350-601 Multiple Select — 20 Questions

Question 1

Which THREE are benefits of using Cisco UCS Manager to manage compute resources? (Choose three.)

Accepted Answer

Centralized management of multiple chassis. Cisco UCS Manager provides a single pane of glass for the entire UCS domain, so option A (Centralized management of multiple chassis) is correct because one UCS Manager instance can manage up to 20 chassis and hundreds of blades from a single interface. Option C (Policy-based provisioning to automate server deployment) is correct because UCS Manager uses service profiles and pools (UUID, MAC, WWN, BIOS, boot policy) to abstract hardware and automate consistent, repeatable server deployment. Option E (Unified fabric for LAN and SAN traffic) is correct because UCS Manager manages the fabric interconnects that carry both Ethernet LAN and Fibre Channel SAN traffic over a unified fabric (FCoE), reducing cabling and adapters. Option B is not a UCS Manager benefit because UCS Manager manages physical compute, network, and storage-access resources, not guest VMs, which are managed by hypervisors such as vCenter or Hyper-V. Option D is incorrect because UCS Manager does not improve performance by disabling hardware features; it enables features and applies BIOS/firmware policies, and disabling hardware would generally reduce capability rather than improve performance.

Answer

Direct management of virtual machines

Answer

Improved performance by disabling hardware features

Question 2

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 3

A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer must configure the underlay to support load balancing of VXLAN traffic across multiple equal-cost paths. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Enable the use of the source UDP port for hashing by configuring the load-balancing algorithm to include Layer 4 information.. To load-balance VXLAN traffic across multiple equal-cost paths, the underlay must have multiple equal-cost routes installed in the routing table, and the switch must hash traffic using fields that vary per flow. Including Layer 4 information, especially the source UDP port, provides the necessary entropy. The routing protocol must support ECMP and be configured to install multiple paths. Together, these actions enable effective distribution of VXLAN traffic.

Answer

Configure the underlay routing protocol to advertise the VTEP loopback with the same cost on all spines.

Answer

Configure the load-balancing algorithm to use the source and destination IP addresses only.

Answer

Enable jumbo frames on all interfaces in the underlay to accommodate the VXLAN encapsulation overhead.

Question 4

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Accepted Answer

DHCP Snooping. DHCP Snooping (A) is correct because it builds a trusted binding table of MAC-to-IP-to-port mappings by inspecting DHCP traffic, which prevents rogue DHCP servers and serves as the foundation for other Layer 2 protections. IP Source Guard (C) is correct because it uses the DHCP Snooping binding table to filter out frames with spoofed source IP or MAC addresses on untrusted ports, blocking IP/MAC spoofing attacks. Dynamic ARP Inspection (D) is correct because it validates ARP packets against the DHCP Snooping binding database, dropping ARP spoofing/poisoning attempts used for man-in-the-middle attacks. RBAC (B) is not a Layer 2 attack mitigation but an access-control mechanism for managing user privileges on the switch, and CoPP (E) is a control-plane policing feature that rate-limits traffic destined to the CPU, protecting the control plane rather than mitigating Layer 2 attacks like spoofing or DHCP/ARP abuse.

Answer

RBAC

Answer

CoPP

Question 5

A UCS administrator is planning to deploy stateless computing using service profiles. Which three components are abstracted from the physical hardware and defined in the service profile? (Choose three.)

Accepted Answer

Boot order. In Cisco UCS stateless computing, the service profile holds all identity and configuration data that can follow a server across hardware. Option A (Boot order) is correct because the boot policy, including boot order, is defined in the service profile and applied to the server. Option B (MAC addresses for vNICs) is correct because MAC addresses are pool-derived identities assigned to vNICs in the service profile, enabling consistent network identity. Option D (Server UUID) is correct because the server UUID is a logical identity defined in the service profile and presented to the OS. Option C (Physical disk serial numbers) is not abstracted; disk serial numbers are physical hardware identifiers tied to the actual drives. Option E (CPU model) is not abstracted; the CPU model is a physical hardware attribute of the server and cannot be defined in a service profile.

