350-601 Storage Network Practice Question
A company has two data centers connected via a WAN link using an FCIP tunnel between two Cisco MDS 9700 switches. The FCIP link is configured on a GigabitEthernet port with an MTU of 1500 bytes and uses IPSec for encryption. Recently, storage replication traffic has become slow, and the administrator notices high TCP retransmissions on the FCIP interface. The administrator checks the bandwidth utilization and sees it is only 50% of the link capacity. The storage arrays report no errors or performance issues on their local switches. The administrator also verifies that the FCIP profile is configured correctly and that compression is enabled but not causing any errors. What is the most likely cause of the TCP retransmissions?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The TCP window size is too small for the latency.
High TCP retransmissions and 50% utilization on an FCIP link over a high-latency WAN are classic symptoms of a TCP window size that is too small for the latency. When the TCP window is insufficient, the sender cannot keep the pipe full, leading to idle periods and retransmissions when the sender's retransmission timer expires while waiting for acknowledgments. In FCIP, the TCP window should be adjusted based on the bandwidth-delay product. A duplex mismatch would cause collisions and errors, but the absence of reported errors and only 50% utilization suggests the issue is not physical layer. IPSec overhead adds processing delay but rarely causes retransmissions. Compression delays are not significant enough to cause retransmissions. Therefore, option D is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The WAN link has packet loss due to a duplex mismatch.
Why it's wrong here
A duplex mismatch between the MDS switch and the WAN router would cause collisions and errors, leading to retransmissions, but it would also typically show interface errors and often result in lower utilization or complete link failure. The scenario does not mention interface errors, and utilization is only 50%, not near saturation, making this less likely.
- ✗
IPSec encryption introduces too much overhead.
Why it's wrong here
IPSec encryption adds processing overhead and reduces effective throughput due to header overhead, but it does not directly cause TCP retransmissions. Overhead would reduce available bandwidth, but utilization is only 50%, indicating the link is not fully utilized.
- ✗
The FCIP profile is configured with compression that is causing delays.
Why it's wrong here
Compression can introduce processing delay but typically does not cause packet loss or retransmissions. If compression were causing errors, the storage arrays would likely report issues. The scenario states compression is enabled without errors.
- ✓
The TCP window size is too small for the latency.
Why this is correct
A TCP window size that is too small for the latency prevents the sender from transmitting enough data to fill the pipe. This leads to underutilization (50%) and can cause retransmissions when the retransmission timer expires because the sender is waiting for ACKs. In FCIP, it is crucial to tune the TCP window to the bandwidth-delay product.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.