984 questions total · 14pages · All types, answers revealed
Filters define the specific protocol and port settings.
Why this answer
In ACI, filters define the L4/L5 parameters such as protocol and port. The filter for TCP port 80 is created and then used in the subject.
An organization is deploying Ansible for network automation across multiple Nexus 9000 leaf switches. They need to ensure that configuration tasks are idempotent and only apply changes when necessary. Which best practice should be followed when using the cisco.nxos.nxos_config module?
The 'replace' option in the nxos_config module compares the running config with the provided config and applies only necessary changes, ensuring idempotency.
Why this answer
The 'replace' option in the cisco.nxos.nxos_config module allows you to provide a configuration file that defines the desired state, and the module will only apply changes if the current configuration does not match, ensuring idempotency. This is a best practice for network automation with Ansible on Nexus switches.
Two Nexus switches are configured for MACsec using MKA. The link between them is up, but MKA does not establish. Which issue is most likely?
MACsec requires the same cipher suite on both ends for MKA to succeed.
Why this answer
MKA (MACsec Key Agreement) requires both endpoints to agree on a cipher suite during the CAK (Connectivity Association Key) exchange. If the cipher suites are mismatched (e.g., one switch uses GCM-AES-128 and the other uses GCM-AES-256), the MKA negotiation will fail, and the link will remain up but unsecured. This is the most common cause of MKA not establishing on an otherwise functional Layer 2 link.
Exam trap
Cisco often tests the distinction between MKA not establishing (cipher suite mismatch) versus MKA establishing but failing authentication (key string mismatch), leading candidates to incorrectly choose the key string option when the question specifically says 'does not establish'.
How to eliminate wrong answers
Option A is wrong because different MTU sizes can cause fragmentation or packet drops at Layer 2, but MKA control frames are small and MTU mismatch does not prevent MKA from establishing; the link would still be up and MKA would attempt to negotiate. Option C is wrong because MKA operates at Layer 2 and is not dependent on VLAN membership; switches in different VLANs can still communicate via trunk links, and MKA frames are tagged appropriately. Option D is wrong because mismatched MKA key strings (pre-shared keys) would cause MKA to fail at the authentication step, but the question states MKA does not establish at all; a key string mismatch typically results in MKA being established but then failing to authenticate, not a complete failure to establish the protocol.
A HyperFlex cluster is being designed with 4 nodes using RF2. Which three statements are true about the cluster's data availability and management? (Choose three.)
Correct. The witness provides the tie-breaking vote to maintain cluster quorum.
Why this answer
With 4-node RF2, the cluster can tolerate one node failure. The witness VM provides quorum. A degraded cluster can still serve data until repaired.
A storage administrator has been tasked with integrating a new Cisco MDS 9706 switch into an existing Fibre Channel SAN. The existing SAN consists of two Cisco MDS 9148S switches configured in a VSAN 100 with a single zone set that contains all initiator and target WWPNs. The administrator connects the new switch to one of the existing switches using an ISL and configures the new switch with VSAN 100 and the same zone configuration. The administrator activates the zone set on the new switch and verifies that the ISL is up and both switches see each other's Fibre Channel IDs. However, servers attached to the existing switches still cannot discover the storage targets that are connected to the new switch. The administrator has confirmed that the ISL is operational and that the zone set on the new switch is activated with the correct WWPNs. What should the administrator check next?
Interfaces must be administratively enabled to allow login.
Why this answer
After confirming the ISL is operational and the zone set is activated with correct WWPNs, the next logical step is to verify that the target-facing interfaces on the new switch are not administratively down. If these interfaces are in shutdown state, the storage targets connected to them will not be accessible from servers on the existing switches. Option A is already confirmed in the scenario.
Option B is not necessary because trunk protocol is not required for a single VSAN environment, and the ISL is already up. Option C is unlikely because a domain ID conflict would prevent the ISL from coming up, but the ISL is operational and both switches see each other's FC IDs. Therefore, option D is the correct next step.
Exam trap
Candidates may assume that zone activation is sufficient without verifying interface states on the new switch.
A UCS administrator is planning to deploy stateless computing using service profiles. Which three components are abstracted from the physical hardware and defined in the service profile? (Choose three.)
Boot order is defined in the boot policy within the service profile.
Why this answer
Service profiles abstract the server identity, including UUID, MAC addresses, WWPNs, and boot order, allowing the profile to be applied to any compatible blade.
A storage administrator is configuring a VSAN on a Cisco MDS switch. After creating the VSAN, what is the next step to ensure that the ports can communicate within that VSAN?
Ports must be assigned to the VSAN for them to participate in that VSAN.
Why this answer
After creating the VSAN, the ports must be assigned to it. This is done by configuring the port VSAN membership.
An organization is deploying Cisco Nexus 9000 switches with NX-OS and needs to prevent ARP spoofing attacks. The network engineer enables Dynamic ARP Inspection (DAI) on all VLANs. However, some legitimate hosts are unable to obtain IP addresses via DHCP. What is the most likely reason?
DAI validates ARP against DHCP snooping database; without it, DAI drops all ARP on untrusted ports.
Why this answer
DAI relies on the DHCP snooping binding table to validate ARP packets. Without DHCP snooping enabled, the binding table is empty, so DAI cannot determine which ARP packets are legitimate, causing it to drop all ARP packets, including DHCP discovery and request messages. This prevents hosts from obtaining IP addresses via DHCP.
Exam trap
Cisco often tests the dependency of DAI on DHCP snooping, and the trap here is that candidates assume DAI can function independently without understanding that it requires the DHCP snooping binding table for validation.
How to eliminate wrong answers
Option A is wrong because the ARP rate limit on the port would cause excessive ARP packets to be dropped, not all ARP requests, and it would not specifically prevent DHCP address acquisition. Option B is wrong because IP Source Guard blocks IP traffic based on the DHCP snooping binding table, not ARP packets directly; it does not interfere with ARP unless combined with DAI. Option D is wrong because an ARP ACL is used to permit or deny ARP packets for static IP hosts, but it is not required for DHCP-based hosts; the core issue is the missing DHCP snooping binding table.
A network administrator must enforce security policies for east-west traffic in a Cisco TrustSec-enabled data center without using IP-based ACLs. Which technology should be used?
SGACLs enforce policy based on SGTs, avoiding IP dependencies.
Why this answer
TrustSec uses SGTs for identity-based tagging and SGACLs to enforce policy without IP addresses.
An engineer is designing a spine-leaf fabric using eBGP for the underlay. The spine switches are in AS 65000 and each leaf switch uses a different private AS from 65001 to 65010. For optimal convergence and to avoid BGP path hunting, which BGP feature should be configured on the spines?
Allowas-in 1 permits the spine to accept updates containing its own AS once, which is needed when leaf uses spine AS as part of AS path.
Why this answer
In a BGP underlay with a common spine AS (65000) and unique leaf AS, each leaf may receive routes from multiple spines. Without 'allowas-in', when a spine receives a route from a leaf that already contains the spine's own AS in the AS_PATH (because another spine previously advertised it), the spine would reject the update due to AS loop detection. Configuring 'allowas-in 1' on spines allows them to accept routes containing their own AS once, enabling them to consider all available paths and avoid path hunting.
Options B, C, and D are incorrect: 'disable-peer-as-check' would ignore AS checks altogether, potentially causing loops; 'multipath-relax' allows multipath with different AS_PATHs but doesn't address the path-hunting issue; 'maxas-limit' limits the maximum AS number but is not relevant to this scenario.
Which THREE components are part of an EVPN VXLAN fabric? (Choose three)
MP-BGP is the standard control plane for EVPN, advertising MAC/IP routes and other attributes.
Why this answer
MP-BGP is the control plane protocol for EVPN VXLAN fabrics. It advertises MAC/VPN reachability information using EVPN address families (L2VPN AFI/SAFI 70/128) and enables overlay route distribution between VTEPs. Without MP-BGP, the fabric cannot dynamically learn remote MAC addresses or maintain a scalable, loop-free control plane.
Which two features allow running Python scripts directly on a Cisco Nexus switch? (Choose two.)
EEM can execute Python scripts on events.
