350-601 Timed Hard Questions — 25 Difficult Questions

Question 1

A data center engineer is troubleshooting high CPU utilization on a Cisco Nexus 9000 switch. The engineer suspects a distributed denial-of-service (DDoS) attack targeting the switch. To mitigate the attack, the engineer configures a Control Plane Policing (CoPP) policy that drops all ICMP packets destined to the switch. The policy is applied to the control-plane using the 'service-policy input COPP' command. After applying the policy, the switch CPU utilization remains high, and ICMP traffic is still reaching the switch. The engineer verifies that the CoPP policy is applied and that the class-map matches ICMP. The policy-map has the correct police and drop actions. No other CoPP policies are applied. What is the most likely cause of the issue?

15 minute time limit — choose an answer to begin.

Accepted Answer

The attack traffic is entering through the management interface, which is not affected by CoPP.. The management interface (mgmt0) on Cisco Nexus 9000 switches operates in a separate management VRF and is not subject to Control Plane Policing (CoPP) policies applied to the default control-plane. CoPP only polices traffic that ingresses through data-plane interfaces (e.g., Ethernet, port-channel). If the DDoS attack is arriving via the management interface, the CoPP policy will not filter it, leaving CPU utilization high. This is a common oversight when troubleshooting control-plane protection.

Answer

The switch requires a reload for the CoPP policy to take effect.

Answer

The CoPP policy must be applied to the management VRF as well.

Answer

The class-map uses 'match protocol icmp' but the traffic uses a different protocol.

Question 2

An engineer is configuring Fibre Channel PortChannels on a Cisco MDS switch. Which statement about Fibre Channel PortChannels is true?

Accepted Answer

They load-balance based on the source and destination WWPNs.. Fibre Channel PortChannels require all member ports to be of the same type (e.g., all E-ports). They load-balance across links and are compatible with VSAN trunking. They do not require the same speed on all ports, but it is recommended.

Answer

They require all member ports to be on the same VSAN.

Answer

They can include both E-ports and F-ports in the same PortChannel.

Answer

They are supported only in NPV mode.

Question 3

An Ansible playbook using the cisco.nxos.nxos_config module fails with the error: 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting'. What is the most likely cause?

Accepted Answer

The playbook includes an invalid parameter 'connection: network_cli' inside the task block.. The error 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting' occurs because the `connection: network_cli` parameter is being passed inside the task block of the playbook. The `cisco.nxos.nxos_config` module does not accept a `connection` parameter at the task level; connection settings must be defined at the play or inventory level. This is a common syntax error when using Ansible network modules.

Answer

The SSH key authentication is misconfigured.

Answer

The module is not installed correctly.

Answer

The playbook is targeting a device running an unsupported NX-OS version.

Question 4

In an FCoE environment, which protocol is responsible for discovering and initializing FCoE-capable endpoints, including the exchange of MAC addresses and establishing virtual links?

Accepted Answer

FIP. FIP (FCoE Initialization Protocol) is the protocol defined in FC-BB-5 that discovers FCoE-capable endpoints (ENodes and FCFs), exchanges MAC addresses, and establishes virtual links between them. It performs the FCoE equivalent of fabric login before FCoE data traffic flows. FCoE itself is the encapsulation of Fibre Channel frames over Ethernet, not the discovery/initialization protocol.

Answer

ARP

Answer

DCBX

Answer

FCoE

Question 5

During an FCoE deployment, the server team reports that hosts can reach the storage array but performance is intermittent with periodic timeouts. The network team sees no errors on the FCoE VLAN. The DCB configuration on the upstream switch shows that PFC is enabled for CoS 3. What should the engineer check next?

Accepted Answer

Check if the PFC configuration matches on both ends and that PFC is enabled on the FCoE VLAN interfaces. D is correct because PFC (Priority Flow Control) must be consistently configured on both ends of an FCoE link to prevent frame loss. If PFC is enabled for CoS 3 on the upstream switch but not on the server's vNIC or the FCoE VLAN interfaces, the lack of lossless behavior causes intermittent timeouts and performance degradation, even if the FCoE VLAN shows no errors.

