350-601 Network — Timed 30 Questions

Question 1

An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?

Accepted Answer

It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.. The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.

Answer

It carries data traffic between vPC peers.

Answer

It is used to synchronize MAC address tables between peers.

Answer

It provides a Layer 3 keepalive to detect peer failure and should be on a separate VLAN.

Question 2

In a VXLAN overlay network, which component is responsible for encapsulating and decapsulating packets and resides at the edge of the underlay network?

Accepted Answer

VTEP. C is correct because the VXLAN Tunnel Endpoint (VTEP) is the device at the edge of the underlay network that performs encapsulation and decapsulation of VXLAN packets. It adds a VXLAN header (including a 24-bit VNI) and outer UDP/IP headers to original Layer 2 frames, and removes them on the receiving side. This function is defined in RFC 7348 and is essential for extending Layer 2 segments over a Layer 3 underlay.

Answer

VNI

Answer

NSX Controller

Answer

Leaf switch

Question 3

An engineer is designing a spine-leaf fabric using eBGP for the underlay. The spine switches are in AS 65000 and each leaf switch uses a different private AS from 65001 to 65010. For optimal convergence and to avoid BGP path hunting, which BGP feature should be configured on the spines?

Accepted Answer

allowas-in 1. In a BGP underlay with a common spine AS (65000) and unique leaf AS, each leaf may receive routes from multiple spines. Without 'allowas-in', when a spine receives a route from a leaf that already contains the spine's own AS in the AS_PATH (because another spine previously advertised it), the spine would reject the update due to AS loop detection. Configuring 'allowas-in 1' on spines allows them to accept routes containing their own AS once, enabling them to consider all available paths and avoid path hunting. Options B, C, and D are incorrect: 'disable-peer-as-check' would ignore AS checks altogether, potentially causing loops; 'multipath-relax' allows multipath with different AS_PATHs but doesn't address the path-hunting issue; 'maxas-limit' limits the maximum AS number but is not relevant to this scenario.

Answer

disable-peer-as-check

Answer

bestpath as-path multipath-relax

Answer

maxas-limit 10

Question 4

In Cisco ACI, which component is responsible for translating EPG communication policies into concrete configuration on leaf switches?

Accepted Answer

APIC controller. The APIC controller is the centralized policy engine in Cisco ACI. It translates high-level EPG communication policies (contracts, filters, subjects) into the concrete switch configuration (e.g., OpFlex policy elements, VXLAN tunnel mappings, and hardware table entries) and pushes them to leaf switches via the OpFlex protocol. Without the APIC, leaf switches cannot autonomously interpret or apply these policies.

Answer

Leaf switch

Answer

Spine switch

Answer

VMM domain

Question 5

A data center network uses MST with multiple instances. Different VLANs are mapped to different MST instances to utilize multiple spanning tree paths. Which MST parameter must be identical on all switches in the same region to ensure proper operation?

Accepted Answer

MST region name and revision number. In MST, all switches within the same region must agree on the region name and revision number to form a consistent MST region. If these parameters differ, switches will treat each other as being in different regions, causing the MST instances to be recalculated as separate CST (Common Spanning Tree) regions, which can lead to suboptimal or broken load balancing across VLANs.

Answer

Port path cost

Answer

Bridge priority

Answer

Max age timer

Question 6

Which NX-OS command displays the vPC consistency parameters and status on a Cisco Nexus switch?

Accepted Answer

show vpc consistency-parameters. The 'show vpc consistency-parameters' command is the correct choice because it directly displays the vPC consistency parameters and their status, which are critical for ensuring that both vPC peer switches have identical configurations for type-1 parameters (e.g., STP, VLANs, MTU). If these parameters mismatch, the vPC will be suspended to prevent traffic loops or forwarding issues. This command is the dedicated tool for verifying consistency before and after vPC configuration changes.

Answer

show vpc peerlink

Answer

show vpc brief

Answer

show running-config vpc

Question 7

In a VXLAN EVPN fabric, BUM traffic can be handled by ingress replication or multicast. Which statement about ingress replication is accurate?

Accepted Answer

The ingress VTEP replicates the BUM packet and sends unicast copies to each remote VTEP.. In ingress replication, the ingress VTEP (VXLAN Tunnel Endpoint) receives a BUM (Broadcast, Unknown unicast, Multicast) packet and creates multiple unicast-encapsulated copies, sending one copy to each remote VTEP in the same VXLAN network identifier (VNI) segment. This method does not rely on any multicast protocol in the underlay; instead, it leverages the VTEP's knowledge of all remote VTEPs (typically learned via the EVPN control plane, such as Type 3 Inclusive Multicast Ethernet Tag routes) to replicate traffic. Option B correctly describes this behavior.

