP header.

Answer

The VNI 10000 is not mapped to a VLAN.

Answer

The ingress replication protocol must be static.

Answer

The loopback0 interface is not configured.

Question 7

Refer to the exhibit. A network engineer notices that the VPC peer status is down, and the peer-keepalive is not reachable. Based on the configuration, what is the likely issue?

Accepted Answer

The peer-keepalive destination must be on the management VRF.. The peer-keepalive link must be routed via the management VRF to ensure it remains independent of the data-plane and peer-link state. If the peer-keepalive destination is not in the management VRF, the keepalive packets may be dropped or unreachable, causing the VPC peer status to remain down. The configuration shown likely omits the 'vrf member management' under the peer-keepalive configuration, or the destination IP is not reachable through the management interface.

Answer

The peer-link port-channel10 has VLAN 100-110 allowed, but the peer-keepalive uses a separate VLAN.

Answer

The VPC domain priority should be lower.

Answer

The peer-keepalive source and destination are swapped.

Question 8

Refer to the exhibit. A network administrator configured VXLAN EVPN as above. The VTEP can communicate with neighbors on VNI 5001, but cannot reach the default gateway for VNI 5002. What is the problem?

Accepted Answer

The route-target for VNI 5002 is missing.. The VXLAN EVPN configuration for VNI 5002 is missing the route-target import/export statements under the VRF TenantA address-family l2vpn evpn. Without the route-target, the VTEP cannot import EVPN type-2 and type-3 routes for VNI 5002, preventing it from learning the default gateway's MAC/IP or the IMET route needed for BUM traffic. This explains why the VTEP can communicate on VNI 5001 (which has route-targets) but not reach the gateway on VNI 5002.

Answer

The default route in VRF TenantA is not exported.

Answer

The VNI 5002 does not have an associated VLAN.

Answer

The NVE interface does not have ingress-replication configured.

Question 9

A network engineer is configuring OSPF on a pair of Nexus 9000 switches acting as spine switches in a VXLAN fabric. The engineer needs to ensure that the spine switches do not become the DR for any VLAN. Which configuration should be applied?

Accepted Answer

Set ospf priority to 0 on the spine interfaces.. Setting the OSPF priority to 0 on the spine interfaces prevents the spine switches from participating in the DR/BDR election process, ensuring they never become the Designated Router (DR) for any VLAN. This is the standard method to suppress DR election on a multi-access network segment.

Answer

Configure passive-interface default under OSPF.

Answer

Set ospf network type to point-to-multipoint.

Answer

Set ospf priority to 255 on the spine interfaces.

Question 10

An engineer is troubleshooting high CPU utilization on a Nexus 7700 switch. The output of 'show process cpu' shows high usage from the 'netstack' process. Which action should the engineer take to identify the cause?

Accepted Answer

Use 'show system internal netstack stats'.. The 'netstack' process handles network stack operations, including packet processing and forwarding. The 'show system internal netstack stats' command provides detailed internal statistics about the netstack process, such as packet drops, buffer usage, and error counters, which help pinpoint the root cause of high CPU utilization.

Answer

Enable 'feature netstack' to get more details.

Answer

Reboot the switch to clear the process.

Answer

Check for broadcast storms using 'show interface'.

Question 11

In a Cisco ACI fabric, the administrator notices that traffic between two endpoints in different EPGs but on the same leaf switch is being dropped when a contract is applied. The endpoints are in the same VRF but different bridge domains. What is the likely cause?

Accepted Answer

The contract does not allow communication between those EPGs.. In Cisco ACI, inter-EPG communication is governed by contracts. Even when endpoints reside on the same leaf switch, same VRF, and different bridge domains, traffic is dropped unless a contract explicitly permits the communication between the source and destination EPGs. The contract defines the filter (e.g., IP protocol, ports) and the direction (provider/consumer) required for traffic to flow.

Answer

The VRF is not configured correctly.

Answer

The bridge domains are not in the same network.

Answer

The leaf switch is missing a route to the destination.

Question 12

A data center network uses VXLAN EVPN for network virtualization. Which component is responsible for advertising MAC addresses and host routes across the fabric?

Accepted Answer

MP-BGP EVPN address family.. In a VXLAN EVPN fabric, the MP-BGP EVPN address family (AFI L2VPN / SAFI EVPN) is the control plane protocol that distributes MAC addresses, IP-to-MAC bindings, and host routes (Type-2 routes) across all VTEPs. This enables each VTEP to build its forwarding table dynamically without relying on data-plane learning or flooding, ensuring optimal east-west traffic forwarding.

Answer

Static routing.

Answer

OSPF.

Answer

VXLAN VTEP.

Question 13

During a network upgrade, an engineer applies a new OSPF configuration on a Nexus 9000 spine. After the change, several leaf switches lose connectivity to each other. The engineer examines the logs and sees OSPF adjacency flapping. What is the most likely cause?

Accepted Answer

Duplicate router IDs.. Duplicate router IDs cause OSPF adjacency flapping because OSPF uses the Router ID (RID) to uniquely identify each router in the OSPF domain. When two routers share the same RID, they reject each other's Hello packets, leading to repeated adjacency resets. In a Nexus 9000 spine-leaf topology, this often occurs when the spine's RID is accidentally configured to match an existing leaf's RID, disrupting the entire fabric's OSPF convergence.

Answer

OSPF hello timer mismatch.

Answer

MTU mismatch on the fabric links.

Answer

Incorrect area configuration.

Question 14

An administrator is deploying a new application in a Cisco ACI fabric. The application requires multicast traffic between end hosts. Which configuration is necessary for multicast in ACI?

Accepted Answer

Create a multicast policy in the bridge domain.. In Cisco ACI, multicast forwarding is enabled at the bridge domain level using a multicast policy. This policy configures the necessary IGMP snooping and multicast group membership for the fabric, allowing end hosts to receive multicast traffic without requiring PIM on the leaf switches. Option C is correct because the bridge domain multicast policy is the required configuration for multicast in ACI.

Answer

Enable PIM on the leaf switches.

Answer

Configure a multicast group in the EPG.

Answer

Use IGMP snooping only.

Question 15

An engineer is troubleshooting a BGP EVPN session between a leaf and a spine. The 'show bgp l2vpn evpn summary' output shows the peer state as 'Active'. What does this indicate?

Accepted Answer

The TCP connection is not established.. In BGP EVPN, the 'Active' state indicates that the BGP speaker is actively trying to establish a TCP connection with the peer but has not yet completed the three-way handshake. This means the TCP session is not established, which is a prerequisite for BGP session establishment. The peer remains in 'Active' until the TCP connection is successfully formed.

Answer

The session is in the process of being established.

Answer

The session is up and exchanging prefixes.

Answer

There is a configuration mismatch.