Knowledge + Practice

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 826–900

984 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Page 12 of 14

826

MCQmedium

Which MST configuration parameter must match across all switches in the same MST region?

A.Port cost

B.Root bridge

C.Region name, revision, and VLAN mapping

D.Bridge priority

AnswerC

These define the MST region.

Why this answer

In MST (Multiple Spanning Tree) protocol, switches in the same MST region must share the same region name, revision number, and VLAN-to-instance mapping. These parameters define the region boundary; if any differ, switches will treat each other as being in different regions, breaking MST interoperability and causing them to run separate spanning trees (e.g., PVST+).

Exam trap

Cisco often tests the misconception that bridge priority or root bridge must match across a region, but the trap here is that only the three region parameters (name, revision, VLAN mapping) must be identical; other spanning-tree parameters are per-instance or per-switch and do not define region membership.

How to eliminate wrong answers

Option A is wrong because port cost is a per-port parameter used for path selection within a spanning tree instance, not a region-wide parameter that must match across switches. Option B is wrong because the root bridge is dynamically elected per MST instance (or per spanning tree) and does not need to be configured identically across switches in the same region. Option D is wrong because bridge priority is a per-switch value used in root bridge election and can differ among switches in the same MST region without affecting region membership.

Full explanation →

827

MCQmedium

In ACI, a contract is defined between two EPGs. Which component specifies the type of traffic allowed?

A.VRF

B.Filter

C.Subject

D.Tenant

AnswerC

The subject in a contract contains one or more filters and defines the direction and applicability.

Why this answer

A contract contains subjects, which include filters that define traffic types.

Full explanation →

828

MCQmedium

A Cisco MDS switch is configured with NPV mode. A host NPIV-capable HBA is connected to this switch. The HBA needs to log in with multiple N-port IDs to support multiple virtual machines. What must be configured on the MDS switch to allow this?

A.PortChannel

B.NPIV

C.VSAN trunking

D.Zoning

AnswerB

NPIV must be enabled on the switch and supported by the HBA to allow multiple FCIDs.

Why this answer

NPIV (N_Port ID Virtualization) allows multiple FCIDs on a single N-port. On an NPV switch, NPIV must be enabled to allow the HBA to register multiple IDs.

Full explanation →

829

Multi-Selecteasy

Which TWO methods can be used to manage Cisco UCS C-series rack servers out-of-band? (Choose two.)

Select 2 answers

A.SSH to the server's OS

B.Cisco IMC Supervisor

C.CIMC web interface

D.Vic CLI

E.UCS Manager GUI

AnswersB, C

IMC Supervisor provides centralized management for multiple C-series.

Why this answer

CIMC and IMC Supervisor are out-of-band management tools for C-series.

Full explanation →

830

MCQmedium

Which feature in NX-OS allows for direct API calls to the switch for automation purposes?

A.NX-API

B.Python scripting

C.Bash shell

D.SNMP

AnswerA

NX-API is the REST API for Nexus switches.

Why this answer

NX-API (option A) is the correct answer because it is the native NX-OS feature that exposes a RESTful API interface, allowing direct HTTP/HTTPS calls (e.g., GET, POST, PUT, DELETE) to the switch for automation and programmability. This enables tools like Ansible, Postman, or custom scripts to send structured data (JSON/XML) to configure, monitor, and manage the switch without requiring CLI parsing or SSH sessions.

Exam trap

Cisco often tests the distinction between a direct API (NX-API) and automation tools (Python, Bash) that may use APIs indirectly, leading candidates to confuse scripting languages or shell access with the actual API endpoint.

How to eliminate wrong answers

Option B is wrong because Python scripting is a method for writing automation scripts that can run on the switch or remotely, but it does not provide direct API endpoints; it typically uses libraries like requests to call NX-API or other APIs. Option C is wrong because Bash shell provides a Linux shell environment on NX-OS for running commands and scripts, but it is not an API; it requires interactive access or SSH, not direct HTTP-based API calls. Option D is wrong because SNMP is a protocol for monitoring and managing network devices via MIBs and OIDs, but it is not designed for direct API calls for automation; it is primarily used for read/write operations with a different data model and lacks the flexibility of RESTful APIs.

Full explanation →

831

Multi-Selecthard

Which THREE factors must be considered when implementing FCIP for SAN extension over a WAN? (Choose three.)

Select 3 answers

A.VSAN configuration on the remote MDS switch.

B.Jitter and packet loss characteristics.

C.Buffer-to-buffer credit count on the FCIP tunnel.

D.Round-trip time (RTT) latency of the WAN link.

E.Available bandwidth and potential congestion.

AnswersB, D, E

Jitter and loss impact TCP performance and retransmissions.

Why this answer

FCIP (Fibre Channel over IP) tunnels encapsulate Fibre Channel frames over IP networks. Jitter and packet loss directly cause Fibre Channel timeouts and retransmissions, severely impacting storage performance. Unlike Fibre Channel over dedicated links, WAN characteristics like jitter and loss must be explicitly accounted for in FCIP design.

Exam trap

Cisco often tests the distinction between Fibre Channel fabric parameters (like VSANs and B2B credits) and WAN-specific factors (jitter, loss, RTT, bandwidth) that directly impact FCIP tunnel performance, leading candidates to select local SAN parameters instead of WAN characteristics.

Full explanation →

832

MCQhard

Which iSCSI authentication method provides mutual authentication between initiator and target using a shared secret?

A.Kerberos

B.CHAP

C.IPsec

D.RADIUS

AnswerB

CHAP can provide mutual authentication in iSCSI.

Why this answer

CHAP (Challenge Handshake Authentication Protocol) can be configured for one-way or mutual authentication. Mutual CHAP authenticates both sides using a shared secret.

Full explanation →

833

MCQhard

A storage administrator is configuring a new storage array that supports thin provisioning. The array reports 10 TB of physical storage and 50 TB of thin-provisioned logical capacity. Which risk is most important to monitor to avoid out-of-space conditions?

A.High latency on the Fibre Channel links

B.The number of snapshots taken

C.The replication status

D.The rate of physical capacity consumption and remaining free space

AnswerD

If physical space is exhausted, writes may fail or data loss can occur.

Why this answer

Thin provisioning overcommits physical storage; monitoring actual physical usage and growth rate is critical to prevent running out of space.

Full explanation →

834

Multi-Selectmedium

A network engineer is troubleshooting an OSPF adjacency that fails to reach FULL state between two Nexus 9000 switches. Which TWO are common causes for this issue?

Select 2 answers

A.Mismatched OSPF process ID

B.Mismatched area ID

C.Mismatched router ID

D.Mismatched hello/dead timers

E.Mismatched network type

AnswersB, D

OSPF neighbors must belong to the same area to form an adjacency.

Why this answer

OSPF requires that both routers in a neighbor relationship belong to the same area. If the area IDs differ, the routers will not exchange routing information and the adjacency will stall at the EXSTART or EXCHANGE state, never reaching FULL. This is a fundamental OSPF neighbor requirement defined in RFC 2328.

Exam trap

Cisco often tests the misconception that the OSPF process ID must match between neighbors, but it is only locally significant and does not affect adjacency formation.

Full explanation →

835

MCQhard

A data center engineer is implementing FCoE and must ensure lossless behavior for Fibre Channel traffic over Ethernet. Which Data Center Bridging (DCB) mechanism prevents frame loss by pausing traffic on a per-priority basis?

A.Data Center Bridging Exchange (DCBX)

B.Priority Flow Control (PFC)

C.FCoE Initialization Protocol (FIP)

D.Enhanced Transmission Selection (ETS)

AnswerB

PFC provides per-priority pause to enable lossless Ethernet.

Why this answer

Priority Flow Control (PFC) is a DCB mechanism that provides per-priority pause to prevent frame loss, ensuring lossless delivery for FCoE traffic.

Full explanation →

836

MCQhard

A company has two Cisco MDS 9700 switches in a dual-fabric SAN. Each fabric has its own set of storage arrays and hosts. The company wants to enable selective communication between specific devices in Fabric A and Fabric B without merging the fabrics. Which Cisco technology should be used?

A.FCIP

B.NPV

C.IVR

D.Port channels

AnswerC

IVR enables selective communication between devices in different VSANs while keeping fabrics separate.

Why this answer

Cisco IVR (Inter-VSAN Routing) allows selective communication between devices in different VSANs without merging the fabrics. In this dual-fabric SAN scenario, IVR enables specific hosts in Fabric A to communicate with specific storage arrays in Fabric B while keeping the VSANs and fabrics logically isolated, preserving fault domains and administrative boundaries.

Exam trap

Cisco often tests the distinction between technologies that merge fabrics (like FCIP or trunking) versus those that enable selective inter-fabric communication without merging (like IVR), and the trap here is confusing FCIP's WAN extension capability with IVR's selective routing within a local dual-fabric design.

How to eliminate wrong answers

Option A is wrong because FCIP (Fibre Channel over IP) is used to interconnect geographically separated SAN islands over an IP network, not to enable selective communication between devices in the same physical location without merging fabrics. Option B is wrong because NPV (N_Port Virtualization) is a mode used by edge switches to aggregate multiple N_Ports into a single uplink to a core switch, reducing domain IDs; it does not provide inter-fabric routing. Option D is wrong because port channels aggregate multiple physical links into a single logical link for increased bandwidth and redundancy within a single fabric, not for routing traffic between separate fabrics.

Full explanation →

837

MCQeasy

A UCS administrator needs to ensure that server boot order always starts from the local disk if available, and falls back to a SAN LUN if local disk fails. Which boot policy setting should be used?

A.Local Disk alone

B.SAN first, then Local Disk

C.SAN Boot Only

D.Local Disk first, then SAN

AnswerD

Matches the requirement.

Why this answer

The UCS boot policy allows you to specify a boot order where the local disk is attempted first. If the local disk is unavailable or fails, the system automatically falls back to the next boot device in the list, which is the SAN LUN. This ensures high availability and aligns with the requirement to prefer local boot while providing a failover path.