Answer

It requires PIM in the underlay to replicate packets.

Answer

It reduces replication overhead on the ingress VTEP compared to multicast.

Answer

It uses IGMP snooping to optimize replication.

Question 8

An engineer is configuring OSPF in a data center fabric with multiple Nexus 9000 switches. To ensure fast convergence after a link failure, which OSPF feature should be enabled?

Accepted Answer

OSPF Fast Hello. OSPF Fast Hello reduces the dead interval to less than 1 second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF to detect a link failure in milliseconds rather than the default 40 seconds, significantly improving convergence time in a data center fabric where rapid failover is critical.

Answer

OSPF authentication

Answer

OSPF LSA throttling

Answer

OSPF stub area

Question 9

In a spine-leaf architecture with 40 leaf switches and 4 spine switches, each leaf has four 40G uplinks to the spines. What is the oversubscription ratio if each leaf has 48 ports of 10G for servers?

Accepted Answer

3:1. The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48 ports × 10G = 480G of server-facing bandwidth, and 4 uplinks × 40G = 160G of spine-facing bandwidth. The ratio is 480:160 = 3:1, meaning three times as much server bandwidth as uplink bandwidth, which is a common design target in Cisco ACI and NX-OS spine-leaf fabrics.

Answer

2:1

Answer

5:1

Answer

4:1

Question 10

Which Cisco Data Center Network Manager component is used for centralized fabric management and automation of Nexus switches?

Accepted Answer

DCNM. Cisco Data Center Network Manager (DCNM) is the centralized management platform specifically designed for fabric management, provisioning, and automation of Nexus switches in data center environments. It provides a single pane of glass for configuring, monitoring, and troubleshooting Nexus-based fabrics, including VXLAN EVPN, Cisco ACI, and traditional SAN/Nexus environments.

Answer

Cisco ISE

Answer

Prime Infrastructure

Answer

APIC

Question 11

In an ACI fabric, an EPG is configured with a contract that provides a service to another EPG. The contract has a filter for TCP port 80. Which component defines the directionality of the communication between the provider and consumer EPG?

Accepted Answer

The provider and consumer labels in the contract. In Cisco ACI, the provider and consumer labels in the contract define the directionality of communication. The provider EPG offers a service, and the consumer EPG initiates the request; the contract's provider/consumer relationship determines which EPG can start the conversation and in which direction the filter (e.g., TCP port 80) applies. This is fundamental to ACI's policy model, where the contract is unidirectional from consumer to provider by default.

Answer

The filter direction specified in the contract

Answer

The BD subnets

Answer

The subject of the contract

Question 12

An engineer needs to extend a Layer 2 VLAN across a VXLAN EVPN fabric. Which construct maps the VLAN to the overlay network?

Accepted Answer

VNI. In a VXLAN EVPN fabric, the VNI (VXLAN Network Identifier) is the construct that maps a Layer 2 VLAN to the overlay network. The VNI uniquely identifies a Layer 2 segment across the underlay, allowing VLAN traffic to be encapsulated and transported over the IP fabric. This mapping is configured on the VTEP (VXLAN Tunnel Endpoint) using commands like 'vlan 100' mapped to 'vn-segment 10100' under the VLAN configuration.

Answer

VLAN ID

Answer

VTEP IP

Answer

VPC

Question 13

An engineer is designing a VXLAN EVPN fabric with multicast-based BUM replication. Which two components are required to support this? (Choose two.)

Accepted Answer

A multicast group address per VNI. Option A is correct because in a VXLAN EVPN fabric using multicast-based BUM replication, each VNI must be mapped to a unique multicast group address in the underlay. This allows the underlay multicast tree to efficiently deliver broadcast, unknown unicast, and multicast traffic to all VTEPs that are members of that VNI, without requiring the ingress VTEP to replicate packets individually.

Answer

NVE interface with multicast group

Answer

BGP EVPN address family

Answer

Ingress replication configured

Question 14

Which three checks are part of the vPC type-1 consistency check? (Choose three.)

