350-601 Hard Questions — 25 Difficult Questions

Question 1

During an FCoE deployment, the server team reports that hosts can reach the storage array but performance is intermittent with periodic timeouts. The network team sees no errors on the FCoE VLAN. The DCB configuration on the upstream switch shows that PFC is enabled for CoS 3. What should the engineer check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the PFC configuration matches on both ends and that PFC is enabled on the FCoE VLAN interfaces. D is correct because PFC (Priority Flow Control) must be consistently configured on both ends of an FCoE link to prevent frame loss. If PFC is enabled for CoS 3 on the upstream switch but not on the server's vNIC or the FCoE VLAN interfaces, the lack of lossless behavior causes intermittent timeouts and performance degradation, even if the FCoE VLAN shows no errors.

Answer

Verify that jumbo frames are enabled on the storage array

Answer

Confirm that the VSAN is appropriately sized for the number of hosts

Answer

Ensure that the FCoE VLAN is enabled for FCoE on the server's vNIC

Question 2

In a Cisco ACI fabric, a tenant has multiple bridge domains in the same VRF all with 'Unicast Routing' enabled and hardware proxy mode. However, endpoints in different BDs within the same VRF cannot communicate even with a contract. What is a possible reason?

Accepted Answer

The 'ARP Flooding' is enabled.. When 'Unicast Routing' is enabled on a bridge domain (BD) in hardware proxy mode, the ACI fabric relies on hardware proxy for forwarding. In this mode, ARP flooding should be disabled to prevent excessive flooding and allow the fabric to properly resolve ARP via the COOP database. If 'ARP Flooding' is enabled, the fabric floods ARP requests across all BDs, which can cause ARP resolution to fail for endpoints in different BDs because the hardware proxy expects ARP to be handled differently. This prevents inter-BD communication even with a contract in place. Therefore, having 'ARP Flooding' enabled is a possible reason for the communication failure.

Answer

The 'L3 Unknown Multicast Flooding' is set to flood.

Answer

The contracts are unidirectional.

Answer

The bridge domains are in different subnets.

Question 3

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 4

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

Accepted Answer

Add 'spanning-tree bpdufilter enable' on the interface.. Enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Answer

Add 'spanning-tree guard loop' to the interface.

Answer

Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.

Answer

Change the port type to 'spanning-tree port type network trunk'.

Question 5

A large financial institution has a Cisco ACI fabric with multiple tenants. The security team requires that all management access to the APIC controllers be authenticated via multi-factor authentication (MFA) using a RADIUS server. The RADIUS server is configured to send a One-Time Password (OTP) challenge during authentication. The current configuration uses local authentication. The engineer needs to implement RADIUS authentication with MFA for APIC GUI and CLI access. The RADIUS server is reachable at 10.10.10.10, shared secret 'SecureSecret123'. The APIC is running software version 4.2(3). The engineer must ensure that local authentication is used as fallback if the RADIUS server is unreachable. Which of the following actions should the engineer take?

Accepted Answer

Add a RADIUS provider with IP 10.10.10.10 and secret 'SecureSecret123', create a login domain with realm 'radius', set fallback to 'local', and assign the domain to users.. It follows the required steps to configure RADIUS authentication with MFA on Cisco APIC: adding a RADIUS provider with the correct IP and shared secret, creating a login domain with realm 'radius', setting fallback to 'local', and assigning the domain to users. This ensures that the APIC sends authentication requests to the RADIUS server, which can issue an OTP challenge for MFA, and falls back to local authentication if the RADIUS server is unreachable.

Answer

Configure TACACS+ as the authentication protocol and set the server IP and secret.

Answer

Enable local authentication only and require strong passwords.

Answer

Configure LDAP authentication with the RADIUS server acting as an LDAP proxy.

Question 6

A HyperFlex cluster uses replication factor 3 (RF3) and consists of 4 all-flash nodes. One node fails permanently. After replacing the node, the cluster re-replicates data. What is the minimum number of additional node failures that can be tolerated without data loss after re-replication completes?

Accepted Answer

2. With RF3 (three copies of data), the cluster can tolerate up to two simultaneous failures (quorum requires at least two copies). After replacing the failed node, the cluster returns to full health, so again can tolerate two failures. However, if the cluster originally had 4 nodes and one fails, only 3 remain; if another fails during re-replication, data could be at risk. But after re-replication, 4 nodes exist, so two failures are tolerable.

Answer

1

Answer

0

Answer

3

Question 7

A Cisco MDS switch is configured as an NPV switch to connect to a core switch. Which statement about NPV operation is true?

