Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 1–75

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'hardware rate-limiter' is a legacy feature on some Cisco platforms that limits traffic in hardware, but it does not provide the granularity of matching ICMP protocol specifically and may affect all ICMP or other traffic; it is not the recommended CoPP approach for NX-OS. Option B is wrong because the police command syntax is incorrect: it uses 'police rate 1000 pps burst 200' without the 'byte' keyword, and the class-map uses 'match access-group name' which matches based on an ACL rather than the protocol directly, potentially missing ICMP TTL-exceeded messages that are not captured by the ACL; also, the policy-map is applied with 'service-policy input' instead of 'service-policy type control-plane', which is the correct NX-OS syntax for CoPP. Option C is wrong because applying a QoS policy on the management interface only affects traffic entering via that interface, not the control plane traffic from data interfaces; it would not protect the supervisor from ICMP TTL-exceeded messages arriving from external networks through data ports.

Why this answer

How to eliminate wrong answers

Option A is wrong because reducing the number of switches by using a single director does not inherently isolate traffic; it simply consolidates hardware without providing logical separation. Option C is wrong because using a single VSAN with extensive zoning only controls which devices can communicate, but all traffic still shares the same fabric services and control plane, which can lead to instability and security risks. Option D is wrong because deploying separate physical cabling for each SAN defeats the purpose of consolidation and increases cost and complexity, whereas VSANs achieve isolation logically.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because checking vCenter logs is a diagnostic step that does not resolve the firmware mismatch; the root cause is already identified (CIMC firmware version out of compliance). Option B is wrong because reinstalling ESXi is unnecessarily disruptive and does not fix the CIMC firmware version mismatch, which is the underlying cause of the management communication failure. Option D is wrong because changing the Intersight firmware baseline to match the outdated CIMC version (4.0(1a)) would bypass the compliance alert but leave the server running an unsupported and potentially buggy firmware version, failing to resolve the actual issue and risking future stability.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because VNI 10000 not being mapped to a VLAN would prevent local bridging, but the NVE interface can still encapsulate VXLAN traffic if the VNI is configured under the NVE and the BGP EVPN control plane is operational. Option B is wrong because ingress replication can be configured as static or dynamic (via BGP EVPN); the protocol does not need to be static—dynamic replication via BGP EVPN is standard. Option C is wrong because the loopback0 interface is likely already configured (the exhibit shows it as the source interface under NVE1), and if it were missing, the NVE interface would not come up at all.

Why this answer

How to eliminate wrong answers

Option B is wrong because a misconfigured VNI would typically prevent the packet from being encapsulated or forwarded at all, or cause it to be dropped, not flooded to all VTEPs. Option C is wrong because an MTU exceeding 1500 bytes would cause fragmentation or drop issues, not flooding behavior. Option D is wrong because ARP suppression is a control-plane optimization that reduces ARP broadcast traffic within a VNI; disabling it would cause ARP requests to be flooded, but the question describes flooding of a data packet with a known destination MAC, which is unrelated to ARP suppression.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because configuring passive-interface default under OSPF suppresses all OSPF hello packets on all interfaces, preventing neighbor adjacency formation entirely, which would break OSPF routing. Option B is wrong because setting the OSPF network type to point-to-multipoint does not inherently prevent a router from becoming DR; it changes the behavior to treat the network as a collection of point-to-point links but still allows DR election on multi-access segments. Option D is wrong because setting the OSPF priority to 255 (the highest possible value) makes the spine switch the most likely candidate to become the DR, which is the opposite of the desired outcome.

Why this answer

How to eliminate wrong answers

Option B is wrong because OSPF with opaque LSA is used for MPLS Traffic Engineering or GMPLS signaling, not for advertising EVPN routes in VXLAN fabrics. Option C is wrong because eBGP with standard IPv4 unicast only carries IPv4 prefix information and cannot carry the MAC, VNI, and VTEP information required for EVPN overlay routes. Option D is wrong because iBGP with standard IPv4 unicast similarly lacks the EVPN address family and cannot transport the necessary overlay control-plane information for VXLAN.

