Practise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command.
Start Scenario PracticeA data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?
Explanation: ACLs are processed top-down, and the first match wins. The explicit permit for SSH from the jump host (10.10.1.100) must come before the deny for the entire 10.10.0.0/16 range to ensure the exception is honored. The final permit ip any any allows all other non-management traffic, which is necessary to avoid dropping legitimate traffic on the management interface.
Refer to the exhibit. An engineer configured NX-API on a Nexus 9000 switch. The REST API client receives 'SSL_ERROR_BAD_CERT_DOMAIN'. What is the most likely cause?
Explanation: The SSL_ERROR_BAD_CERT_DOMAIN error indicates that the certificate presented by the Nexus 9000 switch does not match the hostname used in the REST API client's request. When NX-API uses HTTPS, the client validates the server's certificate against the requested domain; a mismatch triggers this error. This is a common TLS/SSL certificate validation issue, not a problem with HTTP conflicts, missing keys, or corrupted files.
An administrator needs to configure a Fibre Channel SAN to support two separate departments that must not see each other's storage. Each department has its own set of initiators and targets. Which technology should be used?
Explanation: VSANs (Virtual SANs) provide isolation within a single Fibre Channel fabric by partitioning the physical SAN into multiple logical SANs. Each department's initiators and targets are placed in separate VSANs, ensuring they cannot see each other's storage traffic or devices, which meets the requirement for complete separation without additional physical hardware.
A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer must configure the underlay to support load balancing of VXLAN traffic across multiple equal-cost paths. Which two actions are required to achieve this? (Choose two.)
Explanation: To load-balance VXLAN traffic across multiple equal-cost paths, the underlay must have multiple equal-cost routes installed in the routing table, and the switch must hash traffic using fields that vary per flow. Including Layer 4 information, especially the source UDP port, provides the necessary entropy. The routing protocol must support ECMP and be configured to install multiple paths. Together, these actions enable effective distribution of VXLAN traffic.
An engineer is configuring a Cisco MDS switch to connect to a core switch in NPV mode. The edge switch will be connected to the core via an ISL. What port mode should be configured on the edge switch's interface connecting to the core?
Explanation: In NPV (N_Port Virtualization) mode, the edge switch does not participate in the core fabric's domain ID space. Instead, its uplink to the core acts as an NP-port (N-port proxy), which behaves like an N-port to the core but proxies logins from the edge devices. Therefore, the interface on the edge switch connecting to the core must be configured as an NP-port.
+10 more scenario questions available
Practice all Which Command Should the Administrator Use Practice QuestionsPractise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command. These appear throughout the 350-601 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 350-601. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 350-601 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Which Command Should the Administrator Use Practice Questions session with instant scoring and detailed explanations.
Start Scenario Practice →