Exam trap

Cisco often tests the misconception that 'SAN first, then Local Disk' provides a fallback to local disk, but the trap is that the order is reversed, causing the server to always boot from SAN first, which does not satisfy the requirement to prefer local disk when available.

How to eliminate wrong answers

Option A is wrong because 'Local Disk alone' provides no fallback if the local disk fails, leaving the server unable to boot. Option B is wrong because 'SAN first, then Local Disk' reverses the required order, causing the server to always attempt SAN boot before local disk, which does not meet the requirement to start from local disk if available. Option C is wrong because 'SAN Boot Only' forces boot exclusively from the SAN LUN with no option to boot from local disk, even if the local disk is functional.

Full explanation →

838

MCQmedium

An engineer is designing a SAN extension over a WAN link using FCIP. The link has high latency (50 ms RTT). Which configuration is most critical to maintain performance?

A.Configure a large TCP window size.

B.Enable compression on the FCIP tunnel.

C.Increase the buffer-to-buffer credits.

D.Reduce the TCP MSS to 512 bytes.

AnswerA

Window scaling allows more data in flight, improving throughput over high-latency links.

Why this answer

FCIP encapsulates Fibre Channel frames over TCP/IP. High latency (50 ms RTT) means the TCP sender must wait longer for acknowledgments, which can stall the connection if the TCP window is too small. A large TCP window size (e.g., using window scaling per RFC 1323) allows more data to be in flight before requiring an ACK, thereby maintaining throughput and preventing performance collapse on high-latency WAN links.

Exam trap

Cisco often tests the misconception that buffer-to-buffer credits (BB_credits) are the primary flow control for FCIP, when in fact TCP window sizing is the critical parameter for high-latency WAN links.

How to eliminate wrong answers

Option B is wrong because compression reduces bandwidth usage but does not address the fundamental throughput limitation caused by high latency and small TCP windows; it may even add processing delay. Option C is wrong because buffer-to-buffer credits (BB_credits) are a Fibre Channel flow control mechanism used between directly connected FC ports, not over FCIP tunnels; they do not affect TCP windowing over WAN. Option D is wrong because reducing TCP MSS to 512 bytes increases header overhead and the number of segments, which can worsen performance on a high-latency link by requiring more ACKs per byte of data.

Full explanation →

839

Multi-Selecthard

Which THREE statements are true regarding YANG models in the context of data center automation? (Choose three.)

Select 3 answers

A.YANG is a data modeling language used to define configuration and state data.

B.YANG is a communication protocol like NETCONF.

C.RESTCONF supports both JSON and XML encoding.

D.NETCONF uses XML encoding for YANG-modeled data.

E.OpenConfig YANG models are Cisco-proprietary.

AnswersA, C, D

Correct. YANG models define data.

Why this answer

YANG models define data structures for network configuration and state. NETCONF uses XML-based encoding, while RESTCONF uses JSON or XML. OpenConfig provides vendor-neutral YANG models.

YANG is a data modeling language, not a protocol.

Full explanation →

840

MCQmedium

A storage administrator wants to implement Fibre Channel zoning to ensure that only specific initiators can access specific targets. The administrator prefers a method that does not require reconfiguration when a host's HBA is replaced with a new one with a different WWPN. Which zoning type meets this requirement?

A.Hard zoning by port

B.Soft zoning by port

C.Soft zoning by WWN

D.Hard zoning by WWN

AnswerB

Soft zoning by port uses the switch port number. If the same port is used for the new HBA, no reconfiguration is needed.

Why this answer

Soft zoning by port uses the physical port number, not the WWPN. If the HBA is replaced but the same port is used, the zoning remains valid. Hard zoning by WWN would require updating the zone if the WWPN changes.

Full explanation →

841

MCQeasy

In a Cisco ACI fabric, which component is responsible for managing the policy repository, fault monitoring, and API endpoints?

A.DCNM

B.APIC controller

C.Spine switch

D.Leaf switch

AnswerB

The APIC is the central controller for policy, monitoring, and API access.

Why this answer

The APIC (Application Policy Infrastructure Controller) is the centralized management and policy engine in Cisco ACI. It maintains the policy repository (the logical and physical policy model), aggregates faults and events from all fabric nodes, and exposes northbound REST API endpoints for automation and integration. Without the APIC, the fabric cannot enforce policies or provide a single point of management.

Exam trap

Cisco often tests the misconception that spine or leaf switches perform centralized management functions, when in fact they are pure forwarding elements with no policy repository or API endpoint capabilities.

How to eliminate wrong answers

Option A is wrong because DCNM (Data Center Network Manager) is a separate management platform for traditional NX-OS environments and does not serve as the policy repository or API endpoint for ACI fabrics; it is not the controller for ACI. Option C is wrong because a spine switch is a high-speed forwarding element that only handles inter-leaf traffic and does not host the policy repository, fault monitoring, or API endpoints. Option D is wrong because a leaf switch is a top-of-rack device that enforces policy at the edge but does not manage the centralized policy repository or expose northbound APIs.

Full explanation →

842

Drag & Dropmedium

Order the steps to configure FCoE on a Cisco Nexus switch with NPV mode.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

FCoE requires feature fcoe, VSAN mapping, VLAN config, NPV mode, and fabric login.

Full explanation →

843

MCQmedium

An engineer is configuring vPC on a pair of Nexus switches. Which statement correctly describes the vPC peer-keepalive link?

A.It is used to forward data traffic between vPC peers

B.It must be a dedicated Layer 2 link between vPC peers

C.It carries BPDUs to prevent loops

D.It is a Layer 3 link used to verify the health of the vPC peer

AnswerD

The peer-keepalive is a Layer 3 heartbeat used to detect peer failure.

Why this answer

The vPC peer-keepalive link is a Layer 3 link used exclusively to monitor the health of the vPC peer. It sends periodic keepalive messages (typically using UDP port 3200) to detect if the peer switch has failed, enabling the surviving switch to take over the vPC traffic. This link does not carry data traffic, BPDUs, or control-plane information beyond the keepalive probes.

Exam trap

The trap here is that candidates confuse the vPC peer-keepalive link with the vPC peer-link, assuming the keepalive link must be a dedicated Layer 2 trunk or that it carries data or BPDUs, when in fact it is a simple Layer 3 health-check path.

How to eliminate wrong answers

Option A is wrong because the vPC peer-keepalive link is not used to forward data traffic; data traffic between vPC peers is forwarded over the vPC peer-link (a Layer 2 trunk). Option B is wrong because the peer-keepalive link does not have to be a dedicated Layer 2 link; it is a Layer 3 link that can be routed over the management network or a separate Layer 3 interface, and it does not require dedicated hardware. Option C is wrong because BPDUs are carried on the vPC peer-link (Layer 2 trunk) to prevent loops, not on the peer-keepalive link, which is Layer 3 and does not participate in spanning-tree.

Full explanation →

844

MCQmedium

A network engineer needs to replace a failed UCS B-Series blade server with a new blade of the same model. The original blade had a custom service profile with specific vNIC and vHBA settings. What is the most efficient method to apply the same configuration to the new blade without manual reconfiguration?

A.Create a new service profile from scratch for the new blade.

B.Use Cisco IMC Supervisor to import the configuration from the failed blade.

C.Disassociate the existing service profile from the failed blade and associate it with the new blade.

D.Manually configure the new blade using UCS Manager GUI with the same settings as the original blade.

AnswerC

Correct. This applies all settings automatically.

Why this answer

UCS service profiles abstract hardware configuration. By disassociating the profile from the failed blade and associating it with the new blade, all settings (vNICs, vHBAs, policies) are automatically applied, supporting stateless computing.

Full explanation →

845

Matchingmedium

Match each Cisco data center automation tool to its primary use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Configuration management and orchestration

Scripting language for custom automation

Programmatic interface for device management

Infrastructure as code for server configuration

Declarative configuration management

Why these pairings

Automation tools streamline data center operations. UCS Manager handles server management, ACI automates network policy, Intersight offers cloud management, and Nexus Dashboard provides monitoring. The distractors swap these roles.

Full explanation →

846

Multi-Selecteasy

Which TWO are important considerations when using Cisco UCS Central for multi-domain management? (Select TWO.)

Select 2 answers

A.UCS Central requires separate licensing per managed server.

B.Global policies can be defined in UCS Central and applied per domain with local overrides.

C.All domains must have identical hardware and firmware versions.

D.UCS Central communicates with both Fabric Interconnects in each domain for redundancy.

E.Local UCS Manager policies are always overridden by UCS Central policies.

AnswersB, D

This is a key feature of UCS Central.

Why this answer

Cisco UCS Central allows administrators to define global policies that can be applied across multiple UCS domains, while still permitting local overrides at the UCS Manager level. This hierarchical policy model provides centralized control without sacrificing the flexibility needed for domain-specific configurations, such as unique VLANs or boot policies.

Exam trap

Cisco often tests the misconception that UCS Central enforces strict homogeneity across domains, but the correct understanding is that it supports heterogeneous environments with flexible policy inheritance and local overrides.

Full explanation →

847

MCQhard

A HyperFlex cluster uses replication factor 3 (RF3) and consists of 4 all-flash nodes. One node fails permanently. After replacing the node, the cluster re-replicates data. What is the minimum number of additional node failures that can be tolerated without data loss after re-replication completes?

A.2

B.1

C.0

D.3

AnswerA

With RF3, two simultaneous failures are tolerable without data loss.

Why this answer

With RF3 (three copies of data), the cluster can tolerate up to two simultaneous failures (quorum requires at least two copies). After replacing the failed node, the cluster returns to full health, so again can tolerate two failures. However, if the cluster originally had 4 nodes and one fails, only 3 remain; if another fails during re-replication, data could be at risk.

But after re-replication, 4 nodes exist, so two failures are tolerable.

Full explanation →

848

MCQmedium

Refer to the exhibit. An administrator notices the blade firmware is outdated. What is the recommended first step to update the blade firmware?

A.Upgrade the fabric interconnects first

B.Update each blade individually using the CIMC

C.Reboot all blades immediately

D.Create a firmware management policy to stage the update

AnswerD

Allows orchestrated update across all blades with minimal disruption.