Why this answer
Guest shell provides a Linux environment; EEM can trigger Python applets on events.
A data center designer is evaluating oversubscription ratios in a spine-leaf topology with 40 leaf switches and 4 spine switches. Each leaf has 4x100G uplinks to spines, and each spine has 40x100G downlinks. The leaf switches have 48x25G server ports. What is the oversubscription ratio from the server ports to the spine uplinks?
1200G server / 400G uplink = 3:1.
Why this answer
The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48x25G server ports = 1200G, and 4x100G uplinks = 400G, giving a leaf-level ratio of 3:1 (1200:400). Since all leaves are identical and the spine count doesn't affect the leaf-level ratio, the overall ratio remains 3:1.
Exam trap
Cisco often tests the misconception that the spine switch port count or total fabric bandwidth should be used in the ratio calculation, leading candidates to incorrectly include spine downlinks or total aggregate bandwidth instead of focusing on the leaf-level server-to-uplink ratio.
How to eliminate wrong answers
Option A (2:1) is wrong because it would require 600G of uplink bandwidth per leaf (e.g., 6x100G), not the given 4x100G. Option B (4:1) is wrong because it would imply 48x25G server ports (1200G) divided by 300G uplinks, but the uplinks are 400G, not 300G. Option D (5:1) is wrong because it would require only 240G of uplink bandwidth per leaf, which is less than the actual 400G.
Which two commands are used to verify Spanning Tree Protocol (STP) status on a Cisco Nexus switch? (Choose two.)
Correct. Displays STP state for all VLANs.
Why this answer
On Cisco Nexus switches, the correct command to verify Spanning Tree Protocol status is 'show spanning-tree'. This command displays the STP state for all VLANs, including root bridge, port roles, and port states. Option C is correct because it is the standard Cisco command for viewing STP information across all VLANs.
Exam trap
Cisco often tests the distinction between configuration verification commands (like 'show running-config') and operational status commands (like 'show spanning-tree'), leading candidates to mistakenly choose 'show running-config spanning-tree' when they need to verify real-time STP state.
An organization has deployed a pair of Nexus 93180YC-EX switches as vPC peers in a data center. The switches are connected to a server with two 10GbE interfaces configured as an LACP port-channel. The vPC configuration has been verified and was working correctly for months. After a scheduled maintenance window that included upgrading the NX-OS software from version 7.0(3)I7(1) to 7.0(3)I7(5), the server begins experiencing frequent link flaps on the port-channel. The server administrator reports that every 5-10 minutes, the link goes down for about 2 seconds and then recovers. The network team checks the logs on the Nexus switches and sees repeated messages: 'LACP-3-MISCONFIG: Port-channel <channel> is misconfigured: partner not on same aggregator.' The 'show vpc brief' output shows all vPCs in the 'up' state. The 'show port-channel summary' shows the port-channel is up with both member ports in the bundle. What is the most likely root cause?
In a vPC, the LACP system identifier must be identical on both peers to appear as a single partner to the server. Inconsistent system priority leads to different identifiers, triggering the misconfiguration log and link flaps.
Why this answer
In a vPC setup, both peer switches must have the same LACP system identifier (derived from system priority and MAC address) so the server sees a single logical partner. If the LACP system priority is not consistent across the peers, the system identifiers will differ, causing the server to detect multiple partners, leading to the 'partner not on same aggregator' error and link flaps. Option A is incorrect because the LACP rate timer mismatch would cause constant timeout issues, not intermittent flaps with the specific log message.
Option B is incorrect because VLAN mismatch would cause persistent connectivity failures, not intermittent flaps. Option C is incorrect because delay-restore timer affects recovery after link failure, not during steady-state operation.
Refer to the exhibit. Two Nexus switches are connected via Ethernet1/1. MKA does not initiate. What is the issue?
The interface must have 'macsec policy MACSEC' to associate the policy.
Why this answer
The exhibit shows that the MACsec policy is defined but not applied to interface Ethernet1/1. Without applying the policy using the `macsec policy` command under the interface configuration, MKA (MACsec Key Agreement) cannot initiate because the switch does not know which security policy to enforce on that link.
Exam trap
Cisco often tests the distinction between defining a MACsec policy globally and applying it to an interface, knowing that candidates may assume a defined policy is automatically active on all interfaces.
How to eliminate wrong answers
Option A is wrong because the interface is administratively up (state is 'up/up'), so the issue is not administrative shutdown. Option C is wrong because the cipher-suite 'GCM-AES-128' is a standard and supported cipher for MACsec on Nexus switches; unsupported ciphers would cause a configuration rejection, not a silent MKA failure. Option D is wrong because MACsec key chains are used for pre-shared key authentication but are not required for MKA initiation; MKA can use a fallback key or EAP-based authentication, and the absence of a key chain would not prevent MKA from starting.
In Cisco ACI, when creating a contract, which three components are part of the contract definition? (Choose three.)
Subject defines the communication characteristics.
Why this answer
In Cisco ACI, a contract defines the rules for communication between endpoint groups (EPGs). The contract definition consists of three mandatory components: Subject, Filter, and Provider/Consumer. The Subject specifies the direction and type of traffic allowed, the Filter defines the specific protocols and ports (e.g., TCP/UDP, ICMP), and the Provider/Consumer labels establish which EPG offers the service and which consumes it.
Without these three, the contract cannot enforce policy-based connectivity.
Exam trap
Cisco often tests the misconception that VRF or Endpoint IP addresses are part of the contract definition, but in ACI, contracts are purely policy constructs that do not include Layer 3 routing contexts or individual host addresses.
Refer to the exhibit. An engineer sees this error on a Cisco MDS switch. What is the best action to resolve the issue?
Each switch in a fabric must have a unique domain ID.
Why this answer
The error indicates a domain ID conflict between two switches in the same VSAN. In Fibre Channel fabrics, each switch must have a unique domain ID to build a correct forwarding table. Assigning a different domain ID to one of the switches resolves the conflict without disrupting the fabric.
Exam trap
Cisco often tests the misconception that a link flap or reboot will fix a domain ID conflict, when in fact the root cause is a duplicate domain ID that must be manually changed on one switch.
How to eliminate wrong answers
Option A is wrong because reloading both switches would temporarily clear the conflict but does not prevent it from recurring once the switches come back up with the same domain IDs. Option B is wrong because shutting and no shutting the ISL only resets the link state; it does not address the underlying domain ID duplication, so the conflict will persist. Option D is wrong because changing the VSAN would isolate the switches into different fabrics, which is an overly disruptive solution and not necessary when a simple domain ID reassignment resolves the issue.
A HyperFlex cluster requires a cluster witness VM for quorum. The cluster is deployed with 5 nodes using RF2. If one node fails, the cluster remains operational. However, if a second node fails simultaneously, what determines whether the cluster remains available?
The witness VM is essential for quorum when multiple nodes fail.
Why this answer
The witness VM provides a tie-breaking vote. With RF2, if two nodes fail, the cluster can still maintain quorum if the witness is available. The witness is critical for clusters with even number of nodes or after failures.
An organization has four Cisco MDS 9700 directors connected in a full-mesh topology. They use VSANs to separate production, backup, and management traffic. The backup VSAN is experiencing high latency and occasional timeouts. The engineer runs the 'show fcspf routes' command and notices that the path from the backup host to the backup target has an uneven hop count across different paths. The links are all 16 Gbps. The engineer also notes that the backup target is connected to a different director than the backup host. Which action is most likely to improve performance?
Lowering cost makes the direct path more preferred, reducing hop count and latency.
Why this answer
Decreasing the FSPF cost on the direct links encourages traffic to take shorter paths, reducing hop count and latency. Increasing cost would push traffic away, making it worse. IVR is for inter-VSAN routing, not intra-VSAN.
Load balancing via PortChannels increases bandwidth but does not directly reduce latency from long paths.
An engineer is deploying a HyperFlex cluster with all-flash nodes and replication factor 3. What is the minimum number of converged nodes required for the cluster to be fully operational?
Correct. Three converged nodes are the minimum for RF3.
Why this answer
HyperFlex clusters require at least three converged nodes for RF3 to maintain data redundancy and quorum.
