Courseiva

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 676–750

984 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 9

Page 10 of 14

Page 11
676
MCQeasy

A data center engineer is configuring 802.1X authentication on Cisco Nexus switches for wired endpoints. The requirement is to allow traffic on the port even if no EAPOL packet is received from the endpoint (e.g., a printer). Which authentication method should be used?

A.MAC Authentication Bypass (MAB)
B.802.1X using RADIUS server
C.Port security with sticky MAC addresses
D.Local authentication with a predefined list of users
AnswerA

MAB uses the device's MAC address to authenticate against the RADIUS server if no EAPOL is received.

Why this answer

MAC Authentication Bypass (MAB) is the correct method because it allows a port to authenticate endpoints that do not send EAPOL frames, such as printers or other legacy devices. When no EAPOL is received within a configurable timeout, the switch falls back to using the source MAC address of the first frame as the authentication credential, sending it to the RADIUS server for verification. This satisfies the requirement to permit traffic even without 802.1X supplicant capability.

Exam trap

Cisco often tests the distinction between authentication methods that require EAPOL (802.1X) and those that do not (MAB), and the trap here is that candidates confuse port security or local authentication with network access control, failing to recognize that MAB is the specific fallback for non-EAPOL endpoints.

How to eliminate wrong answers

Option B is wrong because 802.1X using a RADIUS server requires the endpoint to send EAPOL frames to initiate authentication; if no EAPOL is received, the port remains unauthorized and blocks traffic. Option C is wrong because port security with sticky MAC addresses is a Layer 2 access control mechanism that limits the number of learned MAC addresses but does not integrate with RADIUS-based authentication or handle the absence of EAPOL. Option D is wrong because local authentication with a predefined list of users is used for device administration (e.g., SSH or console login), not for port-based network access control of wired endpoints.

Full explanation →
677
MCQmedium

Which Python library is part of the ACI SDK and provides a high-level object-oriented interface for interacting with the APIC?

A.pyats
B.cisco_nxapi
C.acitoolkit
D.Cobra SDK
AnswerD

Correct: Cobra SDK is the official Python SDK for ACI.

Why this answer

The Cobra SDK provides an object-oriented Python interface for ACI automation, wrapping the APIC REST API.

Full explanation →
678
MCQmedium

In a UCS B-series chassis, which component provides the management connectivity between the blades and the Fabric Interconnects?

A.CIMC
B.IOM (Input/Output Module)
C.UCS Manager
D.Blade midplane
AnswerB

IOM handles both data and management traffic to FIs.

Why this answer

The Input/Output Module (IOM) in a UCS B-series chassis provides the management connectivity between the blades and the Fabric Interconnects. It aggregates all blade traffic, including management traffic (such as CIMC communications), and forwards it to the Fabric Interconnects over the chassis backplane. Without the IOM, the blades would have no path to the Fabric Interconnects for management or data-plane operations.

Exam trap

Cisco often tests the distinction between the IOM (chassis-level connectivity) and the CIMC (blade-level management controller), leading candidates to mistakenly choose CIMC because they associate 'management connectivity' with the blade's own management processor.

How to eliminate wrong answers

Option A is wrong because the CIMC (Cisco Integrated Management Controller) is the management controller embedded on each blade or server, not a chassis-level component that provides connectivity between blades and Fabric Interconnects. Option C is wrong because UCS Manager is the centralized management software running on the Fabric Interconnects, not a hardware component within the chassis. Option D is wrong because the blade midplane is a passive backplane that provides electrical connectivity between blades and IOMs, but it does not actively manage or provide the management connectivity itself.

Full explanation →
679
MCQeasy

Which UCS B-Series chassis component provides the physical slot for a blade server?

A.IOM
B.Fabric Interconnect
C.Blade slot (bay)
D.Midplane
AnswerC

Correct. Blade servers install into slots.

Why this answer

The UCS 5108 blade chassis has 8 half-width slots or 4 full-width slots. Blades are inserted into these slots and connect to the midplane.

Full explanation →
680
MCQeasy

An engineer notices that the LED of an FC interface is off on a Cisco MDS switch. The interface is up/up. What is the most likely cause?

A.The port LED firmware is corrupted.
B.The interface is administratively down.
C.The link is up but the LED is disabled in software configuration.
D.The SFP is faulty.
AnswerC

On some MDS switches, the LED can be turned off via 'no led enable' interface command.

Why this answer

On Cisco MDS switches, the interface LED can be administratively disabled via the `no led` command in interface configuration mode, even when the interface is fully operational (up/up). This allows operators to selectively turn off LEDs for troubleshooting or to reduce visual noise in a data center, without affecting traffic. The LED being off while the interface shows up/up directly points to this software-based LED disablement.

Exam trap

Cisco often tests the misconception that an LED off always indicates a hardware or link issue, when in fact the LED can be software-disabled independently of the interface operational state.

How to eliminate wrong answers

Option A is wrong because LED firmware corruption would typically cause erratic behavior (e.g., blinking incorrectly or staying stuck in one state) rather than a consistent off state with a fully functional interface. Option B is wrong because an administratively down interface would show as 'down/down' in the show interface output, not 'up/up'. Option D is wrong because a faulty SFP would cause the link to be down (e.g., 'down/down' or 'up/down' with CRC errors), not an up/up state with the LED off.

Full explanation →
681
MCQmedium

A company runs a multi-tenant data center using Cisco ACI with multiple tenants. Each tenant has its own VRF and EPGs. The security policy requires that tenant A's web servers (EPG web_tenantA) be accessible from tenant B's application servers (EPG app_tenantB) only via HTTPS (TCP 443). The ACI fabric is configured with contracts. The administrator has created a contract with a filter for HTTPS (tcp dstPort 443) and applied it as a provider contract on EPG web_tenantA and as a consumer contract on EPG app_tenantB. However, traffic from tenant B's app servers to tenant A's web servers is being dropped. The administrator has verified that the contracts are applied correctly and the filter is correct. What is the most likely cause of the traffic drop?

A.The EPGs are not in the same bridge domain; they must be in the same bridge domain to communicate.
B.The VRF of tenant A and tenant B must have route leaking configured to allow inter-VRF routing.
C.The contract is not marked as 'shared' between tenants; a shared contract must be created and both EPGs must be in the same VRF or use a shared VRF.
D.The filter for HTTPS must also include the source port range 49152-65535 for ephemeral ports.
AnswerC

ACI requires shared contracts for cross-tenant communication, and the EPGs must be in the same VRF or use a shared VRF.

Why this answer

In Cisco ACI, contracts are local to a VRF by default. For inter-tenant communication where each tenant has its own VRF, the contract must be explicitly marked as 'shared' and both EPGs must either be in the same VRF or use a shared VRF that allows cross-VRF policy enforcement. Without this, the contract filter is not applied across VRFs, causing traffic to be dropped even though the contract and filter are correctly configured.

Exam trap

Cisco often tests the misconception that contracts work across VRFs by default, when in fact they require explicit sharing configuration, leading candidates to overlook the 'shared contract' requirement.

How to eliminate wrong answers

Option A is wrong because EPGs do not need to be in the same bridge domain to communicate; ACI uses contracts to enable communication across different bridge domains and even across VRFs when properly configured. Option B is wrong because route leaking is not required for inter-VRF communication in ACI; contracts with a shared VRF handle the routing and policy enforcement between VRFs without explicit route leaking. Option D is wrong because the filter for HTTPS only needs to specify the destination port (tcp dstPort 443); source ports are ephemeral and automatically allowed by ACI's stateful nature, so specifying a source port range is unnecessary and would not cause traffic drops.

Full explanation →
682
MCQmedium

A storage administrator is setting up iSCSI connectivity between a server and a storage array. To enhance security, the administrator wants to authenticate the initiator and target during the login process. Which authentication method should be configured?

A.IPsec
B.RADIUS
C.CHAP
D.Kerberos
AnswerC

CHAP provides authentication during the iSCSI login process, supporting both one-way and mutual authentication.

Why this answer

CHAP is a standard authentication protocol for iSCSI that provides mutual authentication between initiator and target.

Full explanation →
683
MCQhard

You are a network engineer at a financial institution. The company has two data centers: DC1 and DC2, connected via a dark fiber link. Each data center has a pair of Nexus 7000 switches in a vPC configuration. The dark fiber link connects to a port on each Nexus 7000 pair using a Layer 2 port-channel. The requirement is to extend VLAN 100 between the two data centers for a critical application that requires a stretched Layer 2 domain. The current configuration has the port-channel on both sides set to mode 'active' with LACP. VLAN 100 is allowed on the trunk. The application servers report intermittent connectivity issues, with some packets being dropped. Upon inspection, you notice that the MAC address table on the Nexus 7000 in DC1 shows the MAC address of the server in DC2 on the dark fiber port-channel interface, but also on a local access port connected to a different server in the same VLAN. What is the most likely cause of the intermittent connectivity?

A.The dark fiber link is experiencing high latency, causing MAC address timeouts.
B.LACP is misconfigured on one side, causing the port-channel to operate as individual links.
C.There is an asymmetric routing issue between the data centers.
D.Spanning Tree Protocol is not blocking one of the redundant paths, creating a loop.
AnswerD

A loop causes MAC flapping and intermittent connectivity.

Why this answer

The MAC address table showing the same MAC address on both the dark fiber port-channel and a local access port indicates a Layer 2 loop. In a vPC environment with a Layer 2 extension between data centers, Spanning Tree Protocol (STP) should block one of the redundant paths to prevent loops. If STP fails to block the appropriate port, frames loop, causing MAC address flapping and intermittent packet drops.

Exam trap

The trap here is that candidates often attribute intermittent connectivity to LACP or routing issues, but the key clue is the MAC address appearing on two different interfaces in the same VLAN, which is a definitive sign of a Layer 2 loop that STP should have prevented.

How to eliminate wrong answers

Option A is wrong because high latency does not cause MAC address timeouts or flapping; MAC aging timers are independent of latency, and high latency would cause retransmissions, not MAC table instability. Option B is wrong because LACP misconfiguration would cause the port-channel to operate as individual links, which could lead to inconsistent forwarding but not the specific symptom of the same MAC appearing on both a port-channel and a local access port; this symptom is classic for a loop. Option C is wrong because asymmetric routing is a Layer 3 issue, but the problem occurs in a stretched Layer 2 domain where routing is not involved; asymmetric routing would not cause MAC address flapping on the same VLAN.

Full explanation →
684
MCQmedium

In a spine-leaf architecture using eBGP as the routing protocol, what is the primary purpose of using eBGP rather than iBGP between spine and leaf switches?

A.To enable faster convergence than OSPF
B.To avoid the need for an IGP and simplify configuration
C.To support EVPN address families
D.To allow for unequal-cost load balancing
AnswerB

eBGP in a spine-leaf eliminates the need for an IGP and provides simple, scalable routing.

Why this answer

In a spine-leaf architecture using eBGP, the primary purpose is to avoid the need for an IGP (such as OSPF or IS-IS) and simplify configuration. eBGP between spine and leaf switches allows each leaf to be in a different private AS (e.g., 65001–650XX), and the spine can use the BGP AS_PATH to detect and prevent loops without requiring an underlying IGP. This eliminates the complexity of running a separate IGP for underlay routing, reducing operational overhead and configuration steps.