Why this answer

Cisco UCS Manager uses firmware management policies to stage firmware updates across blades in a controlled, non-disruptive manner. Staging the update allows the administrator to schedule the activation during a maintenance window, ensuring all blades receive the same firmware version consistently without immediate impact on production traffic.

Exam trap

The trap here is that candidates often assume a direct, immediate action like rebooting or manual updates is required, but Cisco tests the understanding that UCS Manager provides a policy-based staging mechanism to safely orchestrate firmware updates across multiple blades.

How to eliminate wrong answers

Option A is wrong because upgrading fabric interconnects first is not the recommended first step for blade firmware; fabric interconnect firmware updates are independent and should be coordinated but not necessarily performed before blade updates. Option B is wrong because updating each blade individually using the CIMC is inefficient, error-prone, and bypasses the centralized management capabilities of UCS Manager, which can automate and validate the update process. Option C is wrong because rebooting all blades immediately without staging the firmware could cause unexpected downtime and service disruption, and it does not address the need to actually update the firmware.

Full explanation →

849

MCQeasy

Which of the following is a requirement for iSCSI storage connectivity to support jumbo frames?

A.Enable PFC on the switch

B.Configure MTU 9000 on all involved interfaces

C.Enable MPIO

D.Use CHAP authentication

AnswerB

Jumbo frames require MTU 9000 end-to-end.

Why this answer

Jumbo frames require an MTU of 9000 bytes on all interfaces in the path.

Full explanation →

850

Multi-Selecthard

Which THREE factors should be considered when sizing buffer credits for a long-haul FC link?

Select 3 answers

A.Link speed

B.Number of targets

C.Frame size

D.Distance

E.Buffer-to-buffer credit pool size

AnswersA, C, D

Higher speed requires more credits to keep the link busy.

Why this answer

Link speed (A) is a critical factor because higher speeds require more buffer credits to maintain full throughput over a given distance. The buffer credit requirement scales linearly with link speed, as each credit represents the ability to send one frame before receiving an acknowledgment. For example, a 16 Gbps link needs twice as many buffer credits as an 8 Gbps link for the same distance.

Exam trap

Cisco often tests the misconception that the number of targets or initiators influences buffer credit requirements, when in fact only distance, speed, and frame size matter for the per-link calculation.

Full explanation →

851

MCQmedium

A data center network uses MST with multiple instances. Different VLANs are mapped to different MST instances to utilize multiple spanning tree paths. Which MST parameter must be identical on all switches in the same region to ensure proper operation?

A.MST region name and revision number

B.Port path cost

C.Bridge priority

D.Max age timer

AnswerA

Correct: region name and revision must match for region consistency.

Why this answer

In MST, all switches within the same region must agree on the region name and revision number to form a consistent MST region. If these parameters differ, switches will treat each other as being in different regions, causing the MST instances to be recalculated as separate CST (Common Spanning Tree) regions, which can lead to suboptimal or broken load balancing across VLANs.

Exam trap

Cisco often tests the misconception that any consistent STP parameter (like bridge priority or timers) is sufficient for MST region formation, but the trap is that only the region name, revision number, and VLAN-to-instance mapping must match—other parameters like timers or priorities are per-instance or per-switch and do not affect region membership.

How to eliminate wrong answers

Option B is wrong because port path cost is a per-port parameter used to influence root port selection and path cost calculation within an MST instance, but it does not define or affect region membership. Option C is wrong because bridge priority is a per-switch parameter used for root bridge election within an MST instance, not for region identification. Option D is wrong because the max age timer is a global STP timer that controls how long a BPDU is considered valid, and while it must be consistent across a bridged network for loop-free operation, it is not a region-specific parameter and does not determine MST region boundaries.

Full explanation →

852

MCQmedium

Refer to the exhibit. An NX-API request returns this JSON error. What is the most likely cause?

A.The API version in the request is mismatched

B.Invalid credentials

C.The command is not allowed via NX-API

D.The switch is in maintenance mode

AnswerC

Some commands are restricted in NX-API. The error 'Invalid command' suggests a disallowed command.

Why this answer

The JSON error indicates that the NX-API request was rejected because the command is not permitted through the NX-API interface. NX-API enforces a strict allowlist of commands; any command not explicitly allowed (e.g., certain show commands or configuration commands that could destabilize the switch) will return this error. This is a security and stability feature of the NX-API RESTful interface.

Exam trap

Cisco often tests the misconception that any CLI command can be executed via NX-API, but in reality, NX-API has a restricted command set, and candidates may incorrectly attribute the error to credentials or API version mismatches.

How to eliminate wrong answers

Option A is wrong because an API version mismatch would typically return a different error, such as 'API version not supported' or a 400 Bad Request, not a generic JSON error about command permission. Option B is wrong because invalid credentials would result in an HTTP 401 Unauthorized response or an authentication failure message, not a command-level error. Option D is wrong because maintenance mode affects the switch's operational state and would generate a different error (e.g., 'switch is in maintenance mode'), not a command-specific rejection.

Full explanation →

853

MCQmedium

In a Cisco HyperFlex cluster, a new ESXi host is being added. The host is discovered, but the cluster health status shows 'Degraded'. What should be the first troubleshooting step?

A.Reboot the new ESXi host.

B.Verify that the new host's controller VM has the same firmware version as the cluster.

C.Check if the vCenter Server is in maintenance mode.

D.Delete and re-create the cluster.

AnswerB

Firmware consistency is critical for cluster stability.

Why this answer

When adding a new ESXi host to a Cisco HyperFlex cluster, the controller VM (CVM) firmware version must match the cluster's version. A mismatch causes the cluster health status to show 'Degraded' because the CVMs cannot properly synchronize storage operations. Verifying and aligning the firmware version is the first troubleshooting step, as it directly impacts cluster stability.

Exam trap

Cisco often tests the misconception that a 'Degraded' cluster health status is due to network or vCenter issues, when in fact it frequently stems from firmware or software version mismatches in the HyperFlex storage layer.

How to eliminate wrong answers

Option A is wrong because rebooting the new ESXi host will not resolve a firmware version mismatch; it only restarts services without addressing the root cause. Option C is wrong because vCenter Server maintenance mode affects vCenter operations, not HyperFlex cluster health; a host in maintenance mode would not cause a 'Degraded' status due to firmware mismatch. Option D is wrong because deleting and re-creating the cluster is an extreme, unnecessary step that would disrupt operations; the issue is isolated to the new host's CVM firmware, not the cluster configuration.

Full explanation →

854

Multi-Selecthard

Which THREE factors should be considered when calculating the required number of buffer credits for a long-distance Fibre Channel link? (Choose three.)

Select 3 answers

A.The link data rate (e.g., 16 Gbps).

B.The maximum frame size (e.g., 2148 bytes).

C.The number of VSANs configured.

D.The number of zones in the fabric.

E.The distance between the switches.

AnswersA, B, E

Higher data rates require more buffer credits to keep the link busy.

Why this answer

Buffer credits are calculated using the link data rate (affects how many bits can be transmitted per second), the maximum frame size (determines how many bytes are consumed per credit), and the distance between switches (affects propagation delay and round-trip time). Therefore, options A (data rate), B (frame size), and E (distance) are correct. VSAN count (C) and zone count (D) have no impact on buffer credit calculations.

Full explanation →

855

Multi-Selectmedium

A security engineer is deploying IP Source Guard on a Nexus switch. Which two components must be operational for IP Source Guard to function correctly?

Select 2 answers

A.Dynamic ARP Inspection

B.ACL

C.DHCP snooping

D.Cisco TrustSec

E.Port security

AnswersA, C

Dynamic ARP Inspection is required to validate ARP packets and ensure IP-MAC bindings are consistent with the DHCP snooping database.

Why this answer

IP Source Guard on Nexus switches relies on both DHCP snooping and Dynamic ARP Inspection. DHCP snooping builds the binding table that IP Source Guard uses to validate source IP addresses, while Dynamic ARP Inspection prevents ARP spoofing attacks and ensures IP integrity. Without both, IP Source Guard cannot function correctly.

Full explanation →

856

Multi-Selectmedium

A storage administrator reports that a host cannot reach any of the targets on a Cisco MDS 9000 Series switch. The VSAN configuration is correct, and all interfaces are up. Which two commands should be used to verify the Fibre Channel name server database and zoning configuration?

Select 2 answers

A.show zoneset active

B.show zone

C.show flogi database

D.show fcns database

E.show fcns details

AnswersA, D

Shows the active zoneset and its member devices, verifying zoning.

Why this answer

The 'show zoneset active' command displays the currently active zone set, which is essential for verifying which zones are enforced by the switch. Since the VSAN configuration is correct and interfaces are up, a missing or incorrect active zone set could prevent the host from reaching any targets, even if the name server database is populated.

Exam trap

Cisco often tests the distinction between 'show flogi database' (which shows fabric login state) and 'show fcns database' (which shows name server registrations), leading candidates to mistakenly choose 'show flogi database' when the question asks for name server verification.

Full explanation →

857

Multi-Selecthard

Which two benefits does EVPN provide compared to traditional VPLS? (Choose two.)

Select 2 answers

A.Simpler BGP configuration

B.Load balancing of traffic across multiple active paths

C.Reduced MAC address learning

D.No need for MPLS

E.Support for IP routing

AnswersB, E

EVPN allows active-active multihoming, improving bandwidth utilization.

Why this answer

EVPN uses BGP to advertise MAC addresses and IP prefixes, enabling per-flow load balancing across multiple equal-cost paths via its all-active multi-homing capability. In contrast, traditional VPLS relies on a single active forwarder per site (using Spanning Tree Protocol or VPLS Multihoming), which prevents active-active load balancing and wastes bandwidth.

Exam trap

Cisco often tests the misconception that EVPN simplifies BGP configuration or eliminates MPLS, when in fact EVPN requires more BGP knobs and still relies on an MPLS or VXLAN transport layer.