Which TWO statements are true regarding the differences between REST API (NX-API) and NETCONF for automating Nexus switches?
NX-API is a REST-based interface over HTTP/HTTPS.
Why this answer
Which TWO are benefits of using the Cisco NX-API for network automation compared to traditional SSH-based scripting?
The NX-API supports the 'chunk' parameter to batch commands, reducing round-trips.
Why this answer
In a Fibre Channel fabric using NPV mode, what is the role of the NP-port on the edge switch?
The NP-port connects to the core switch's F-port and represents multiple hosts.
Why this answer
The NP-port (N_Port Proxy) on the edge switch behaves like an N-port but proxies the login for multiple hosts through the core switch's F-port, reducing the number of domain IDs needed.
An engineer wants to enforce security policies in a data center based on user identity rather than IP addresses. Which Cisco technology enables identity-based tagging and policy enforcement?
TrustSec uses SGTs for identity-based tagging and policy.
Why this answer
Cisco TrustSec uses SGTs to tag traffic based on user/device identity, and SGACLs enforce policies.
An organization's storage network uses RAID-10 for critical databases. The storage array has 12 disks. How many disks can fail simultaneously without data loss, assuming the worst-case scenario?
RAID-10 can tolerate up to 6 disk failures as long as no mirror loses both disks.
Why this answer
RAID-10 combines mirroring and striping. With 12 disks, there are 6 mirrored pairs. Data is lost only if both disks in the same mirror fail.
Therefore, as long as no more than one disk per mirror fails, up to 6 disks can fail simultaneously without data loss. The phrase 'worst-case scenario' often confuses candidates into thinking only 1 failure is tolerable, but the question asks for the maximum number that can fail without data loss, which is 6.
Exam trap
RAID-10 can tolerate up to one disk failure per mirrored pair. With 6 pairs, up to 6 disks can fail simultaneously as long as no two failures occur in the same pair. The 'worst-case scenario' often misleads candidates into thinking only one disk can fail, but the intended interpretation is that failures are spread across different mirrors.
A network engineer is deploying FCoE in a top-of-rack design. Which statement about the required lossless Ethernet fabric is correct?
PFC ensures lossless behavior for FCoE frames.
Why this answer
FCoE requires a lossless Ethernet fabric to prevent frame drops, which would corrupt Fibre Channel traffic. Priority Flow Control (PFC), defined in IEEE 802.1Qbb, provides per-priority pause mechanisms to create lossless CoS (Class of Service) queues, ensuring no frames are lost due to congestion. Without PFC, standard Ethernet's best-effort delivery would cause frame drops, breaking FCoE's reliability.
Exam trap
Cisco often tests the misconception that DCBX automatically enables PFC when FCoE is configured, but in reality, DCBX only negotiates capabilities, and PFC must be manually enabled on the interfaces (e.g., using the 'priority-flow-control' command).
How to eliminate wrong answers
Option A is wrong because DCBX (Data Center Bridging Exchange) is used to negotiate and advertise PFC and other DCB parameters, but it does not automatically enable PFC; PFC must be explicitly configured on the interfaces. Option B is wrong because FCoE does not use VLAN 1002 by default; FCoE traffic is typically mapped to a dedicated VLAN (often VLAN 1002 in some Cisco defaults, but this is not a standard requirement and the statement is misleading—FCoE uses a specific FCoE VLAN, not a default VLAN number for all traffic). Option C is wrong because FCoE frames are not limited to 1500 bytes; FCoE encapsulates Fibre Channel frames (typically up to 2148 bytes) into Ethernet frames, and jumbo frames (up to 2500 bytes or more) are required to avoid fragmentation.
An engineer is configuring a Cisco UCS Manager deployment. The goal is to enforce the organization's security policy by limiting administrative access based on job roles. Which two actions should the engineer take? (Select two.)
Integrating with LDAP allows centralized management of user groups and roles, simplifying administration and security.
Why this answer
C is correct because integrating LDAP groups with RBAC allows the organization to enforce security policies by mapping directory groups to UCS roles, centralizing authentication and authorization. This approach ensures that administrative access is limited based on job roles without managing local users, aligning with the goal of role-based access control.
Exam trap
The trap here is that candidates often confuse RBAC with local user management or maintenance policies, assuming that disabling password defaults or using default policies somehow restricts access, when in fact RBAC requires explicit role definitions and user-to-role mappings.
Which THREE conditions must be met for a Cisco Nexus switch to form a vPC? (Choose three.)
Same version ensures feature compatibility and stability.
Why this answer
Cisco vPC requires both peer switches to run the same NX-OS software version to ensure consistent feature support, protocol behavior, and configuration syntax. Version mismatches can lead to unexpected failures, such as the vPC not forming or inconsistent forwarding states across the peer-link.
Exam trap
Cisco often tests the misconception that the peer-keepalive link must traverse the peer-link, when in fact it must be a separate Layer 3 path to avoid a single point of failure for vPC health monitoring.
A storage administrator wants to provide a volume that appears larger than its actual physical capacity, allocating storage blocks only as data is written. Which storage provisioning method is being described?
Correct. Thin provisioning presents more capacity than physically available, allocating on demand.
Why this answer
Thin provisioning allows over-allocation of storage capacity, presenting a large logical volume to hosts while using physical storage only as needed.
A data center switch is experiencing high CPU due to excessive BGP updates. Which action can mitigate this without affecting legitimate BGP traffic?
CoPP can rate-limit specific control plane protocols, protecting CPU while allowing legitimate BGP updates.
Why this answer
Control Plane Policing (CoPP) protects the control plane by rate-limiting specific traffic classes. Applying a CoPP policy that rate-limits BGP traffic (option A) reduces CPU load from excessive BGP updates while still allowing legitimate BGP sessions to function, as the rate-limit only drops packets exceeding a configured threshold. This preserves BGP neighbor reachability and route exchange, unlike dropping all BGP traffic.
Exam trap
Cisco often tests the distinction between 'rate-limit' and 'drop' in CoPP policies, where candidates mistakenly choose to drop all BGP traffic (option B) thinking it solves the CPU issue, but this breaks routing entirely.
How to eliminate wrong answers
Option B is wrong because dropping all BGP traffic would terminate all BGP sessions, causing complete loss of routing updates and potentially isolating the router. Option C is wrong because disabling BGP route filtering would increase the number of BGP updates processed, worsening the CPU issue by allowing all routes without any filtering. Option D is wrong because increasing BGP timers globally (e.g., keepalive and hold timers) reduces the frequency of updates but does not mitigate a flood of updates from external sources; it may also cause neighbor timeouts if timers are set too high.
Which TWO configuration steps are necessary to enable VXLAN EVPN on a Cisco Nexus 9000 switch using the centralized anycast gateway model?
BGP EVPN is required for route distribution.
Why this answer
Exam trap
Cisco often tests the distinction between mandatory EVPN control plane steps (BGP address-family l2vpn evpn) and generic VXLAN data plane steps (NVE interface, UDP port), leading candidates to select options like creating the NVE interface or setting the UDP port as 'necessary' for EVPN, when they are actually prerequisites for VXLAN itself but not the two specific steps asked for enabling VXLAN EVPN with centralized anycast gateway.
Refer to the exhibit. A network administrator configured VXLAN EVPN as above. The VTEP can communicate with neighbors on VNI 5001, but cannot reach the default gateway for VNI 5002. What is the problem?
The configuration lacks a separate RD and route-target for VNI 5002, preventing EVPN route exchange for that VNI.
Why this answer
The VXLAN EVPN configuration for VNI 5002 is missing the route-target import/export statements under the VRF TenantA address-family l2vpn evpn. Without the route-target, the VTEP cannot import EVPN type-2 and type-3 routes for VNI 5002, preventing it from learning the default gateway's MAC/IP or the IMET route needed for BUM traffic. This explains why the VTEP can communicate on VNI 5001 (which has route-targets) but not reach the gateway on VNI 5002.
Exam trap
Cisco often tests the distinction between Layer 2 VNI (which needs VLAN association and ingress-replication) and Layer 3 VNI (which needs route-target configuration), and the trap here is that candidates assume a missing VLAN or ingress-replication is the root cause, when the real issue is the missing route-target for the Layer 3 VNI under the VRF.