Why this answer

How to eliminate wrong answers

Option A is wrong because Type 3 (Inclusive Multicast Ethernet Tag) routes are used to advertise multicast group membership for BUM traffic, not individual MAC addresses. Option B is wrong because Type 1 (Ethernet Auto-Discovery) routes are used for redundancy and fast convergence (e.g., aliasing and backup paths), not for MAC/VNI advertisement. Option C is wrong because Type 5 (IP Prefix) routes are used to advertise IP prefixes (e.g., external networks) in EVPN, not MAC addresses.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the VLAN ID is a Layer 2 identifier local to a switch or within a broadcast domain, and it does not provide the global segmentation needed for VXLAN overlay networks; the VNI is used instead. Option B is wrong because the VTEP IP is the source or destination IP address used for VXLAN encapsulation and decapsulation, not the identifier that maps a VLAN to the overlay. Option D is wrong because VPC (Virtual Port Channel) is a Cisco technology for link aggregation and redundancy, unrelated to VLAN-to-VXLAN mapping.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (MST) is wrong because MST (Multiple Spanning Tree Protocol, 802.1s) maps multiple VLANs into a single spanning tree instance, reducing the number of STP instances but not providing per-VLAN load balancing; it groups VLANs, which can lead to suboptimal path usage for individual VLANs. Option C (RSTP) is wrong because RSTP (Rapid Spanning Tree Protocol, 802.1w) is a single-instance protocol that does not support per-VLAN load balancing; it operates on the entire bridged network without VLAN awareness. Option D (STP) is wrong because classic STP (802.1D) is a single-instance protocol with slow convergence (30-50 seconds) and no VLAN awareness, making it unsuitable for per-VLAN load balancing in modern data center networks.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Ansible is an automation framework that uses playbooks to manage devices, but it does not itself provide an HTTP-based interface for executing CLI commands on Nexus switches; it typically relies on NX-API or SSH via modules like nxos_command. Option B is wrong because pyATS (Python Test Automation System) is a testing framework for network devices, not a tool that exposes an HTTP-based CLI execution interface; it uses other transports like SSH or NX-API to interact with devices. Option C is wrong because Netmiko is a Python library for simplifying SSH connections to network devices, not an HTTP-based interface; it uses SSH, not HTTP, and returns unstructured text, not structured JSON.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because CDB snapshots are used for backup and restore of NSO's own configuration database, not for detecting or reconciling out-of-band device changes. Option C is wrong because service model templates define service-level configurations and are used for deploying services, not for detecting or reconciling direct device modifications. Option D is wrong because the rollback and recovery mechanism reverts NSO's own transaction history to a previous state, but it does not detect or reconcile out-of-band changes made directly on devices.

Why this answer

How to eliminate wrong answers

Option A is wrong because imperative Python scripts that execute CLI commands are not inherently idempotent; they blindly send commands each time they run, potentially causing errors or duplicate configurations unless the script explicitly checks the current state. Option C is wrong because directly calling the UCS Manager XML API using POST requests is a procedural method that requires custom logic to check existing state before applying changes; without such checks, repeated POST requests can create duplicate objects or overwrite configurations. Option D is wrong because SNMP is a monitoring protocol (RFC 1157) designed for reading MIB variables and sending traps, not for idempotent configuration operations; it lacks the state comparison and transactional guarantees needed for reliable configuration management.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because VTP (VLAN Trunking Protocol) is a Layer 2 messaging protocol used to synchronize VLAN information across switches, not a trunking encapsulation method; it is disabled by default on Nexus switches and not used to carry VLANs over a link. Option B is wrong because DTP (Dynamic Trunking Protocol) is a Cisco proprietary protocol used to negotiate trunking status between switch ports, but it does not encapsulate or carry VLAN traffic; it merely automates the establishment of a trunk link. Option C is wrong because ISL (Inter-Switch Link) is a Cisco proprietary trunking encapsulation that is not supported on Nexus switches; Nexus platforms use only 802.1Q for VLAN trunking.

