350-601 Multiple Select — 50 Questions

Question 1

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 2

Which TWO statements about Cisco UCS service profiles are correct? (Choose TWO.)

Accepted Answer

Service profiles can include policies for firmware management.. Cisco UCS service profiles can include firmware management policies that specify the firmware versions to be applied to the associated server components, such as adaptors, BIOS, and storage controllers. This allows administrators to enforce consistent firmware levels across the infrastructure without manual intervention.

Answer

Service profiles are only supported on B-Series blades.

Answer

Service profiles are tied to specific physical hardware.

Answer

A service profile does not include network identity settings such as MAC addresses.

Question 3

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

Accepted Answer

IP Source Guard. IP Source Guard (IPSG) uses the DHCP snooping binding table to validate the source IP address of packets received on untrusted ports. It drops any packet whose source IP does not match an entry in the binding table, preventing IP spoofing attacks. Dynamic ARP Inspection (DAI) also relies on the DHCP snooping binding table to validate ARP packets, ensuring that the sender MAC and IP addresses match a legitimate binding, thereby blocking ARP poisoning attacks.

Answer

Port Security

Answer

Private VLANs

Answer

MACsec

Question 4

Which TWO are best practices when automating ACI fabric configuration using Ansible?

Accepted Answer

Use the cisco.aci collection. The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

Answer

Set validate_certs: no to avoid certificate errors

Answer

Store credentials in plain text in playbooks

Answer

Use delegate_to: localhost for all tasks

Question 5

A storage administrator reports that a Cisco UCS domain is not booting from the Fibre Channel SAN. The boot policy is correctly configured and the vHBA is associated. Which two alignment issues could cause this problem? (Choose two.)

Accepted Answer

The WWPN of the vHBA is not zoned on the SAN fabric.. If the WWPN of the vHBA is not properly zoned on the SAN fabric, the Fibre Channel switch will not allow the server to log in to the target storage. Even with a correct boot policy and vHBA association, without zoning, the initiator cannot discover or communicate with the boot LUN, causing the boot to fail.

Answer

The Ethernet LAN is not configured on the FI.

Answer

The disk firmware on the server is outdated.

Question 6

Which three EVPN route types are essential for VXLAN EVPN operation in a typical data center fabric? (Choose three.)

Accepted Answer

Type-3 (Inclusive Multicast Ethernet Tag). Type-3 (Inclusive Multicast Ethernet Tag) routes are essential for VXLAN EVPN because they enable BUM traffic replication across the underlay network by advertising the VNI and multicast group mapping, allowing VTEPs to join the correct multicast tree for flooding unknown unicast, broadcast, and multicast frames.

Answer

Type-4 (Ethernet Segment)

Answer

Type-1 (Ethernet Auto-Discovery)

Question 7

A company is planning to deploy Cisco Intersight to manage a hybrid environment including on-premises UCS domains and AWS EC2 instances. Which THREE of the following are required components for integrating AWS with Intersight?

Accepted Answer

An Intersight account with appropriate licenses. A valid Intersight account with the appropriate licenses (e.g., Intersight Essentials or Premier) is required to enable the AWS integration feature. Without the proper license tier, the Intersight account cannot access the cloud orchestration or management capabilities needed to connect and manage external cloud providers like AWS.

Answer

An Intersight Virtual Appliance deployed in AWS

Answer

A VPN tunnel between the on-premises network and AWS

Question 8

Which THREE of the following are required to configure FCoE NPV on a Cisco Nexus switch?

Accepted Answer

Enable FIP snooping.. FIP snooping is required on the NPV switch to inspect and validate FCoE Initialization Protocol (FIP) frames, preventing unauthorized FCoE devices from joining the fabric. Without FIP snooping, the NPV switch cannot properly forward FCoE traffic between the ENode and the upstream FCF, making it a mandatory configuration step for FCoE NPV.

Answer

Configure a storage VLAN.

Answer

Configure a VSAN for FCoE.

Question 9

Which TWO commands are used to verify zoning configuration on a Cisco MDS switch? (Choose two.)

Accepted Answer

show zone. The 'show zone' command displays the configured zone database, including zone members and their aliases, which is essential for verifying zoning configuration. The 'show zoneset active' command shows the currently active zoneset that is enforced by the switch, confirming which zones are actually applied to traffic. Both commands directly verify zoning configuration on a Cisco MDS switch.

Answer

show fcns database

Answer

show flogi database

Answer

show vsan membership

Question 10

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 11

An engineer is configuring a storage network with FCoE and must ensure that the FCoE traffic does not interfere with standard LAN traffic. Which two mechanisms should be implemented?

Accepted Answer

Enable PFC on the FCoE VLAN.. FCoE requires lossless transport to prevent frame drops that would corrupt Fibre Channel frames. Priority Flow Control (PFC), defined by IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured as lossless while standard LAN traffic remains best-effort. This ensures FCoE traffic does not interfere with LAN traffic by isolating the flow control behavior.