Exam trap

Cisco often tests the misconception that eBGP is chosen for faster convergence or for EVPN support, but the real reason in a spine-leaf architecture is to eliminate the need for a separate IGP, simplifying the underlay design.

How to eliminate wrong answers

Option A is wrong because eBGP does not inherently provide faster convergence than OSPF; OSPF can converge in sub-second time with fast hello timers and LSA throttling, while BGP convergence depends on BGP timers and route processing. Option C is wrong because EVPN address families can be supported over both eBGP and iBGP; the choice of eBGP over iBGP is not driven by EVPN support but by the desire to avoid an IGP. Option D is wrong because eBGP does not support unequal-cost load balancing; BGP by default selects only the best path (single path) and requires specific features like BGP multipath (which works only for equal-cost paths) or BGP-LU for unequal-cost, and this is not the primary reason for using eBGP in spine-leaf.

Full explanation →
685
MCQhard

In an EVPN-VXLAN fabric, a network engineer notices that MAC addresses learned from an external router are not being advertised as EVPN type-2 routes. The external router is connected to a leaf switch via a Layer 3 port. Which additional configuration is needed on the leaf switch?

A.Configure `redistribute host-routes` under the BGP address-family l2vpn evpn.
B.Configure `evpn` under the VLAN interface associated with the external router's VLAN.
C.Configure `ip arp evpn` on the Layer 3 interface.
D.Configure `routing-config` under BGP to enable both MAC-VRF and IP-VRF.
AnswerC

Allows the switch to advertise the neighbor's MAC and IP via EVPN.

Why this answer

When an external router is connected via a Layer 3 port, the leaf switch learns the router's MAC address through ARP, not through a VLAN. To advertise this MAC as an EVPN type-2 route, the `ip arp evpn` command must be configured on the Layer 3 interface. This command enables the switch to synchronize ARP entries into the EVPN BGP control plane, allowing MAC/IP advertisement for directly connected hosts on routed interfaces.

Exam trap

Cisco often tests the distinction between VLAN-based EVPN (where MACs are learned from the bridge domain) and routed interface EVPN (where MACs come from ARP), leading candidates to incorrectly choose VLAN-related options like `evpn` under the VLAN interface when the scenario involves a Layer 3 port.

How to eliminate wrong answers

Option A is wrong because `redistribute host-routes` under BGP address-family l2vpn evpn is used to redistribute host routes from the routing table into EVPN, not to advertise MAC addresses learned via ARP; it addresses IP prefix advertisement, not MAC-VRF type-2 routes. Option B is wrong because `evpn` under a VLAN interface is used to enable EVPN for a VLAN-based service (e.g., IRB), but the external router is connected via a Layer 3 port, not a VLAN; this configuration would not apply to a routed interface. Option D is wrong because `routing-config` under BGP is not a valid command; the correct approach for MAC-VRF and IP-VRF is to configure separate address-family contexts (e.g., `address-family l2vpn evpn` and `vrf definition`) and the `routing-config` keyword does not exist in Cisco NX-OS EVPN configuration.

Full explanation →
686
Multi-Selecthard

Which TWO are best practices when automating ACI fabric configuration using Ansible?

Select 2 answers
A.Set validate_certs: no to avoid certificate errors
B.Use the cisco.aci collection
C.Store credentials in plain text in playbooks
D.Use state: query for idempotent checks
E.Use delegate_to: localhost for all tasks
AnswersB, D

The official collection provides idempotent modules for ACI.

Why this answer

The cisco.aci collection is the official Ansible collection for automating Cisco ACI fabric configuration. It provides modules that abstract the ACI REST API, ensuring idempotent and reliable configuration management. Using this collection is a best practice because it is maintained by Cisco and follows Ansible's recommended approach for interacting with ACI.

Exam trap

Cisco often tests the misconception that disabling certificate validation (validate_certs: no) is acceptable for lab environments, but the exam expects adherence to security best practices regardless of environment.

Full explanation →
687
Multi-Selecthard

Which THREE factors should be considered when determining the number of upstream Ethernet uplinks from a UCS Fabric Interconnect to the core network? (Choose THREE.)

Select 3 answers
A.Number of VLANs defined on the Fabric Interconnect.
B.Server CPU oversubscription ratio.
C.The number of vNICs per service profile and their bandwidth limits.
D.Total expected traffic from server blades.
E.Redundancy and high availability requirements.
AnswersC, D, E

More vNICs may require more uplinks for queuing.

Why this answer

The number of vNICs per service profile and their bandwidth limits directly determine the aggregate traffic that must be carried by the upstream Ethernet uplinks. Each vNIC is assigned a specific bandwidth cap (e.g., via QoS policy or vNIC template), and the sum of these caps across all service profiles on a Fabric Interconnect dictates the minimum uplink capacity required to avoid oversubscription.

Exam trap

Cisco often tests the distinction between Layer 2 constructs (VLANs) and actual bandwidth consumption, leading candidates to incorrectly select the number of VLANs as a factor for uplink sizing.

Full explanation →
688
Multi-Selecteasy

Which THREE are best practices for securing a data center network? (Choose three.)

Select 3 answers
A.Apply device hardening, such as disabling unused services.
B.Use encryption (e.g., MACsec, IPsec) for sensitive traffic.
C.Implement role-based access control (RBAC) for management access.
D.Disable logging to reduce CPU load.
E.Use default SNMP community strings for simplicity.
AnswersA, B, C

Hardening reduces attack surface.

Why this answer

Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Exam trap

Cisco often tests the concept that security best practices must never sacrifice security for performance or convenience, so traps like 'disable logging' or 'use default strings' are designed to lure candidates who prioritize operational simplicity over security.

Full explanation →
689
MCQeasy

Which Cisco NX-OS feature allows automation and programmatic access to device configuration and monitoring using REST APIs?

A.NX-API
B.Python scripting
C.Bash shell access
D.SNMP
AnswerA

NX-API is the REST API interface for NX-OS.

Why this answer

NX-API is the correct answer because it provides a REST-based API interface on Cisco NX-OS devices, allowing automation and programmatic access to configuration and monitoring via HTTP/HTTPS methods (GET, POST, PUT, DELETE). It exposes the device's CLI commands as RESTful API calls, enabling tools like Ansible, Postman, or custom scripts to interact with the switch without requiring SSH or direct CLI access.

Exam trap

Cisco often tests the distinction between direct scripting (Python/Bash) and API-based automation, leading candidates to confuse Python scripting (which can consume APIs) with the actual API endpoint itself (NX-API).

How to eliminate wrong answers

Option B is wrong because Python scripting, while powerful for automation, does not inherently provide REST API access; it typically relies on libraries like requests to consume APIs or uses NX-API indirectly. Option C is wrong because Bash shell access provides a Linux shell environment on NX-OS but lacks native REST API capabilities; it is used for low-level system tasks, not for structured API-based configuration. Option D is wrong because SNMP is a monitoring protocol (MIB-based) that supports read/write operations but is not designed for RESTful programmatic configuration; it uses OIDs and traps, not HTTP methods or JSON/XML payloads.

Full explanation →
690
MCQhard

A large cloud provider is building a new data center using Cisco ACI with multiple leaf and spine switches. They plan to host thousands of tenants with overlapping IP addresses in different VRFs. The network team has deployed the fabric with a common security policy. During testing, they discover that traffic from Tenant A to Tenant B is being allowed even though a contract should deny it. The APIC policy shows the contract is applied to the EPGs and the deny rule is present. What is the most likely cause of the policy not being enforced?

A.The fabric is using VRF leaking that bypasses contracts.
B.The contract is not configured with the correct subject.
C.The leaf switches have not downloaded the updated policy.
D.The EPGs are in the same bridge domain.
AnswerC

Leaves may have stale policy if not refreshed.

Why this answer

In Cisco ACI, the leaf switches enforce contracts locally based on the policy downloaded from the APIC. If a contract is correctly configured on the APIC but traffic is still permitted, the most likely cause is that the leaf switches have not yet received or applied the updated policy. This can happen due to a delay in policy propagation, a communication issue between the APIC and leaf switches, or the leaf not having completed the policy resolution process.

Exam trap

Cisco often tests the misconception that once a contract is configured on the APIC, it is immediately enforced everywhere, ignoring the asynchronous policy download and local leaf switch policy resolution process.

How to eliminate wrong answers

Option A is wrong because VRF leaking in ACI is explicitly controlled by contracts and does not bypass them; any inter-VRF traffic must still be permitted by a contract. Option B is wrong because the contract subject is only relevant for defining filters and actions; if the deny rule is present and applied to the EPGs, the subject configuration is not the cause of the policy not being enforced. Option D is wrong because EPGs in the same bridge domain can communicate only if a contract allows it; being in the same bridge domain does not automatically bypass contract enforcement.

Full explanation →
691
MCQmedium

Refer to the exhibit. What is the effect of this configuration on traffic in VLAN 10?

A.Telnet traffic is permitted; all other traffic is denied.
B.All traffic is denied except telnet.
C.Telnet traffic is denied; all other traffic is permitted.
D.All traffic is permitted.
AnswerC

Correct. The ACL denies Telnet (port 23) and permits all other traffic via an explicit permit ip any any.

Why this answer

The ACL applied to VLAN 10 contains two entries: the first denies TCP traffic destined for port 23 (Telnet), and the second permits all IP traffic (permit ip any any). As a result, Telnet packets are denied by the first entry, while all other traffic (including other TCP, UDP, ICMP, etc.) is permitted by the second entry. Option C correctly states this behavior.

Option A incorrectly says Telnet is permitted. Option B incorrectly says all except telnet is denied; actually all other traffic is permitted. Option D incorrectly says all traffic is permitted; telnet is denied.

Exam trap

Cisco often tests the implicit deny any any at the end of an ACL, leading candidates to forget that a permit statement must be explicitly added to allow other traffic; here the trap is that the ACL includes a permit ip any any, so the effect is selective denial rather than blanket denial.

How to eliminate wrong answers

Option A is wrong because it states Telnet traffic is permitted, but the ACL explicitly denies Telnet (TCP port 23), so Telnet is blocked. Option B is wrong because it claims all traffic is denied except Telnet, which is the opposite of the ACL's effect—Telnet is denied and other traffic is permitted. Option D is wrong because it says all traffic is permitted, but the ACL specifically denies Telnet traffic, so not all traffic is permitted.

Full explanation →
692
MCQhard

An organization has deployed Cisco UCS Central to manage multiple UCS domains. A global service profile template is created in UCS Central. When a local UCS domain administrator tries to modify the service profile derived from this global template in UCS Manager, what happens?

A.The local administrator can modify the profile if granted specific RBAC permissions.
B.The local administrator can modify the profile, but changes are overwritten by UCS Central after 5 minutes.
C.The local administrator cannot modify the profile; it is read-only.
D.The local administrator can modify the profile, and changes sync back to UCS Central.
AnswerC

Global profiles are locked locally.

Why this answer

Global service profiles from UCS Central are read-only in local UCS Manager. They can only be modified in UCS Central, ensuring consistency across domains.

