350-601 Network Practice Test 6 — 15 Questions

Question 1

A data center network uses Cisco Nexus switches with VXLAN EVPN. Which two components are essential for VXLAN EVPN operation? (Choose two.)

Accepted Answer

VXLAN VTEPs on leaf switches.. VXLAN VTEPs (VXLAN Tunnel Endpoints) on leaf switches are essential because they perform the encapsulation and decapsulation of VXLAN frames, enabling Layer 2 overlay networks over a Layer 3 underlay. Without VTEPs, there is no mechanism to create the VXLAN tunnels that carry traffic between endpoints across the IP fabric.

Answer

OSPF as underlay routing protocol.

Answer

VPC for host-facing links.

Answer

PIM-SM for multicast replication.

Question 2

When troubleshooting a VXLAN EVPN fabric with Cisco Nexus 9000 switches, which three commands provide information about the EVPN operation? (Choose three.)

Accepted Answer

show bgp l2vpn evpn summary.. The 'show bgp l2vpn evpn summary' command is correct because it displays the BGP session status for the L2VPN address family, which is the control plane protocol for VXLAN EVPN. This command shows neighbor states, prefixes received, and route table statistics, directly indicating whether EVPN route exchange is operational.

Answer

show running-config interface nve1.

Answer

show ip interface brief.

Question 3

An engineer is designing a Cisco ACI multi-site solution. Which two considerations are critical for inter-site connectivity? (Choose two.)

Accepted Answer

Deploy a L3Out at each site for external connectivity.. In Cisco ACI Multi-Site, each site operates with its own APIC cluster and independent fabric. A L3Out at each site is critical because it provides external connectivity for that site's endpoints, allowing traffic to exit locally rather than being hair-pinned across the inter-site network. This design optimizes traffic flow and aligns with the Multi-Site architecture where sites are managed separately but interconnected via the Inter-Site Network (ISN).

Answer

Configure a stretch VLAN across sites.

Answer

Use a separate OSPF process per site.

Answer

Use a single APIC cluster for both sites.

Question 4

A large enterprise data center is deploying a new application using Cisco ACI with a multi-pod design. The application requires low-latency communication between servers in different pods. The network team has configured the ACI fabric with two pods, each connected via inter-pod network (IPN) switches. After deployment, the application experiences intermittent latency spikes and packet loss. The APIC health scores remain high but the latency issue persists. The team has verified the underlay IP connectivity and MTU settings. What is the most likely cause of the latency issues?

Accepted Answer

The CoS settings for the application traffic are not properly mapped to the appropriate queue on the IPN switches.. In a Cisco ACI multi-pod design, the IPN switches must properly trust and map the CoS values from the ACI fabric to the appropriate egress queues. If the CoS markings are not correctly configured on the IPN switches, application traffic can experience buffer drops and latency spikes even when the underlay has sufficient bandwidth and the APIC health scores are high. This is a common misconfiguration because the IPN switches are Layer 3 devices that require explicit QoS policies to preserve the ACI fabric's priority handling.

Answer

The application servers are using different VLANs that are not stretched between pods.

Answer

The IPN switches are using a shared link aggregation group that is causing traffic congestion.

Answer

The inter-pod network is not configured with enough bandwidth due to oversubscription.

Question 5

A financial services company is migrating its core banking application to a new data center built on Cisco Nexus 9000 switches with VXLAN EVPN. The application requires active-active multihoming for its servers, which are dual-homed to two leaf switches. The network team has configured vPC on the leaf switches for the server connections. After the migration, the application team reports that some packets are being dropped during failover events when one of the vPC member links goes down. The network team confirms that vPC is properly configured and the peer-keepalive is functioning. What is the most likely cause of packet drops during failure?

Accepted Answer

The vPC consistency parameters are not identical between the peer switches.. In a vPC setup, if the consistency parameters (such as STP, VLAN, or interface configurations) are not identical between the two vPC peer switches, the vPC will not forward traffic correctly during a link failure. This mismatch can cause packet drops during failover events, even though the peer-keepalive is functioning. The Cisco Nexus 9000 series requires strict consistency checks to ensure loop-free and seamless failover in VXLAN EVPN environments.

Answer

The vPC peer-gateway feature is not enabled.

Answer

The vPC orphan port configuration is missing.

Answer

The vPC role is not configured with preempt.

Question 6

A mid-size organization is upgrading its data center network to support server virtualization. They have deployed two Nexus 9300 switches as access switches for their server racks. The servers are configured with VLAN tagging and connect to the switches using trunks. The network administrator needs to ensure that the switches can provide default gateway services to the servers to reduce latency. They have configured interface VLAN interfaces and HSRP for redundancy. After implementation, the servers can communicate within the same VLAN but fail to reach the default gateway. The network administrator checks the switch configuration and finds that "ip routing" is not enabled globally. What is the most likely impact of this missing configuration?

