350-601 Quick Quiz — 10 Questions

Question 1

A company is deploying FCoE in their data center. The design includes a Cisco Nexus 9000 switch with FEX modules. The storage team insists on using dedicated FCoE VLANs. Which best practice should be followed to ensure lossless behavior for FCoE traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable PFC on the switch for the FCoE VLAN. FCoE requires lossless transport to prevent frame drops that could corrupt Fibre Channel frames. Priority Flow Control (PFC), defined in IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured with a dedicated priority class that receives no-drop treatment. On Cisco Nexus 9000 switches, this is achieved by enabling PFC on the specific VLAN used for FCoE traffic, ensuring lossless behavior without affecting other traffic classes.

Answer

Configure traffic shaping on FCoE interfaces

Answer

Use the same VLAN for FCoE and IP traffic to reduce VLAN count

Answer

Disable flow control on all interfaces

Question 2

In a Cisco ACI fabric, which component is responsible for managing the policy repository, fault monitoring, and API endpoints?

Accepted Answer

APIC controller. The APIC (Application Policy Infrastructure Controller) is the centralized management and policy engine in Cisco ACI. It maintains the policy repository (the logical and physical policy model), aggregates faults and events from all fabric nodes, and exposes northbound REST API endpoints for automation and integration. Without the APIC, the fabric cannot enforce policies or provide a single point of management.

Answer

DCNM

Answer

Spine switch

Answer

Leaf switch

Question 3

An engineer is configuring vPC on a pair of Nexus switches. Which statement correctly describes the vPC peer-keepalive link?

Accepted Answer

It is a Layer 3 link used to verify the health of the vPC peer. The vPC peer-keepalive link is a Layer 3 link used exclusively to monitor the health of the vPC peer. It sends periodic keepalive messages (typically using UDP port 3200) to detect if the peer switch has failed, enabling the surviving switch to take over the vPC traffic. This link does not carry data traffic, BPDUs, or control-plane information beyond the keepalive probes.

Answer

It is used to forward data traffic between vPC peers

Answer

It must be a dedicated Layer 2 link between vPC peers

Answer

It carries BPDUs to prevent loops

Question 4

A data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?

Accepted Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit ip any any. ACLs are processed top-down, and the first match wins. The explicit permit for SSH from the jump host (10.10.1.100) must come before the deny for the entire 10.10.0.0/16 range to ensure the exception is honored. The final permit ip any any allows all other non-management traffic, which is necessary to avoid dropping legitimate traffic on the management interface.

Answer

permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22

Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255

Answer

deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any

Question 5

In an FCoE environment, which protocol is responsible for discovering and initializing FCoE-capable endpoints, including the exchange of MAC addresses and establishing virtual links?

Accepted Answer

FIP. FIP (FCoE Initialization Protocol) is the protocol defined in FC-BB-5 that discovers FCoE-capable endpoints (ENodes and FCFs), exchanges MAC addresses, and establishes virtual links between them. It performs the FCoE equivalent of fabric login before FCoE data traffic flows. FCoE itself is the encapsulation of Fibre Channel frames over Ethernet, not the discovery/initialization protocol.

Answer

ARP

Answer

DCBX

Answer

FCoE

Question 6

Refer to the exhibit. An engineer configured NX-API on a Nexus 9000 switch. The REST API client receives 'SSL_ERROR_BAD_CERT_DOMAIN'. What is the most likely cause?

Accepted Answer

The certificate does not match the switch's hostname. The SSL_ERROR_BAD_CERT_DOMAIN error indicates that the certificate presented by the Nexus 9000 switch does not match the hostname used in the REST API client's request. When NX-API uses HTTPS, the client validates the server's certificate against the requested domain; a mismatch triggers this error. This is a common TLS/SSL certificate validation issue, not a problem with HTTP conflicts, missing keys, or corrupted files.

Answer

HTTP is enabled which conflicts with HTTPS

Answer

The key file is missing

Answer

The certificate file is corrupted

Question 7

Which THREE are benefits of using Cisco UCS Manager to manage compute resources? (Choose three.)

Accepted Answer

Centralized management of multiple chassis. Cisco UCS Manager provides a single pane of glass for the entire UCS domain, so option A (Centralized management of multiple chassis) is correct because one UCS Manager instance can manage up to 20 chassis and hundreds of blades from a single interface. Option C (Policy-based provisioning to automate server deployment) is correct because UCS Manager uses service profiles and pools (UUID, MAC, WWN, BIOS, boot policy) to abstract hardware and automate consistent, repeatable server deployment. Option E (Unified fabric for LAN and SAN traffic) is correct because UCS Manager manages the fabric interconnects that carry both Ethernet LAN and Fibre Channel SAN traffic over a unified fabric (FCoE), reducing cabling and adapters. Option B is not a UCS Manager benefit because UCS Manager manages physical compute, network, and storage-access resources, not guest VMs, which are managed by hypervisors such as vCenter or Hyper-V. Option D is incorrect because UCS Manager does not improve performance by disabling hardware features; it enables features and applies BIOS/firmware policies, and disabling hardware would generally reduce capability rather than improve performance.

Answer

Direct management of virtual machines

Answer

Improved performance by disabling hardware features

Question 8

An organization requires disk encryption for data at rest in their UCS environment. Which technology should be used?

Accepted Answer

SED. Self-encrypting drives (SEDs) provide hardware-based encryption for data at rest.

Answer

AES-256 software encryption

Answer

FC-SP-2

Answer

SAN encryption

Question 9

A data center uses NPV to connect edge switches to a core Fibre Channel switch. The edge switches report that some servers cannot log in. What is a likely cause?

Accepted Answer

NPIV not enabled on the core switch. In an NPV environment, the edge switch (NPV mode) relies on the core Fibre Channel switch to handle fabric login (FLOGI) and name server registration. NPIV (N_Port ID Virtualization) must be enabled on the core switch to allow multiple N_Port IDs to be assigned to a single physical N_Port, which is essential for NPV to function. If NPIV is not enabled on the core, the core switch cannot accept FLOGI requests from the NPV edge switch, preventing servers from logging into the fabric.

Answer

Overlapping VSAN IDs between edge and core

Answer

F port binding on the edge switch

Answer

Trunking mode not enabled on the core switch

Question 10

A storage administrator wants to ensure that only designated initiators can access a specific target in a Fibre Channel SAN. Which mechanism enforces this policy?

Accepted Answer

Zoning. Zoning is the correct mechanism because it restricts Fibre Channel (FC) communication to only those initiators and targets that are members of the same zone. By defining a zone that includes only the designated initiator WWPNs and the target WWPN, the switch enforces access control at the fabric level, preventing any unauthorized device from discovering or communicating with the target.

Answer

IVR

Answer

Port channel

Answer

VSAN

Answer

Credit recovery