Full explanation →
693
MCQmedium

An engineer configures zoning on a Cisco MDS switch to restrict access between storage arrays and servers. They use the command 'zone name ZONE1 vsan 10' and 'member pwwn 21:00:00:1b:32:12:34:56'. Which type of zoning is being configured?

A.VSAN zoning
B.Soft zoning by port
C.Lun zoning
D.Hard zoning by WWN
AnswerD

Hard zoning by WWN uses the pwwn keyword to specify WWPN.

Why this answer

Hard zoning uses WWN (pwwn) to define zone members, and traffic is permitted only between members in the same zone. Soft zoning uses port IDs and relies on name server lookups.

Full explanation →
694
MCQeasy

Which management interface is used for out-of-band management of UCS C-Series rack servers, providing features like KVM, virtual media, and remote firmware upgrade?

A.Cisco IMC Supervisor
B.UCS Central
C.CIMC
D.UCS Manager
AnswerC

CIMC provides direct out-of-band management for each C-Series server.

Why this answer

The Cisco Integrated Management Controller (CIMC) is the out-of-band management interface for UCS C-Series servers, offering KVM, virtual media, and remote firmware management.

Full explanation →
695
Matchingmedium

Match each Cisco storage protocol to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Lossless, high-speed block storage over dedicated fabric

Block storage over TCP/IP networks

High-performance flash storage over RDMA

Fibre Channel frames encapsulated in Ethernet

File-level storage access over network

Why these pairings

The correct matches are: Fibre Channel uses dedicated hardware, iSCSI uses IP, FCoE encapsulates FC over Ethernet, and NVMe-oF extends NVMe over fabrics. Common confusions include mixing Fibre Channel and FCoE, or iSCSI and Fibre Channel characteristics.

Full explanation →
696
MCQeasy

Which protocol is used by Cisco ACI fabric to distribute endpoint information among spines?

A.IS-IS
B.OSPF
C.BGP
D.COOP
AnswerD

COOP (Council of Oracles Protocol) is the ACI-specific protocol for endpoint database distribution.

Why this answer

D is correct because the Cisco ACI fabric uses the Council of Oracle Protocol (COOP) specifically to distribute endpoint information (such as IP-to-MAC bindings and location) among spine switches. COOP operates as a lightweight, publish-subscribe protocol that runs between leaf and spine switches, ensuring that all spines maintain a consistent endpoint database without the overhead of a full routing protocol.

Exam trap

Cisco often tests the distinction between the underlay routing protocol (IS-IS) and the overlay endpoint distribution protocol (COOP), so candidates mistakenly choose IS-IS because they recall it is used in ACI, but they fail to recognize that endpoint distribution is a separate function handled by COOP.

How to eliminate wrong answers

Option A is wrong because IS-IS is used as the underlay routing protocol in ACI to establish reachability between leaf and spine switches, not to distribute endpoint information. Option B is wrong because OSPF is not used in ACI fabric; the underlay is based on IS-IS with a link-state database, and OSPF would add unnecessary complexity and is not designed for endpoint distribution. Option C is wrong because BGP is used in ACI for external routing (e.g., connecting to outside networks via L3Out) and for the Overlay-1 control plane, but it does not distribute internal endpoint information among spines; that is the role of COOP.

Full explanation →
697
MCQmedium

A company uses Cisco TrustSec in its data center to enforce segmentation. Servers in VLAN 10 (Finance) should only communicate with servers in VLAN 20 (ERP) via an application gateway. Which TrustSec component is used to assign a Security Group Tag (SGT) to traffic from the Finance servers?

A.Identity Services Engine (ISE) as the authentication and policy server
B.MACsec encryption on the links
C.802.1X port-based authentication
D.VLAN ACL (VACL) on the switch
AnswerA

ISE assigns SGTs based on user or device identity.

Why this answer

In Cisco TrustSec, the Identity Services Engine (ISE) acts as the authentication and policy server that assigns Security Group Tags (SGTs) to endpoints or traffic based on identity and policy. ISE uses 802.1X, MAB, or web authentication to identify the Finance servers and then dynamically assigns the appropriate SGT, which is then used for segmentation enforcement.

Exam trap

Cisco often tests the distinction between the authentication mechanism (802.1X) and the policy server (ISE) that actually assigns the SGT, leading candidates to mistakenly select 802.1X as the component that assigns the tag.

How to eliminate wrong answers

Option B is wrong because MACsec provides link-layer encryption and integrity, not SGT assignment; it is used to secure TrustSec links after SGTs are already assigned. Option C is wrong because 802.1X is an authentication method that can be used by ISE to identify endpoints, but it does not directly assign SGTs—ISE is the component that maps the authenticated identity to an SGT. Option D is wrong because VLAN ACLs (VACLs) filter traffic based on Layer 2/3/4 fields, not SGTs; they are not part of the TrustSec SGT assignment process.

Full explanation →
698
MCQhard

A company is deploying a Cisco UCS Mini in a remote office. They need to support both VMware vSphere and Microsoft Hyper-V on the same UCS domain. What is the best practice for deploying compute resources for both hypervisors?

A.Create separate service profile templates for each hypervisor
B.Use a single service profile but assign different VLANs for management traffic
C.Place each hypervisor in a separate UCS Organization within the same service profile template
D.Create a single service profile template and use different identity pools for each hypervisor
AnswerA

Separate templates enable boot order, firmware, and BIOS settings per hypervisor.

Why this answer

Separate service profile templates are required because VMware vSphere and Microsoft Hyper-V have different boot and storage configuration requirements. Each hypervisor needs its own boot policy (e.g., SAN boot vs. local disk), firmware settings, and potentially different vNIC/vHBA configurations. Using distinct templates ensures that each hypervisor's compute resources are correctly provisioned without conflicts.

Exam trap

Cisco often tests the misconception that VLANs or identity pools alone can differentiate hypervisor configurations, when in fact the core differences lie in boot and storage policies that require separate service profile templates.

How to eliminate wrong answers

Option B is wrong because a single service profile cannot accommodate the different boot policies, firmware versions, and storage configurations required by two distinct hypervisors; VLAN assignment for management traffic does not address these fundamental differences. Option C is wrong because UCS Organizations are used for administrative separation and RBAC, not to define different compute resource configurations within a single service profile template; a single template still applies the same policies to all servers. Option D is wrong because identity pools (e.g., UUID, MAC, WWN) only manage unique identifiers, not the boot order, firmware, or storage policies that differ between hypervisors; a single template with different pools still enforces the same configuration.

Full explanation →
699
MCQhard

A Cisco MDS switch has multiple Fibre Channel interfaces that need to be aggregated into a single logical interface to increase bandwidth and provide redundancy. Which technology should be used?

A.VSAN load balancing
B.NPV mode
C.EISL trunking
D.PortChannel
AnswerD

PortChannel provides link aggregation in FC.

Why this answer

PortChannels in Fibre Channel aggregate multiple physical links into one logical link.

Full explanation →
700
Multi-Selecthard

Which THREE factors should be considered when designing an FCoE SAN to avoid traffic loss? (Choose three.)

Select 3 answers
A.Use standard Ethernet cut-through switching for all FCoE traffic.
B.Enable priority flow control (PFC) on all FCoE-enabled interfaces.
C.Use a dedicated FCoE VLAN that is not used for any other traffic.
D.Disable the FIP snooping feature to reduce latency.
E.Ensure that the FCoE Maximum Transmission Unit (MTU) is set to 2500 bytes.
AnswersB, C, E

PFC is essential to prevent frame loss due to congestion.

Why this answer

Priority Flow Control (PFC) is essential in an FCoE SAN because it provides a lossless Ethernet fabric by pausing traffic on a per-priority basis. Without PFC, standard Ethernet congestion mechanisms would drop FCoE frames, which violates the lossless requirement of Fibre Channel traffic. Enabling PFC on all FCoE-enabled interfaces ensures that buffer credits are managed correctly and no frames are discarded due to congestion.

Exam trap

Cisco often tests the misconception that cut-through switching or disabling FIP snooping improves performance, when in fact these actions compromise lossless behavior or security in an FCoE design.

Full explanation →
701
MCQmedium

An administrator notices that a new server connected to a Fibre Channel switch cannot log in. The 'show flogi database' command does not show the server's WWPN. What is the most likely cause?

A.Trunking mode not enabled on the port
B.Incorrect zoning configuration
C.Speed mismatch between the server and switch
D.Port security enabled with WWN mismatch
AnswerD

Correct: Port security restricts which WWNs can log in.

Why this answer

The 'show flogi database' command lists all devices that have successfully completed the Fabric Login (FLOGI) process. If the server's WWPN is absent, it indicates that the FLOGI request was rejected by the switch. Port security with a WWN mismatch is the most likely cause because the switch is configured to allow only specific WWPNs, and the server's WWPN does not match the allowed list, causing the switch to silently drop the FLOGI request without logging the device.

Exam trap

Cisco often tests the distinction between FLOGI rejection (port security, fabric binding) and post-login restrictions (zoning, VSAN membership), so candidates mistakenly choose 'incorrect zoning' because they confuse zoning with port-level authentication.

How to eliminate wrong answers

Option A is wrong because trunking mode (E_port or TE_port) is used for inter-switch links (ISL), not for server-facing F_ports; a server connected to an F_port does not require trunking to perform FLOGI. Option B is wrong because incorrect zoning configuration would allow the server to log in (appear in 'show flogi database') but then prevent communication with other devices; zoning does not block the FLOGI process itself. Option C is wrong because a speed mismatch between the server and switch would prevent link initialization (the port would be in a non-operational state), but the 'show flogi database' command would not show the WWPN because the link would never come up; however, the question states the server is connected, implying link is up, and speed negotiation (auto-negotiation) typically handles mismatches without silently dropping FLOGI.

Full explanation →
702
MCQhard

In a vPC domain, a consistency check failure is observed for the vPC keepalive link. What is the impact on the vPC domain operation?

A.The vPC peer link will be suspended.
B.The secondary switch will shutdown its vPC member ports.
C.The vPC domain will continue to operate but with reduced reliability.
D.Both switches will independently forward traffic via the vPC peer link.
AnswerC

The keepalive is a secondary monitoring mechanism; its loss increases risk of split-brain if the peer link fails.

Why this answer

The vPC keepalive link is used as a secondary heartbeat to detect dual-active scenarios when the peer link fails. A consistency check failure on the keepalive link does not directly affect data forwarding; the vPC domain continues to operate, but the loss of this redundancy mechanism reduces reliability because the switches can no longer reliably detect a split-brain condition without the peer link.

Exam trap

Cisco often tests the distinction between the keepalive link and the peer link; the trap here is that candidates assume any consistency check failure will suspend the vPC domain, but only failures on the peer link or critical parameters (like vPC VLAN consistency) cause suspension, while keepalive failures merely degrade redundancy.

How to eliminate wrong answers

Option A is wrong because the vPC peer link is suspended only when there is a peer-link failure or a consistency check failure on the peer link itself, not on the keepalive link. Option B is wrong because the secondary switch shuts down its vPC member ports only when a dual-active detection occurs (e.g., peer link fails and keepalive is also lost), not due to a keepalive consistency check failure alone. Option D is wrong because both switches independently forwarding traffic via the vPC peer link describes a split-brain scenario that happens when the peer link fails and the keepalive link is also lost, not when only the keepalive consistency check fails.