Why this answer

How to eliminate wrong answers

Option A is wrong because an MTU mismatch on the peer-link would cause packet drops or CRC errors, not the suspension of vPC member ports; the peer-link itself would still be up and vPC member ports would remain active. Option C is wrong because a mismatched vPC domain ID would prevent the vPC peer-link from forming at all, not cause member ports to suspend after the peer-link is established. Option D is wrong because incorrect VLAN configuration on member ports would cause traffic issues or ports to be in an err-disabled state, but the vPC member ports would not be suspended specifically due to VLAN misconfiguration; suspension is a vPC-specific state triggered by dual-active detection.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because if the username were incorrect, the error would typically be 'Authentication failed' or 'User not found', but the error message shown does not distinguish between username and password; however, the most common cause in Ansible playbooks is a password mismatch, not a username typo. Option C is wrong because if SSH were not enabled, the error would be 'Connection refused' or 'No route to host', not 'Permission denied'. Option D is wrong because Ansible version incompatibility with NX-OS would manifest as module execution failures or unsupported features, not an SSH authentication error.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because SSH CLI commands via Paramiko emulate a terminal session, which is slower, less reliable for large-scale automation, and requires parsing CLI output, whereas NX-API offers structured data exchange. Option C is wrong because Ansible is a configuration management tool that abstracts the underlying API or CLI, but the question specifically asks for a Python script-based tool; Ansible playbooks are written in YAML, not Python scripts, and while Ansible can use NX-API modules, the question's context demands a direct Python scripting approach. Option D is wrong because SNMP SET commands are designed for monitoring and simple configuration changes, not for complex tasks like VLAN deployment, and they lack the transactional reliability and structured data handling of NX-API.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because insufficient buffer credits typically cause frame drops and retransmissions under high load, not a consistent speed cap; the scenario describes a persistent throughput limit, not loss‑induced slowdown. Option C is wrong because hardware compression reduces the volume of data written to tape, which would improve backup performance, not limit it. Option D is wrong because Fibre Channel operates in full‑duplex mode by design; half‑duplex does not exist in FC standards (FC‑0 through FC‑4 all assume full‑duplex links).

Why this answer

How to eliminate wrong answers

Option B is wrong because moving the backup server to VSAN 100 would disrupt backup isolation and does not address the root cause—the switch interface is not trunking to carry VSAN 200 traffic. Option C is wrong because changing the storage array interface to 'F' mode would force it into a single VSAN, preventing it from serving both production and backup traffic, which is the opposite of what is needed. Option D is wrong because disabling trunking on the storage array interface would eliminate the ability to carry multiple VSANs, making the backup failure permanent; trunking is required to allow the single interface to participate in both VSANs.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because leaf switches are fully involved in forwarding data-plane traffic, not just management traffic; they handle all server-to-spine forwarding. Option B is wrong because leaf switches do not provide the Layer 3 routing core or connect to external networks—that role belongs to spine switches, which perform routing and often connect to the WAN or core. Option D is wrong because leaf switches do not interconnect spine switches; spine switches interconnect leaf switches to provide any-to-any connectivity, not the reverse.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the software repository is used to store and manage firmware images, not to check compliance against a time-based policy. Option B is wrong because the Actions tab with pending updates shows only immediate pending firmware actions, not historical or policy-based compliance status over a 30-day window. Option D is wrong because a firmware update policy defines the update schedule and target version, but it does not provide a compliance report or drift analysis for a specific server against a release-date-based policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because the playbook uses the same credentials across all sites, and if a different user lacked permissions, the error would typically be an authentication or authorization failure, not an 'object doesn't exist' error. Option B is wrong because an APIC version incompatibility would likely cause module-level errors (e.g., missing parameters or API changes), not a specific object-not-found error for an existing EPG. Option C is wrong because a typo in the EPG name would cause the same error across all sites, not just one, and the engineer confirmed the EPG exists with the correct name on the failing site.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A (2:1) is wrong because it would require 240G of uplink bandwidth (e.g., 6 × 40G uplinks), not the 160G provided. Option B (5:1) is wrong because it would imply 800G of server bandwidth, which is not the case with 48 × 10G ports. Option D (4:1) is wrong because it would require 120G of uplink bandwidth (e.g., 3 × 40G uplinks), but the actual uplink capacity is 160G, making the ratio 3:1, not 4:1.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the order of ACL entries affects which traffic is matched, but it does not cause all counters to be 0; even a misordered ACL would still match some traffic (e.g., a deny entry before a permit would still show matches for the deny). Option C is wrong because a 'permit ip any any' entry at the end of an ACL permits all unmatched traffic, but it would still match traffic and increment its own counter, not cause all counters to be 0. Option D is wrong because applying the ACL outbound instead of inbound would still match traffic exiting the interface; counters would increment if traffic flows out that interface, so 0 matches indicates no traffic is being evaluated, not a direction mismatch.