Full explanation →

858

Multi-Selecthard

An engineer is configuring a HyperFlex cluster with three nodes. Which three components are required for a functional cluster? (Choose three.)

Select 3 answers

A.A witness VM for quorum

B.VMware vSphere or other supported hypervisor

C.HyperFlex HX Data Platform software

D.Cisco UCS Manager for node management

E.At least three storage nodes (converged or compute+storage)

AnswersB, C, E

HyperFlex runs on a hypervisor; vSphere is the most common.

Why this answer

HyperFlex requires at least three storage nodes for RF2, a vSphere cluster, and the HX Data Platform. A witness is needed for clusters with even number of nodes or for RF3? Actually for 3 nodes, witness is optional if RF2? Standard deployment: 3 nodes form a cluster; the witness is optional for 3 nodes but often recommended. The question expects the core components: storage nodes, vSphere, and HXDP.

Witness is not mandatory for 3-node RF2 clusters.

Full explanation →

859

MCQmedium

An engineer is configuring a UCS service profile for PXE boot. The server must obtain an IP address from a DHCP server and then download the OS image from a TFTP server. Which boot policy parameters must be configured?

A.Configure the boot policy to use iSCSI boot.

B.Specify the DHCP server IP and TFTP server IP in the boot policy.

C.Select the SAN boot option and specify the WWPN.

D.Add a LAN boot entry and select the appropriate vNIC for PXE.

AnswerD

The LAN boot entry enables PXE boot on the specified vNIC.

Why this answer

PXE boot requires specifying the LAN boot option with the appropriate vNIC. In UCS, the boot policy can include a PXE boot entry that references a vNIC. DHCP and TFTP servers are configured externally; the boot policy just needs to enable PXE on the correct interface.

Full explanation →

860

MCQeasy

In Cisco TrustSec, what is used to tag traffic based on identity or group membership?

A.VLAN ID

B.Security Group Tag

C.MAC address

D.IP address

AnswerB

SGTs carry identity information.

Why this answer

Security Group Tags (SGTs) are used to classify traffic by identity.

Full explanation →

861

MCQeasy

A mid-size organization is upgrading its data center network to support server virtualization. They have deployed two Nexus 9300 switches as access switches for their server racks. The servers are configured with VLAN tagging and connect to the switches using trunks. The network administrator needs to ensure that the switches can provide default gateway services to the servers to reduce latency. They have configured interface VLAN interfaces and HSRP for redundancy. After implementation, the servers can communicate within the same VLAN but fail to reach the default gateway. The network administrator checks the switch configuration and finds that "ip routing" is not enabled globally. What is the most likely impact of this missing configuration?

A.The switches will not forward traffic between VLANs.

B.The servers will not receive DHCP addresses.

C.HSRP will not elect an active router.

D.The VLAN interfaces will not come up.

AnswerA

ip routing is required for inter-VLAN forwarding.

Why this answer

Without the 'ip routing' command enabled globally, the Nexus 9300 switches operate as Layer 2 devices only. This means they can forward frames within the same VLAN (since that relies on MAC address learning and switching), but they cannot perform IP routing between VLANs or route traffic to the configured SVI (VLAN interface) default gateway. The servers can communicate within the same VLAN because that is purely Layer 2 switching, but any attempt to reach the default gateway (which requires Layer 3 forwarding) fails because the switch does not have IP routing enabled.

Exam trap

Cisco often tests the misconception that HSRP or SVI functionality requires global IP routing to be enabled, when in fact HSRP can operate and SVIs can come up without 'ip routing', but inter-VLAN routing and default gateway reachability will fail.

How to eliminate wrong answers

Option B is wrong because DHCP address assignment relies on DHCP snooping, IP helper-address, or a DHCP server; the absence of 'ip routing' does not prevent a switch from relaying DHCP requests or a server from obtaining an IP address via broadcast within the same VLAN. Option C is wrong because HSRP operates at Layer 3 using the SVI IP address and does not require global IP routing to be enabled; HSRP can still elect an active router and maintain virtual IP/MAC addresses as long as the SVI is up and the HSRP configuration is correct. Option D is wrong because VLAN interfaces (SVIs) come up as long as the VLAN exists and at least one port in that VLAN is up; the 'ip routing' command does not affect the operational state of an SVI.

Full explanation →

862

MCQhard

In a Fibre Channel over Ethernet (FCoE) deployment, which Data Center Bridging (DCB) feature is responsible for preventing frame loss due to congestion and ensuring the lossless behavior required for FCoE traffic?

A.Priority Flow Control (PFC)

B.Data Center Bridging Exchange (DCBX)

C.Enhanced Transmission Selection (ETS)

D.Jumbo frames

AnswerA

PFC provides per-priority pause to ensure lossless delivery for FCoE traffic.

Why this answer

Priority Flow Control (PFC) is a per-priority pause mechanism that creates lossless links for specific traffic classes such as FCoE.

Full explanation →

863

MCQeasy

What is a key advantage of using structured data (e.g., JSON or XML) from Cisco NX-API responses compared to traditional CLI scraping (e.g., using regular expressions)?

A.It automatically commits changes to running-config.

B.It provides machine-readable output that is less prone to parsing errors due to display changes.

C.It requires no software libraries to parse.

D.It eliminates the need for any authentication.

AnswerB

Structured data is consistent across versions, while CLI output can change with cosmetic updates.

Why this answer

Cisco NX-API returns structured data formats like JSON or XML, which are inherently machine-readable and consistent regardless of CLI display changes or software version updates. This eliminates the fragility of traditional CLI scraping with regular expressions, where output formatting changes (e.g., column widths, spacing, or label text) can break parsing logic. Structured data ensures reliable, predictable automation workflows.

Exam trap

Cisco often tests the misconception that structured data eliminates the need for parsing libraries or authentication, but the key advantage is purely about reliability and consistency of machine-readable output versus fragile CLI scraping.

How to eliminate wrong answers

Option A is wrong because NX-API responses do not automatically commit changes; configuration changes require explicit API calls (e.g., using the 'configure' or 'cli' method) and a separate commit action if in candidate mode. Option C is wrong because parsing JSON or XML typically requires software libraries (e.g., Python's json or xml.etree.ElementTree) to deserialize the data into usable objects. Option D is wrong because NX-API still requires authentication (e.g., HTTP basic, cookie-based, or token-based) to access the API endpoint.

Full explanation →

864

MCQmedium

A Nexus 9000 switch is configured with VPC. The VPC keepalive link fails. What is the effect on the VPC domain?

A.Both switches suspend the VPC VLANs.

B.Both switches continue to forward traffic normally.

C.The secondary switch suspends its VPC member ports.

D.The primary switch becomes orphan.

AnswerC

To avoid split-brain, the secondary switch suspends its VPC member ports while keepalive is down.

Why this answer

In a VPC domain, the keepalive link is used to monitor the liveness of the peer switch, but it does not carry data traffic. When the keepalive link fails, the secondary switch cannot confirm the primary is alive, so it suspends its VPC member ports to prevent a dual-active scenario. The primary switch remains active and continues forwarding traffic normally because it assumes the secondary has failed.

Exam trap

Cisco often tests the misconception that a keepalive link failure causes both switches to stop forwarding or that the primary becomes orphan, but the correct behavior is that only the secondary suspends its VPC member ports to maintain a single active forwarding path.

How to eliminate wrong answers

Option A is wrong because both switches do not suspend VPC VLANs; only the secondary suspends its VPC member ports to avoid a split-brain condition. Option B is wrong because both switches do not continue forwarding traffic normally; the secondary suspends its VPC ports, disrupting traffic on that side. Option D is wrong because the primary switch does not become orphan; it remains active and continues to forward traffic, while the secondary suspends its ports.

Full explanation →

865

MCQmedium

A storage administrator needs to monitor traffic between two specific storage arrays without causing any disruption. Which approach should be used?

A.Configure a SPAN session on the MDS switch to copy traffic between the storage ports.

B.Use FC traceroute to identify the path.

C.Enable FC ping between arrays.

D.Use IVR to route traffic through a monitoring zone.

E.Configure port channel between arrays.

AnswerA

SPAN (Switched Port Analyzer) copies traffic to a monitor port for analysis without disruption.

Why this answer

A SPAN (Switched Port Analyzer) session on an MDS switch copies traffic from source ports to a destination port without affecting the original traffic flow. This allows the administrator to monitor the traffic between the two storage arrays non-disruptively, as SPAN does not introduce latency or packet loss on the monitored ports.

Exam trap

Cisco often tests the distinction between diagnostic tools (FC ping, traceroute) and monitoring tools (SPAN), leading candidates to confuse connectivity verification with traffic capture.

How to eliminate wrong answers

Option B is wrong because FC traceroute is a diagnostic tool used to discover the Layer 2 path between Fibre Channel endpoints, not a method for continuous traffic monitoring. Option C is wrong because FC ping is a connectivity test that sends probe frames, not a monitoring solution, and it generates its own traffic rather than capturing existing traffic. Option D is wrong because IVR (Inter-VSAN Routing) is used to route traffic between different VSANs, not to copy or monitor traffic; creating a monitoring zone would not provide a copy of the traffic.

Option E is wrong because configuring a port channel between arrays aggregates bandwidth and provides redundancy, but it does not provide any traffic monitoring or copying capability.

Full explanation →

866

MCQeasy

Which Fibre Channel frame field is used to identify the upper-layer protocol being carried?

A.Source FC ID

B.D_ID

C.CS_CTL

D.R_CTL

AnswerD

Routing Control field specifies the frame category and protocol.

Why this answer

The R_CTL (Routing Control) field in the Fibre Channel frame header is used to identify the upper-layer protocol being carried, such as SCSI-FCP, IP, or VI. It contains the routing bits and information category that specify the frame type and protocol context, enabling the receiver to interpret the payload correctly.

Exam trap

Cisco often tests the R_CTL field by confusing candidates with the D_ID field, as many assume the destination address determines the protocol, but R_CTL is the explicit field for upper-layer protocol identification.