Full explanation →
703
MCQhard

Refer to the exhibit. A server with vNIC eth0 is experiencing packet drops on its Ethernet interface. The server is sending jumbo frames (MTU 9000) on VLAN 100. The QoS system class 'Class-Platinum' has an MTU of 9216 and is configured with 'Drop'. The vNIC is not assigned to any QoS policy. What is the most likely reason for the drops?

A.The vNIC is not mapped to a QoS policy, so it uses the default best-effort class which has an MTU of 1500 and drops jumbo frames.
B.The QoS system class for jumbo frames requires a 'No Drop' policy to avoid drops.
C.The server is sending frames larger than 9216 bytes.
D.The native VLAN setting on the vNIC causes the QoS system class to be ignored.
AnswerA

Without a QoS policy, the default class (often Bronze) applies, which has MTU 1500.

Why this answer

When a vNIC is not assigned to a QoS policy, it defaults to the best-effair class, which typically has an MTU of 1500 bytes. Since the server is sending jumbo frames (MTU 9000) on VLAN 100, these frames exceed the default MTU and are dropped at the Ethernet interface. The 'Class-Platinum' system class with MTU 9216 is irrelevant because the vNIC is not mapped to it.

Exam trap

Cisco often tests the misconception that a system class with a higher MTU (like Class-Platinum) automatically applies to all traffic, when in fact the vNIC must be explicitly mapped to that QoS policy to use it.

How to eliminate wrong answers

Option B is wrong because a 'No Drop' policy (e.g., using pause frames or priority flow control) is not required for jumbo frames; the issue is the MTU mismatch, not the drop/no-drop setting. Option C is wrong because the server is sending frames of MTU 9000, which is less than the system class MTU of 9216, so the frames are not oversized for the system class. Option D is wrong because the native VLAN setting does not cause the QoS system class to be ignored; the vNIC's lack of a QoS policy assignment is the direct cause of defaulting to the best-effort class.

Full explanation →
704
Multi-Selectmedium

When troubleshooting a VXLAN EVPN fabric with Cisco Nexus 9000 switches, which three commands provide information about the EVPN operation? (Choose three.)

Select 3 answers
A.show bgp l2vpn evpn summary.
B.show l2route mac all.
C.show running-config interface nve1.
D.show nve peers.
E.show ip interface brief.
AnswersA, B, D

Shows BGP EVPN session status.

Why this answer

The 'show bgp l2vpn evpn summary' command is correct because it displays the BGP session status for the L2VPN address family, which is the control plane protocol for VXLAN EVPN. This command shows neighbor states, prefixes received, and route table statistics, directly indicating whether EVPN route exchange is operational.

Exam trap

Cisco often tests the distinction between configuration commands (like 'show running-config interface nve1') and operational verification commands (like 'show nve peers'), leading candidates to mistakenly select configuration-only outputs as evidence of EVPN operation.

Full explanation →
705
MCQmedium

A network engineer is automating a repetitive configuration task on a Nexus 9000 switch using Python scripts with NX-API. The script sends a CLI command via POST request but receives HTTP 400 status with error 'Invalid request payload'. What is the most likely cause?

A.The JSON payload does not include the required 'ins_api' wrapper with version and type fields.
B.The switch is running an unsupported NX-OS version.
C.The script is using HTTP instead of HTTPS.
D.The CLI command syntax is incorrect with too many spaces.
AnswerA

The NX-API requires a specific JSON format with 'ins_api' envelope containing attributes like version, type, chunk, sid, and input.

Why this answer

The NX-API on Nexus switches requires a JSON payload wrapped in an 'ins_api' object that includes fields such as 'version', 'type', 'chunk', 'sid', and 'input'. Omitting this wrapper or any required field results in HTTP 400 'Invalid request payload'. Option A correctly points out that the payload lacks the required 'ins_api' wrapper.

Full explanation →
706
Multi-Selectmedium

An OSPF router in a broadcast network has not formed a neighbor relationship. What are three possible causes? (Choose three.)

Select 3 answers
A.Authentication incorrect
B.MTU mismatch
C.Area ID mismatch
D.Hello interval mismatch
E.Network type mismatch
AnswersB, D, E

Causes the routers to stay in ExStart state during database exchange.

Why this answer

In OSPF, an MTU mismatch prevents the formation of a neighbor relationship because OSPF routers compare the MTU value in Database Description (DBD) packets. If the receiving router's interface MTU is smaller than the DBD packet size, the packet is dropped, and the neighbor state remains stuck in EXSTART/EXCHANGE. This is a common issue on broadcast networks where different link types or misconfigured interfaces exist.

Exam trap

Cisco often tests the MTU mismatch as a subtle cause of OSPF neighbor failure, especially since it is less obvious than Hello/Dead interval or Area ID mismatches, and candidates may overlook it or confuse it with Layer 2 issues.

Full explanation →
707
Multi-Selecteasy

A storage administrator reports that a Cisco UCS domain is not booting from the Fibre Channel SAN. The boot policy is correctly configured and the vHBA is associated. Which two alignment issues could cause this problem? (Choose two.)

Select 2 answers
A.The WWPN of the vHBA is not zoned on the SAN fabric.
B.The vHBA is assigned to an incorrect VSAN.
C.The Ethernet LAN is not configured on the FI.
D.The disk firmware on the server is outdated.
AnswersA, B

Proper WWPN zoning is critical for SAN boot.

Why this answer

If the WWPN of the vHBA is not properly zoned on the SAN fabric, the Fibre Channel switch will not allow the server to log in to the target storage. Even with a correct boot policy and vHBA association, without zoning, the initiator cannot discover or communicate with the boot LUN, causing the boot to fail.

Exam trap

The trap here is that candidates often focus only on the UCS-side configuration (boot policy, vHBA association) and forget that SAN fabric-level settings like zoning and VSAN assignment are equally critical for Fibre Channel boot to succeed.

Full explanation →
708
MCQhard

Based on the exhibited FLOGI database, what is the state of the interface fc1/1?

A.It is an F port with a hub attached.
B.It is an NP port (proxy FW) because multiple FCIDs appear on the same interface.
C.It is a trunking E port.
D.It is a disabled port because there are two WWNs.
AnswerB

Multiple FCIDs from different WWNs on a single interface indicate NPIV, which is typical for NPV uplink or FCoE.

Why this answer

The FLOGI database shows multiple FCIDs (0x010000, 0x010001) associated with the same interface fc1/1, which is characteristic of an NP port (proxy FW) in NPV mode. An NP port acts as a proxy for multiple end devices behind it, such as in a Fibre Channel NPV switch or a converged network adapter (CNA) in FCoE NPV mode, allowing multiple FCIDs to share a single physical link.

Exam trap

The trap here is that candidates often assume multiple FCIDs on one interface indicate a trunking E port or a misconfiguration, but in NPV mode, an NP port legitimately proxies multiple FCIDs, which is a key distinguishing feature tested in the 350-601 exam.

How to eliminate wrong answers

Option A is wrong because an F port connects to a single N port (end device) and would show only one FCID per interface; a hub attached to an F port would still present a single FCID from the hub's perspective, not multiple distinct FCIDs. Option C is wrong because a trunking E port connects two switches and would show multiple FCIDs only if multiple VSANs are trunked, but the FLOGI database would list the same FCID across different VSANs, not multiple FCIDs on the same interface within a single VSAN. Option D is wrong because having two WWNs does not disable a port; a disabled port would not appear in the FLOGI database at all, and multiple WWNs are normal for NP ports or multi-homed devices.

Full explanation →
709
MCQmedium

A Cisco MDS switch is configured in NPV mode. A host connected to this switch fails to log into the SAN. Which command should be used to verify the host's FLOGI status?

A.show zone
B.show fcns database
C.show flogi database module <module>
D.show flogi database
E.show port-channel summary
AnswerC

This command shows FLOGIs on a specific module, which is more precise when troubleshooting a host on a known module.

Why this answer

In NPV mode, the MDS switch acts as a passthrough and does not maintain its own FLOGI database; instead, it forwards FLOGI requests to the upstream NPIV-capable switch. The 'show flogi database module <module>' command is used on the NPV switch to verify the host's FLOGI status because it displays the FLOGI entries learned from the upstream switch for the specific module where the host is connected, which is essential for troubleshooting login failures.

Exam trap

Cisco often tests the distinction between NPV mode and standard switch mode, where candidates mistakenly use 'show flogi database' without the module parameter, not realizing that NPV switches require the module keyword to display FLOGI entries.

How to eliminate wrong answers

Option A is wrong because 'show zone' displays zone configurations and members, not FLOGI or login status. Option B is wrong because 'show fcns database' shows the Fibre Channel Name Server database (registered FC-4 types and WWNs), which is populated after successful FLOGI and login, not the FLOGI status itself. Option D is wrong because 'show flogi database' without the module keyword is not valid on an NPV switch; the command requires the module parameter to specify the line card or port module.

Option E is wrong because 'show port-channel summary' displays port-channel interface status and load-balancing, not FLOGI or host login information.

Full explanation →
710
MCQhard

A storage administrator notices that a host is unable to see a LUN after zoning is configured. The zone contains the host WWPN and the target WWPN. The LUN is not masked at the storage array. What is the most likely cause?

A.LUN masking is not configured on the storage array.
B.The host requires NPIV to be enabled.
C.The host is in a different VSAN.
D.The zone is incorrectly configured.
AnswerA

LUN masking is required to present LUNs to specific hosts.

Why this answer

The host cannot see the LUN because LUN masking is not configured on the storage array. Even with correct zoning (host WWPN to target WWPN), the storage array must explicitly grant access to specific LUNs for a given initiator WWPN. Without LUN masking, the target will not present the LUN to the host, regardless of zone membership.

Exam trap

Cisco often tests the distinction between fabric-level zoning (which controls which ports can communicate) and storage-array-level LUN masking (which controls which LUNs are visible to an initiator), leading candidates to incorrectly assume zoning alone grants LUN access.

How to eliminate wrong answers

Option B is wrong because NPIV (N_Port ID Virtualization) is used to allow multiple virtual initiators to share a single physical port, which is unrelated to LUN visibility after zoning. Option C is wrong because if the host were in a different VSAN, the zone would not be effective at all (zones are VSAN-specific), but the question states zoning is configured and the host cannot see the LUN, not that zoning fails. Option D is wrong because the zone is correctly configured (contains host WWPN and target WWPN), so incorrect zone configuration is not the cause.

Full explanation →
711
MCQeasy

A startup company is deploying a new web application on UCS B-Series blades. They want to use PXE boot for rapid provisioning. The network team has configured a DHCP server and a PXE server on the same VLAN as the UCS service profiles. The system administrator creates a service profile for a blade and sets the boot policy to 'PXE' as the first boot device, and local disk as second. However, when the blade powers on, it boots from the local disk instead of PXE. The PXE server logs show no request from the blade's MAC address. The DHCP server logs show no activity. The fabric interconnect is configured with a default VLAN. What is the most likely cause?