How to eliminate wrong answers
Option A is wrong because the default route in VRF TenantA is not relevant; the issue is with EVPN route import for VNI 5002, not with route leaking or export of a default route. Option C is wrong because VNI 5002 can operate without an associated VLAN if it is used for Layer 3 VNI (IRB) or if the VLAN mapping is done elsewhere; the exhibit shows no VLAN association, but that is not the cause of the gateway unreachability. Option D is wrong because ingress-replication is configured under the NVE interface for VNI 5001 and 5002 (as shown in the exhibit), so the problem is not missing replication; the missing route-target prevents the VTEP from learning the gateway's MAC/IP via EVPN.
During a fabric reconfigure event, which behavior is expected if all switches are running the same Cisco SAN-OS version and have the same domain ID configuration?
Duplicate domain IDs cause fabric segmentation; the switches will not merge.
Why this answer
When all switches in a fabric reconfigure event run the same Cisco SAN-OS version and have the same domain ID configured, a domain ID conflict occurs because the principal switch cannot assign a unique domain ID to each switch. This conflict causes the fabric to segment, as the principal switch isolates the conflicting switch into a separate principal switch selection process, preventing a stable merged fabric.
Exam trap
The trap here is that candidates assume identical domain IDs will simply cause a re-election or a forced reassignment, but Cisco tests that the fabric segments instead, as the principal switch cannot resolve the conflict without manual intervention.
How to eliminate wrong answers
Option A is wrong because the principal switch selection is based on the highest WWN only during the initial election or when no principal switch exists; during a reconfigure event with identical domain IDs, the conflict triggers segmentation, not a re-election based on WWN. Option B is wrong because the principal switch does not force a new domain ID assignment; instead, it detects the conflict and segments the fabric to avoid duplicate IDs, as domain IDs must be unique per VSAN. Option D is wrong because even if VSANs match, a domain ID conflict prevents a merge; the fabric will segment rather than merge without issues, as the principal switch enforces domain ID uniqueness.
An organization uses FCIP to extend their SAN between two data centers over a 100 Mbps WAN link with 80 ms latency. The storage traffic includes large sequential writes. Which statement best describes the benefit of enabling compression on the FCIP tunnel?
Reduces data volume, so more data can be sent within the limited bandwidth.
Why this answer
Enabling compression on an FCIP tunnel reduces the amount of data transmitted over the WAN link by compressing FC frames before encapsulation. For large sequential writes, this directly improves effective throughput because more actual storage data can be sent within the same 100 Mbps bandwidth, compensating for the high latency and low bandwidth.
Exam trap
Cisco often tests the misconception that compression reduces latency, but candidates must remember that compression only improves throughput by reducing the amount of data sent, not the physical propagation delay.
How to eliminate wrong answers
Option A is wrong because compression does not reduce end-to-end latency; latency is dominated by the 80 ms propagation delay and serialization delay, which compression cannot change. Option C is wrong because compression is beneficial regardless of packet loss; it is primarily used to improve bandwidth efficiency, not to mitigate loss. Option D is wrong because compression does not eliminate the need for jumbo frames; jumbo frames reduce CPU overhead and improve efficiency for large frames, but compression and jumbo frames are independent optimizations.
During a capacity planning review, an engineer notices that a UCS domain with 8 blades (each with 16 cores) is using 70% CPU average. The environment runs VDI workloads. Each VM requires 2 vCPUs and 4 GB RAM. The hypervisor uses 1:1 CPU oversubscription. How many additional VMs can be deployed before reaching 100% CPU utilization?
38 remaining vCPUs / 2 per VM = 19.
Why this answer
The UCS domain has 8 blades × 16 cores = 128 cores. With 1:1 CPU oversubscription, the hypervisor can allocate 128 vCPUs. Each VM requires 2 vCPUs, so the maximum VMs are 128 / 2 = 64.
Currently at 70% CPU, 0.70 × 128 = 89.6 vCPUs are used, meaning 89.6 / 2 = 44.8 VMs (round to 45 VMs). The remaining vCPUs are 128 - 89.6 = 38.4, allowing 38.4 / 2 = 19.2 additional VMs, so 19 VMs can be deployed before hitting 100% CPU utilization.
Exam trap
Cisco often tests the trap of confusing CPU utilization percentage with the number of vCPUs already allocated, leading candidates to incorrectly calculate remaining capacity by applying the percentage to the total VM count rather than to the total vCPU count.
How to eliminate wrong answers
Option B (23) is wrong because it incorrectly assumes a higher oversubscription ratio (e.g., 1.5:1) or miscalculates the remaining vCPUs. Option C (17) is wrong because it likely uses a lower total core count (e.g., 112 cores) or misapplies the 70% utilization to total VMs instead of vCPUs. Option D (21) is wrong because it might result from rounding errors or using 75% utilization instead of 70%.
In a Cisco UCS B-Series environment, which component provides the physical connectivity between blade chassis and Fabric Interconnects?
IOMs provide uplink ports to Fabric Interconnects.
Why this answer
The I/O Module (IOM) in the 5108 blade chassis connects to Fabric Interconnects via server ports, handling data traffic from blades to the FIs.
Which BGP variant is commonly used in data center EVPN fabrics to carry Layer 2 and Layer 3 network information?
MP-BGP with EVPN address family carries overlay information.
Why this answer
MP-BGP (Multiprotocol BGP) is the correct variant because it carries both Layer 2 (MAC/VXLAN) and Layer 3 (IP/VRF) network information in EVPN fabrics via BGP EVPN address families (L2VPN EVPN and IP VPN). It extends BGP with multiprotocol extensions (RFC 4760) to support Network Layer Reachability Information (NLRI) for Ethernet segments, MAC addresses, and IP prefixes, which is essential for VXLAN-based data center fabrics.
Exam trap
Cisco often tests the distinction between the BGP deployment mode (eBGP/iBGP) and the protocol variant (MP-BGP), leading candidates to confuse eBGP or iBGP as the answer when the question specifically asks for the variant that carries Layer 2 and Layer 3 information.
How to eliminate wrong answers
Option A is wrong because eBGP (External BGP) is a deployment mode (between different autonomous systems), not a protocol variant that supports multiple address families; EVPN fabrics can use eBGP as the transport for MP-BGP sessions, but the variant itself is MP-BGP. Option C is wrong because iBGP (Internal BGP) is a deployment mode within a single AS and does not inherently provide multiprotocol extensions; while iBGP can carry MP-BGP address families, the question asks for the variant that carries Layer 2/3 info, which is MP-BGP, not iBGP. Option D is wrong because OSPF is a link-state IGP that only carries IPv4/IPv6 routing information and cannot transport Layer 2 MAC/VXLAN or EVPN NLRI; it lacks the multiprotocol extensions and address family support required for EVPN.
The 'ip dhcp snooping trust' command on the interface makes it trusted for all snooped VLANs.
Why this answer
When a DHCP server is connected to a switch port and clients in different VLANs (like VLAN 10) obtain IP addresses, the switch must trust the DHCP server port for all VLANs. This is typically achieved by configuring the port as a DHCP snooping trusted port or by using an IP helper address on the VLAN interface. Without trust, DHCP snooping would drop server responses on untrusted ports, preventing the client from obtaining an address.
How to eliminate wrong answers
Option A is wrong because the DHCP server is connected to Ethernet1/1, which is not necessarily in VLAN 20; the client in VLAN 10 obtains an IP address, implying the server can communicate with VLAN 10, likely via an IP helper address or trunk, not that the server itself is in VLAN 20. Option B is wrong because the client obtains an IP address via DHCP, which contradicts the use of a static IP address; a static IP would not require DHCP. Option D is wrong because the DHCP client MAC address is verified by DHCP snooping by default on untrusted ports; the fact that the client obtains an IP address suggests the MAC address is verified and not spoofed, or the port is trusted.
An engineer is automating ACI configuration using Terraform. Which provider and resource should be used to create an Application Profile under a Tenant?
Correct. terraform-provider-aci uses the aci_application_profile resource.