How to eliminate wrong answers

Option A is wrong because the Source FC ID (S_ID) identifies the source Fibre Channel node or port, not the upper-layer protocol. Option B is wrong because the D_ID (Destination ID) specifies the destination Fibre Channel address, not the protocol type. Option C is wrong because CS_CTL (Class Specific Control) is used for flow control and class-specific operations (e.g., Class 1 or Class 2 acknowledgments), not for protocol identification.

Full explanation →

867

MCQmedium

A storage administrator needs to ensure that a Fibre Channel zone configuration is operationally effective without disrupting the current active zone set. Which approach should be used?

A.Create the new zone configuration in the defined configuration, then activate it as a new zone set.

B.Delete the active zone set and create a new one.

C.Edit the active zone set directly.

D.Use the 'commit' command to update the zone set.

AnswerA

Standard best practice.

Why this answer

In Cisco MDS Fibre Channel SANs, zone configurations are created in the defined configuration and then activated as a new zone set. This approach ensures that the current active zone set remains operational and unaffected during the configuration process, preventing any disruption to existing traffic. Only when the new zone set is explicitly activated does it replace the active set, allowing for a controlled cutover.

Exam trap

Cisco often tests the misconception that you can directly edit the active zone set, similar to how you might edit a running configuration on a router, but in Fibre Channel zoning, the active set is immutable and must be replaced via activation.

How to eliminate wrong answers

Option B is wrong because deleting the active zone set would immediately disrupt all Fibre Channel zoning, causing all devices to lose connectivity and potentially causing a SAN outage. Option C is wrong because editing the active zone set directly is not supported in Cisco MDS; the active zone set is a read-only copy of the last activated configuration, and any changes must be made to the defined configuration. Option D is wrong because the 'commit' command is used in Cisco NX-OS to apply pending configuration changes in other contexts (e.g., interface or VLAN configurations), but it is not a valid command for updating Fibre Channel zone sets; zone set activation is performed using the 'activate' command.

Full explanation →

868

Multi-Selecteasy

Which TWO of the following are valid methods to enforce security on a Cisco Nexus switch? (Choose two.)

Select 2 answers

A.SSHv2

B.NetFlow

C.Control Plane Policing (CoPP)

D.FabricPath

E.Private VLANs

AnswersC, E

CoPP protects the control plane by rate-limiting traffic.

Why this answer

Control Plane Policing (CoPP) is a valid security enforcement method on Cisco Nexus switches because it protects the control plane from excessive or malicious traffic by applying QoS policies that rate-limit packets destined for the supervisor module. By filtering traffic such as routing protocols, SSH, or ICMP, CoPP prevents CPU overload and DoS attacks, directly enforcing security at the control plane level.

Exam trap

Cisco often tests the distinction between security enforcement mechanisms (like CoPP and Private VLANs) and management protocols (like SSH) or monitoring tools (like NetFlow), leading candidates to mistakenly select SSHv2 as a security enforcement method.

Full explanation →

869

MCQeasy

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets for transport over the IP network?

A.VTEP

B.VXLAN Gateway

C.VXLAN Tunnel

D.VNI

AnswerA

VTEP is the tunnel endpoint that does encapsulation.

Why this answer

The VXLAN Tunnel Endpoint (VTEP) is the component responsible for performing encapsulation and decapsulation of Ethernet frames into UDP packets for transport over the IP network. It sits at the edge of the VXLAN overlay and maps tenant traffic to VXLAN segments by adding a VXLAN header (including the VNI) and an outer UDP/IP header. This process allows Layer 2 frames to traverse a Layer 3 underlay network.

Exam trap

Cisco often tests the distinction between the VTEP (the endpoint that performs encapsulation) and the VXLAN Tunnel (the logical path), causing candidates to mistakenly select 'VXLAN Tunnel' because they associate tunnels with encapsulation.

How to eliminate wrong answers

Option B (VXLAN Gateway) is wrong because a VXLAN Gateway is used to interconnect a VXLAN overlay with a traditional VLAN or another overlay, not to perform the primary encapsulation/decapsulation of frames into UDP packets. Option C (VXLAN Tunnel) is wrong because a VXLAN Tunnel is the logical path between two VTEPs, not a component that performs encapsulation; it is the result of the VTEPs creating the tunnel. Option D (VNI) is wrong because the VXLAN Network Identifier (VNI) is a 24-bit segment identifier in the VXLAN header that distinguishes tenant traffic, but it does not perform encapsulation or decapsulation.

Full explanation →

870

MCQmedium

An engineer is configuring AAA on a Cisco Nexus switch to authenticate management access via TACACS+. The switch is reachable, but login attempts repeatedly fail. Which action should the engineer take to isolate the issue?

A.Enable 'debug tacacs' on the switch to see detailed TACACS+ exchange.

B.Run 'test aaa authentication login <user> <password> legacy' to validate AAA configuration.

C.Verify IP connectivity to the TACACS+ server using ping.

D.Check if the TACACS+ server port (49) is open using Telnet.

AnswerB

This command directly tests the AAA authentication process.

Why this answer

The 'test aaa authentication login' command with the 'legacy' keyword directly validates the AAA authentication configuration against the TACACS+ server without requiring a full login session. This isolates whether the issue is with the AAA configuration itself versus network connectivity or server reachability, as the command simulates the exact authentication flow the switch uses.

Exam trap

Cisco often tests the distinction between connectivity verification (ping, port checks) and actual AAA authentication validation, trapping candidates who assume that reachability implies correct AAA operation, when in fact the shared secret, server configuration, or authentication method may be misconfigured.

How to eliminate wrong answers

Option A is wrong because enabling 'debug tacacs' generates verbose output that can overwhelm the console and impact performance, and it is a reactive troubleshooting step that should be used after confirming basic configuration and connectivity, not as the first isolation action. Option C is wrong because while IP connectivity is necessary, the switch is already reachable per the scenario, and ping only tests ICMP reachability, not whether the TACACS+ service is properly responding to authentication requests. Option D is wrong because using Telnet to test port 49 is not a valid method; Telnet uses TCP port 23, and testing a TACACS+ server port requires a TACACS+ client or a tool like 'telnet <server> 49' to check if the port is open, but this only verifies TCP connectivity, not the AAA authentication logic or shared secret correctness.

Full explanation →

871

MCQmedium

A company is deploying a new Cisco UCS Mini. They need to ensure that the chassis can be managed from either fabric interconnect. What configuration is required to achieve this?

A.Configure a private VLAN to isolate management traffic

B.Set the chassis to in-band management mode

C.Enable FC-Zoning on the fabric interconnects

D.Configure a management VLAN on both fabric interconnects and enable chassis management on that VLAN

AnswerD

This allows the chassis to be reachable from both FIs for management purposes.

Why this answer

Cisco UCS Mini requires a dedicated management VLAN to be configured on both fabric interconnects, and chassis management must be enabled on that VLAN. This allows the chassis management controller (CMC) to be reachable from either FI, enabling active/standby management redundancy without relying on a single point of control.

Exam trap

The trap here is that candidates often confuse in-band management (Option B) with the required out-of-band management VLAN configuration, mistakenly thinking that using the data path is sufficient for redundant chassis management.

How to eliminate wrong answers

Option A is wrong because private VLANs are used to isolate traffic within a VLAN (e.g., for multi-tenant environments) and are not required for chassis management redundancy in UCS Mini. Option B is wrong because in-band management mode is used for managing the chassis through the data path (e.g., via a server's vNIC), not for enabling management from either fabric interconnect; the correct approach is out-of-band management via a dedicated management VLAN. Option C is wrong because FC-Zoning is a Fibre Channel storage networking concept used to control access in a SAN fabric and has no role in enabling chassis management from either FI.

Full explanation →

872

MCQmedium

A UCS administrator needs to perform a firmware upgrade on a UCS B-Series blade server. Which management interface should be used to perform the upgrade remotely?

A.HyperFlex Connect

B.Cisco IMC Supervisor

C.UCS Manager

D.CIMC of the blade server

AnswerC

Correct. UCS Manager manages firmware for all components.

Why this answer

UCS Manager provides centralized firmware management for all blades and FIs. The administrator can initiate firmware updates through UCS Manager GUI or CLI, which handles the upgrade process across the domain.

Full explanation →

873

MCQmedium

A data center team is configuring a Cisco MDS switch to support multiple isolated SAN environments on the same physical infrastructure. They need to create separate fabrics that are completely isolated at Layer 2. Which technology should be used?

A.NPV

B.VSANs

C.Zoning

D.PortChannels

AnswerB

VSANs create separate logical SANs, providing complete isolation.

Why this answer

VSANs provide isolation similar to VLANs in Ethernet, allowing multiple virtual Fibre Channel fabrics on the same physical switch.

Full explanation →

874

MCQmedium

A data center administrator is implementing Cisco TrustSec on a Nexus 7000 switch to enforce role-based access control. After configuring a security group tag (SGT) classification policy, users report that traffic between two servers is not being tagged. What is the most likely cause?

A.DHCP snooping is not enabled on the VLAN.

B.The ingress interface is missing the 'sgt' or 'ip policy' command to classify traffic.

C.The switch ASIC does not support TrustSec in hardware.

D.The SGT is assigned on the egress interface instead of ingress.

AnswerB

Ingress interface must have 'sgt' or 'ip policy' to assign SGTs.

Why this answer

Cisco TrustSec requires the ingress interface to be explicitly configured with either the 'sgt' command (for static SGT assignment) or an 'ip policy' command (for dynamic SGT classification via a security group ACL). Without this, the switch cannot classify traffic and apply the SGT tag. The scenario describes a classification policy that is not being applied, which directly points to a missing ingress classification command.

Exam trap

The trap here is that candidates often assume SGT classification is automatic once a policy is defined, but Cisco explicitly tests that the ingress interface must have the 'sgt' or 'ip policy' command to trigger classification.

