Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 826–900

The cluster witness VM (arbiter) is used in HyperFlex for quorum decisions and to prevent split-brain scenarios, especially with RF2.

Option D is correct because the 'show interface fc <slot/port>' command displays detailed status, errors, and operational state of a specific Fibre Channel interface, which is essential for diagnosing physical or link-level connectivity issues on a Cisco MDS switch. Option E is correct because the 'show flogi database' command lists all N-port (host) logins registered with the fabric via the Fabric Login (FLOGI) process, verifying that end devices have successfully established a session with the switch and are visible in the Fibre Channel fabric.

Service profiles abstract hardware and are template-based for consistency.

When a device that does not support 802.1X is connected to a port configured for 802.1X with MAB as fallback, the switch detects that no EAPOL frames are received from the device. It then initiates MAC authentication bypass (MAB), which uses the device's MAC address as the identity for authentication against the RADIUS server. If the MAC address is allowed, the port is authorized, providing a seamless fallback authentication method for non-802.1X-capable devices.

vPC consistency checks ensure critical parameters match; allowed VLANs on the port channel are a common source of mismatch.

With two vHBAs connected to two separate FIs, the host can use active/active multipathing (e.g., ALUA or symmetric) to utilize both paths simultaneously for redundancy and load balancing.

SED encrypts data on the drive; SAN array encryption encrypts data at the storage level.

NX-API on Cisco Nexus switches supports both XML and JSON as data formats. It uses HTTP/HTTPS (not CLI telnet) and provides a RESTful API. The 'nxapi' feature must be enabled, and authentication uses credentials, not certificates by default.

VSANs (Virtual SANs) provide isolation within a single Fibre Channel fabric by partitioning the physical SAN into multiple logical SANs. Each department's initiators and targets are placed in separate VSANs, ensuring they cannot see each other's storage traffic or devices, which meets the requirement for complete separation without additional physical hardware.

Adding an additional ISL and configuring a port channel increases the aggregate bandwidth between the two switches, reducing per-link utilization and thus lowering queuing latency. This directly addresses the root cause—high utilization on a single 16 Gbps link—by distributing traffic across multiple physical links, which also provides load balancing and redundancy.

In NPV mode, the switch acts as a transparent proxy, forwarding FLOGI requests from initiators to the upstream NPIV-capable core switch. If NPIV is disabled on the upstream switch, it will reject the FLOGI because it cannot register multiple N-Port IDs on a single physical link, causing the initiator to fail login.

Fabric Interconnects A and B operate in an active-active or active-standby configuration to provide redundancy for both management and data traffic. Each FI connects to all IOMs, but each IOM is associated with one FI (fabric A or B) for failover.

The MST region includes the region name, revision number, and VLAN-to-instance mapping. All must match for switches to be in the same region.

A contract contains subjects, which include filters that define traffic types.

NPIV (N_Port ID Virtualization) allows multiple FCIDs on a single N-port. On an NPV switch, NPIV must be enabled to allow the HBA to register multiple IDs.

CIMC and IMC Supervisor are out-of-band management tools for C-series.

NX-API provides a RESTful API interface for automation.

FCIP (Fibre Channel over IP) tunnels encapsulate Fibre Channel frames over IP networks. Jitter and packet loss directly cause Fibre Channel timeouts and retransmissions, severely impacting storage performance. Unlike Fibre Channel over dedicated links, WAN characteristics like jitter and loss must be explicitly accounted for in FCIP design.

CHAP (Challenge Handshake Authentication Protocol) can be configured for one-way or mutual authentication. Mutual CHAP authenticates both sides using a shared secret.

Thin provisioning overcommits physical storage; monitoring actual physical usage and growth rate is critical to prevent running out of space.

Option B is correct because OSPF requires that both routers in a neighbor relationship belong to the same area. If the area IDs differ, the routers will not exchange routing information and the adjacency will stall at the EXSTART or EXCHANGE state, never reaching FULL. This is a fundamental OSPF neighbor requirement defined in RFC 2328.

Priority Flow Control (PFC) is a DCB mechanism that provides per-priority pause to prevent frame loss, ensuring lossless delivery for FCoE traffic.

Cisco IVR (Inter-VSAN Routing) allows selective communication between devices in different VSANs without merging the fabrics. In this dual-fabric SAN scenario, IVR enables specific hosts in Fabric A to communicate with specific storage arrays in Fabric B while keeping the VSANs and fabrics logically isolated, preserving fault domains and administrative boundaries.