Answer

Physical disk serial numbers

Answer

CPU model

Question 6

A network engineer wants to use Ansible to automate the configuration of Nexus switches. Which two statements about the cisco.nxos Ansible collection are correct? (Choose two.)

Accepted Answer

It includes the nxos_config module for applying CLI commands.. The collection includes modules like nxos_config and nxos_vlan, and it is supported on NX-OS platforms.

Answer

It is part of the Ansible Core collection.

Answer

It can only manage VLANs.

Answer

It is used exclusively for ACI automation.

Question 7

Which two statements about the NX-API REST interface on Nexus switches are true? (Choose two.)

Accepted Answer

It supports JSON and XML encoding.. NX-API REST supports JSON and XML and uses HTTPS for secure communication.

Answer

It uses YANG models exclusively.

Answer

It only supports read-only operations.

Answer

It uses SSH for transport.

Question 8

Which TWO components are required in a HyperFlex cluster to provide both compute and storage functionality?

Accepted Answer

Storage Controller VM (SCVM). The Storage Controller VM (SCVM) is correct because it is the software-defined storage controller that runs on each HyperFlex node, aggregates local disks into the distributed HX Data Platform datastore, and delivers the storage functionality of the cluster. The Hypervisor (e.g., VMware ESXi) is correct because it runs on each node and hosts both the SCVM and the user VMs, providing the compute functionality alongside storage. Together, the hypervisor plus SCVM on every node are what make HyperFlex a converged compute-and-storage platform. UCS Manager is not required, since HyperFlex is managed through HyperFlex Connect and the HX Data Platform rather than UCSM. CIMC is only the out-of-band management interface on the servers and does not provide compute or storage services. The Witness VM is only used in stretched/edge deployments for quorum and does not supply compute or storage functionality.

Answer

UCS Manager

Answer

CIMC

Answer

Witness VM

Question 9

Which THREE of the following are required for a successful FCoE deployment on a Cisco MDS switch?

Accepted Answer

Enable the FCoE feature globally. The FCoE feature must be enabled globally on the Cisco MDS switch using the 'feature fcoe' command. This activates the FCoE protocol stack and allows the switch to process FCoE frames, which is a prerequisite for any FCoE deployment.

Answer

Enable FIP snooping on the FCoE VLAN

Answer

Set the MTU to 9216 bytes on all FCoE interfaces

Question 10

Which TWO statements about NPV configuration on a Cisco MDS switch are true? (Choose two.)

Accepted Answer

NPV mode is enabled globally with the 'npv enable' command.. NPV (N-Port Virtualization) mode is enabled globally on a Cisco MDS switch using the 'npv enable' command. This command places the entire switch into NPV mode, allowing it to function as an NPV proxy that forwards FLOGI requests from downstream F ports to the core Fibre Channel switch. NPV mode is not a per-VSAN configuration; it is a global switch-level setting.

Answer

The core switch must have NPV enabled as well.

Answer

All downstream interfaces must be F ports.

Answer

NPV mode is configured per VSAN.

Question 11

Which THREE factors should be considered when designing an FCoE SAN to avoid traffic loss? (Choose three.)

Accepted Answer

Enable priority flow control (PFC) on all FCoE-enabled interfaces.. Priority Flow Control (PFC) is essential in an FCoE SAN because it provides a lossless Ethernet fabric by pausing traffic on a per-priority basis. Without PFC, standard Ethernet congestion mechanisms would drop FCoE frames, which violates the lossless requirement of Fibre Channel traffic. Enabling PFC on all FCoE-enabled interfaces ensures that buffer credits are managed correctly and no frames are discarded due to congestion.

Answer

Use standard Ethernet cut-through switching for all FCoE traffic.

