350-601 Timed Hard Questions — 25 Difficult Questions

Question 1

Which TWO are valid methods to configure a Cisco UCS service profile for stateless computing? (Choose two.)

Accepted Answer

Create a service profile from a template. Option A is correct because creating a service profile from a template is a core method for stateless computing in Cisco UCS. Stateless computing abstracts hardware identity (e.g., WWPNs, MAC addresses, UUIDs) from physical blades, allowing a service profile to be applied to any compatible blade without reconfiguration. Templates enable rapid, consistent deployment of these stateless profiles across multiple servers.

Answer

Use boot from SAN to store OS images

Answer

Assign persistent WWPNs to vHBAs

Answer

Configure local storage on the blade

Question 2

Refer to the exhibit. An engineer applies this QoS policy to a Cisco Nexus 9000 switch in a data center. After applying the policy, storage traffic (iSCSI) is experiencing high latency and occasional drops. The engineer verifies that the iSCSI traffic is not matching the 'BulkData' class. What is the most likely cause of the issue?

Accepted Answer

The policy-map does not specify a priority queue for latency-sensitive traffic.. The correct answer is A because iSCSI is a latency-sensitive storage protocol that requires a strict priority queue to ensure low latency and minimal jitter. Without a priority queue configured in the policy-map, iSCSI traffic competes with other traffic classes on a best-effort basis, leading to high latency and drops even if it is not matching the 'BulkData' class.

Answer

The policy-map is applied at the system level, but iSCSI traffic is not classified under any class-map.

Answer

The bandwidth percent for class-default is too low, causing iSCSI to be starved.

Answer

The class-map 'BulkData' does not match the correct traffic because the match statement uses qos-group instead of dscp.

Question 3

A large enterprise is using Cisco UCS Manager to manage a chassis with 8 B-Series blades. The environment uses a combination of Ethernet and Fibre Channel traffic. The UCS fabric interconnect (FI) is configured in end-host mode with two uplinks to the core network. Recently, the engineering team deployed a new service profile for a high-performance computing workload that requires 40Gbps Ethernet per vNIC and 16Gbps Fibre Channel per vHBA. The server has two vNICs and two vHBAs. After deployment, the server's OS shows only 10Gbps connectivity on each vNIC. The engineer checks UCS Manager and sees that the vNIC templates are set to '10 Gbps' and the vHBA templates are set to '16 Gbps' but the actual link speed for vNICs is only 10Gbps. The fabric interconnect ports are configured as 40Gbps uplinks. The engineer has verified that the server adapter supports 40Gbps. What is the most likely cause of the speed mismatch?

Accepted Answer

The vNIC template used in the service profile specifies a requested speed of '10 Gbps' instead of '40 Gbps'.. The vNIC template in the service profile defines the requested speed for the virtual NIC. If the template is set to '10 Gbps', the UCS Manager will allocate only 10 Gbps of bandwidth per vNIC, regardless of the physical adapter's capability or the uplink speed. Since the engineer verified the adapter supports 40 Gbps and the uplinks are 40 Gbps, the mismatch is directly caused by the template configuration.

Answer

The fabric interconnect uplinks are configured as 40Gbps, but the port channel is not configured correctly, causing speed negotiation to fail.

Answer

The server's adapter policy is set to 'Windows' mode, which limits Ethernet speeds to 10Gbps.

Answer

The QoS policy applied to the vNIC limits the bandwidth to 10Gbps.

Question 4

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Accepted Answer

Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.. Option A is correct because the Cisco UCS Manager XML API allows operations to be idempotent by using the 'dn' (distinguished name) attribute to target a specific managed object. When you include the 'dn' in an XML request, the operation applies only to that exact object, so repeating the same request produces the same result without side effects. This is a key design principle of the management information model (MIT) that ensures predictable and safe automation.

Answer

The API uses SNMP for configuration changes.

Answer

The UCS Manager XML API uses RESTful JSON format.

Question 5

A company has two Cisco MDS 9700 switches in a dual-fabric SAN. Each fabric has its own set of storage arrays and hosts. The company wants to enable selective communication between specific devices in Fabric A and Fabric B without merging the fabrics. Which Cisco technology should be used?

Accepted Answer

IVR. Cisco IVR (Inter-VSAN Routing) allows selective communication between devices in different VSANs without merging the fabrics. In this dual-fabric SAN scenario, IVR enables specific hosts in Fabric A to communicate with specific storage arrays in Fabric B while keeping the VSANs and fabrics logically isolated, preserving fault domains and administrative boundaries.