Why this answer
terraform-provider-aci is the correct provider for ACI automation. The resource for an application profile in ACI is 'aci_application_profile' which is part of the provider. 'aci_tenant' is for tenants, 'aci_epg' for EPGs, and 'aci_bridge_domain' for bridge domains.
An engineer needs to enable equal-cost multipath (ECMP) routing in a spine-leaf fabric using OSPF. Which OSPF feature allows load balancing across multiple equal-cost paths?
This command sets the number of ECMP paths.
Why this answer
The maximum-paths command is the OSPF feature that directly controls the number of equal-cost routes installed in the routing table, enabling ECMP load balancing across multiple equal-cost paths. By default, OSPF installs only one best path, but increasing the maximum-paths value allows the router to use up to that many equal-cost routes simultaneously.
Exam trap
Cisco often tests the misconception that OSPF automatically load-balances across equal-cost paths without any configuration, but in reality the maximum-paths command must be explicitly set to a value greater than 1 to enable ECMP.
How to eliminate wrong answers
Option A is wrong because OSPF network type (e.g., broadcast, point-to-point) affects neighbor discovery and LSA flooding behavior, not the ability to load-balance across equal-cost paths. Option B is wrong because OSPF area type (e.g., standard, stub, NSSA) controls route summarization and LSA filtering, not ECMP load balancing. Option D is wrong because OSPF cost metric is used to calculate path preference and determine which paths are equal-cost, but it does not enable or disable load balancing; the maximum-paths command is required to actually use multiple equal-cost paths.
Which component in a UCS B-series chassis provides the connectivity between blade servers and the Fabric Interconnects?
Correct. IOMs provide uplinks from the chassis to the FIs.
Why this answer
I/O Modules (IOMs) in the chassis connect blades to the Fabric Interconnects via server ports.
In VXLAN, which method of handling BUM traffic replicates packets to remote VTEPs only when there is a known receiver behind that VTEP?
The ingress VTEP replicates packets to each remote VTEP with known receivers.
Why this answer
Ingress replication is the correct method because in VXLAN, the ingress VTEP replicates BUM (Broadcast, Unknown unicast, Multicast) traffic and sends a copy to each remote VTEP only if that VTEP has at least one receiver (i.e., a host or VM) that has joined the relevant multicast group or is reachable via the VNI. This avoids unnecessary replication to VTEPs with no interested receivers, optimizing bandwidth and reducing load on the underlay network.
Exam trap
Cisco often tests the distinction between 'ingress replication' and 'multicast-based replication' by making candidates think multicast is always more efficient, but the trap here is that multicast-based replication sends BUM to all VTEPs in the multicast group regardless of receiver presence, whereas ingress replication only sends to VTEPs with known receivers, making it more efficient in many scenarios.
How to eliminate wrong answers
Option B (Egress replication) is wrong because egress replication is not a standard VXLAN BUM handling method; the term is sometimes misused to describe replication at the destination VTEP, but Cisco’s VXLAN implementations use ingress replication or multicast-based replication. Option C (Multicast-based replication) is wrong because it relies on an underlay multicast group (e.g., PIM) to distribute BUM traffic to all VTEPs in the VNI, regardless of whether a receiver exists behind each VTEP, which can waste bandwidth and requires multicast routing in the underlay. Option D (Head-end replication) is wrong because this is a generic term sometimes used interchangeably with ingress replication, but Cisco specifically uses the term 'ingress replication' in VXLAN documentation; 'head-end replication' is more commonly associated with MPLS L2VPN or EVPN, not VXLAN BUM handling.
An engineer is configuring a new VLAN on a Nexus switch that is part of a vPC pair. Which step is mandatory to ensure the VLAN is created on both vPC peers?
Manual creation on both switches is required unless using config-sync.
Why this answer
In a vPC domain, VLANs are not automatically synchronized between peers. The engineer must manually create the VLAN on both vPC peers to ensure it is present in the local VLAN database on each switch. This is because vPC relies on consistent local configuration on both devices for proper operation, and there is no built-in mechanism to propagate VLAN definitions from one peer to the other.
Exam trap
The trap here is that candidates often assume vPC automatically synchronizes all configurations between peers, but in reality, only specific operational states are synced, while VLAN definitions must be manually created on both switches.
How to eliminate wrong answers
Option A is wrong because vPC peer-gateway is used to enable routing of traffic with the peer's MAC address, not to propagate VLANs. Option B is wrong because creating the VLAN only on the secondary peer will not cause the primary to learn it via STP; STP does not synchronize VLAN databases. Option C is wrong because the primary peer does not automatically sync VLANs to the secondary peer; both peers require explicit manual configuration.
An engineer is writing an Ansible playbook to configure a Nexus switch. The playbook uses the cisco.nxos.nxos_config module. Which Ansible concept is used to ensure the playbook is idempotent?
Check mode is used for idempotency testing.
Why this answer
The 'check_mode' (or '--check') flag in Ansible allows dry-run to verify idempotency.
Which TWO statements about NPV (N_Port Virtualization) mode in FC networks are correct?
NPV switches are placed at the top of the rack to aggregate server connections.
Why this answer
NPV is specifically designed for top-of-rack (ToR) deployments to reduce the number of physical cables and simplify SAN cabling. In NPV mode, the ToR switch acts as a transparent proxy, forwarding FLOGI requests from end devices to the core NPV-enabled switch, which handles all fabric services. This eliminates the need for each ToR switch to have its own domain ID, reducing management complexity.
Exam trap
Cisco often tests the distinction between NP-ports and E-ports, and the trap here is that candidates mistakenly think NPV switches use E-ports for uplinks, when in fact they use NP-ports to avoid introducing additional domain IDs.
What is the purpose of a witness VM in a HyperFlex cluster?
Witness ensures quorum in failure scenarios.
Why this answer
In a HyperFlex cluster, the witness VM provides a tie-breaking vote for cluster quorum decisions when the cluster experiences a network partition or node failure. It ensures that the surviving side can maintain a majority and continue operating, preventing split-brain scenarios where both sides would independently write data.
Exam trap
Cisco often tests the distinction between the witness VM's quorum role and the management or storage functions of other components, leading candidates to confuse it with the HyperFlex Management Controller or a storage node.
How to eliminate wrong answers
Option B is wrong because the management node in a HyperFlex cluster is the HyperFlex Management Controller (HXMC), not the witness VM; the witness VM is solely for quorum. Option C is wrong because the witness VM does not provide storage capacity; it is a lightweight VM that consumes minimal resources and does not participate in the data plane. Option D is wrong because data replication across sites is handled by HyperFlex stretch clusters using synchronous replication, not by the witness VM, which only provides quorum in a single-site or stretched-cluster scenario.
An engineer is troubleshooting a UCS blade server that fails to boot from SAN. The server is associated with a service profile that includes a SAN connectivity policy. Which two items should be verified to ensure the boot from SAN works? (Choose two.)
If local disk is first, it may attempt to boot from there.
Why this answer
For boot from SAN, the WWPNs must be correctly assigned and the boot policy must list the SAN path as the first boot device. Also, zoning on the SAN switch is required but that is external.
Which two mechanisms are used by Dynamic ARP Inspection to prevent ARP spoofing? (Choose two.)
DAI compares ARP packet MAC-IP pair with the binding table to detect spoofing.
Why this answer
Dynamic ARP Inspection (DAI) validates ARP packets by comparing the sender MAC and IP addresses against the DHCP snooping binding table. If an ARP packet's MAC-IP binding does not match an entry in the binding table, DAI drops the packet, preventing ARP spoofing attacks. Additionally, DAI can use ARP access lists (ARP ACLs) to statically define valid MAC-IP bindings for hosts that do not use DHCP, providing an alternative validation mechanism.
Exam trap
The trap here is that candidates often confuse the enabling configuration (ARP inspection VLAN configuration) with the actual validation mechanism, or they mistakenly think port security or rate limiting directly prevent ARP spoofing, when in fact they serve different security purposes.
A UCS administrator is deploying a 3-node HyperFlex cluster with vSphere. Each node has a single vNIC for management and two vNICs for storage data traffic. During the cluster creation, the storage vNIC MTU must be configured. What is the recommended MTU value for the storage data vNICs in HyperFlex?