Answer

Disable the FIP snooping feature to reduce latency.

Question 12

A data center network uses Cisco Nexus switches with VXLAN EVPN. Which two components are essential for VXLAN EVPN operation? (Choose two.)

Accepted Answer

VXLAN VTEPs on leaf switches.. VXLAN VTEPs (VXLAN Tunnel Endpoints) on leaf switches are essential because they perform the encapsulation and decapsulation of VXLAN frames, enabling Layer 2 overlay networks over a Layer 3 underlay. Without VTEPs, there is no mechanism to create the VXLAN tunnels that carry traffic between endpoints across the IP fabric.

Answer

OSPF as underlay routing protocol.

Answer

VPC for host-facing links.

Answer

PIM-SM for multicast replication.

Question 13

Which two statements about the Cisco NX-API REST interface are true? (Choose two.)

Accepted Answer

It can be used to send CLI commands.. Option B is correct because the Cisco NX-API REST interface allows you to send CLI commands to the switch by including them in the request body, typically using the `ins_api` or `cli` input, so existing CLI knowledge can be reused programmatically. Option D is correct because NX-API REST supports both XML and JSON as message formats for requests and responses, selectable via the `Content-Type` and `Accept` headers or the `output_format` parameter. Option A is incorrect because NX-API REST supports multiple HTTP methods, including GET, POST, PUT, and DELETE, not only GET. Option C is incorrect because YANG models are not required; NX-API REST can accept CLI-style commands and does not mandate model-driven operations. Option E is incorrect because NX-API REST uses HTTP or HTTPS (typically TCP 80/443) for transport, not SSH.

Answer

It only supports GET operations.

Answer

It requires the use of YANG models.

Answer

It uses SSH for transport.

Question 14

Which three actions can be taken when a port security violation occurs? (Choose three.)

Accepted Answer

Shutdown. When a port security violation occurs, the switch can be configured to take one of three actions: shutdown, restrict, or protect. The shutdown action (A) immediately disables the port and places it in an errdisable state, which is the default behavior. This is correct because it provides the most secure response by completely blocking traffic from the violating MAC address.

Answer

Errdisable recovery

Answer

Log

Question 15

Which two features are provided by Cisco IMC on UCS C-series rack servers? (Choose two.)

Accepted Answer

Virtual media mounting. Cisco IMC (Integrated Management Controller) on UCS C-series rack servers provides out-of-band management capabilities, including virtual media mounting (Option B), which allows an administrator to map a remote ISO or image as a virtual DVD/USB drive for OS installation and troubleshooting. It also provides remote KVM console access (Option D), enabling full keyboard, video, and mouse redirection to the server over the network for remote administration. Fabric Interconnect management (Option A) is handled by UCS Manager on B-series blade systems, not by IMC on C-series. Service profile creation (Option C) is a UCS Manager function for stateless computing on B-series and some C-series integrated with UCS Manager, not a native IMC feature. HyperFlex cluster management (Option E) is performed through HyperFlex Connect or UCS Manager/Intersight, not by the standalone IMC.

Answer

Fabric Interconnect management

Answer

Service profile creation

Answer

HyperFlex cluster management

Question 16

Which TWO UCS components are part of the unified fabric architecture?

Accepted Answer

Fabric Interconnect. The Fabric Interconnect (A) is correct because it is the core of Cisco UCS unified fabric, providing the single point of management and carrying both LAN and SAN traffic (FCoE) between the fabric and the servers. The I/O Module (C) is correct because it sits in the blade chassis and aggregates the blade server's adapter traffic, connecting it to the Fabric Interconnects as part of the unified fabric data path. The Storage Array (B) is not a UCS component of the unified fabric; it is external storage that connects to the fabric but is not itself part of the architecture. The Control Plane (D) is a functional concept, not a physical UCS component of the unified fabric. The Blade Server (E) is a compute node managed by UCS but is not itself a fabric component; it connects through the IOM and Fabric Interconnect.