Accepted Answer

The NPV switch uses FDISC to register multiple N-Port IDs from a single physical link.. In N_Port Virtualization (NPV) mode, a Cisco MDS switch acts as a passthrough device that aggregates multiple end-device N_Ports onto a single uplink to a core Fibre Channel switch. The NPV switch uses the Fabric Discovery (FDISC) protocol to register multiple N_Port IDs (NPIV) from a single physical link, allowing each end device to obtain its own FC ID from the core switch. This is correct because NPV does not assign FC IDs itself but relies on the core switch for fabric login and address assignment.

Answer

The NPV switch allocates FC IDs to end devices from its own pool.

Answer

The NPV switch requires at least one VSAN to be defined as a fabric VSAN.

Answer

The NPV switch performs fabric login (FLOGI) on behalf of all attached end devices.

Question 8

In an ACI fabric, an EPG is configured with a contract that provides a service to another EPG. The contract has a filter for TCP port 80. Which component defines the directionality of the communication between the provider and consumer EPG?

Accepted Answer

The provider and consumer labels in the contract. In Cisco ACI, the provider and consumer labels in the contract define the directionality of communication. The provider EPG offers a service, and the consumer EPG initiates the request; the contract's provider/consumer relationship determines which EPG can start the conversation and in which direction the filter (e.g., TCP port 80) applies. This is fundamental to ACI's policy model, where the contract is unidirectional from consumer to provider by default.

Answer

The filter direction specified in the contract

Answer

The BD subnets

Answer

The subject of the contract

Question 9

A UCS Central administrator is creating a global service profile policy that applies to multiple UCS domains. The policy must include boot order settings. What is the recommended approach to ensure consistency across domains?

Accepted Answer

Use UCS Central to create a global boot policy and assign it to service profiles. UCS Central allows creation of global policies that are applied to service profiles in multiple domains, ensuring consistency.

Answer

Rely on default boot policy

Answer

Define the boot order directly in the service profile template

Answer

Create a local boot policy in each UCS domain

Question 10

Which TWO are best practices when automating ACI fabric configuration using Ansible?

Accepted Answer

Use the cisco.aci collection. The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

Answer

Set validate_certs: no to avoid certificate errors

Answer

Store credentials in plain text in playbooks

Answer

Use delegate_to: localhost for all tasks

Question 11

In a Cisco HyperFlex cluster, the management plane uses vCenter, but the data plane uses which protocol to replicate data across nodes?

Accepted Answer

HX Data Platform. In a Cisco HyperFlex cluster, the data plane replication across nodes is handled by the HX Data Platform, which is a distributed, log-structured file system that synchronously replicates data at the hypervisor level. This platform manages all I/O operations and ensures data consistency across the cluster without relying on external storage protocols like Fibre Channel or iSCSI.

Answer

Fibre Channel

Answer

NFS

Answer

iSCSI

Question 12

A data center engineer is designing a UCS Manager solution that requires VLAN segmentation across multiple fabric interconnects. The network team requires that each VLAN is assigned a unique native VLAN ID per fabric. Which pool configuration supports this requirement?

Accepted Answer

Create separate VLAN pools for each fabric with non-overlapping ranges. UCS Manager allows separate VLAN pools to be assigned per fabric interconnect, enabling unique native VLAN IDs per fabric. By creating non-overlapping VLAN pools for each fabric, the engineer ensures that each fabric has its own native VLAN ID without conflict, meeting the requirement for VLAN segmentation across multiple fabric interconnects.

Answer

Use derived VLAN pools based on chassis location

Answer

Create a single VLAN pool that includes all required VLANs

Answer

Configure VLANs directly in the service profile using inline pools

Question 13

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

Accepted Answer

Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.. APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.

Answer

Change the authentication method in the script from password-based to certificate-based authentication.

Answer

Regenerate the API key for the service account and update the script with the new key.

Answer

Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.

Question 14

A Cisco UCS upgrade from release 3.1(1) to 4.0(4) is planned. The current release has a known issue that affects NVRAM backup. What is the best practice to avoid an outage during this upgrade?

Accepted Answer

Upgrade to an intermediate release that is recommended for the upgrade path.. Cisco UCS firmware upgrades must follow a supported upgrade path to avoid incompatibilities and known issues. Skipping directly from 3.1(1) to 4.0(4) is not supported; an intermediate release (e.g., 3.2(x) or 4.0(1)) is required to resolve the NVRAM backup issue and ensure a seamless upgrade without service disruption.

Answer

Perform a cold reboot of all Fabric Interconnects before starting.

Answer

Upgrade all components simultaneously to reduce transition time.

Answer

Upgrade the firmware on the chassis first, then the Fabric Interconnects.

Question 15

In a VXLAN BGP EVPN fabric, which component is responsible for handling BUM traffic using ingress replication, and how does the VTEP learn the list of remote VTEPs to replicate to?