Answer

Verify that jumbo frames are enabled on the storage array

Answer

Confirm that the VSAN is appropriately sized for the number of hosts

Answer

Ensure that the FCoE VLAN is enabled for FCoE on the server's vNIC

Question 6

A HyperFlex cluster uses replication factor 3 (RF3) and consists of 4 all-flash nodes. One node fails permanently. After replacing the node, the cluster re-replicates data. What is the minimum number of additional node failures that can be tolerated without data loss after re-replication completes?

Accepted Answer

2. With RF3 (three copies of data), the cluster can tolerate up to two simultaneous failures (quorum requires at least two copies). After replacing the failed node, the cluster returns to full health, so again can tolerate two failures. However, if the cluster originally had 4 nodes and one fails, only 3 remain; if another fails during re-replication, data could be at risk. But after re-replication, 4 nodes exist, so two failures are tolerable.

Answer

1

Answer

0

Answer

3

Question 7

An engineer is implementing CI/CD for network changes. Which tool is commonly used for version control of network configuration files and infrastructure code?

Accepted Answer

Git. Git is the industry-standard version control system used for managing infrastructure as code, including network configurations.

Answer

Docker

Answer

Jenkins

Answer

Ansible

Question 8

A data center deployment uses NPV mode on a Cisco MDS switch to connect to a core Fibre Channel switch. After configuration, the NPV switch does not register with the core. What is the most likely cause?

Accepted Answer

NPIV is not enabled on the core switch.. NPV (N_Port Virtualization) mode requires NPIV (N_Port ID Virtualization) to be enabled on the core Fibre Channel switch. NPIV allows a single physical N_Port to register multiple FCIDs (Fibre Channel IDs) for multiple virtual initiators behind the NPV switch. Without NPIV on the core, the NPV switch cannot complete the FLOGI (Fabric Login) process and will not register with the fabric.

Answer

Fibre Channel ports are in trunk mode.

Answer

The core switch has NPV mode enabled.

Answer

The NPV switch has an incorrect domain ID.

Question 9

A data center engineer is configuring Control Plane Policing (CoPP) on a Cisco Nexus 7000 switch to protect against a flood of ARP requests. The engineer wants to rate-limit ARP traffic to the supervisor module while ensuring that legitimate ARP requests are not dropped. Which CoPP policy configuration should be applied?

Accepted Answer

Create a class-map that matches ARP traffic, then a policy-map that assigns a policer with a committed information rate (CIR) and a conform action of transmit and an exceed action of drop.. CoPP uses class-maps to identify traffic and policy-maps to apply policers. For ARP flood protection, the class-map should match ARP, and the policer should transmit conforming traffic and drop excess. This rate-limits ARP to the supervisor while allowing legitimate requests, protecting the control plane without disrupting normal ARP operation.

Answer

Create a class-map that matches ARP traffic, then a policy-map that assigns a policer with a high CIR and a conform action of transmit and an exceed action of transmit.

Answer

Create a class-map that matches all IP traffic, then a policy-map that assigns a policer with a high CIR and a conform action of transmit and an exceed action of drop.

Answer

Create a class-map that matches ARP traffic, then a policy-map that assigns a policer with a low CIR and a conform action of drop and an exceed action of transmit.

Question 10

In a VXLAN EVPN fabric using BGP as the control plane, which BGP address family is used to exchange MAC/VTEP reachability information between VTEPs?

Accepted Answer

L2VPN EVPN. In a VXLAN EVPN fabric, the L2VPN EVPN address family (AFI 25, SAFI 70) is used to exchange MAC/VTEP reachability information between VTEPs. This address family carries BGP EVPN routes (type-2 for MAC/IP advertisements) that include the MAC address, VNI, and VTEP IP, enabling the control plane to distribute host reachability without flooding.