A.The vNIC on the service profile is not configured with the correct native VLAN
B.The boot policy order lists local disk before PXE
C.The service profile is not properly associated with the blade
D.The fabric interconnect uplinks are not in trunk mode
AnswerA

Native VLAN mismatch prevents DHCP from reaching the server

Why this answer

PXE boot requires the vNIC to have an untagged native VLAN that matches the PXE/DHCP subnet. If the native VLAN on the vNIC is different, DHCP requests are not forwarded. Option B wrong because PXE boot order is usually correct.

Option C wrong because it would cause different symptoms. Option D wrong because service profile association is fine.

Full explanation →
712
MCQeasy

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

A.Create a contract between EPGs with appropriate filters.
B.Use a tenant to separate the EPGs logically.
C.Configure a VRF to isolate traffic between EPGs.
D.Define a bridge domain with L2 policies.
AnswerA

Contracts in ACI define allowed communication with filters for specific protocols/ports.

Why this answer

In Cisco ACI, contracts are the primary mechanism for enforcing policy-based communication between EPGs. By creating a contract between the web and app EPGs with a filter that permits HTTP (TCP/80), and another contract between management and web EPGs with a filter that denies SSH (TCP/22), the architect can precisely meet both requirements. Contracts allow granular control over which protocols and ports are allowed or denied, making them the correct construct for this access control scenario.

Exam trap

Cisco often tests the misconception that VRFs or bridge domains alone can provide security isolation, but in ACI, traffic filtering is always enforced via contracts, regardless of VRF or BD boundaries.

How to eliminate wrong answers

Option B is wrong because tenants are used for administrative and policy isolation between different customers or organizations, not for defining traffic rules between EPGs within the same tenant. Option C is wrong because VRFs (private L3 contexts) provide routing and forwarding isolation but do not enforce security policies like permitting or denying specific application traffic; contracts are still needed within a VRF. Option D is wrong because bridge domains define Layer 2 forwarding boundaries and subnets, not access control policies; they do not filter traffic based on protocols or ports.

Full explanation →
713
MCQeasy

An administrator needs to reset the CIMC password on a Cisco UCS C-Series server without physical access. Which method can be used?

A.Use the front panel reset button
B.Use UCS Manager
C.Use the CIMC XML API
D.Connect via serial console during boot
AnswerC

Allows remote management commands, including password change.

Why this answer

The CIMC XML API allows remote management of Cisco UCS C-Series servers, including password resets, without physical access. This API provides a programmatic interface to CIMC functions, enabling administrators to send authenticated XML requests over HTTPS to reset the CIMC password. Physical access is not required because the API operates over the network, making it the correct method for this scenario.

Exam trap

Cisco often tests the distinction between UCS Manager (for B-Series and integrated environments) and CIMC (for C-Series standalone servers), leading candidates to incorrectly assume UCS Manager can manage C-Series servers directly.

How to eliminate wrong answers

Option A is wrong because the front panel reset button requires physical access to the server, which the administrator does not have. Option B is wrong because UCS Manager manages UCS B-Series blade servers and fabric interconnects, not C-Series standalone servers; C-Series servers are managed directly via CIMC, not through UCS Manager. Option D is wrong because connecting via serial console during boot requires physical access to the server's serial port or a remote console solution that is not available without physical presence.

Full explanation →
714
Multi-Selectmedium

An organization is deploying UCS Central to manage multiple UCS domains. Which THREE benefits does UCS Central provide over using individual UCS Managers?

Select 3 answers
A.Automatic failover between Fabric Interconnects in different domains.
B.Simplified firmware management across multiple domains.
C.Single pane of glass for monitoring all UCS domains.
D.Direct management of blade chassis power supplies.
E.Global service profile and policy management across domains.
AnswersB, C, E

UCS Central coordinates firmware upgrades for multiple domains.

Why this answer

UCS Central offers global policy management, centralized monitoring, and multi-domain firmware upgrades.

Full explanation →
715
MCQmedium

In ACI, which construct defines the set of endpoints that can communicate based on contracts?

A.VRF
B.Bridge Domain
C.Tenant
D.EPG
AnswerD

EPGs are the policy enforcement boundary.

Why this answer

In Cisco ACI, an Endpoint Group (EPG) is the logical grouping of endpoints (such as servers, VMs, or storage) that share the same policy requirements. Contracts define the rules for communication between EPGs, specifying which EPGs can talk to each other and what services (e.g., HTTP, SSH) are allowed. Thus, the EPG construct directly defines the set of endpoints that can communicate based on contracts.

Exam trap

Cisco often tests the distinction between EPGs and Bridge Domains, where candidates mistakenly think a Bridge Domain defines endpoint communication because it handles Layer 2 forwarding, but contracts are applied at the EPG level, not the Bridge Domain level.

How to eliminate wrong answers

Option A is wrong because a VRF (Virtual Routing and Forwarding) is a Layer 3 construct that provides network segmentation and routing isolation, not a grouping of endpoints for contract-based communication. Option B is wrong because a Bridge Domain is a Layer 2 forwarding context that defines a broadcast domain and subnet, but it does not directly define which endpoints can communicate based on contracts; contracts are applied between EPGs, not Bridge Domains. Option C is wrong because a Tenant is the highest-level container in ACI that holds policies, networking constructs, and applications, but it does not itself define endpoint communication; contracts are applied between EPGs within or across tenants.

Full explanation →
716
MCQeasy

Based on the exhibited output, what is the status of the interface?

A.The interface is up but has no license.
B.The interface is in trunk mode and licensed.
C.The interface is operational and licensed.
D.The interface is down due to no license.
AnswerA

The interface is up but lacks a license; it may be using grace period.

Why this answer

The interface is up (line protocol is up) but the output shows 'license not installed' or similar, meaning the port is administratively up but lacks the required license for full functionality. In Cisco MDS/Nexus storage networks, interfaces can be in an 'up' state without a license, but they will not pass traffic or operate in the licensed mode until the license is installed.

Exam trap

Cisco often tests the distinction between an interface being 'up/up' and being fully licensed, leading candidates to assume that an up interface is automatically operational and licensed, when in fact it may be in a 'no-license' state that prevents data forwarding.

How to eliminate wrong answers

Option B is wrong because the interface is not in trunk mode (the output shows access mode or no trunking) and it is not licensed. Option C is wrong because the interface is not operational in the sense of passing traffic; it is up but unlicensed, so it cannot forward data. Option D is wrong because the interface is not down; it is up (line protocol up) but lacks a license, which is a different state from being administratively or protocol down.

Full explanation →
717
Multi-Selecteasy

A network engineer is verifying VPC configuration on a pair of Nexus switches. Which two commands should be used to check VPC status and consistency? (Choose two.)

Select 2 answers
A.show vpc role
B.show vpc consistency-parameters
C.show vpc peer-keepalive
D.show vpc
E.show vpc statistics
AnswersB, D

This checks for configuration mismatches between VPC peers.

Why this answer

(show vpc) is correct because it displays the overall VPC status, including the local and peer VPC system MAC, role, and the operational state of each VPC member port. Option B (show vpc consistency-parameters) is correct because it verifies that critical parameters (e.g., STP mode, VLAN interfaces, MTU) are consistent between the two VPC peers, which is essential for VPC to function correctly and avoid traffic black-holing.

Exam trap

Cisco often tests the distinction between commands that show operational status (show vpc) versus those that verify configuration synchronization (show vpc consistency-parameters), leading candidates to mistakenly select 'show vpc role' or 'show vpc peer-keepalive' as sufficient for consistency checks.

Full explanation →
718
MCQeasy

What is the purpose of jumbo frames in an iSCSI storage network?

A.To increase throughput by reducing protocol overhead
B.To reduce latency
C.To provide authentication
D.To enable flow control
AnswerA

Jumbo frames allow more data per packet, reducing the number of packets and overhead.

Why this answer

Jumbo frames (MTU 9000) reduce overhead by allowing larger payloads per packet, improving throughput and CPU efficiency for iSCSI traffic.

Full explanation →
719
MCQeasy

A large financial institution has recently migrated its data center network to a new Cisco ACI fabric. The operations team is tasked with automating the provisioning of new application tenants, including EPGs, contracts, and bridge domains, using the APIC REST API. They have developed a comprehensive set of Python scripts that successfully performed these actions in their lab environment. However, when deploying the scripts to production, they receive an 'SSL: CERTIFICATE_VERIFY_FAILED' error from the requests library. The production APIC cluster uses a self-signed certificate for HTTPS, and the corporate security policy strictly prohibits the use of HTTP or disabling certificate verification. Additionally, the policy does not allow replacing the self-signed certificate with a CA-signed one without a lengthy approval process that could delay the automation project. The team needs an immediate solution that maintains security best practices. What should the team do?

A.Use HTTP instead of HTTPS for the API calls.
B.Add the self-signed certificate to the Python trust store by using the cert file in the verify parameter.
C.Disable SSL certificate verification in the Python requests by setting verify=False.
D.Request an exception to the security policy to allow a CA-signed certificate.
AnswerB

This enables verification against the specific certificate, maintaining security without policy changes.

Why this answer

The Python requests library allows you to pass a self-signed certificate file via the `verify` parameter, which adds that certificate to the trusted store for that session. This satisfies the security policy by maintaining HTTPS encryption and certificate verification without disabling SSL checks or requiring a CA-signed certificate. The team can export the APIC's self-signed certificate (e.g., from the APIC GUI or CLI) and use it in their scripts as `requests.get(url, verify='/path/to/cert.pem')`.

Exam trap

Cisco often tests the misconception that disabling SSL verification (`verify=False`) is an acceptable workaround for self-signed certificates, but the trap is that the security policy explicitly prohibits disabling verification, and the correct solution is to trust the specific certificate via the `verify` parameter.

How to eliminate wrong answers

Option A is wrong because using HTTP instead of HTTPS violates the corporate security policy that strictly prohibits HTTP, and it exposes API credentials and data in plaintext, which is a severe security risk. Option C is wrong because setting `verify=False` disables SSL certificate verification entirely, which violates the security policy's requirement to maintain certificate verification and opens the connection to man-in-the-middle attacks. Option D is wrong because requesting an exception for a CA-signed certificate would require a lengthy approval process that delays the project, and the question explicitly states the team needs an immediate solution.

Full explanation →
720
MCQhard

A network engineer is configuring Cisco Nexus VXLAN with BGP EVPN. The VTEPs are using loopback0 as the NVE source. The physical interfaces are up, but the NVE interface remains down. What is the most likely cause?

A.The loopback0 interface is not reachable via the underlay network.
B.The NVE interface is not configured with source-interface.
C.The VLAN 1 is not associated with the NVE interface.
D.The loopback0 interface is not created.
AnswerA

The NVE source must be routable in the underlay. If loopback0 is not advertised by IGP, the NVE interface stays down.

Why this answer

The NVE interface requires the specified source interface (loopback0) to have IP reachability via the underlay network to establish VXLAN tunnels. If loopback0 is not reachable (e.g., due to missing OSPF/IS-IS routes or incorrect underlay configuration), the NVE interface will remain in a down state even if the physical interfaces are up. This is because the NVE interface depends on the underlay routing to encapsulate and forward VXLAN traffic.