Answer

FCIP

Answer

NPV

Answer

Port channels

Question 6

An engineer is designing an automation solution for a large data center with multiple Cisco UCS Manager domains. Which approach best ensures idempotent configuration operations?

Accepted Answer

Using a declarative automation tool like Ansible with idempotent modules. Option B is correct because Ansible's declarative modules for Cisco UCS Manager (e.g., `ucs_*` modules) are designed to be idempotent: they compare the current state of the configuration against the desired state defined in the playbook and only apply changes when necessary. This ensures that running the same playbook multiple times yields the same result without unintended side effects, which is critical for large-scale automation across multiple UCS domains.

Answer

Writing imperative Python scripts that execute CLI commands

Answer

Directly calling UCS Manager XML API using POST requests

Answer

Using SNMP to set configuration parameters

Question 7

A Cisco MDS switch has the above configuration on two 16 Gbps FC interfaces. An engineer connects an initiator to fc1/2 and a target to fc1/1. The initiator cannot discover the target. What is the most likely cause?

Accepted Answer

The fc1/1 interface is configured as an E-port but is connected to a storage target.. Option D is correct because the configuration shows interface fc1/1 with the command 'switchport mode E', which explicitly configures it as an E-port (expansion port). E-ports are used to interconnect two Fibre Channel switches, not to connect a storage target. When a target is connected to an E-port, the link will not come up properly because the target expects to be connected to an F-port (fabric port) or FL-port, preventing discovery by the initiator.

Answer

The fc1/2 interface is configured as an F-port but the initiator requires an FL-port.

Answer

The fc1/1 interface is configured as dedicated rate-mode but the target expects shared.

Answer

The fc1/2 interface is configured as shared rate-mode which prevents F-port operation.

Question 8

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

Accepted Answer

The script uses strict type checking, and the values are returned as strings instead of integers.. The NX-API returns all values as strings in JSON output, including numeric fields like VLAN IDs. If the script uses strict type checking (e.g., `===` in Python or JavaScript), comparing the string '100' to the integer 100 will fail, even though the interface is correctly configured in access mode with VLAN 100. This is a common pitfall when parsing NX-API responses without explicit type conversion.

Answer

The JSON output is malformed and cannot be parsed.

Answer

The interface is administratively down.

Answer

The JSON output is missing the 'switchportMode' field.

Question 9

A data center engineer is designing a storage network for a virtualized environment with 100 hosts and 50 storage arrays. Each host requires 4 Gbps of bandwidth to storage, and each storage array provides 8 Gbps. All devices use 16 Gbps FC links. What is the minimum number of 16 Gbps FC links required to support the total bandwidth demand without oversubscription?

Accepted Answer

25. The total bandwidth demand from hosts is 100 hosts × 4 Gbps = 400 Gbps. Each storage array provides 8 Gbps, so total storage bandwidth is 50 arrays × 8 Gbps = 400 Gbps. Since all links are 16 Gbps FC, the minimum number of links required to carry 400 Gbps without oversubscription is 400 / 16 = 25 links. This assumes full-duplex links and no oversubscription in the fabric.

Answer

50

Answer

200

Answer

100

Question 10

A network engineer is implementing automated configuration management using Cisco NSO (Network Services Orchestrator). The team wants to ensure that any configuration changes made directly on the devices (out-of-band) are detected and reconciled. Which NSO feature should be used?

Accepted Answer

Fast-map synchronization. Fast-map synchronization is the correct NSO feature because it is specifically designed to detect and reconcile configuration changes made directly on managed devices (out-of-band changes). It compares the device's running configuration against NSO's CDB and generates the necessary NETCONF or CLI operations to bring the device back into sync with NSO's desired state, ensuring consistency without manual intervention.

Answer

Configuration Database (CDB) snapshots

Answer

Service model templates

Answer

Rollback and recovery mechanism

Question 11

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

Accepted Answer

Add 'spanning-tree bpdufilter enable' on the interface.. Option C is correct because enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Answer

Add 'spanning-tree guard loop' to the interface.

Answer

Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.

Answer

Change the port type to 'spanning-tree port type network trunk'.

Question 12

Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?

Accepted Answer

Enable the address-family l2vpn evpn under the BGP configuration.. Option A is correct because in VXLAN EVPN, BGP is used as the control plane to exchange MAC and IP reachability information. Enabling the address-family l2vpn evpn under BGP configuration is mandatory to advertise EVPN routes (type-2 and type-3) between VTEPs, which is the foundation of the centralized anycast gateway model.

Answer

Enable IGMP snooping on all VLANs extended over VXLAN.