Answer

IPv4 unicast

Answer

IPv6 unicast

Answer

VPNv4 unicast

Question 11

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

Accepted Answer

The script uses strict type checking, and the values are returned as strings instead of integers.. The NX-API returns all values as strings in JSON output, including numeric fields like VLAN IDs. If the script uses strict type checking (e.g., `===` in Python or JavaScript), comparing the string '100' to the integer 100 will fail, even though the interface is correctly configured in access mode with VLAN 100. This is a common pitfall when parsing NX-API responses without explicit type conversion.

Answer

The JSON output is malformed and cannot be parsed.

Answer

The interface is administratively down.

Answer

The JSON output is missing the 'switchportMode' field.

Question 12

A network engineer is configuring an ACI contract between an EPG and an external EPG. Which construct is used to permit traffic from the external EPG to the internal EPG?

Accepted Answer

The external EPG is the provider and the internal EPG is the consumer.. In Cisco ACI, the provider EPG exposes a contract, and the consumer EPG consumes it. To permit traffic from an external EPG to an internal EPG, the internal EPG must be the consumer (initiating the communication) and the external EPG must be the provider (offering the contract). This aligns with the default directionality of contracts, where the provider's filter rules allow inbound traffic from the consumer.

Answer

The internal EPG is the provider and the external EPG is the consumer.

Answer

Both EPGs are providers.

Answer

Both EPGs are consumers.

Question 13

A company is deploying a Cisco UCS Mini in a remote office. They need to support both VMware vSphere and Microsoft Hyper-V on the same UCS domain. What is the best practice for deploying compute resources for both hypervisors?

Accepted Answer

Create separate service profile templates for each hypervisor. Separate service profile templates are required because VMware vSphere and Microsoft Hyper-V have different boot and storage configuration requirements. Each hypervisor needs its own boot policy (e.g., SAN boot vs. local disk), firmware settings, and potentially different vNIC/vHBA configurations. Using distinct templates ensures that each hypervisor's compute resources are correctly provisioned without conflicts.

Answer

Use a single service profile but assign different VLANs for management traffic

Answer

Place each hypervisor in a separate UCS Organization within the same service profile template

Answer

Create a single service profile template and use different identity pools for each hypervisor

Question 14

A data center designer is evaluating oversubscription ratios in a spine-leaf topology with 40 leaf switches and 4 spine switches. Each leaf has 4x100G uplinks to spines, and each spine has 40x100G downlinks. The leaf switches have 48x25G server ports. What is the oversubscription ratio from the server ports to the spine uplinks?

Accepted Answer

3:1. The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48x25G server ports = 1200G, and 4x100G uplinks = 400G, giving a leaf-level ratio of 3:1 (1200:400). Since all leaves are identical and the spine count doesn't affect the leaf-level ratio, the overall ratio remains 3:1.

Answer

2:1

Answer

4:1

Answer

5:1

Question 15

Two data center switches are connected via a fiber link. They need to encrypt all traffic at Layer 2. Which configuration is required on both switches to establish MACsec?

Accepted Answer

Enable MACsec and configure a pre-shared key or CA. MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption between directly connected switches. To establish a MACsec session, both switches must enable MACsec on the interface and either configure a pre-shared key (PSK) or use a CA (Connectivity Association) key agreement protocol like MKA (MACsec Key Agreement, IEEE 802.1X-2010). This ensures all Ethernet frames are encrypted at the data link layer.

Answer

Configure the interface as a trunk

Answer

Enable IPsec on the interface

Answer

Enable 802.1X on the interface

Question 16

An engineer is troubleshooting a vPC consistency check failure. Which parameter must be identical on both vPC peer switches to avoid a consistency check violation for a vPC member port?

Accepted Answer

Allowed VLAN list on the port channel. In a vPC environment, the allowed VLAN list on the port channel must be identical on both peer switches for a vPC member port. If the lists differ, the vPC consistency check fails, causing the port to be suspended or placed in a consistency-check failure state. This ensures that both peers forward the same set of VLANs across the vPC, preventing asymmetric forwarding and potential loops.