Exam trap

Cisco often tests the dependency of the NVE interface on underlay IP reachability, tricking candidates into focusing on NVE-specific configuration errors (like missing source-interface) rather than verifying the underlay routing for the loopback address.

How to eliminate wrong answers

Option B is wrong because the NVE interface is already configured with source-interface loopback0 (as stated in the question), so the absence of that configuration is not the issue. Option C is wrong because VLAN 1 association with the NVE interface is not required for the NVE interface to come up; VLANs are mapped to VNIs after the NVE is operational. Option D is wrong because the loopback0 interface is explicitly mentioned as the NVE source, implying it exists; if it were not created, the NVE configuration would fail at the CLI level, not just keep the interface down.

Full explanation →
721
MCQmedium

An engineer wants to automate the configuration of BGP on a Nexus switch using Ansible. Which module from the cisco.nxos collection is appropriate?

A.nxos_interface
B.nxos_config
C.nxos_bgp
D.nxos_vlan
AnswerC

Correct module for BGP.

Why this answer

The nxos_bgp module is designed to manage BGP configuration on NX-OS devices.

Full explanation →
722
MCQeasy

Which FCoE feature allows multiple VLANs to be carried over a single physical link when using FIP snooping?

A.NPV
B.VSANs
C.FIP snooping
D.Port channels
AnswerC

FIP snooping enables multiple FCoE VLANs on a link.

Why this answer

FIP snooping is the correct answer because it is the FCoE feature that enables multiple VLANs to be carried over a single physical link by snooping FIP (FCoE Initialization Protocol) frames. FIP snooping builds a forwarding table that maps FCoE sessions to specific VLANs, allowing the switch to forward FCoE traffic for different VLANs on the same physical interface while maintaining isolation and security.

Exam trap

Cisco often tests the misconception that FIP snooping is only about security or that it is the same as FCoE VLAN mapping, but the trap here is that candidates confuse FIP snooping with VSANs or NPV, not realizing that FIP snooping specifically enables VLAN multiplexing by snooping control frames.

How to eliminate wrong answers

Option A is wrong because NPV (N_Port Virtualization) is a feature that allows a Fibre Channel switch to connect to a core switch without requiring a separate domain ID, and it does not handle VLAN multiplexing over a single link. Option B is wrong because VSANs (Virtual SANs) are used to create isolated Fibre Channel fabrics within a single physical SAN infrastructure, but they are not a feature of FCoE and do not directly enable multiple VLANs over a single physical link in the context of FIP snooping. Option D is wrong because port channels aggregate multiple physical links into a single logical link for increased bandwidth and redundancy, but they do not provide the VLAN multiplexing capability that FIP snooping offers.

Full explanation →
723
MCQmedium

Refer to the exhibit. After applying this configuration, the engineer activates the zoneset with 'zoneset activate name ZONESET1 vsan 10'. The host with pwwn 10:00:00:00:c9:aa:bb:01 can communicate with the target with pwwn 10:00:00:00:c9:aa:bb:02. However, the host reports that it cannot see a third target with pwwn 10:00:00:00:c9:aa:bb:03. What is the most likely reason?

A.The third target is in a different VSAN.
B.The third target is not a member of ZONE1.
C.The zone name is case-sensitive and does not match.
D.The zoneset was not activated successfully.
AnswerB

Zoning restricts access; only members of the same zone can communicate.

Why this answer

The host can communicate with the target in ZONE1 (pwwn 10:00:00:00:c9:aa:bb:02) but not with the third target (pwwn 10:00:00:00:c9:aa:bb:03). This indicates that the zoneset activation was successful and the host is in the correct VSAN. The most likely reason is that the third target is not a member of ZONE1; in Fibre Channel zoning, only members of the same zone can communicate, and a device not in the zone will be invisible to other zone members.

Exam trap

The trap here is that candidates may assume the third target is in a different VSAN or that the zoneset activation failed, but the key is that successful communication with one target proves the zoneset is active and the host is in the correct VSAN, so the issue must be that the third target is simply not a member of the zone.

How to eliminate wrong answers

Option A is wrong because the host can already communicate with one target in VSAN 10, and the zoneset was activated on VSAN 10; if the third target were in a different VSAN, it would not be part of the same zoneset and would be invisible, but the question states the host cannot see it, implying it might be in the same VSAN but not zoned. Option C is wrong because zone names in Cisco NX-OS are case-sensitive, but the exhibit shows the zone name as 'ZONE1' and the zoneset activation command uses 'ZONESET1' — the mismatch is between the zoneset name and the zone name, not a case issue; the zone name itself is correctly referenced in the zoneset membership. Option D is wrong because the host can communicate with the first target, which proves the zoneset was activated successfully; if activation had failed, no communication would occur.

Full explanation →
724
Multi-Selectmedium

Which three components are part of the VXLAN overlay architecture? (Choose three.)

Select 3 answers
A.VTEP (Virtual Tunnel Endpoint)
B.VPC peer-link
C.Spine switches only in VXLAN
D.IP transport network (underlay)
E.VNI (VXLAN Network Identifier)
AnswersA, D, E

Correct. VTEPs encapsulate and decapsulate VXLAN frames.

Why this answer

A VTEP is a fundamental component of VXLAN overlay architecture because it encapsulates and decapsulates Layer 2 Ethernet frames into UDP packets for transport over the IP underlay network. It serves as the tunnel endpoint where VXLAN traffic originates and terminates, enabling Layer 2 extension across Layer 3 boundaries.

Exam trap

Cisco often tests the distinction between overlay components (VTEP, VNI) and underlay infrastructure (spine switches, IP transport), leading candidates to incorrectly include spine switches as part of the overlay architecture.

Full explanation →
725
MCQeasy

What is the purpose of a cluster witness VM in a HyperFlex cluster?

A.To host the HyperFlex management interface
B.To provide additional storage capacity
C.To act as a tie-breaker for quorum in cluster splits
D.To provide compute resources for the cluster
AnswerC

The witness VM helps maintain quorum when there are an even number of nodes.

Why this answer

The witness VM is used to achieve quorum in a two-node cluster (or to maintain quorum in case of network partitions). It is a lightweight VM that participates in cluster decision-making.

Full explanation →
726
MCQmedium

A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?

A.ip access-group ACL_NAME in on VLAN interface
B.ip access-group ACL_NAME on VLAN
C.access-list ACL_NAME in on VLAN interface
D.vlan access-group ACL_NAME in
AnswerA

The correct syntax is applied to the VLAN interface.

Why this answer

ACLs on Nexus switches can be applied to VLANs using the 'ip access-group' command under the VLAN interface.

Full explanation →
727
MCQhard

A data center design requires Layer 2 extension between two sites using OTV. The network engineer notices that MAC addresses from Site A are not learned at Site B. OTV adjacency is up, and both sites have the same overlay interface configured. Which configuration issue is most likely the cause?

A.The OTV control group is misconfigured on one side.
B.The spanning tree root bridge is different at each site.
C.The multicast group range for the overlay does not match.
D.The site VLAN is not allowed on the OTV join interface.
AnswerD

The join interface must be a trunk that carries the site VLAN for OTV to forward traffic.

Why this answer

D is correct because the OTV join interface must have the site VLAN allowed; if the site VLAN is not permitted on the join interface, the OTV edge device cannot send or receive encapsulated traffic for that VLAN, preventing MAC address learning between sites even though the OTV adjacency is up.

Exam trap

Cisco often tests the distinction between control-plane (adjacency) and data-plane (VLAN transport) issues, and the trap here is that candidates assume a working OTV adjacency guarantees all VLANs are extended, overlooking the need to explicitly allow the site VLAN on the join interface.

How to eliminate wrong answers

Option A is wrong because the OTV control group is used for control-plane communication (IS-IS adjacency), and if it were misconfigured, the OTV adjacency would not form; the question states adjacency is up, so the control group is correctly configured. Option B is wrong because OTV does not rely on spanning tree; it uses its own loop-prevention mechanism (authoritative edge device) and isolates STP domains, so different root bridges at each site do not affect MAC learning. Option C is wrong because the multicast group range for the overlay is used for data-plane transport; if it did not match, traffic would not be forwarded, but the question specifies the same overlay interface configuration, implying the multicast group range is consistent.

Full explanation →
728
MCQmedium

When configuring a UCS service profile for a blade server that needs to boot from the local disk, which boot order setting is appropriate?

A.Enable PXE boot only.
B.Set the boot order to local disk first, with no other boot devices.
C.Configure boot from CD/DVD as first device.
D.Set the boot order to SAN first, then local disk.
AnswerB

Correct. Local disk is first and only boot device.

Why this answer

To boot from local disk, the boot policy should list the local disk as the first boot device. Other devices can be secondary or disabled.

Full explanation →
729
MCQmedium

A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?

A.Enable the DHCP snooping information option
B.Set Ethernet 1/2 as a trusted port
C.Disable DHCP snooping globally
D.Set Ethernet 1/1 as a trusted port
AnswerD

The DHCP server port must be trusted to permit DHCP server messages such as OFFER and ACK.

Why this answer

DHCP snooping uses the concept of trusted and untrusted ports. By default, all ports are untrusted. Setting Ethernet 1/1, where the legitimate DHCP server is connected, as a trusted port allows DHCP server messages (OFFER, ACK, etc.) from that port to be forwarded.

All other ports, including Ethernet 1/2, remain untrusted, so any DHCP server messages received on them are dropped, effectively blocking the unauthorized DHCP server.

Exam trap

Cisco often tests the common misconception that you must set the port connected to the unauthorized server as untrusted (which is the default) rather than explicitly setting the legitimate server's port as trusted, leading candidates to incorrectly select option B or C.

How to eliminate wrong answers

Option A is wrong because enabling the DHCP snooping information option (option 82) inserts circuit-id and remote-id information into DHCP packets, but it does not control which ports are allowed to send DHCP server messages; it is used for DHCP relay and security auditing, not for blocking unauthorized servers. Option B is wrong because setting Ethernet 1/2 as a trusted port would allow the unauthorized DHCP server's messages to be forwarded, which is the opposite of the desired action. Option C is wrong because disabling DHCP snooping globally would remove all protection, allowing both legitimate and unauthorized DHCP servers to operate freely, which does not prevent the unauthorized server from offering IP addresses.

Full explanation →
730
MCQeasy

A network engineer is configuring OSPF on a Cisco Nexus switch for a data center network. The requirement is to ensure that the switch does not become the Designated Router (DR) on a multi-access segment. Which OSPF configuration achieves this?

A.Set OSPF priority to 255 on the interface
B.Set OSPF priority to 0 on the interface
C.Change the OSPF network type to point-to-point
D.Configure the interface as passive under OSPF
AnswerB

Priority 0 means the router will never become DR or BDR.

Why this answer

Setting the OSPF priority to 0 on the interface prevents the switch from participating in the DR/BDR election process, ensuring it will never become the Designated Router (DR) or Backup Designated Router (BDR) on a multi-access segment. This is the standard method per RFC 2328 to make a router ineligible for DR/BDR status while still allowing it to form full adjacencies with the DR and BDR.