Answer

Storage Array

Answer

Control Plane

Answer

Blade Server

Question 17

Which TWO are features of the Embedded Event Manager (EEM) with Python applets on Cisco NX-OS? (Choose two.)

Accepted Answer

EEM Python applets can execute CLI commands on the Nexus switch.. Option B is correct because EEM Python applets on Cisco NX-OS run locally on the switch and can invoke NX-OS CLI commands through the CLI library (for example, cli() from the Cisco NX-OS Python API), allowing the script to gather state or take corrective action. Option E is correct because EEM event statements can match syslog messages (for example, an event syslog pattern statement) and trigger the registered Python applet when a matching log is generated. Option A is incorrect because EEM Python applets execute locally on the NX-OS device and do not require an external Python server. Option C is incorrect because Python applets can import supported external libraries available on the NX-OS Python environment. Option D is incorrect because applets are not restricted to running only as root; they run under the privileges of the user or context that registered/executed them.

Answer

EEM Python applets require an external Python server.

Answer

EEM Python applets cannot use external libraries.

Answer

EEM Python applets can only run as root.

Question 18

An engineer is designing a Cisco ACI multi-site solution. Which two considerations are critical for inter-site connectivity? (Choose two.)

Accepted Answer

Deploy a L3Out at each site for external connectivity.. In Cisco ACI Multi-Site, each site operates with its own APIC cluster and independent fabric. A L3Out at each site is critical because it provides external connectivity for that site's endpoints, allowing traffic to exit locally rather than being hair-pinned across the inter-site network. This design optimizes traffic flow and aligns with the Multi-Site architecture where sites are managed separately but interconnected via the Inter-Site Network (ISN).

Answer

Configure a stretch VLAN across sites.

Answer

Use a separate OSPF process per site.

Answer

Use a single APIC cluster for both sites.

Question 19

An engineer is troubleshooting a UCS B-Series blade that fails to boot from SAN. Which TWO actions should be verified first? (Choose TWO.)

Accepted Answer

Verify that the vHBA WWPN is correctly zoned on the SAN switches.. Option A is correct because SAN boot depends on the vHBA's WWPN being included in the correct zone on the SAN fabric; if the WWPN is not zoned to the storage array's target ports, the blade cannot see the boot LUN. Option B is correct because the UCS boot policy must explicitly reference the SAN boot target (the array's WWPN and LUN), and without that entry the blade has no boot target to attempt. Option C is not relevant because a MAC address belongs to the vNIC/Ethernet path and does not affect Fibre Channel SAN boot. Option D is not relevant because QoS policy settings for FC traffic do not determine whether the boot LUN is reachable. Option E is incorrect because listing local disk first would actually prevent or delay SAN boot, not fix it.

Answer

Check the MAC address assigned to the vNIC.

Answer

Ensure the QoS policy for FC traffic is set to Platinum.

Answer

Verify the server's boot order lists local disk first.

Question 20

Which TWO methods are supported by Cisco NX-API for automating Nexus switches? (Choose two.)

Accepted Answer

NX-API CLI. NX-API CLI (option A) is correct because it allows automation clients to send NX-OS CLI commands over HTTP/HTTPS to the Nexus switch's NX-API engine, which parses and executes them and returns structured output such as JSON or XML. NX-API REST (option B) is also correct because it exposes a RESTful interface using HTTP methods (GET, POST, PUT, DELETE) against NX-OS data models and managed objects, returning JSON or XML responses. SNMP (option C) is not an NX-API method; it is a separate legacy management protocol used for monitoring and limited configuration. RESTCONF (option D) and NETCONF (option E) are model-driven programmatic interfaces based on YANG, but they are distinct from Cisco's NX-API framework and are not the two methods NX-API itself supports.

Answer

SNMP

Answer

RESTCONF

Answer

NETCONF