Why this answer

How to eliminate wrong answers

Option A is wrong because MAC address synchronization between vPC peers is performed over the vPC peer-link (typically a port-channel), not the keepalive link; the keepalive link only carries heartbeat messages. Option B is wrong because BPDUs for STP are exchanged over the vPC peer-link or directly on member ports, not over the keepalive link, which is a Layer 3 path and does not participate in spanning tree. Option D is wrong because the keepalive link never forwards data traffic; it is a control-plane-only link used solely for peer liveness detection, while all data traffic between vPC peers traverses the peer-link.

Why this answer

How to eliminate wrong answers

Option B is wrong because Cisco IMC Supervisor is used for managing standalone Cisco UCS C-Series servers, not for distributing VLANs across UCS domains managed by UCS Central. Option C is wrong because configuring VLANs directly on Fabric Interconnects is a local, per-domain approach that bypasses UCS Central's centralized policy management, leading to configuration drift and administrative overhead. Option D is wrong because defining the VLAN policy locally in each UCS domain defeats the purpose of centralized management with UCS Central, requiring manual replication and increasing the risk of inconsistencies.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the link timeout interval only masks the symptom by making the switch wait longer before declaring a link down, but it does not fix the underlying cause of the flapping (e.g., signal loss or SFP incompatibility). Option C is wrong because Fiber Channel ports do not support auto-negotiation for speed; speed is statically configured on both ends, and mismatched or unsupported SFPs cause flapping regardless of speed settings. Option D is wrong because performing a shut and no shut only temporarily resets the interface and does not address the root cause; the flapping will recur if the SFP is faulty or incompatible.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an incorrect NX-API version in the URL would typically result in a 404 Not Found or a different HTTP error, not a 401 Unauthorized, as the request would reach a non-existent endpoint. Option B is wrong because a firewall blocking port 443 would cause a connection timeout or a TCP reset, not an HTTP 401 response, which requires the TCP handshake to complete and the HTTP server to respond. Option D is wrong because invalid credentials would indeed produce a 401 error, but the question asks for the 'most likely' cause; in practice, NX-API being disabled is a more common initial misconfiguration than entering wrong credentials, and the 401 in that case is a generic response from the switch's HTTP server when the API feature is off.

Why this answer

How to eliminate wrong answers

Option A is wrong because the NVE interface is a virtual interface that does not require a 'no shutdown' command; it is automatically enabled when configured. Option B is wrong because the question does not mention multicast; VXLAN can use unicast (e.g., static or EVPN) for BUM traffic, and the underlay OSPF adjacency is already established, so multicast reachability is not the missing piece. Option D is wrong because VNI-to-VLAN mapping is only required for bridging traffic to local VLANs, not for the VXLAN tunnel itself to become operational.

Why this answer

How to eliminate wrong answers

Option A is wrong because API rate limiting (e.g., exceeding requests per second) typically returns a 429 Too Many Requests error, not 401 Unauthorized. Option B is wrong because a network connectivity issue would result in a timeout or connection refused error (e.g., HTTP 0 or socket error), not a 401 HTTP status code. Option C is wrong because insufficient privileges (e.g., non-admin role) would cause a 403 Forbidden error after successful authentication, not a 401 Unauthorized error.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a VRF is a Layer 3 construct that provides routing table separation, not Layer 2 segmentation; it is associated with a Bridge Domain, not the other way around. Option B is wrong because an Application Profile is a container for EPGs and their relationships, not a Layer 2 boundary; it does not define traffic separation at the data plane level. Option C is wrong because an EPG is a logical grouping of endpoints with common policy requirements, but it does not define the Layer 2 broadcast domain or VLAN-like separation; EPGs reside within a Bridge Domain.