Answer

Set the VXLAN destination UDP port to 8472.

Answer

Create an NVE interface with a loopback interface as the source.

Question 13

Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)

Accepted Answer

Both switches must run the same NX-OS software version. Option C is correct because Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.

Answer

Both switches must use the same routing protocol

Answer

The peer-keepalive link must be carried over the peer-link

Question 14

A data center design requires Layer 2 extension between two sites using OTV. The network engineer notices that MAC addresses from Site A are not learned at Site B. OTV adjacency is up, and both sites have the same overlay interface configured. Which configuration issue is most likely the cause?

Accepted Answer

The site VLAN is not allowed on the OTV join interface.. D is correct because the OTV join interface must have the site VLAN allowed; if the site VLAN is not permitted on the join interface, the OTV edge device cannot send or receive encapsulated traffic for that VLAN, preventing MAC address learning between sites even though the OTV adjacency is up.

Answer

The OTV control group is misconfigured on one side.

Answer

The spanning tree root bridge is different at each site.

Answer

The multicast group range for the overlay does not match.

Question 15

Which TWO statements about NPV (N_Port Virtualization) mode in FC networks are correct?

Accepted Answer

NPV is commonly used in top-of-rack (ToR) deployments to simplify SAN cabling.. Option A is correct because NPV is specifically designed for top-of-rack (ToR) deployments to reduce the number of physical cables and simplify SAN cabling. In NPV mode, the ToR switch acts as a transparent proxy, forwarding FLOGI requests from end devices to the core NPV-enabled switch, which handles all fabric services. This eliminates the need for each ToR switch to have its own domain ID, reducing management complexity.

Answer

An NPV switch connects to the core switch using E-ports.

Answer

NPV switches can be used to connect FC and FCoE devices without a separate FCoE VLAN.

Answer

NPV switches perform fabric login (FLOGI) on behalf of attached devices.

Question 16

A network engineer is troubleshooting CoPP drops on a Cisco Nexus 9000 switch. The 'show control-plane' output indicates that packets are being dropped due to 'CoPP' on the 'default' control-plane class. Which action is most likely to resolve the issue without affecting routing protocol stability?

Accepted Answer

Increase the policer rate for the 'default' class in the CoPP policy.. The 'default' class in a CoPP policy catches all control-plane traffic not explicitly matched by higher-priority classes. Drops in this class indicate that the aggregate policer rate for unmatched traffic is too low. Increasing the policer rate for the 'default' class allows more legitimate control-plane packets (e.g., ARP, BFD, or management traffic) to pass without impacting the dedicated policers for critical protocols like OSPF or BGP, thus preserving routing stability.

Answer

Disable CoPP globally to allow all control-plane traffic.

Answer

Modify the class-map to reclassify the dropped packets to a higher priority class.

Answer

Increase the ingress buffer size on the control-plane interface.

Question 17

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. Option C is correct because SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 18

In a VXLAN EVPN multi-tier design, which feature ensures traffic between leaf switches takes the optimal path without hair-pinning through a spine?

Accepted Answer

ECMP. C is correct because Equal-Cost Multipath (ECMP) in a VXLAN EVPN multi-tier design allows leaf switches to load-balance traffic across multiple equal-cost spine paths, ensuring that traffic between leaf switches takes the most direct route without being forced to hair-pin through a spine. ECMP leverages the underlying IP fabric's routing to forward VXLAN-encapsulated packets over any available spine, avoiding suboptimal forwarding that would occur if a single spine were used as a relay.

Answer

Anycast gateway

Answer

Type-2 routes

Answer

ARP suppression

Question 19

Which THREE factors should be considered when determining the number of upstream Ethernet uplinks from a UCS Fabric Interconnect to the core network? (Choose THREE.)

Accepted Answer

The number of vNICs per service profile and their bandwidth limits.. Option C is correct because the number of vNICs per service profile and their bandwidth limits directly determine the aggregate traffic that must be carried by the upstream Ethernet uplinks. Each vNIC is assigned a specific bandwidth cap (e.g., via QoS policy or vNIC template), and the sum of these caps across all service profiles on a Fabric Interconnect dictates the minimum uplink capacity required to avoid oversubscription.

Answer

Number of VLANs defined on the Fabric Interconnect.

Answer

Server CPU oversubscription ratio.

Question 20

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

Accepted Answer

Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.. Option C is correct because Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

Answer

Assign the 'read-only' role to the user within the tenant.

Answer

Create a separate VRF for each tenant and assign admin to that VRF.

Answer

Assign the 'tenant-admin' role to the user globally.