Accepted Answer

The ingress VTEP learns remote VTEPs via MP-BGP EVPN Type 3 routes.. In a VXLAN BGP EVPN fabric, ingress replication is the default method for handling BUM traffic, where the ingress VTEP replicates packets and sends unicast copies to each remote VTEP. The ingress VTEP learns the list of remote VTEPs from MP-BGP EVPN Type 3 routes (Inclusive Multicast routes), which advertise the VNI and the originating VTEP's IP address, allowing the ingress VTEP to build its replication list.

Answer

The ingress VTEP learns remote VTEPs via IGMP snooping.

Answer

The egress VTEP sends unicast copies to all other VTEPs.

Answer

The spine switch performs replication to all leaf VTEPs.

Question 16

A network engineer is configuring Cisco Nexus VXLAN with BGP EVPN. The VTEPs are using loopback0 as the NVE source. The physical interfaces are up, but the NVE interface remains down. What is the most likely cause?

Accepted Answer

The loopback0 interface is not reachable via the underlay network.. The NVE interface requires the specified source interface (loopback0) to have IP reachability via the underlay network to establish VXLAN tunnels. If loopback0 is not reachable (e.g., due to missing OSPF/IS-IS routes or incorrect underlay configuration), the NVE interface will remain in a down state even if the physical interfaces are up. This is because the NVE interface depends on the underlay routing to encapsulate and forward VXLAN traffic.

Answer

The NVE interface is not configured with source-interface.

Answer

The VLAN 1 is not associated with the NVE interface.

Answer

The loopback0 interface is not created.

Question 17

Based on the exhibited FLOGI database, what is the state of the interface fc1/1?

Accepted Answer

It is an NP port (proxy FW) because multiple FCIDs appear on the same interface.. The FLOGI database shows multiple FCIDs (0x010000, 0x010001) associated with the same interface fc1/1, which is characteristic of an NP port (proxy FW) in NPV mode. An NP port acts as a proxy for multiple end devices behind it, such as in a Fibre Channel NPV switch or a converged network adapter (CNA) in FCoE NPV mode, allowing multiple FCIDs to share a single physical link.

Answer

It is an F port with a hub attached.

Answer

It is a trunking E port.

Answer

It is a disabled port because there are two WWNs.

Question 18

An engineer is designing an ACI fabric and needs to provide connectivity to an external Layer 3 network. Which construct must be configured to achieve this?

Accepted Answer

L3Out. To connect an ACI fabric to an external Layer 3 network, you must configure an L3Out. An L3Out defines the external routed connectivity by associating a VRF with external interfaces, routing protocols (e.g., OSPF, BGP, EIGRP), and subnets that are advertised into or from the fabric. This construct allows ACI to exchange routes with the external Layer 3 domain.

Answer

VMM domain

Answer

EPG

Answer

VXLAN tunnel

Question 19

An engineer notices that a UCS server with a service profile using a QoS policy for FC traffic experiences excessive latency during heavy workloads. The Fibre Channel fabric is configured for lossless operation. Which design issue is most likely causing the latency?

Accepted Answer

The QoS policy for FC traffic does not allocate enough buffer for the no-drop class.. The excessive latency during heavy workloads in a lossless Fibre Channel fabric is most likely due to insufficient buffer allocation for the no-drop class in the QoS policy. In UCS, the no-drop class (typically class-fcoe) must have adequate buffer space to prevent frame drops that trigger retransmissions and latency. Without enough buffer, the switch cannot absorb bursts, leading to congestion and increased latency even though the fabric is lossless.

Answer

The MTU on the Ethernet uplink from the FI is set to 1500 bytes.

Answer

Fibre Channel buffer-to-buffer credit recovery is disabled on the upstream switch.

Answer

The vHBA is configured for 16 Gbps but the upstream switch port is 8 Gbps.

Question 20

Refer to the exhibit. A UCS domain shows a 'Major' NVRAM backup failure alarm in Intersight. What is the best immediate action?

Accepted Answer

Attempt a manual NVRAM configuration backup from the primary Fabric Interconnect to the secondary.. A 'Major' NVRAM backup failure alarm in Intersight indicates that the automatic periodic backup of the UCS domain's configuration from the primary Fabric Interconnect (FI) to the secondary FI has failed. The best immediate action is to attempt a manual NVRAM configuration backup from the primary FI to the secondary, as this directly addresses the backup failure without disrupting domain operations or requiring re-registration.

Answer

Perform a factory reset on both Fabric Interconnects.

Answer

Reboot the primary Fabric Interconnect.

Answer

Reclaim the UCS domain from Intersight and register again.