Option D is correct because the UCS boot policy allows you to specify a boot order where the local disk is attempted first. If the local disk is unavailable or fails, the system automatically falls back to the next boot device in the list, which is the SAN LUN. This ensures high availability and aligns with the requirement to prefer local boot while providing a failover path.

FCIP encapsulates Fibre Channel frames over TCP/IP. High latency (50 ms RTT) means the TCP sender must wait longer for acknowledgments, which can stall the connection if the TCP window is too small. A large TCP window size (e.g., using window scaling per RFC 1323) allows more data to be in flight before requiring an ACK, thereby maintaining throughput and preventing performance collapse on high-latency WAN links.

Soft zoning by port uses the physical port number, not the WWPN. If the HBA is replaced but the same port is used, the zoning remains valid. Hard zoning by WWN would require updating the zone if the WWPN changes.

The APIC controller is the centralized policy and management controller in ACI, handling all these functions.

FCoE requires feature fcoe, VSAN mapping, VLAN config, NPV mode, and fabric login.

The peer-keepalive link is used to detect a split-brain scenario and is typically a Layer 3 link.

UCS service profiles abstract hardware configuration. By disassociating the profile from the failed blade and associating it with the new blade, all settings (vNICs, vHBAs, policies) are automatically applied, supporting stateless computing.

Automation tools streamline data center operations.

Option B is correct because Cisco UCS Central allows administrators to define global policies that can be applied across multiple UCS domains, while still permitting local overrides at the UCS Manager level. This hierarchical policy model provides centralized control without sacrificing the flexibility needed for domain-specific configurations, such as unique VLANs or boot policies.

Option D is correct because Cisco UCS Manager uses firmware management policies to stage firmware updates across blades in a controlled, non-disruptive manner. Staging the update allows the administrator to schedule the activation during a maintenance window, ensuring all blades receive the same firmware version consistently without immediate impact on production traffic.

Jumbo frames require an MTU of 9000 bytes on all interfaces in the path.

Link speed (A) is a critical factor because higher speeds require more buffer credits to maintain full throughput over a given distance. The buffer credit requirement scales linearly with link speed, as each credit represents the ability to send one frame before receiving an acknowledgment. For example, a 16 Gbps link needs twice as many buffer credits as an 8 Gbps link for the same distance.

MST region requires consistent revision number, name, and VLAN-to-instance mapping on all switches in the region.

The JSON error indicates that the NX-API request was rejected because the command is not permitted through the NX-API interface. NX-API enforces a strict allowlist of commands; any command not explicitly allowed (e.g., certain show commands or configuration commands that could destabilize the switch) will return this error. This is a security and stability feature of the NX-API RESTful interface.

When adding a new ESXi host to a Cisco HyperFlex cluster, the controller VM (CVM) firmware version must match the cluster's version. A mismatch causes the cluster health status to show 'Degraded' because the CVMs cannot properly synchronize storage operations. Verifying and aligning the firmware version is the first troubleshooting step, as it directly impacts cluster stability.

IP Source Guard relies on DHCP snooping binding table and validates source IP against it.

Option A is correct because the 'show zoneset active' command displays the currently active zone set, which is essential for verifying which zones are enforced by the switch. Since the VSAN configuration is correct and interfaces are up, a missing or incorrect active zone set could prevent the host from reaching any targets, even if the name server database is populated.

EVPN uses BGP to advertise MAC addresses and IP prefixes, enabling per-flow load balancing across multiple equal-cost paths via its all-active multi-homing capability. In contrast, traditional VPLS relies on a single active forwarder per site (using Spanning Tree Protocol or VPLS Multihoming), which prevents active-active load balancing and wastes bandwidth.

PXE boot requires specifying the LAN boot option with the appropriate vNIC. In UCS, the boot policy can include a PXE boot entry that references a vNIC. DHCP and TFTP servers are configured externally; the boot policy just needs to enable PXE on the correct interface.

Security Group Tags (SGTs) are used to classify traffic by identity.

Without the 'ip routing' command enabled globally, the Nexus 9300 switches operate as Layer 2 devices only. This means they can forward frames within the same VLAN (since that relies on MAC address learning and switching), but they cannot perform IP routing between VLANs or route traffic to the configured SVI (VLAN interface) default gateway. The servers can communicate within the same VLAN because that is purely Layer 2 switching, but any attempt to reach the default gateway (which requires Layer 3 forwarding) fails because the switch does not have IP routing enabled.

Priority Flow Control (PFC) is a per-priority pause mechanism that creates lossless links for specific traffic classes such as FCoE.

Option B is correct because structured data is predictable and parsable, reducing errors compared to relying on raw text output.