Recommended for HyperFlex storage data.
Why this answer
C is correct because HyperFlex storage data vNICs require jumbo frame support to optimize storage traffic performance. The recommended MTU value for these vNICs is 9000, which allows larger packet sizes and reduces CPU overhead for storage I/O operations. This value is consistent with Cisco's best practices for HyperFlex cluster deployments.
Exam trap
Cisco often tests the specific recommended MTU value of 9000 for HyperFlex storage vNICs, and the trap here is that candidates may confuse it with the maximum jumbo frame size of 9216 supported by some switches, or assume the standard 1500 MTU is sufficient for storage traffic.
How to eliminate wrong answers
Option A is wrong because an MTU of 1500 is the standard Ethernet MTU and does not support jumbo frames, which are necessary for efficient storage traffic in HyperFlex. Option B is wrong because 9216 is a common jumbo frame MTU value for some Cisco switches, but HyperFlex specifically recommends 9000, not 9216, for storage vNICs. Option D is wrong because 4096 is not a standard jumbo frame MTU value; it is too small to provide the benefits of jumbo frames and is not recommended by Cisco for HyperFlex storage data traffic.
Which two of the following are valid methods to automate Nexus switch configuration using Python? (Choose two.)
cisco_nxapi provides Python bindings for NX-API.
Why this answer
cisco_nxapi is a Python library for Nexus API. Guest Shell allows running Python scripts on-box. EEM uses Tcl, not Python natively.
NETCONF uses Python via ncclient, but not natively on Nexus. Ansible is not Python library.
A SAN administrator notices intermittent connectivity issues between an initiator and target. The Fibre Channel link shows CRC errors. What is the most likely cause?
Physical layer issues cause CRC errors.
Why this answer
CRC errors on a Fibre Channel link indicate physical-layer issues such as signal degradation, dirty connectors, or faulty hardware. The most common cause is a faulty SFP module or damaged fiber optic cable, which introduces bit errors that the CRC check detects. This is the first component to verify when troubleshooting intermittent connectivity with CRC errors.
Exam trap
Cisco often tests the distinction between physical-layer errors (CRC) and higher-layer issues (zoning, domain ID, buffer credits) to see if candidates can map symptoms to the correct OSI layer.
How to eliminate wrong answers
Option A is wrong because an incorrect domain ID would cause fabric segmentation or routing issues, not physical-layer CRC errors. Option C is wrong because buffer credit starvation results in frame drops and credit recovery delays, not CRC errors. Option D is wrong because an incorrect zone configuration would cause access control failures (e.g., frames being discarded at the switch), not CRC errors on the link.
Refer to the exhibit. An engineer is configuring a server-facing interface on a Nexus switch. The server is running VMware ESXi with multiple virtual machines in VLANs 10, 20, and 30. After applying the configuration, the ESXi host reports that it cannot communicate on VLAN 30. Which configuration change should be made?
If VLAN 30 does not exist, the switch will not forward traffic for it even if allowed on the trunk.
Why this answer
VLAN 30 must exist in the global VLAN database before it can be used on any interface. Even though the interface configuration allows VLAN 30 as a trunked VLAN, the switch will not forward traffic for a VLAN that has not been created globally. Without the 'vlan 30' command in global configuration mode, the VLAN is not present in the switch's VLAN database, and the interface will not pass traffic for that VLAN.
How to eliminate wrong answers
Option A is wrong because removing 'spanning-tree port type edge trunk' would disable PortFast and BPDU guard on the trunk, which is unrelated to VLAN 30 communication failure; it would only affect STP convergence and loop prevention. Option B is wrong because changing the native VLAN to 30 would cause all untagged traffic to be placed in VLAN 30, but the issue is that VLAN 30 does not exist globally, and the native VLAN mismatch could also cause connectivity problems for other VLANs. Option D is wrong because configuring the port as an access port in VLAN 30 would remove the trunk and prevent the ESXi host from carrying multiple VLANs (10, 20, 30) to the virtual machines, breaking the required trunking behavior.
An engineer has configured a service profile with a WWPN pool that has exhausted its assigned range. The server boots from SAN. What happens when the server is associated?
Correct behavior.
Why this answer
When a WWPN pool is exhausted, Cisco UCS automatically assigns a temporary WWPN from the conflict-free range (00:00:00:00:00:00 to 00:00:00:00:00:FF) to allow the server to associate and boot from SAN. This temporary WWPN is used only until a permanent WWPN becomes available from the pool, ensuring the server can still access storage during the interim period.
Exam trap
Cisco often tests the misconception that pool exhaustion causes association failure, but the correct behavior is that UCS uses a temporary WWPN from the conflict-free range to maintain boot-from-SAN functionality.
How to eliminate wrong answers
Option A is wrong because the server does associate and boot successfully using a temporary WWPN from the conflict-free range, not fail due to no WWPN assignment. Option B is wrong because Cisco UCS does not prompt for manual entry; it automatically assigns a temporary WWPN from the conflict-free range. Option C is wrong because the association does not fail; it proceeds with a temporary WWPN, and new WWPNs can be added to the pool later without disrupting the association.
A UCS administrator needs to update the firmware on a UCS 5108 chassis that contains eight B-Series blades. The firmware update must be performed with minimal downtime. Which update method should be used?
This method allows the administrator to control when blades reboot, minimizing downtime by staggering reboots.
Why this answer
The User Acknowledged update method, combined with a maintenance policy that reboots blades sequentially, allows the firmware update to proceed blade by blade with minimal downtime. This approach ensures that only one blade is offline at a time, while the remaining blades continue to serve traffic, making it ideal for a chassis with eight B-Series blades where service continuity is critical.
Exam trap
Cisco often tests the distinction between 'User Acknowledged' and 'Non-Impactful' updates, trapping candidates who mistakenly think that a non-impactful update can include a forced reboot, when in fact any reboot makes the update impactful.
How to eliminate wrong answers
Option A is wrong because Fast-Impact update is designed for scenarios where immediate, disruptive updates are acceptable, not for minimizing downtime. Option B is wrong because Non-Impactful update with a forced reboot contradicts the definition of a non-impactful update, which should not require a reboot; a forced reboot would cause unnecessary downtime. Option D is wrong because System-Impactful update with a single reboot would take the entire chassis or all blades offline simultaneously, resulting in maximum downtime, which is the opposite of the requirement.
Which three components are required for a fully functional FCoE deployment in a data center? (Choose three.)
DCB provides lossless Ethernet required for FCoE.
Why this answer
FCoE requires Converged Network Adapters (CNAs) on servers, DCB-enabled switches, and FIP for initialization. The other options are not mandatory.
In a VXLAN overlay network, which component is responsible for encapsulating and decapsulating packets and resides at the edge of the underlay network?
Correct: VTEP is the tunnel endpoint.
Why this answer
C is correct because the VXLAN Tunnel Endpoint (VTEP) is the device at the edge of the underlay network that performs encapsulation and decapsulation of VXLAN packets. It adds a VXLAN header (including a 24-bit VNI) and outer UDP/IP headers to original Layer 2 frames, and removes them on the receiving side. This function is defined in RFC 7348 and is essential for extending Layer 2 segments over a Layer 3 underlay.
Exam trap
Cisco often tests the distinction between the data-plane component (VTEP) and the control-plane component (NSX Controller or EVPN), leading candidates to mistakenly select the controller as the encapsulating device.
How to eliminate wrong answers
Option A is wrong because VNI (VXLAN Network Identifier) is a 24-bit segment ID in the VXLAN header that identifies the overlay network segment, not a component that encapsulates or decapsulates packets. Option B is wrong because NSX Controller is a management and control plane component in VMware NSX that handles VXLAN configuration and MAC/VTEP learning, but it does not perform data-plane encapsulation or decapsulation. Option D is wrong because a leaf switch is a top-of-rack switch in a spine-leaf architecture; while it can function as a VTEP if configured, the term 'leaf switch' alone does not specify the encapsulation/decapsulation role, and not all leaf switches are VTEPs.
Which THREE are valid methods for handling BUM traffic in VXLAN? (Choose three.)
Replicates from ingress VTEP.