How to eliminate wrong answers

Option A is wrong because DHCP snooping is unrelated to SGT classification; it is a security feature to prevent rogue DHCP servers and does not affect SGT tagging. Option C is wrong because the Nexus 7000 series switches (with the appropriate line cards, e.g., F2e, M3) support TrustSec in hardware; the question does not indicate a hardware limitation, and the issue is configuration-based. Option D is wrong because SGTs are assigned on the ingress interface, not egress; egress interfaces enforce policies based on the SGT but do not assign the tag.

Full explanation →

875

MCQmedium

In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?

A.CoPP

B.IP Source Guard

C.SED encryption

D.RBAC in UCS Manager

AnswerD

RBAC in UCS Manager defines roles and privileges for users.

Why this answer

UCS Manager role-based access control (RBAC) allows granular assignment of privileges to users.

Full explanation →

876

MCQmedium

A VACL is configured to capture traffic between hosts in the same VLAN. The capture port is configured and the VACL is applied to the VLAN. However, no traffic is being captured. What is a likely reason?

A.The VACL is applied in the wrong direction

B.The capture port is a SPAN destination port

C.The VACL does not have a capture action

D.The capture port is not in the same VLAN

AnswerC

Without the capture action, the VACL will not copy packets to the capture port.

Why this answer

A VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.

Exam trap

The trap here is that candidates often assume a VACL applied to a VLAN will automatically send all matched traffic to a capture port, overlooking the explicit `capture` action required in the VACL configuration.

How to eliminate wrong answers

Option A is wrong because VACLs are applied to VLANs, not to interfaces, and they operate on traffic within the VLAN regardless of direction; direction-based ACLs are for router ACLs, not VACLs. Option B is wrong because a SPAN destination port cannot be used as a capture port for VACL capture; VACL capture requires a dedicated capture port configured with the `switchport capture` command, and SPAN and VACL capture are mutually exclusive on the same port. Option D is wrong because the capture port does not need to be in the same VLAN as the traffic being captured; VACL capture replicates traffic to the capture port regardless of its VLAN membership, as long as the capture port is configured correctly.

Full explanation →

877

MCQhard

An engineer is configuring a UCS service profile for a blade server that will boot from SAN. The storage is connected via FC SAN. Which policy must be included in the service profile to define the WWPNs for the HBAs?

A.Network control policy

B.Boot policy

C.SAN connectivity policy

D.vNIC placement policy

AnswerC

SAN connectivity policy specifies the vHBA configuration, including WWPN assignment.

Why this answer

To boot from SAN, the service profile must include a SAN connectivity policy that defines the WWPNs (World Wide Port Names) for the vHBAs. This policy assigns WWPNs from a pool or statically.

Full explanation →

878

MCQhard

A UCS domain is experiencing intermittent storage connectivity. The storage admin confirms the SAN is properly zoned and the VSANs are configured. The UCS admin finds that the host interface (HBAs) are showing 'Link Down' intermittently. Which of the following is a likely cause?

A.Incompatible HBA firmware

B.Mismatched fabric failover policy

C.Incorrect Fibre Channel interface mode on the FI

D.Faulty SFP or cable

AnswerD

Physical layer issues often cause intermittent link flapping.

Why this answer

Intermittent 'Link Down' on HBAs, despite correct SAN zoning and VSAN configuration, strongly points to a physical-layer issue. Faulty SFPs or damaged cables cause intermittent link flaps, which manifest as sporadic HBA link-down events. This is the most common cause of such symptoms in UCS environments.

Exam trap

Cisco often tests the distinction between physical-layer issues (SFP/cable) and configuration or policy errors, tempting candidates to overthink with fabric failover or interface mode when the symptom is a simple link flap.

How to eliminate wrong answers

Option A is wrong because incompatible HBA firmware typically causes persistent driver errors or failure to log in to the fabric, not intermittent link flaps. Option B is wrong because mismatched fabric failover policy affects how traffic is redirected during a failure, not the physical link state of the HBA. Option C is wrong because incorrect Fibre Channel interface mode on the FI (e.g., End Host vs.

Switching mode) impacts upstream FLOGI behavior and zoning, not the point-to-point link status between the HBA and the FI.

Full explanation →

879

MCQmedium

An engineer is configuring zoning on a Cisco MDS switch. The requirement is to allow a single host HBA to access two storage array ports. Which zone configuration meets this requirement?

A.Create a zone with the host's port ID and both storage port IDs.

B.Create one zone with all three WWPNs.

C.Create one zone with the host's WWPN and one storage port WWPN, and another zone with the host's WWPN and the second storage port WWPN.

D.Create a zone with the host's WWPN and both storage ports as a single zone.

AnswerC

Creating two zones with the host's WWPN and each storage port WWPN separately follows the single-initiator zoning best practice. This is correct.

Why this answer

The recommended practice for Fibre Channel zoning is to use single-initiator zones, where each zone contains one host WWPN and one storage port WWPN. To allow a single host HBA to access two storage array ports, two zones should be created: the first zone includes the host's WWPN and the first storage port's WWPN, and the second zone includes the same host's WWPN and the second storage port's WWPN. This prevents direct communication between storage ports (which could cause issues) and follows Cisco best practices for MDS zoning.

Option C correctly implements this configuration. Options A and B use port IDs or a single zone with multiple targets, which are less secure and not recommended. Option D creates a single zone with all three WWPNs, which allows the storage ports to communicate with each other, potentially leading to errors or instability.

Exam trap

A common mistake is to think that using port IDs (Option A) is acceptable because they are dynamic and can change after a link reset, leading to unintended access. Also, avoiding a single zone with all three WWPNs (Option D) prevents storage ports from communicating directly, which could cause LUN masking issues or instability.

Full explanation →

880

Multi-Selecthard

In a vPC environment, which two conditions must be identical on both vPC peer switches to ensure proper consistency? (Choose two.)

Select 2 answers

A.VLAN configuration on the member ports

B.System priority

C.Port channel mode (active/passive)

D.STP port type (edge, network, normal)

E.Peer-keepalive IP address

AnswersA, D

Allowed VLANs must match.

Why this answer

In a vPC environment, the VLAN configuration on member ports must be identical on both peer switches to ensure that traffic is forwarded consistently across the vPC. If VLANs are pruned or allowed differently on the member ports, the vPC can become inconsistent, leading to traffic drops or loops. This is a key consistency check enforced by Cisco NX-OS to maintain a stable vPC domain.

Exam trap

Cisco often tests the misconception that all vPC parameters must match, but only specific ones (like VLAN configuration and STP port type) are required to be identical for consistency, while others like system priority or peer-keepalive IP are intentionally different.

Full explanation →

881

MCQmedium

A network administrator needs to configure iSCSI multipath I/O (MPIO) for a host connecting to a storage array. Which requirement must be met to ensure that MPIO functions correctly with load balancing?

A.The iSCSI initiator must use CHAP authentication

B.Jumbo frames must be enabled on all switches

C.The host must have multiple network interfaces on different subnets

D.The storage array must support synchronous replication

AnswerC

Multiple distinct network paths are required for MPIO to provide redundancy and load balancing.

Why this answer

MPIO requires multiple paths between the initiator and target. Each path must be on a separate network interface and subnet to provide redundancy and load balancing.

Full explanation →

882

MCQeasy

A network engineer is troubleshooting VXLAN connectivity between two VTEPs. The source VTEP is configured with `nve1` and member VNI 10000. The `show nve peers` command shows the remote VTEP IP but the status is 'Init'. What is a likely cause?

A.The multicast group is not reachable.

B.The remote VTEP is not configured with the same VNI.

C.The MTU is too low.

D.The VRF is mismatched between the VTEPs.

AnswerA

VXLAN relies on multicast for BUM traffic; if the multicast group is unreachable, the peer remains in 'Init'.

Why this answer

The 'Init' status in the output of 'show nve peers' indicates that the VXLAN tunnel endpoint (VTEP) has learned the remote VTEP IP address (likely via BGP EVPN or static configuration) but is unable to complete the tunnel establishment. In VXLAN multicast mode, the underlay multicast group is used for BUM traffic and for VTEP discovery. If the multicast group is not reachable (e.g., due to missing PIM configuration, incorrect RP, or firewall filtering), the source VTEP cannot receive the multicast join or data from the remote VTEP, leaving the peer stuck in 'Init' state.

Exam trap

Cisco often tests the distinction between control-plane and data-plane issues; the trap here is that candidates assume 'Init' means a configuration mismatch (like VNI or VRF) rather than an underlay multicast reachability problem, because they overlook that VXLAN multicast mode requires a functional underlay multicast tree for peer establishment.

How to eliminate wrong answers

Option B is wrong because a VNI mismatch would typically cause the remote VTEP to not advertise that VNI in BGP EVPN, resulting in the peer not being learned at all, or the VNI not being operational, but the peer status would not show 'Init' for a learned peer. Option C is wrong because an MTU issue would cause packet fragmentation or drops after the tunnel is established, not prevent the peer from leaving the 'Init' state; the 'Init' state is a control-plane issue, not a data-plane MTU problem. Option D is wrong because a VRF mismatch would affect traffic forwarding and route import/export in BGP EVPN, but the peer status is independent of VRF configuration; the VTEP peer can still be established even with mismatched VRFs, though traffic may not be forwarded correctly.

Full explanation →

883

MCQhard

A UCS domain has two fabric interconnects in end-host mode. The engineer needs to implement a policy that ensures all traffic from a specific vNIC is load-balanced across both uplinks to the upstream switches. Which type of policy should be used?

A.Link aggregation policy

B.Pin group policy

C.QoS policy

D.Network control policy

AnswerB

Allows pinning a vNIC to specific uplinks or 'no-pin' for load balancing across all.

Why this answer

In a UCS domain with fabric interconnects in end-host mode, a Pin Group policy is used to explicitly map a vNIC's traffic to specific uplink ports, ensuring load balancing across the upstream switches. This policy overrides the default MAC-based hashing and allows the engineer to control traffic distribution, which is critical for consistent performance and redundancy.

Exam trap

Cisco often tests the distinction between Pin Group policies (which control per-vNIC traffic distribution) and Link Aggregation policies (which bundle ports), leading candidates to mistakenly choose the latter when the question emphasizes load balancing across individual uplinks rather than aggregated bandwidth.