In a VPC domain, the keepalive link is used to monitor the liveness of the peer switch, but it does not carry data traffic. When the keepalive link fails, the secondary switch cannot confirm the primary is alive, so it suspends its VPC member ports to prevent a dual-active scenario. The primary switch remains active and continues forwarding traffic normally because it assumes the secondary has failed.

Option B is correct. R_CTL indicates the frame's information category, including upper-layer protocol (e.g., SCSI-FCP).

Option A is correct. 'vsan <id>' in global config creates the VSAN. Option D is not complete.

Option A is correct because in Cisco MDS Fibre Channel SANs, zone configurations are created in the defined configuration and then activated as a new zone set. This approach ensures that the current active zone set remains operational and unaffected during the configuration process, preventing any disruption to existing traffic. Only when the new zone set is explicitly activated does it replace the active set, allowing for a controlled cutover.

Control Plane Policing (CoPP) is a valid security enforcement method on Cisco Nexus switches because it protects the control plane from excessive or malicious traffic by applying QoS policies that rate-limit packets destined for the supervisor module. By filtering traffic such as routing protocols, SSH, or ICMP, CoPP prevents CPU overload and DoS attacks, directly enforcing security at the control plane level.

The VTEP (Virtual Tunnel Endpoint) performs encapsulation and decapsulation of VXLAN frames.

Option B is correct because the 'test aaa authentication login' command with the 'legacy' keyword directly validates the AAA authentication configuration against the TACACS+ server without requiring a full login session. This isolates whether the issue is with the AAA configuration itself versus network connectivity or server reachability, as the command simulates the exact authentication flow the switch uses.

Option D is correct because Cisco UCS Mini requires a dedicated management VLAN to be configured on both fabric interconnects, and chassis management must be enabled on that VLAN. This allows the chassis management controller (CMC) to be reachable from either FI, enabling active/standby management redundancy without relying on a single point of control.

UCS Manager provides centralized firmware management for all blades and FIs. The administrator can initiate firmware updates through UCS Manager GUI or CLI, which handles the upgrade process across the domain.

VSANs provide isolation similar to VLANs in Ethernet, allowing multiple virtual Fibre Channel fabrics on the same physical switch.

Option B is correct because Cisco TrustSec requires the ingress interface to be explicitly configured with either the 'sgt' command (for static SGT assignment) or an 'ip policy' command (for dynamic SGT classification via a security group ACL). Without this, the switch cannot classify traffic and apply the SGT tag. The scenario describes a classification policy that is not being applied, which directly points to a missing ingress classification command.

UCS Manager role-based access control (RBAC) allows granular assignment of privileges to users.

Option C is correct because a VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.

To boot from SAN, the service profile must include a SAN connectivity policy that defines the WWPNs (World Wide Port Names) for the vHBAs. This policy assigns WWPNs from a pool or statically.

Intermittent 'Link Down' on HBAs, despite correct SAN zoning and VSAN configuration, strongly points to a physical-layer issue. Faulty SFPs or damaged cables cause intermittent link flaps, which manifest as sporadic HBA link-down events. This is the most common cause of such symptoms in UCS environments.

A zone should include the host's WWPN and both storage ports' WWPNs. Zoning by WWPN is hardware-independent and more secure.

MPIO requires multiple paths between the initiator and target. Each path must be on a separate network interface and subnet to provide redundancy and load balancing.

The 'Init' status in the output of 'show nve peers' indicates that the VXLAN tunnel endpoint (VTEP) has learned the remote VTEP IP address (likely via BGP EVPN or static configuration) but is unable to complete the tunnel establishment. In VXLAN multicast mode, the underlay multicast group is used for BUM traffic and for VTEP discovery. If the multicast group is not reachable (e.g., due to missing PIM configuration, incorrect RP, or firewall filtering), the source VTEP cannot receive the multicast join or data from the remote VTEP, leaving the peer stuck in 'Init' state.

In a UCS domain with fabric interconnects in end-host mode, a Pin Group policy is used to explicitly map a vNIC's traffic to specific uplink ports, ensuring load balancing across the upstream switches. This policy overrides the default MAC-based hashing and allows the engineer to control traffic distribution, which is critical for consistent performance and redundancy.

In Cisco ACI, multicast forwarding is enabled at the bridge domain level using a multicast policy. This policy configures the necessary IGMP snooping and multicast group membership for the fabric, allowing end hosts to receive multicast traffic without requiring PIM on the leaf switches. Option C is correct because the bridge domain multicast policy is the required configuration for multicast in ACI.

Contracts in ACI allow the specified traffic direction from provider to consumer. The provider EPG is the one that offers the service. VMM integration allows EPGs to be mapped to VMware port groups.