Answer

Use the same VLAN for FCoE and LAN.

Answer

Disable flow control on FCoE VLAN.

Answer

Use jumbo frames for LAN traffic only.

Question 12

Which TWO statements correctly describe the difference between synchronous and asynchronous replication?

Accepted Answer

Asynchronous replication has lower impact on application performance. Synchronous replication has zero RPO but can impact performance due to latency, while asynchronous replication has a lower performance impact but may have some data loss (nonzero RPO).

Answer

Asynchronous replication requires dedicated links

Answer

Synchronous replication is more tolerant of high latency links

Answer

Asynchronous replication guarantees zero data loss

Question 13

Which TWO of the following are benefits of using Smart Zoning in Cisco MDS switches?

Accepted Answer

Reduces number of zone objects. Smart Zoning reduces the number of zone objects by automatically grouping initiator-target pairs into a single zone entry, rather than requiring a separate zone for each pair. This minimizes the size of the zone database and reduces the processing overhead on the switch during fabric reconfigurations.

Answer

Provides faster FLOGI processing

Answer

Eliminates the need for VSANs

Answer

Allows automatic LUN masking

Question 14

In an ACI fabric, a tenant is configured with multiple bridge domains (BDs) and EPGs. Which three statements correctly describe the ACI model? (Choose three.)

Accepted Answer

Contracts are applied between EPGs to allow communication.. In ACI, contracts are the mechanism used to enable communication between EPGs. By default, all traffic is denied, and a contract must be explicitly applied to allow traffic flow between EPGs, enforcing a zero-trust model.

Answer

EPGs can communicate with each other without any contract.

Answer

L3Out is used to connect the ACI fabric to external Layer 2 networks.

Question 15

In Cisco ACI, when creating a contract, which three components are part of the contract definition? (Choose three.)

Accepted Answer

Subject. In Cisco ACI, a contract defines the rules for communication between endpoint groups (EPGs). The contract definition consists of three mandatory components: Subject, Filter, and Provider/Consumer. The Subject specifies the direction and type of traffic allowed, the Filter defines the specific protocols and ports (e.g., TCP/UDP, ICMP), and the Provider/Consumer labels establish which EPG offers the service and which consumes it. Without these three, the contract cannot enforce policy-based connectivity.

Answer

VRF

Answer

Endpoint IP address

Question 16

Which THREE are valid methods for handling BUM traffic in VXLAN? (Choose three.)

Accepted Answer

Ingress replication. Ingress replication is a valid method for handling BUM traffic in VXLAN where the ingress VTEP replicates broadcast, unknown unicast, and multicast frames to all remote VTEPs in the VXLAN segment. This approach does not require a multicast routing infrastructure in the underlay, making it simpler to deploy in networks that lack multicast support. It is defined in RFC 7348 and is commonly used in VXLAN EVPN fabrics.

Answer

Egress replication

Answer

Flood and learn

Question 17

A UCS administrator needs to update the firmware on a remote rack server that is not reachable via the production network. Which two features of Cisco IMC can be used? (Choose two.)

Accepted Answer

Virtual media. CIMC provides out-of-band management; KVM console and virtual media can be used for firmware updates even if the OS network is down.

Answer

Syslog

Answer

SNMP traps

Answer

HTTP server integration

Question 18

An organization is deploying UCS C-series rack servers in standalone mode. Which two management capabilities are available through Cisco IMC? (Choose two.)

Accepted Answer

KVM console access. Cisco IMC provides KVM console and virtual media mounting, as well as remote firmware upgrade. These are common out-of-band management features.

Answer

UCS Manager integration

Answer

HyperFlex cluster management

Answer

Fibre Channel zoning

Question 19

A HyperFlex cluster with 6 nodes using RF3 experiences a node failure. After the failed node is replaced, the administrator notices degraded performance. Which THREE factors could contribute to the performance degradation?

Accepted Answer

The cluster is rebalancing data across all nodes.. During re-replication, there is increased I/O and CPU load. Additionally, if the replacement node is slower (e.g., fewer SSDs) or if the cluster is rebalancing, performance can suffer.

Answer

The witness VM is offline.

Answer

The replication factor changed from RF3 to RF2.

Question 20

A data center administrator is designing a HyperFlex cluster for a virtualized environment. The cluster must be able to tolerate the failure of any two nodes. Which two configuration choices are required? (Choose two.)

Accepted Answer

Minimum of 5 nodes. To tolerate two node failures, the cluster must have at least 5 nodes (with RF3, quorum requires >50% of total nodes; with 5 nodes, quorum is 3, and losing 2 leaves 3, maintaining quorum). RF3 replicates data three times, ensuring data remains available even after two failures.

Answer

Cluster witness VM

Answer

Minimum of 4 nodes

Answer

Replication factor RF2