Exam trap

Cisco often tests the misconception that setting a high priority (like 255) ensures a router does not become DR, when in fact it does the opposite; the trap here is confusing priority 0 (ineligible) with priority 255 (most likely to be elected).

How to eliminate wrong answers

Option A is wrong because setting OSPF priority to 255 (the highest possible value) makes the switch the most likely candidate to become the DR, which directly contradicts the requirement. Option C is wrong because changing the network type to point-to-point eliminates the DR/BDR election entirely, which may not be desirable if the segment is truly multi-access and other routers need to participate in elections; it also changes OSPF behavior (e.g., no hello/dead interval mismatches) and could break adjacency with neighbors expecting a broadcast network. Option D is wrong because configuring the interface as passive under OSPF suppresses OSPF hello packets entirely, preventing the switch from forming any OSPF adjacencies on that interface, which is more restrictive than simply avoiding DR status.

Full explanation →
731
MCQmedium

In a UCS B-Series environment, where are vNICs and vHBAs defined to provide network and storage connectivity to a blade server?

A.In the server BIOS settings
B.In the I/O Module (IOM) configuration
C.In the Fabric Interconnect CLI
D.In the service profile associated with the blade
AnswerD

Service profiles define the identity and policies for the server, including vNICs and vHBAs.

Why this answer

vNICs and vHBAs are defined in a service profile, which is then applied to a blade server to abstract the hardware identity.

Full explanation →
732
MCQmedium

A data center team is implementing FCoE and needs to ensure that FCoE traffic is not dropped during congestion. The network switches support Data Center Bridging (DCB). Which two DCB features are required for FCoE?

A.Enhanced Transmission Selection (ETS) and Data Center Bridging Exchange (DCBX)
B.Priority Flow Control (PFC) and Data Center Bridging Exchange (DCBX)
C.Enhanced Transmission Selection (ETS) and jumbo frames
D.Priority Flow Control (PFC) and jumbo frames
AnswerB

PFC ensures no-drop, and DCBX enables negotiation of DCB parameters.

Why this answer

PFC provides lossless transport, and DCBX is used for capability exchange between peers to configure PFC and other DCB features.

Full explanation →
733
MCQmedium

Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?

A.Port Security
B.ACL
C.Dynamic ARP Inspection
D.IP Source Guard
AnswerD

IP Source Guard prevents IP spoofing.

Why this answer

IP Source Guard uses DHCP snooping binding to validate source IP.

Full explanation →
734
Multi-Selecthard

Which TWO statements are true about Control Plane Policing (CoPP) on a Cisco Nexus 9000 switch? (Choose two.)

Select 2 answers
A.CoPP can be used to limit the rate of ICMP unreachable messages.
B.CoPP automatically drops all unknown unicast traffic.
C.CoPP is configured using the 'control-plane' sub-mode with policy-maps.
D.CoPP applies only to traffic destined to the switch management IP.
E.CoPP can be used to prioritize OSPF traffic over SSH.
AnswersA, C

ICMP unreachable messages can be rate-limited with CoPP to prevent DoS.

Why this answer

CoPP can rate-limit control-plane traffic such as ICMP unreachable messages. By applying a policy-map in the 'control-plane' sub-mode, you can define class-maps that match specific control-plane protocols (e.g., ICMP) and then police their rate to prevent CPU overload from floods of such packets.

Exam trap

Cisco often tests the misconception that CoPP is only for management IP traffic or that it can prioritize traffic, when in fact it is a policing mechanism for all control-plane traffic and does not provide prioritization.

Full explanation →
735
MCQmedium

A large enterprise data center uses Cisco UCS Manager to manage hundreds of blade servers. The automation team has been using Python SDK scripts to provision service profiles. Recently, after a UCS Manager firmware upgrade, several scripts that previously worked are now failing with 'AttributeError: 'ServiceProfile' object has no attribute 'set_vnic_order''. The team confirms that the UCS Manager version changed from 4.0 to 4.2. Which course of action should the engineer take to resolve the issue?

A.Use the UCS Manager XML API directly without the SDK
B.Downgrade UCS Manager back to version 4.0 to restore compatibility
C.Replace Python scripts with Ansible modules that use the UCS API
D.Update the Python SDK to the version that supports UCS Manager 4.2 and modify scripts accordingly
AnswerD

Permanent fix; SDK update restores API compatibility.

Why this answer

The Python SDK for UCS Manager is version-specific; upgrading UCS Manager from 4.0 to 4.2 introduces API changes that can deprecate or remove methods like `set_vnic_order`. Updating the SDK to a version compatible with UCS Manager 4.2 ensures the Python scripts use the correct API calls, and modifying the scripts to align with any new method signatures or attributes resolves the AttributeError.

Exam trap

Cisco often tests the misconception that direct API usage (Option A) or alternative tools (Option C) bypass version compatibility issues, when in fact all API layers require version alignment.

How to eliminate wrong answers

Option A is wrong because using the UCS Manager XML API directly without the SDK would require rewriting all scripts from scratch, which is more labor-intensive and error-prone than updating the SDK; the XML API also undergoes version changes, so it would not inherently avoid compatibility issues. Option B is wrong because downgrading UCS Manager is a backward step that loses new features, security patches, and bug fixes, and it is not a sustainable solution for an enterprise environment. Option C is wrong because replacing Python scripts with Ansible modules is unnecessary and introduces a new toolchain; Ansible modules also rely on the UCS API and would require similar version compatibility updates.

Full explanation →
736
MCQeasy

A multicast application requires that all receivers join the same group using PIM sparse mode. Which router is responsible for forwarding traffic from the source to the RP?

A.Rendezvous point (RP)
B.First-hop router
C.Last-hop router
D.Source-specific router
AnswerB

The source's DR unicasts the traffic to the RP.

Why this answer

In PIM sparse mode, the first-hop router (the router directly connected to the multicast source) is responsible for encapsulating the source's multicast traffic in unicast PIM register messages and forwarding them to the rendezvous point (RP). This process establishes the initial path and triggers the RP to join the source-specific tree (SPT) toward the source.

Exam trap

Cisco often tests the misconception that the RP originates or forwards traffic from the source, when in fact the first-hop router is the one that encapsulates and sends the source traffic to the RP using PIM register messages.

How to eliminate wrong answers

Option A is wrong because the RP is the meeting point for receivers and sources, but it does not forward traffic from the source to itself; it receives register messages from the first-hop router and then joins the SPT toward the source. Option C is wrong because the last-hop router (the router directly connected to receivers) is responsible for sending PIM join messages toward the RP and later switching to the SPT, not for forwarding traffic from the source to the RP. Option D is wrong because there is no standard 'source-specific router' in PIM sparse mode; the concept of source-specific multicast (SSM) uses a different model (PIM-SSM) where receivers join directly to the source via (S,G) state, bypassing the RP entirely.

Full explanation →
737
Multi-Selecthard

An engineer is designing a Cisco ACI multi-site solution. Which two considerations are critical for inter-site connectivity? (Choose two.)

Select 2 answers
A.Configure a stretch VLAN across sites.
B.Use a separate OSPF process per site.
C.Deploy a L3Out at each site for external connectivity.
D.Use a single APIC cluster for both sites.
E.Ensure IP connectivity between the sites for the underlay.
AnswersC, E

Each site typically has its own L3Out.

Why this answer

In Cisco ACI Multi-Site, each site operates with its own APIC cluster and independent fabric. A L3Out at each site is critical because it provides external connectivity for that site's endpoints, allowing traffic to exit locally rather than being hair-pinned across the inter-site network. This design optimizes traffic flow and aligns with the Multi-Site architecture where sites are managed separately but interconnected via the Inter-Site Network (ISN).

Exam trap

Cisco often tests the misconception that a single APIC cluster can manage multiple sites, but in reality, each site requires its own APIC cluster for independent operation and fault isolation.

Full explanation →
738
Multi-Selecteasy

Which TWO are required for FCoE communication on a Nexus switch configured as an FCF? (Choose two.)

Select 2 answers
A.Jumbo frame support on the VLAN
B.VSAN configuration for the FCoE VLAN
C.NPV enabled on the switch
D.A dedicated FCoE VLAN
E.DCBX exchange to enable priority flow control
AnswersD, E

Correct: FCoE traffic is mapped to a specific VLAN.

Why this answer

In an FCoE FCF (Fabric Connect) configuration on a Nexus switch, a dedicated FCoE VLAN is required to carry FCoE traffic. This VLAN must be separate from standard Ethernet VLANs to prevent FCoE frames from being processed as regular Ethernet frames. Additionally, DCBX (Data Center Bridging Exchange) must be used to negotiate and enable Priority Flow Control (PFC) on the link, ensuring lossless behavior for FCoE traffic.

Exam trap

Cisco often tests the distinction between a dedicated FCoE VLAN (required) and jumbo frame support (optional), leading candidates to mistakenly select jumbo frames as a requirement when they are not mandatory for basic FCoE operation.

Full explanation →
739
Multi-Selecthard

Which THREE of the following are components of an Ansible playbook for automating Cisco Nexus configuration? (Choose three.)

Select 3 answers
A.roles
B.variables
C.hosts
D.modules
E.tasks
AnswersC, D, E

Correct: 'hosts' defines the target devices.

Why this answer

An Ansible playbook consists of hosts (target devices), tasks (what to do), and modules (the actual operations). Variables can be used but are not mandatory components.

Full explanation →
740
MCQeasy

An engineer notices that AAA authentication using RADIUS is failing, and the RADIUS server logs show no incoming authentication requests. Which of the following is the most likely cause?

A.The device has not been configured with any RADIUS server host
B.The device is using TACACS+ instead of RADIUS
C.The RADIUS server is not reachable due to a firewall
D.The RADIUS shared secret is incorrect
AnswerA

Without a configured server host, no RADIUS requests are generated, so no logs appear.

Why this answer

If the RADIUS server logs show no incoming authentication requests, the issue is that the device is not sending any traffic to the server. This occurs when no RADIUS server host is configured on the device, meaning the device has no IP address or hostname to which it can send authentication packets. Without a configured server host, the device will not attempt any RADIUS communication, resulting in zero requests reaching the server.

Exam trap

Cisco often tests the distinction between configuration errors that prevent packet generation (like missing server host) versus errors that cause packet rejection or timeout (like wrong secret or firewall), and the trap here is assuming that any authentication failure must involve network-level issues rather than a missing fundamental configuration element.

How to eliminate wrong answers

Option B is wrong because if the device were using TACACS+ instead of RADIUS, the RADIUS server would still not see requests, but the device would be sending TACACS+ traffic to a different server or port, and the question states RADIUS authentication is failing, implying RADIUS is configured but not working. Option C is wrong because if the RADIUS server were unreachable due to a firewall, the device would still send authentication requests (which would be dropped), and the server logs would show incoming requests that are blocked or not responded to, not zero requests. Option D is wrong because an incorrect shared secret would cause authentication failures (e.g., Access-Reject or no response), but the device would still send RADIUS Access-Request packets to the server, which would appear in the server logs.