Why this answer
Ingress replication is a valid method for handling BUM traffic in VXLAN where the ingress VTEP replicates broadcast, unknown unicast, and multicast frames to all remote VTEPs in the VXLAN segment. This approach does not require a multicast routing infrastructure in the underlay, making it simpler to deploy in networks that lack multicast support. It is defined in RFC 7348 and is commonly used in VXLAN EVPN fabrics.
Exam trap
Cisco often tests the distinction between 'ingress replication' and 'multicast-based replication' as the two primary BUM handling methods, while 'ARP suppression' is a separate optimization feature that reduces BUM traffic but is not a replication method itself.
Which TWO statements about NPV (N_Port Virtualization) are correct? (Choose two.)
NPV aggregates multiple ports to uplinks.
Why this answer
NPV (N_Port Virtualization) allows a NPV switch to aggregate traffic from multiple host ports (NP ports) and forward it to the core switch via a few uplinks (NP uplinks). This reduces the number of physical connections required between edge and core switches, simplifying cabling and management.
Exam trap
Cisco often tests the distinction between NPV (switch-level virtualization) and NPIV (port-level virtualization), so the trap here is confusing the ability to assign multiple N-port IDs to a single port (NPIV) with the fabric scaling benefits of NPV.
Based on the exhibited output, what can be concluded about the fabric?
The 'NL' type indicates a loop-attached node (public loop).
Why this answer
The output shows that the device with FCID 0x010003 has an 'NLP' (Node Loop Port) state, which indicates it is attached to a loop (e.g., via an FL_Port). This is a key characteristic of a loop-attached device, as opposed to a point-to-point fabric-attached device. Therefore, option D is correct.
Exam trap
Cisco often tests the distinction between loop-attached and fabric-attached devices by using FCID states like 'NLP' versus 'Online' to mislead candidates into thinking all devices are fabric-attached, when in fact the 'NLP' state specifically indicates a loop topology.
How to eliminate wrong answers
Option A is wrong because there is no evidence of a domain ID conflict; the output does not show duplicate domain IDs or any error messages related to domain ID overlap. Option B is wrong because FCID 0x010002 is listed with a port type of 'N' (Node port) and state 'Online', which is typical for an initiator or target, but there is no indication it is specifically a disk array (e.g., no 'Disk' or 'Storage' label in the output). Option C is wrong because the output shows multiple devices with FCIDs 0x010001, 0x010002, and 0x010003, but it does not provide enough information to determine which are initiators and which are targets; the count of three initiators and one target cannot be concluded from this output alone.
An engineer is configuring a UCS service profile for a blade that will boot from local disk. The blade has two SAS drives configured as a RAID 1 mirror. Which policy is required to specify the local disk boot order?
Boot policy specifies the boot order including local disk.
Why this answer
The boot policy in a service profile defines the boot order and boot devices. For local disk boot, the boot policy must list the local disk as the primary boot device.
In a Cisco HyperFlex cluster, which component is responsible for ensuring data redundancy and consistency across nodes, and typically requires a separate VM for proper operation?
The witness VM provides arbitration for cluster membership.
Why this answer
The cluster witness VM (arbiter) is used in HyperFlex for quorum decisions and to prevent split-brain scenarios, especially with RF2.
Which TWO commands are used to verify Fibre Channel connectivity issues on a Cisco MDS switch? (Choose two.)
Shows interface status, errors.
Why this answer
The 'show interface fc <slot/port>' command displays detailed status, errors, and operational state of a specific Fibre Channel interface, which is essential for diagnosing physical or link-level connectivity issues on a Cisco MDS switch. Option E is correct because the 'show flogi database' command lists all N-port (host) logins registered with the fabric via the Fabric Login (FLOGI) process, verifying that end devices have successfully established a session with the switch and are visible in the Fibre Channel fabric.
Exam trap
Cisco often tests the distinction between Ethernet-based troubleshooting commands (like 'show ip interface brief' or 'show mac address-table') and Fibre Channel-specific commands, leading candidates to mistakenly apply familiar IP/Ethernet commands to a storage networking context.
Which TWO statements accurately describe Cisco UCS service profiles? (Choose two.)
Templates provide standard configurations.
Why this answer
Service profiles abstract hardware and are template-based for consistency.
A data center switch port is configured for 802.1X with MAB as fallback. A device that does not support 802.1X is connected. Which method will allow the device to authenticate?
MAB is the fallback method for devices that do not support 802.1X.
Why this answer
When a device that does not support 802.1X is connected to a port configured for 802.1X with MAB as fallback, the switch detects that no EAPOL frames are received from the device. It then initiates MAC authentication bypass (MAB), which uses the device's MAC address as the identity for authentication against the RADIUS server. If the MAC address is allowed, the port is authorized, providing a seamless fallback authentication method for non-802.1X-capable devices.
Exam trap
The trap here is that candidates often confuse MAB with web authentication or assume that any non-802.1X device will automatically trigger web authentication, but Cisco tests that MAB is the first fallback method when configured, and it uses the MAC address, not a pre-shared key or certificate.
How to eliminate wrong answers
Option A is wrong because EAP-TLS is an 802.1X authentication method that requires the device to support 802.1X and present a client certificate, which the non-802.1X-capable device cannot do. Option B is wrong because web authentication (WebAuth) is a separate fallback method that redirects HTTP traffic to a captive portal for user credentials, but it is not the default or automatic fallback when MAB is configured; MAB is tried first before WebAuth. Option C is wrong because local authentication using a pre-shared key is not a standard 802.1X or MAB mechanism; MAB relies on RADIUS server authentication using the MAC address, not a locally configured pre-shared key.
An engineer is troubleshooting a vPC consistency check failure. Which parameter must be identical on both vPC peer switches to avoid a consistency check violation for a vPC member port?
Mismatched allowed VLANs cause consistency check failure and may suspend the vPC.
Why this answer
In a vPC environment, the allowed VLAN list on the port channel must be identical on both peer switches for a vPC member port. If the lists differ, the vPC consistency check fails, causing the port to be suspended or placed in a consistency-check failure state. This ensures that both peers forward the same set of VLANs across the vPC, preventing asymmetric forwarding and potential loops.
Exam trap
The trap here is that candidates often confuse vPC consistency check parameters with STP or MTU settings, but Cisco specifically tests that the allowed VLAN list on the port channel must match, while other parameters like STP guard or MTU are not part of the Type-1 consistency check.
How to eliminate wrong answers
Option B is wrong because STP root guard setting is a per-port STP feature that does not affect vPC consistency checks; vPC consistency checks focus on parameters that must be identical across the peer link, not STP guard configurations. Option C is wrong because MTU size is not a required identical parameter for vPC member ports; MTU mismatches can cause fragmentation issues but are not part of the vPC consistency check violation criteria. Option D is wrong because spanning-tree port type (e.g., edge, network, normal) is not checked for consistency across vPC peers; vPC consistency checks involve Layer 2 parameters like VLAN lists and port-channel mode, not STP port roles.
A UCS blade server has two vHBAs configured. The storage array is connected to both Fabric Interconnects. Which multipathing configuration should be used on the host to provide path redundancy without needing additional storage ports?
Active/active allows both paths to be used concurrently.
Why this answer
With two vHBAs connected to two separate FIs, the host can use active/active multipathing (e.g., ALUA or symmetric) to utilize both paths simultaneously for redundancy and load balancing.
A financial services company is migrating its core banking application to a new data center built on Cisco Nexus 9000 switches with VXLAN EVPN. The application requires active-active multihoming for its servers, which are dual-homed to two leaf switches. The network team has configured vPC on the leaf switches for the server connections. After the migration, the application team reports that some packets are being dropped during failover events when one of the vPC member links goes down. The network team confirms that vPC is properly configured and the peer-keepalive is functioning. What is the most likely cause of packet drops during failure?
Mismatched parameters cause forwarding inconsistencies.
Why this answer
In a vPC setup, if the consistency parameters (such as STP, VLAN, or interface configurations) are not identical between the two vPC peer switches, the vPC will not forward traffic correctly during a link failure. This mismatch can cause packet drops during failover events, even though the peer-keepalive is functioning. The Cisco Nexus 9000 series requires strict consistency checks to ensure loop-free and seamless failover in VXLAN EVPN environments.