Answer

STP root guard setting

Answer

MTU size

Answer

Spanning-tree port type

Question 17

A UCS administrator wants to deploy a Cisco UCS C-Series rack server in a UCS Manager-managed environment. The server is currently in standalone mode using CIMC. Which step is required to integrate the C-Series server into UCS Manager?

Accepted Answer

Adopt the server into UCS Manager by reinitializing CIMC and connecting it to the Fabric Interconnects.. To bring a standalone C-Series rack server under UCS Manager, the administrator must adopt it — which involves reinitializing the Cisco IMC (CIMC) so the server can be discovered and claimed by the Fabric Interconnects. Adoption is the supported integration path for C-Series in a UCSM-managed environment, after which the server appears under Equipment and can receive service profiles.

Answer

Configure the server in direct connect mode with the Fabric Interconnects.

Answer

Install an I/O Module in the rack server to enable Fabric Interconnect connectivity.

Answer

Use Cisco IMC Supervisor to connect the server to UCS Manager.

Question 18

A HyperFlex cluster is configured with RF3 and has 6 nodes. If one node fails completely, how many nodes are still required to maintain data availability and cluster quorum?

Accepted Answer

4 nodes. With RF3 (Replication Factor 3), each data block is replicated across three nodes. In a 6-node cluster, if one node fails, the remaining 5 nodes still contain all replicas because the failed node's replicas are also present on two other nodes. However, to maintain cluster quorum and tolerate another failure, the cluster needs at least 4 nodes. Cisco HyperFlex uses a quorum mechanism where a majority of nodes must be available. For a 6-node cluster, quorum is 4 nodes (majority of 6 is 4). Thus, after one node fails, 5 nodes remain, which is above quorum, but the question asks how many nodes are still required to maintain data availability and quorum. The minimum required is 4 nodes: with 4 nodes, quorum is still met (4 out of 6 is a majority), and data availability is maintained because RF3 ensures that even if two nodes fail, the remaining 4 nodes still have at least one replica of each data block. Therefore, 4 nodes are required.

Answer

3 nodes

Answer

5 nodes

Answer

6 nodes

Question 19

An engineer is configuring a HyperFlex cluster with three nodes. Which three components are required for a functional cluster? (Choose three.)

Accepted Answer

VMware vSphere or other supported hypervisor. Option B is correct because a HyperFlex cluster requires a supported hypervisor layer—typically VMware vSphere (ESXi) or Hyper-V—to run the controller VMs and host the HX Data Platform, so a hypervisor is mandatory for a functional cluster. Option C is correct because the HyperFlex HX Data Platform software is the distributed storage controller that provides the SDS layer, replication, deduplication, and compression across nodes; without it the nodes cannot form a cluster. Option E is correct because a minimum of three storage nodes (converged, or compute-plus-storage) is required to form a functioning cluster with the necessary replication factor and quorum. Option A is not required for a three-node cluster because a witness VM is only needed for two-node clusters to break ties for quorum. Option D is not required because HyperFlex nodes are managed through the HyperFlex Connect/Installer and the hypervisor, not through Cisco UCS Manager.

Answer

A witness VM for quorum

Answer

Cisco UCS Manager for node management

Question 20

Refer to the exhibit. The CoPP policy above is applied. Which traffic is most likely to be dropped?

Accepted Answer

ICMP traffic that exceeds 1000 bps. The CoPP policy explicitly defines a class-map for ICMP traffic with a police rate of 1000 bps. Any ICMP traffic exceeding this rate is dropped due to the 'drop' action in the police command. The other classes (OSPF and class-default) have higher rates and are not as constrained, making ICMP the most likely to be dropped when exceeded.

Answer

Both ICMP and class-default traffic that exceed their rates

Answer

class-default traffic that exceeds 20000 bps

Answer

OSPF traffic that exceeds 5000 bps