Accepted Answer

STP mode. Type-1 consistency parameters are critical and must match on both vPC peers; they include STP mode, MST region, VLAN configuration, and vPC-related parameters like role priority. STP mode, MST region name, and VLAN interface configuration are type-1.

Answer

Port-channel load-balancing method

Answer

MTU on the peer-link

Question 15

An engineer is deploying a new application in an ACI fabric. Which two objects must be created to define a network policy? (Choose two.)

Accepted Answer

Bridge Domain. In Cisco ACI, a network policy is defined by the combination of a Tenant and a Bridge Domain. The Tenant is the top-level container that isolates policies and configurations, while the Bridge Domain defines the Layer 2 forwarding boundary and associates the subnet, enabling communication within the fabric. Without these two objects, a network policy cannot be fully realized.

Answer

VRF

Answer

External routed network

Answer

VMM domain

Question 16

An engineer is deploying a VXLAN overlay network in a data center using Cisco Nexus 9000 series switches. The network must handle BUM traffic efficiently across the fabric. Which method for BUM traffic handling requires the VTEP to maintain a list of all remote VTEPs and replicate packets individually?

Accepted Answer

Ingress replication. Ingress replication (Option D) is the correct method because it requires the ingress VTEP to maintain a list of all remote VTEPs in the VXLAN segment and replicate each BUM packet individually to each remote VTEP. This is a unicast-based replication approach that does not rely on multicast in the underlay, making it suitable for networks where multicast is not enabled or desired.

Answer

Multicast-based replication

Answer

Suppression of BUM traffic

Answer

Head-end replication

Question 17

In a Cisco ACI fabric, which component is responsible for policy enforcement and management of the entire infrastructure?

Accepted Answer

APIC controller. The APIC (Application Policy Infrastructure Controller) is the central policy and management entity in Cisco ACI. It enforces the application-centric policy model, manages the fabric's operational state, and provides the single point of configuration and monitoring for the entire ACI fabric. Without the APIC, the leaf and spine switches operate as standalone devices with no centralized policy enforcement.

Answer

Leaf switch

Answer

DCNM

Answer

Spine switch

Question 18

A data center engineer is configuring vPC on a pair of Cisco Nexus switches. The vPC peer-link is established but the vPC member ports remain suspended. After checking the configuration, the engineer notices that the vPC peer-keepalive link is not functioning. What is the most likely cause of the suspended member ports?

Accepted Answer

Peer-keepalive link failure causing dual-active detection issues. When the vPC peer-keepalive link fails, each vPC peer switch cannot detect whether the other peer is operational. This triggers the dual-active detection mechanism, causing the secondary switch to suspend its vPC member ports to prevent a split-brain scenario where both switches forward traffic for the same vPC VLAN. The suspended state is a protective measure until the peer-keepalive link is restored or the vPC role is resolved.

Answer

MTU mismatch on the peer-link

Answer

Mismatched vPC domain ID

Answer

Incorrect VLAN configuration on member ports

Question 19

In a spine-leaf architecture using eBGP as the routing protocol, what is the primary purpose of using eBGP rather than iBGP between spine and leaf switches?

Accepted Answer

To avoid the need for an IGP and simplify configuration. In a spine-leaf architecture using eBGP, the primary purpose is to avoid the need for an IGP (such as OSPF or IS-IS) and simplify configuration. eBGP between spine and leaf switches allows each leaf to be in a different private AS (e.g., 65001–650XX), and the spine can use the BGP AS_PATH to detect and prevent loops without requiring an underlying IGP. This eliminates the complexity of running a separate IGP for underlay routing, reducing operational overhead and configuration steps.

Answer

To enable faster convergence than OSPF

Answer

To support EVPN address families

Answer

To allow for unequal-cost load balancing

Question 20

An engineer is configuring MST on a pair of Cisco Nexus switches that will be part of a vPC domain. The vPC peer-link will carry multiple MST instances. Which MST parameter must be identical on both vPC peers to ensure proper operation?

Accepted Answer

MST region configuration (name, revision, mapping). In a vPC domain with MST, both peers must share an identical MST region configuration (name, revision number, and VLAN-to-instance mapping) to ensure they agree on which VLANs belong to which MST instance. Without matching region configurations, the switches would treat each other as being in different MST regions, breaking the common spanning tree topology required for the vPC peer-link to properly carry multiple MST instances.

Answer

PortFast and BPDUguard settings

Answer

STP root bridge priority

Answer

STP path cost for instance 0