Accepted Answer

The switches will not forward traffic between VLANs.. Without the 'ip routing' command enabled globally, the Nexus 9300 switches operate as Layer 2 devices only. This means they can forward frames within the same VLAN (since that relies on MAC address learning and switching), but they cannot perform IP routing between VLANs or route traffic to the configured SVI (VLAN interface) default gateway. The servers can communicate within the same VLAN because that is purely Layer 2 switching, but any attempt to reach the default gateway (which requires Layer 3 forwarding) fails because the switch does not have IP routing enabled.

Answer

The servers will not receive DHCP addresses.

Answer

HSRP will not elect an active router.

Answer

The VLAN interfaces will not come up.

Question 7

A large cloud provider is building a new data center using Cisco ACI with multiple leaf and spine switches. They plan to host thousands of tenants with overlapping IP addresses in different VRFs. The network team has deployed the fabric with a common security policy. During testing, they discover that traffic from Tenant A to Tenant B is being allowed even though a contract should deny it. The APIC policy shows the contract is applied to the EPGs and the deny rule is present. What is the most likely cause of the policy not being enforced?

Accepted Answer

The leaf switches have not downloaded the updated policy.. In Cisco ACI, the leaf switches enforce contracts locally based on the policy downloaded from the APIC. If a contract is correctly configured on the APIC but traffic is still permitted, the most likely cause is that the leaf switches have not yet received or applied the updated policy. This can happen due to a delay in policy propagation, a communication issue between the APIC and leaf switches, or the leaf not having completed the policy resolution process.

Answer

The fabric is using VRF leaking that bypasses contracts.

Answer

The contract is not configured with the correct subject.

Answer

The EPGs are in the same bridge domain.

Question 8

A network engineer is troubleshooting an OSPF adjacency that fails to reach FULL state between two Nexus 9000 switches. Which TWO are common causes for this issue?

Accepted Answer

Mismatched area ID. OSPF requires that both routers in a neighbor relationship belong to the same area. If the area IDs differ, the routers will not exchange routing information and the adjacency will stall at the EXSTART or EXCHANGE state, never reaching FULL. This is a fundamental OSPF neighbor requirement defined in RFC 2328.

Answer

Mismatched OSPF process ID

Answer

Mismatched router ID

Answer

Mismatched network type

Question 9

A data center runs OSPF as the underlay for an EVPN-VXLAN fabric. The fabric includes two spine switches and eight leaf switches. After adding a new leaf switch, the network team notices that some EVPN routes are missing from the other leaves. The new leaf has established BGP EVPN sessions to both spines and the BGP sessions are up. The spines report receiving all routes from the new leaf, but the other leaves do not receive certain prefixes. The engineer checks the BGP configuration on the new leaf and sees the address-family l2vpn evpn is configured under router bgp. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify the new leaf has the address-family l2vpn evpn activated under the neighbor configuration. The issue is that the new leaf has BGP EVPN sessions to both spines, but other leaves do not receive certain prefixes. Since the spines (acting as route reflectors) receive all routes from the new leaf but do not propagate them to other leaves, the most likely cause is that the address-family l2vpn evpn is not activated under the neighbor configuration on the new leaf. Without this activation, the new leaf does not advertise its EVPN routes to the spines, even though the BGP session is up and the address-family is configured globally under router bgp.

Answer

Check the new leaf's BGP router ID for uniqueness

Answer

Ensure the new leaf's BGP next-hop-self is enabled

Answer

Verify the cluster ID on the route reflectors is consistent

Question 10

A large enterprise uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric. The underlay is OSPF. Each leaf switch has a loopback0 interface as the source interface for VXLAN tunnel endpoints. After a maintenance window, an engineer modifies the IP address of loopback0 on leaf-5 from 10.1.1.5/32 to 10.1.1.105/32. Subsequently, all VXLAN tunnels to leaf-5 go down. OSPF adjacencies between leaf-5 and the spines are still FULL. The engineer checks the NVE interface on leaf-5 and sees the source-interface is loopback0 but the interface status is up/up. However, pings from other leaves to 10.1.1.105 fail. What is the most likely cause?

Accepted Answer

The new loopback IP 10.1.1.105 is not included in the OSPF network statement under router ospf. After changing the loopback0 IP address on leaf-5, the new IP 10.1.1.105/32 must be explicitly advertised into OSPF for other leaves to reach it. If the OSPF network statement under router ospf still references the old subnet or does not include 10.1.1.105/32, the route for this new loopback IP will not be installed in the OSPF database. Consequently, other leaves cannot route to the new VTEP IP, causing VXLAN tunnels to fail even though OSPF adjacencies remain FULL (since adjacencies are formed over physical interfaces, not the loopback).