How to eliminate wrong answers

Option A is wrong because a Link Aggregation policy (LACP) bundles multiple uplinks into a single logical link for increased bandwidth and redundancy, but it does not control per-vNIC traffic distribution across individual uplinks; it operates at the port-channel level. Option C is wrong because a QoS policy manages traffic prioritization and bandwidth allocation, not load balancing or path selection for a specific vNIC. Option D is wrong because a Network Control policy defines Layer 2 features like STP or LLDP, but it does not influence how vNIC traffic is pinned or load-balanced across uplinks.

Full explanation →

884

MCQhard

An administrator is deploying a new application in a Cisco ACI fabric. The application requires multicast traffic between end hosts. Which configuration is necessary for multicast in ACI?

A.Enable PIM on the leaf switches.

B.Configure a multicast group in the EPG.

C.Create a multicast policy in the bridge domain.

D.Use IGMP snooping only.

AnswerC

A multicast policy in the bridge domain enables multicast forwarding.

Why this answer

In Cisco ACI, multicast forwarding is enabled at the bridge domain level using a multicast policy. This policy configures the necessary IGMP snooping and multicast group membership for the fabric, allowing end hosts to receive multicast traffic without requiring PIM on the leaf switches. Option C is correct because the bridge domain multicast policy is the required configuration for multicast in ACI.

Exam trap

Cisco often tests the misconception that PIM must be enabled for multicast in ACI, but the fabric's overlay uses head-end replication and IGMP snooping at the bridge domain level instead.

How to eliminate wrong answers

Option A is wrong because PIM is not required in ACI; the fabric uses a head-end replication model with IGMP snooping and a multicast policy, not traditional PIM routing. Option B is wrong because multicast groups are not configured in the EPG; the EPG defines endpoint groups and contracts, while multicast group membership is managed via the bridge domain multicast policy. Option D is wrong because IGMP snooping alone is insufficient; ACI requires the multicast policy in the bridge domain to enable the fabric's multicast forwarding behavior, including head-end replication.

Full explanation →

885

MCQhard

In an ACI fabric, a contract between two EPGs uses a filter that permits TCP port 443. The provider EPG is configured with a VMM domain integration. Which statement about the contract's effect is true?

A.Both directions are allowed for TCP 443.

B.Traffic from the provider EPG to the consumer EPG on TCP 443 is allowed.

C.Traffic from the consumer EPG to the provider EPG on TCP 443 is allowed.

D.The VMM domain overrides the contract and permits all traffic.

AnswerC

This is correct. The contract with a filter for TCP 443 permits traffic from the consumer EPG to the provider EPG.

Why this answer

In Cisco ACI, contracts define unidirectional communication from the consumer EPG to the provider EPG. The filter permitting TCP port 443 allows traffic from the consumer to the provider. The VMM domain integration does not alter this contract behavior; it only manages virtual machine connectivity.

Therefore, only traffic from the consumer EPG to the provider EPG on TCP 443 is permitted.

Exam trap

Cisco often tests the misconception that contracts allow traffic from provider to consumer, leading candidates to incorrectly select option B, when in fact ACI contracts are unidirectional from consumer to provider unless a reverse filter is explicitly configured.

How to eliminate wrong answers

Option A is wrong because ACI contracts are unidirectional by default; a filter permitting TCP 443 only allows traffic in the direction from provider to consumer, not both directions, unless a separate reverse filter is configured. Option C is wrong because the consumer EPG cannot initiate TCP 443 traffic to the provider EPG under this contract; the provider is the source of allowed traffic. Option D is wrong because a VMM domain integration does not override contract rules; it integrates with hypervisors for policy enforcement but still respects the contract's directionality and filters.

Full explanation →

886

MCQmedium

A company recently deployed Cisco UCS B-Series blades with a single Fabric Interconnect. During a maintenance window, the Fabric Interconnect must be upgraded. Which action ensures minimal disruption to running workloads?

A.Disassociate service profiles from blades, upgrade the Fabric Interconnect, then re-associate the service profiles.

B.Use the UCS Manager GUI to migrate all service profiles to a second Fabric Interconnect.

C.Shut down all blades gracefully, upgrade the Fabric Interconnect, then power on blades.

D.Change the boot order of blades to boot from NFS image, then upgrade FI.

AnswerC

Gracefully shutting down the blades ensures workloads are safely stopped. After the FI upgrade, powering on the blades restores service. This is the correct procedure for a single FI.

Why this answer

In a single Fabric Interconnect domain, there is no redundancy. Disassociating service profiles while blades are running causes loss of management connectivity and potential network disruption. The only way to perform the upgrade without risking data corruption is to schedule a maintenance window: gracefully shut down all blades, upgrade the Fabric Interconnect, then power on the blades.

This ensures workloads are safely stopped and restarted after the upgrade.

Exam trap

A common trap is to assume that disassociating service profiles allows a non-disruptive upgrade. In reality, for a single FI, this causes loss of connectivity and service disruption. The correct procedure requires a maintenance window with blade shutdown.

How to eliminate wrong answers

Option B is wrong because migrating service profiles to a second Fabric Interconnect requires a second Fabric Interconnect to be present, but the scenario specifies a single Fabric Interconnect, making this option technically impossible. Option C is wrong because shutting down all blades gracefully causes a complete outage for all running workloads, which is not minimal disruption. Option D is wrong because changing the boot order to boot from an NFS image does not address the Fabric Interconnect upgrade; the blades still rely on the Fabric Interconnect for network connectivity, and the upgrade would disrupt that connectivity.

Full explanation →

887

MCQmedium

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

A.Filter with action deny

B.Taboo contract

C.QoS policy

D.VRF with route leaking

AnswerB

Taboo contracts enforce a deny-all policy between EPGs.

Why this answer

Taboo contracts are used to explicitly deny traffic between EPGs.

Full explanation →

888

MCQhard

A large enterprise data center is deploying a new application using Cisco ACI with a multi-pod design. The application requires low-latency communication between servers in different pods. The network team has configured the ACI fabric with two pods, each connected via inter-pod network (IPN) switches. After deployment, the application experiences intermittent latency spikes and packet loss. The APIC health scores remain high but the latency issue persists. The team has verified the underlay IP connectivity and MTU settings. What is the most likely cause of the latency issues?

A.The application servers are using different VLANs that are not stretched between pods.

B.The CoS settings for the application traffic are not properly mapped to the appropriate queue on the IPN switches.

C.The IPN switches are using a shared link aggregation group that is causing traffic congestion.

D.The inter-pod network is not configured with enough bandwidth due to oversubscription.

AnswerB

Improper CoS mapping leads to sporadic drops.

Why this answer

In a Cisco ACI multi-pod design, the IPN switches must properly trust and map the CoS values from the ACI fabric to the appropriate egress queues. If the CoS markings are not correctly configured on the IPN switches, application traffic can experience buffer drops and latency spikes even when the underlay has sufficient bandwidth and the APIC health scores are high. This is a common misconfiguration because the IPN switches are Layer 3 devices that require explicit QoS policies to preserve the ACI fabric's priority handling.

Exam trap

Cisco often tests the misconception that underlay connectivity and MTU settings are sufficient for multi-pod performance, when in fact the IPN switches require explicit QoS configuration to preserve ACI's priority handling across pods.

How to eliminate wrong answers

Option A is wrong because VLANs are not stretched between pods in ACI multi-pod; inter-pod traffic uses Layer 3 routing via the IPN, so different VLANs per pod do not cause latency or packet loss. Option C is wrong because a shared link aggregation group (LAG) on IPN switches would not inherently cause congestion; LAGs are used for bandwidth aggregation and redundancy, and the issue is about queue drops, not link bundling. Option D is wrong because oversubscription of the inter-pod network would manifest as consistent congestion and high APIC health degradation, not intermittent latency spikes with high health scores; the problem is QoS misconfiguration, not bandwidth shortage.

Full explanation →

889

MCQmedium

An engineer is designing a UCS Mini deployment for a remote office. The chassis will contain four blade servers. Each server needs two 10GbE connections for data and one 1GbE for management. What is the minimum number of fabric interconnects required?

A.One

B.Three

C.Four

D.Two

AnswerA

UCS Mini can operate with a single FI for up to four blades, meeting the requirement.

Why this answer

A single UCS Mini fabric interconnect (FI) can provide both data and management connectivity for up to eight blade servers in a single chassis. Each blade server requires two 10GbE data connections (from the integrated VIC) and one 1GbE management connection (from the Cisco Integrated Management Controller, or CIMC). The FI aggregates these connections internally, so one FI is sufficient for a four-server deployment, as UCS Mini supports a single FI configuration for non-redundant setups.

Exam trap

Cisco often tests the misconception that each blade server's management connection requires a separate physical port or that two FIs are always needed for any UCS deployment, but UCS Mini's integrated architecture allows a single FI to handle both data and management for up to eight blades.

How to eliminate wrong answers

Option B is wrong because three fabric interconnects are not supported in UCS Mini; the architecture only supports one or two FIs for redundancy. Option C is wrong because four fabric interconnects exceed the maximum supported in any UCS Mini configuration (max two). Option D is wrong because two fabric interconnects are only required for redundancy (e.g., for high availability or dual-homing), not for meeting the minimum connectivity needs of four blade servers; the question asks for the minimum number.

Full explanation →

890

MCQeasy

Which NX-OS command displays the current VLAN configuration on a Nexus switch?

A.show vlan

B.show running-config vlan

C.show vlan brief

D.show interface vlan

AnswerA

Correct command.

Why this answer

The 'show vlan' command on NX-OS displays the current VLAN configuration, including VLAN IDs, names, status, and ports assigned to each VLAN. This command is the standard way to view VLAN information in Cisco NX-OS, similar to IOS, and it shows both default and user-created VLANs.

Exam trap

Cisco often tests the distinction between 'show vlan' (which shows VLAN membership and status) and 'show running-config vlan' (which shows the configuration commands), leading candidates to mistakenly choose the latter when asked for the current VLAN configuration.