Exam trap
Cisco often tests the misconception that peer-keepalive or peer-gateway features are the primary cause of failover packet drops, when in reality, consistency parameter mismatches are the most common culprit in vPC failure scenarios.
How to eliminate wrong answers
Option A is wrong because the vPC peer-gateway feature is used to allow a vPC peer switch to forward traffic destined for the other peer's gateway MAC address, which is not directly related to packet drops during a vPC member link failure. Option B is wrong because orphan ports are ports that are not part of a vPC and require special handling to avoid traffic black-holing, but the scenario describes dual-homed servers using vPC, not orphan ports. Option C is wrong because the vPC role preempt feature controls which switch becomes the primary after a reboot, but it does not cause packet drops during a failover event when a link goes down.
An engineer is deploying data encryption in a SAN environment. Which two methods provide at-rest encryption? (Choose two.)
SED provides at-rest encryption on the drive.
Why this answer
SED encrypts data on the drive; SAN array encryption encrypts data at the storage level.
A network administrator is configuring a Cisco Nexus switch to use NX-API for automation. Which statement about NX-API is true?
NX-API provides both JSON-RPC and REST interfaces.
Why this answer
NX-API is a feature on Cisco Nexus switches that provides both a RESTful API using HTTP/HTTPS and a JSON-RPC interface for programmatic access to the switch's CLI commands. This dual support allows automation tools to interact with the switch using standard web protocols and data formats, making option A correct.
Exam trap
Cisco often tests the misconception that NX-API is limited to a single data format or requires a specific scripting language, when in fact it supports multiple formats and any HTTP-capable client.
How to eliminate wrong answers
Option B is wrong because NX-API does not require Python scripts exclusively; it supports any programming language or tool capable of making HTTP/HTTPS requests, such as Python, JavaScript, or curl. Option C is wrong because NX-API supports both XML and JSON data formats, not only XML; JSON is often preferred for its lighter weight and easier integration with modern automation frameworks. Option D is wrong because NX-API is included in the base NX-OS software and does not require a separate license; it is enabled via the 'feature nxapi' command.
An administrator needs to configure a Fibre Channel SAN to support two separate departments that must not see each other's storage. Each department has its own set of initiators and targets. Which technology should be used?
VSANs isolate traffic.
Why this answer
VSANs (Virtual SANs) provide isolation within a single Fibre Channel fabric by partitioning the physical SAN into multiple logical SANs. Each department's initiators and targets are placed in separate VSANs, ensuring they cannot see each other's storage traffic or devices, which meets the requirement for complete separation without additional physical hardware.
Exam trap
Cisco often tests the distinction between VSANs and IVR, where candidates mistakenly think IVR is needed for isolation, but IVR actually enables controlled sharing between VSANs, not isolation.
How to eliminate wrong answers
Option B (Port channels) is wrong because port channels aggregate multiple physical links into a single logical link for increased bandwidth and redundancy, but they do not provide any isolation or segmentation between different departments' storage traffic. Option C (NPV) is wrong because NPV (N_Port Virtualization) is used to reduce the number of Fibre Channel domain IDs in a SAN by allowing a switch to proxy logins for multiple initiators, but it does not create separate logical SANs or prevent inter-department visibility. Option D (IVR) is wrong because IVR (Inter-VSAN Routing) is specifically designed to selectively route traffic between different VSANs, which would allow the departments to see each other's storage, directly violating the requirement that they must not see each other's storage.
A Fibre Channel switch is experiencing high latency on a specific ISL. The link is operating at 16 Gbps and has high utilization. Which action will most likely reduce latency?
Load balancing reduces latency.
Why this answer
Adding an additional ISL and configuring a port channel increases the aggregate bandwidth between the two switches, reducing per-link utilization and thus lowering queuing latency. This directly addresses the root cause—high utilization on a single 16 Gbps link—by distributing traffic across multiple physical links, which also provides load balancing and redundancy.
Exam trap
Cisco often tests the misconception that trunking or flow control adjustments can solve bandwidth-related latency, when in fact only increasing aggregate bandwidth (via port channels) reduces queuing delay caused by high utilization.
How to eliminate wrong answers
Option A is wrong because reducing the buffer credit count would actually decrease the number of frames that can be in transit, potentially increasing latency due to credit starvation, especially on long-distance links. Option B is wrong because enabling trunking on the ISL (typically via VSAN trunking) does not increase bandwidth; it only allows multiple VSANs to share the same link, which does not reduce utilization or latency. Option C is wrong because disabling flow control (e.g., buffer-to-buffer credit flow control) would remove the mechanism that prevents frame loss, leading to retransmissions and higher latency, not lower.
A storage administrator notices that a newly deployed Fibre Channel initiator cannot log in to the SAN switch. The switch is configured for NPV mode. Which condition is most likely causing the issue?
NPIV must be enabled on upstream switches for NPV mode to work.
Why this answer
In NPV mode, the switch acts as a transparent proxy, forwarding FLOGI requests from initiators to the upstream NPIV-capable core switch. If NPIV is disabled on the upstream switch, it will reject the FLOGI because it cannot register multiple N-Port IDs on a single physical link, causing the initiator to fail login.
Exam trap
Cisco often tests the distinction between NPV (a switch mode) and NPIV (a feature on the upstream switch), leading candidates to confuse the two or assume the issue is with the NPV switch's own configuration.
How to eliminate wrong answers
Option B is wrong because device aliases are used for zoning and management convenience, not for the FLOGI process; an initiator can log in without any alias. Option C is wrong because the question states the switch is configured for NPV mode, and NPIV mode is a feature of the upstream switch, not a conflicting mode. Option D is wrong because in NPV mode, the switch port facing the upstream switch is configured as an NP port (proxy N-port), not an E port; E ports are used for ISL links between switches in standard FC switching mode, not NPV.
A large enterprise data center uses Cisco ACI with a spine-leaf architecture. The security team requires that all traffic between the Web and App tiers be inspected by a firewall, but traffic within the same tier should be allowed directly. The Web EPG is in VRF PROD with Bridge Domain WEB-BD, and App EPG is in VRF PROD with Bridge Domain APP-BD. The firewall is connected as a service graph device in a different VRF (FW-VRF). The administrator configures a contract between Web and App EPGs that redirects traffic through the firewall. However, after implementation, traffic from Web to App is not passing through the firewall; instead, it is forwarded directly. The contract is applied correctly. What is the most likely cause?
ACI service graph redirection typically works within the same VRF or with PBR; different VRFs break the redirection.
Why this answer
In Cisco ACI, service graphs redirect traffic through firewall devices by inserting the firewall as a Layer 4-Layer 7 device in the traffic path. However, the service graph device must reside in the same VRF as the consumer and provider EPGs, or a shared VRF with proper route leaking must be configured, because ACI uses VRF isolation to enforce policy-based redirect (PBR). Since the firewall is in FW-VRF while both EPGs are in VRF PROD, the leaf switches cannot redirect traffic to the firewall without a common routing context, causing the contract to bypass the firewall and forward traffic directly.
Exam trap
Cisco often tests the misconception that a service graph device can be in any VRF as long as the contract is applied correctly, but in reality, the VRF alignment is mandatory for the redirect to function.
How to eliminate wrong answers
Option B is wrong because the question states the contract is applied correctly and the firewall is connected as a service graph device; a routing issue would typically manifest as unreachability or packet drops, not as direct forwarding without redirection. Option C is wrong because the contract filter controls which traffic is permitted or denied, not the redirection path; the service graph redirection is configured separately in the contract's service graph template. Option D is wrong because the contract is explicitly configured between Web and App EPGs, which is inter-EPG traffic, and intra-EPG traffic within the same tier is allowed directly by default without a contract.
Which of the following correctly describes the role of Fabric Interconnects A and B in a UCS domain?
Correct. They provide redundant connectivity and management.
Why this answer
Fabric Interconnects A and B operate in an active-active or active-standby configuration to provide redundancy for both management and data traffic. Each FI connects to all IOMs, but each IOM is associated with one FI (fabric A or B) for failover.
Practice 350-601 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →