350-601 Network — Timed 10 Questions

Question 1

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

10 minute time limit — choose an answer to begin.

Accepted Answer

VRF. The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default. This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Answer

Context (default)

Answer

Application-profile

Answer

Global

Question 2

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

Accepted Answer

The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract. In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.

Answer

The contract is applied but not enforced due to a configuration error

Answer

The VRF has a default route that bypasses contract enforcement

Answer

A preferred group contract is applied to the VRF

Question 3

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Accepted Answer

Both switches must run the same NX-OS software version. Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.

Answer

Both switches must use the same routing protocol

Answer

The peer-keepalive link must be carried over the peer-link

Question 4

A data center design requires Layer 2 extension between two sites using OTV. The network engineer notices that MAC addresses from Site A are not learned at Site B. OTV adjacency is up, and both sites have the same overlay interface configured. Which configuration issue is most likely the cause?

Accepted Answer

The site VLAN is not allowed on the OTV join interface.. D is correct because the OTV join interface must have the site VLAN allowed; if the site VLAN is not permitted on the join interface, the OTV edge device cannot send or receive encapsulated traffic for that VLAN, preventing MAC address learning between sites even though the OTV adjacency is up.

Answer

The OTV control group is misconfigured on one side.

Answer

The spanning tree root bridge is different at each site.

Answer

The multicast group range for the overlay does not match.

Question 5

Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?

Accepted Answer

Enable the address-family l2vpn evpn under the BGP configuration.. In VXLAN EVPN, BGP is used as the control plane to exchange MAC and IP reachability information. Enabling the address-family l2vpn evpn under BGP configuration is mandatory to advertise EVPN routes (type-2 and type-3) between VTEPs, which is the foundation of the centralized anycast gateway model.

Answer

Enable IGMP snooping on all VLANs extended over VXLAN.

Answer

Set the VXLAN destination UDP port to 8472.

Answer

Create an NVE interface with a loopback interface as the source.

Question 6

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 1 is not allowed on the trunk, so untagged frames are dropped.. The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1. This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Answer

The spanning-tree port type edge trunk is causing BPDU guard to block the port.

Answer

The port is in err-disabled state due to a loop.

Answer

The port is administratively down.

Question 7

You are a network engineer at a financial institution. The company has two data centers: DC1 and DC2, connected via a dark fiber link. Each data center has a pair of Nexus 7000 switches in a vPC configuration. The dark fiber link connects to a port on each Nexus 7000 pair using a Layer 2 port-channel. The requirement is to extend VLAN 100 between the two data centers for a critical application that requires a stretched Layer 2 domain. The current configuration has the port-channel on both sides set to mode 'active' with LACP. VLAN 100 is allowed on the trunk. The application servers report intermittent connectivity issues, with some packets being dropped. Upon inspection, you notice that the MAC address table on the Nexus 7000 in DC1 shows the MAC address of the server in DC2 on the dark fiber port-channel interface, but also on a local access port connected to a different server in the same VLAN. What is the most likely cause of the intermittent connectivity?

Accepted Answer

Spanning Tree Protocol is not blocking one of the redundant paths, creating a loop.. The MAC address table showing the same MAC address on both the dark fiber port-channel and a local access port indicates a Layer 2 loop. In a vPC environment with a Layer 2 extension between data centers, Spanning Tree Protocol (STP) should block one of the redundant paths to prevent loops. If STP fails to block the appropriate port, frames loop, causing MAC address flapping and intermittent packet drops.

Answer

The dark fiber link is experiencing high latency, causing MAC address timeouts.

Answer

LACP is misconfigured on one side, causing the port-channel to operate as individual links.

Answer

There is an asymmetric routing issue between the data centers.

Question 8

Arrange the steps to configure a vPC domain on a pair of Cisco Nexus switches.

Accepted Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports. vPC requires feature vPC, then domain creation, keepalive link, peer-link, and member ports.

Answer

Step 1: Enable feature vPC, Step 2: Create vPC domain, Step 3: Configure peer-link, Step 4: Configure keepalive link, Step 5: Add member ports

Answer

Step 1: Create vPC domain, Step 2: Enable feature vPC, Step 3: Configure keepalive link, Step 4: Configure peer-link, Step 5: Add member ports

Answer

Step 1: Enable feature vPC, Step 2: Configure keepalive link, Step 3: Create vPC domain, Step 4: Configure peer-link, Step 5: Add member ports

Question 9

Match each Cisco data center technology to its primary purpose.

Accepted Answer

VDC: Enables partitioning a single physical switch into multiple logical switches.. VDC partitions switches; VPC provides redundant LAG; FEX extends fabric ports; OTV extends Layer 2 over Layer 3.

Answer

VPC: Enables partitioning a single physical switch into multiple logical switches.

Answer

FEX: Allows a link aggregation group to terminate on two upstream switches for redundancy.

Question 10

After adding a new spine switch to a VXLAN EVPN fabric with OSPF underlay, some leaf switches experience routing instability. Which action could resolve the instability?

Accepted Answer

Increase the OSPF cost on the leaf-to-spine links.. When a new spine switch is added to a VXLAN EVPN fabric with an OSPF underlay, the leaf switches may experience routing instability because the new spine advertises routes with a lower cost, causing traffic to shift abruptly. Increasing the OSPF cost on the leaf-to-spine links makes those paths less preferred, stabilizing the routing table by preventing flapping and ensuring a more gradual convergence.

Answer

Configure OSPF neighbor authentication.

Answer

Decrease the OSPF hello timer.

Answer

Enable OSPF route summarization on the leaves.