Full explanation →
741
MCQeasy

An engineer is configuring iSCSI multipath I/O (MPIO) on a Windows server connected to a storage array. The goal is to provide load balancing and failover. What must be configured on the storage side to support MPIO?

A.Jumbo frames
B.Multiple iSCSI target IP addresses presenting the same LUN
C.CHAP authentication
D.Thin provisioning
AnswerB

Multiple paths to the same LUN allow MPIO to function.

Why this answer

MPIO requires that the storage array presents the same LUN to the server through multiple target portal groups or multiple iSCSI target IP addresses.

Full explanation →
742
MCQhard

Which of the following is a YANG data model developed by the OpenConfig working group to provide vendor-neutral configuration for network interfaces?

A.openconfig-interfaces
B.ietf-interfaces
C.nacm
D.Cisco-NX-OS-device
AnswerA

OpenConfig's interface model is vendor-neutral.

Why this answer

OpenConfig defines standard YANG models for various network functions, including interfaces.

Full explanation →
743
MCQhard

An engineer is troubleshooting BGP EVPN control plane. They issue 'show bgp l2vpn evpn' and see Type-3 routes but no Type-2 routes for any VNI. Which condition is most likely?

A.The VTEP has not learned any MAC addresses
B.The overlay VNI is not mapped to a VLAN
C.The BGP neighbor is not from the same AS
D.The EVPN address-family is not enabled
AnswerA

Type-2 routes carry MAC/IP information. Without any MACs learned, no Type-2 routes are generated.

Why this answer

Type-3 routes (Inclusive Multicast Ethernet Tag routes) are generated automatically when an EVPN VNI is configured, regardless of MAC learning. Type-2 routes (MAC/IP Advertisement routes) are only generated after the VTEP learns MAC addresses from data-plane traffic or from local endpoints. The absence of Type-2 routes with Type-3 present indicates the VTEP has not yet learned any MAC addresses for that VNI.

Exam trap

Cisco often tests the distinction between control-plane-generated routes (Type-3) and data-plane-triggered routes (Type-2), trapping candidates who assume both route types appear simultaneously upon VNI configuration.

How to eliminate wrong answers

Option B is wrong because an unmapped overlay VNI would prevent Type-3 routes from being generated as well, but the question states Type-3 routes are present. Option C is wrong because BGP EVPN sessions can operate between different AS numbers (eBGP) or the same AS (iBGP); AS mismatch does not selectively suppress Type-2 routes while allowing Type-3 routes. Option D is wrong because if the EVPN address-family were not enabled, no EVPN routes (including Type-3) would appear in the BGP table.

Full explanation →
744
MCQhard

A data center network uses MST to interoperate with a legacy switch that supports only RSTP. Which MST configuration parameter must match between the MST region and the legacy switch?

A.Region name
B.Revision number
C.No parameters need to match; the boundary port runs RSTP.
D.VLAN-to-instance mapping
AnswerC

MST interacts with RSTP via boundary ports using RSTP BPDUs.

Why this answer

When an MST region connects to a legacy switch running only RSTP, the boundary port on the MST switch automatically runs RSTP to interoperate. No MST-specific parameters (region name, revision number, or VLAN-to-instance mapping) need to match because the legacy switch is not part of the MST region; it simply runs RSTP on the link.

Exam trap

Cisco often tests the misconception that MST and RSTP require matching configuration parameters for interoperability, when in fact the boundary port automatically falls back to RSTP, making MST-specific parameters irrelevant for the legacy switch.

How to eliminate wrong answers

Option A is wrong because the region name is used only within an MST region to identify switches belonging to the same region; a legacy RSTP switch does not participate in MST, so no region name matching is required. Option B is wrong because the revision number is an MST-specific parameter that must match only among switches within the same MST region; it has no meaning for an RSTP-only switch. Option D is wrong because VLAN-to-instance mapping is an MST configuration that defines how VLANs map to MST instances inside a region; a legacy RSTP switch does not use MST instances, so this mapping is irrelevant for interoperability.

Full explanation →
745
MCQmedium

A network engineer is configuring a UCS service profile for a B-series blade server that will boot from SAN. Which WWPN assignment method should be used to ensure the boot LUN remains accessible if the blade is replaced with another blade of the same type?

A.Assign a dynamic WWPN from a WWPN pool
B.Set WWPN to the blade's serial number
C.Use the WWPN of the Fabric Interconnect port
D.Use the built-in WWPN of the mezzanine card
AnswerA

WWPNs from a pool are persistent and not tied to the physical hardware; the service profile retains the same WWPNs even if the blade is replaced.

Why this answer

Stateless computing in UCS relies on persistent WWPNs assigned from a WWPN pool, so when a blade is replaced, the new blade inherits the same WWPNs and can access the same storage LUNs without reconfiguration.

Full explanation →
746
MCQhard

In a Cisco MDS switch, what is the effect of the command 'fcdomain restart vsan 100'?

A.It enables NPV mode on VSAN 100.
B.It clears the zone configuration for VSAN 100.
C.It reboots the switch.
D.It causes a fabric reconfiguration, which may disrupt traffic.
AnswerD

Domain restart disrupts traffic.

Why this answer

The 'fcdomain restart vsan 100' command triggers a fabric reconfiguration (RCF) on VSAN 100. This process resets the principal switch selection and domain ID distribution, causing all switches in the VSAN to renegotiate their roles and domain IDs, which disrupts existing Fibre Channel traffic during the reconfiguration.

Exam trap

Cisco often tests the distinction between fabric-level commands (like 'fcdomain restart') and switch-level commands (like 'reload'), leading candidates to mistakenly think a fabric reconfiguration is equivalent to a switch reboot.

How to eliminate wrong answers

Option A is wrong because enabling NPV mode requires the 'feature npv' command and 'npv enable' on the interface, not 'fcdomain restart'. Option B is wrong because clearing the zone configuration is done with 'zone commit' or 'no zone' commands, not 'fcdomain restart', which only affects the fabric domain parameters. Option C is wrong because 'fcdomain restart' only restarts the fabric domain service for the specified VSAN, not the entire switch; a switch reboot would require the 'reload' command.

Full explanation →
747
MCQhard

Two data center switches are connected via a fiber link. They need to encrypt all traffic at Layer 2. Which configuration is required on both switches to establish MACsec?

A.Configure the interface as a trunk
B.Enable MACsec and configure a pre-shared key or CA
C.Enable IPsec on the interface
D.Enable 802.1X on the interface
AnswerB

MACsec must be enabled and a security key configured (PSK or CA) to establish secure links.

Why this answer

MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption between directly connected switches. To establish a MACsec session, both switches must enable MACsec on the interface and either configure a pre-shared key (PSK) or use a CA (Connectivity Association) key agreement protocol like MKA (MACsec Key Agreement, IEEE 802.1X-2010). This ensures all Ethernet frames are encrypted at the data link layer.

Exam trap

Cisco often tests the distinction between Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec), and candidates mistakenly choose IPsec because they associate 'encryption' with IPsec, forgetting that MACsec is the correct solution for Layer 2 traffic.

How to eliminate wrong answers

Option A is wrong because configuring the interface as a trunk (802.1Q) is unrelated to encryption; trunking allows multiple VLANs but does not provide any security or encryption. Option C is wrong because IPsec operates at Layer 3 (Network layer) and is used for encrypting IP packets, not Layer 2 Ethernet frames; MACsec is the correct Layer 2 encryption protocol. Option D is wrong because 802.1X is a port-based network access control (NAC) protocol used for authentication, not encryption; while 802.1X can be used in conjunction with MKA for key exchange, simply enabling 802.1X does not enable MACsec encryption.

Full explanation →
748
MCQmedium

A DevOps team is implementing CI/CD for network configuration using Git. They want to ensure that any changes to the YANG-based configuration are automatically validated before merging. Which tool is used for network automation with YANG models and supports NETCONF/RESTCONF?

A.Terraform with terraform-provider-aci
B.Python with cisco_nxapi library
C.Terraform with netconf-client provider
D.Ansible with cisco.nxos collection
AnswerC

Terraform can use NETCONF/RESTCONF providers to manage network devices declaratively.

Why this answer

Terraform can use RESTCONF/NETCONF providers, but Ansible with cisco.nxos collection also supports YANG; however, Terraform is declarative and fits CI/CD pipelines well.

Full explanation →
749
Multi-Selectmedium

Which TWO of the following are characteristics of NPV (N-Port Virtualization) in a Cisco MDS fabric?

Select 2 answers
A.It enables multiple hosts to share the same physical uplink.
B.It reduces the number of domain IDs required.
C.It allows the edge switch to appear as a virtual host to the core switch.
D.It requires FC-SP authentication.
E.It is only supported on 8 Gbps or higher ports.
AnswersA, B

NPIV allows multiple FLOGIs over a single NP port.

Why this answer

NPV (N-Port Virtualization) allows multiple hosts to share a single physical uplink from an NPV switch to a core NPIV-enabled switch. This is achieved by multiplexing multiple Fibre Channel N-Port IDs over the same physical link, reducing the number of domain IDs required in the fabric because the NPV switch does not participate in principal switch selection or domain ID distribution. The core switch sees each host as a separate virtual N_Port, but the NPV switch itself does not consume a domain ID.

Exam trap

Cisco often tests the misconception that NPV requires the edge switch to appear as a virtual host to the core, when in fact it is the hosts that appear as virtual N_Ports, not the switch itself.

Full explanation →
750
MCQeasy

In a Fibre Channel SAN, a technique is used to allow multiple initiators to share a single physical FC port by assigning multiple N-port IDs. What is this technique called?

A.N_Port ID Virtualization (NPIV)
B.NPIV is exclusive to FCoE environments
C.NPIV is only available on initiator HBAs
D.N_Port Virtualization (NPV)
AnswerA

NPIV allows multiple FCIDs per physical port.

Why this answer

NPIV (N_Port ID Virtualization) allows a single physical Fibre Channel port to register multiple N_Port IDs (FCIDs), enabling multiple initiators (e.g., virtual machines or logical partitions) to share that port while each appears as a unique entity to the fabric. This is achieved by the HBA requesting additional FCIDs from the fabric switch via the FLOGI and FDISC processes. The technique is defined in the FC-FS and FC-LS standards and is widely used in virtualized server environments to reduce the number of physical ports needed.

Exam trap

Cisco often tests the distinction between NPIV (port-level virtualization on the HBA) and NPV (switch-level aggregation), and candidates confuse the two because of the similar acronyms and overlapping use in virtualized environments.

How to eliminate wrong answers

Option B is wrong because NPIV is not exclusive to FCoE environments; it was originally defined for native Fibre Channel and is commonly used in both FC and FCoE SANs. Option C is wrong because NPIV is not only available on initiator HBAs; it is also supported on target ports (e.g., storage arrays) and switch N_Ports to enable virtualization features. Option D is wrong because N_Port Virtualization (NPV) is a different technology that allows a switch to aggregate multiple N_Ports into a single uplink, whereas NPIV operates at the HBA level to assign multiple FCIDs to one physical port.

Full explanation →
Page 9

Page 10 of 14

Page 11

All pages

1234567891011121314

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

NetworkStorage NetworkAutomationComputeSecurity
See all domains with question counts →