Answer

The OSPF process on leaf-5 was not restarted after the IP change

Answer

The MTU on loopback0 is set too low causing OSPF hello drops

Answer

The VXLAN source-interface was automatically changed to a different loopback

Question 11

An engineer is troubleshooting a VXLAN network where traffic between two VTEPs in the same VNI is not being forwarded. The underlay network is operational and IP connectivity exists between the VTEPs. Which two actions should the engineer take to verify the VXLAN configuration?

Accepted Answer

Verify that the NVE interface is configured with the correct source-interface.. The NVE interface's source-interface (typically a loopback) defines the local VTEP IP address used for VXLAN encapsulation. If this source-interface is misconfigured or not reachable from the remote VTEP, VXLAN packets will not be sourced from the correct IP, breaking traffic forwarding even when underlay IP connectivity exists.

Answer

Verify that the multicast group for BUM traffic is reachable.

Answer

Verify that the VXLAN tunnel endpoint IP addresses are in the same subnet.

Answer

Verify that the VXLAN routing table is populated correctly.

Question 12

Refer to the exhibit. An engineer configured a VXLAN tunnel endpoint (VTEP) but the VXLAN tunnel is not operational. The underlay OSPF adjacency is established. What is the missing configuration?

Accepted Answer

The loopback0 interface is not included in the OSPF process.. The loopback0 interface is not included in the OSPF process. For VXLAN underlay routing, the VTEP source interface (typically loopback0) must be advertised via the underlay IGP (OSPF) so that remote VTEPs can reach it. Without this, the NVE interface cannot form a VXLAN tunnel even though OSPF adjacency is established, as the source IP is unreachable.

Answer

The NVE interface must be enabled with the no shutdown command.

Answer

The multicast group must be reachable via the underlay.

Answer

The VNI must be mapped to a VLAN.

Question 13

An organization has deployed a pair of Nexus 93180YC-EX switches as vPC peers in a data center. The switches are connected to a server with two 10GbE interfaces configured as an LACP port-channel. The vPC configuration has been verified and was working correctly for months. After a scheduled maintenance window that included upgrading the NX-OS software from version 7.0(3)I7(1) to 7.0(3)I7(5), the server begins experiencing frequent link flaps on the port-channel. The server administrator reports that every 5-10 minutes, the link goes down for about 2 seconds and then recovers. The network team checks the logs on the Nexus switches and sees repeated messages: 'LACP-3-MISCONFIG: Port-channel <channel> is misconfigured: partner not on same aggregator.' The 'show vpc brief' output shows all vPCs in the 'up' state. The 'show port-channel summary' shows the port-channel is up with both member ports in the bundle. What is the most likely root cause?

Accepted Answer

The LACP system priority is not configured consistently between the vPC peers, causing the LACP system identifier to differ.. In a vPC setup, both peer switches must have the same LACP system identifier (derived from system priority and MAC address) so the server sees a single logical partner. If the LACP system priority is not consistent across the peers, the system identifiers will differ, causing the server to detect multiple partners, leading to the 'partner not on same aggregator' error and link flaps. Option A is incorrect because the LACP rate timer mismatch would cause constant timeout issues, not intermittent flaps with the specific log message. Option B is incorrect because VLAN mismatch would cause persistent connectivity failures, not intermittent flaps. Option C is incorrect because delay-restore timer affects recovery after link failure, not during steady-state operation.

Answer

The LACP fast rate timer default changed to slow in the new software, causing a timeout mismatch with the server.

Answer

The vPC delay-restore timer is set too low, causing the vPC to prematurely come up before LACP is fully up.

Answer

The vPC peer-link VLAN allowed list does not include the server's VLAN, causing intermittent drops.

Question 14

An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?

Accepted Answer

It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.. The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.

Answer

It carries data traffic between vPC peers.

Answer

It is used to synchronize MAC address tables between peers.

Answer

It provides a Layer 3 keepalive to detect peer failure and should be on a separate VLAN.

Question 15

In a VXLAN overlay network, which component is responsible for encapsulating and decapsulating packets and resides at the edge of the underlay network?

Accepted Answer

VTEP. C is correct because the VXLAN Tunnel Endpoint (VTEP) is the device at the edge of the underlay network that performs encapsulation and decapsulation of VXLAN packets. It adds a VXLAN header (including a 24-bit VNI) and outer UDP/IP headers to original Layer 2 frames, and removes them on the receiving side. This function is defined in RFC 7348 and is essential for extending Layer 2 segments over a Layer 3 underlay.

Answer

VNI

Answer

NSX Controller

Answer

Leaf switch