How to eliminate wrong answers

Option B is wrong because 'show running-config vlan' displays the VLAN configuration as it appears in the running configuration file, not a formatted VLAN table; it shows the actual CLI commands used to configure VLANs, not a summary of VLAN status and port assignments. Option C is wrong because 'show vlan brief' is not a valid NX-OS command; the correct command to see a brief VLAN summary is 'show vlan' or 'show vlan summary', and 'brief' is an optional keyword in some IOS versions but not a standalone command in NX-OS. Option D is wrong because 'show interface vlan' displays the Layer 3 interface status and configuration for SVI (Switch Virtual Interface) VLAN interfaces, not the VLAN database or port membership.

Full explanation →

891

Multi-Selectmedium

Which TWO statements about Cisco UCS service profiles are correct? (Choose TWO.)

Select 2 answers

A.Service profiles are only supported on B-Series blades.

B.Service profiles can include policies for firmware management.

C.A service profile can be associated with one server at a time.

D.Service profiles are tied to specific physical hardware.

E.A service profile does not include network identity settings such as MAC addresses.

AnswersB, C

Firmware policies can be included.

Why this answer

Cisco UCS service profiles can include firmware management policies that specify the firmware versions to be applied to the associated server components, such as adaptors, BIOS, and storage controllers. This allows administrators to enforce consistent firmware levels across the infrastructure without manual intervention.

Exam trap

Cisco often tests the misconception that service profiles are hardware-specific or only apply to B-Series blades, when in fact they are designed to be hardware-agnostic and support both blade and rack server form factors.

Full explanation →

892

MCQeasy

Which RAID level provides both striping and mirroring for high performance and fault tolerance?

A.RAID 0

B.RAID 5

C.RAID 10

D.RAID 6

AnswerC

RAID 10 combines mirroring and striping for performance and fault tolerance.

Why this answer

RAID 10 (also known as RAID 1+0) combines mirroring and striping to provide both high performance and redundancy.

Full explanation →

893

MCQeasy

A network engineer is configuring a UCS service profile for a new blade server. The requirement is that if the blade fails, it can be replaced with any blade of the same model without reconfiguration. Which UCS feature enables this capability?

A.VLAN configuration

B.Stateless computing

C.RAID configuration

D.Firmware management policies

AnswerB

Stateless computing decouples the server identity from the hardware, enabling swap without reconfiguration.

Why this answer

Stateless computing in UCS abstracts the hardware identity and configuration via service profiles, allowing a replacement blade to inherit the same configuration without manual reconfiguration.

Full explanation →

894

Multi-Selecthard

A data center engineer is implementing model-driven telemetry using Cisco NX-OS. Which three components are required in the telemetry configuration? (Choose three.)

Select 3 answers

A.A HTTPS certificate for authentication

B.An SNMP community string

C.A sensor path to specify the data to stream

D.A subscription to a YANG data model

E.A destination profile with collector IP and port

AnswersC, D, E

Specifies which data to collect.

Why this answer

A sensor path defines the specific YANG data model paths or operational data that the device will stream to the collector. In model-driven telemetry on Cisco NX-OS, the sensor path is the fundamental component that tells the device exactly which data to monitor and stream, such as 'Cisco-NX-OS-device:System/clock-items' or interface statistics paths.

Exam trap

The trap here is that candidates confuse model-driven telemetry with SNMP or traditional monitoring, mistakenly thinking SNMP community strings or HTTPS certificates are core components, when in fact the three required components are the sensor path, subscription, and destination profile.

Full explanation →

895

MCQmedium

A UCS domain has two Fabric Interconnects (FI-A and FI-B) in a redundant configuration. A blade server is configured with two vNICs: one for FI-A and one for FI-B. What happens if FI-A fails?

A.Traffic is automatically failed over to the vNIC connected to FI-B

B.The blade loses all network connectivity

C.Both vNICs are reconnected to FI-B automatically

D.The blade continues to use the vNIC on FI-A but without redundancy

AnswerA

The NIC teaming or failover mechanism (e.g., active-backup) will use the second vNIC.

Why this answer

When FI-A fails, the blade server's vNIC connected to FI-A becomes unavailable. However, because the vNICs are configured in a redundant pair (active/standby or active/active with failover), the operating system or the Cisco UCS Manager's NIC teaming policy automatically fails over traffic to the vNIC connected to FI-B. This is achieved through the use of MAC address pinning and the failover mechanism inherent in the Cisco UCS fabric interconnect architecture, ensuring continuous network connectivity without manual intervention.

Exam trap

The trap here is that candidates often assume a single vNIC failure causes total connectivity loss (Option B) or that UCS automatically re-pins vNICs to the surviving fabric (Option C), when in fact the failover is handled by the server's NIC teaming software, not by the fabric interconnects themselves.

How to eliminate wrong answers

Option B is wrong because the blade does not lose all network connectivity; the redundant vNIC on FI-B takes over the traffic seamlessly. Option C is wrong because the vNIC connected to FI-A is not reconnected to FI-B; it remains associated with the failed FI-A and is simply taken out of service, while the vNIC on FI-B continues to operate independently. Option D is wrong because the blade does not continue to use the vNIC on FI-A after its fabric interconnect fails; that vNIC becomes non-functional, and traffic is failed over to the vNIC on FI-B, which then handles all traffic without redundancy until FI-A is restored.

Full explanation →

896

MCQhard

A storage administrator configures zoning on a Cisco MDS switch. The requirement is to prevent any changes to the zone set from taking effect unless explicitly activated. Which configuration is correct?

A.Create zones and directly add them to the database; activation is automatic.

B.Create zones and add them to the active zone set; deactivate the zone set to apply changes.

C.Create zones, add them to the zone set, then activate the zone set.

D.Create zones and add them to the full zone set; the switch automatically activates changes.

AnswerC

Zones must be added to a zone set, which is then activated to become the active zone set.

Why this answer

The active zone set is the only zone set that is enforced; changes must be activated to apply.

Full explanation →

897

MCQmedium

A company wants to automate backup of running-configurations for 200 Nexus switches. Which solution provides the best combination of reliability and version history?

A.Manual backup via CLI

B.Custom Python script using TFTP

C.Ansible playbook with the nxos_config backup option

D.A cron job that SCPs config to a server

AnswerC

Idempotent, stores backups with timestamps, supports diffs.

Why this answer

An Ansible playbook with the nxos_config backup option is the best solution because it provides idempotent, version-controlled backups of running-configurations across 200 Nexus switches. The nxos_config module automatically creates a timestamped backup file on the Ansible control node, ensuring both reliability through automated, consistent execution and a built-in version history via the backup files. This approach scales efficiently without requiring manual intervention or fragile scripting.

Exam trap

Cisco often tests the misconception that any automated backup method is sufficient, but the trap here is that only Ansible's nxos_config backup option combines reliability, scalability, and built-in version history without requiring custom scripting or insecure protocols like TFTP.

How to eliminate wrong answers

Option A is wrong because manual backup via CLI is not scalable for 200 switches, lacks version history, and is prone to human error. Option B is wrong because a custom Python script using TFTP is unreliable due to TFTP's lack of authentication and encryption, and it does not inherently provide version history or idempotency. Option D is wrong because a cron job that SCPs config to a server offers no built-in version history or rollback capability, and it requires custom scripting to manage backups reliably across many devices.

Full explanation →

898

MCQeasy

A data center has 100 Nexus switches in a fabric managed by Cisco Nexus Dashboard Orchestrator (NDO). The network team needs to automate the creation of a new network template that includes multiple VLANs and VRF configurations. They want to ensure that the template is applied consistently across all leaf switches without manual intervention. The engineer writes a Python script using the NDO REST API to create the template and deploy it. However, the deployment fails with an error 'Template validation failed: overlapping IP subnets'. Upon reviewing the template, the engineer notices that two VLANs have overlapping subnet definitions. Which action should the engineer take to resolve this issue efficiently?

A.Use the NDO GUI to edit the template and then re-run the script

B.Manually correct the overlapping subnets in the template and re-run the deployment script

C.Create separate templates for each VLAN to avoid overlaps

D.Modify the Python script to ignore validation errors and force the deployment

AnswerB

Directly fixes the root cause; then automation can proceed.

Why this answer

The root cause of the deployment failure is overlapping IP subnets in the template definition. Manually correcting the overlapping subnets in the template and re-running the deployment script directly resolves the validation error without introducing unnecessary complexity or risk. This approach ensures the template is valid before deployment, maintaining consistency across all leaf switches.

Exam trap

Cisco often tests the candidate's ability to distinguish between fixing the root cause (overlapping subnets) versus workarounds that bypass validation or increase complexity, testing whether you understand that automation must still adhere to network design rules.

How to eliminate wrong answers

Option A is wrong because using the NDO GUI to edit the template is not efficient; it introduces manual steps that defeat the automation goal and does not leverage the script for consistent deployment. Option C is wrong because creating separate templates for each VLAN does not address the overlapping subnet issue; it adds administrative overhead and may still result in overlaps if not carefully managed. Option D is wrong because modifying the Python script to ignore validation errors would force deployment of an invalid configuration, potentially causing IP conflicts and network outages across the fabric.

Full explanation →

899

Multi-Selecthard

An engineer is hardening a Nexus switch. Which THREE actions should be taken? (Choose three.)

Select 3 answers

A.Use SNMPv1 for monitoring

B.Disable unused services like HTTP and Telnet

C.Configure CoPP to protect the control plane

D.Enable LLDP on all interfaces

E.Enable SSH only for remote management

AnswersB, C, E

Reduces attack surface.

Why this answer

Disabling unused services, enabling SSH only, and configuring CoPP are standard hardening practices.

Full explanation →

900

MCQmedium

An engineer is troubleshooting a BGP EVPN session between a leaf and a spine. The 'show bgp l2vpn evpn summary' output shows the peer state as 'Active'. What does this indicate?

A.The session is in the process of being established.

B.The session is up and exchanging prefixes.

C.There is a configuration mismatch.

D.The TCP connection is not established.

AnswerD

Active means BGP is trying to establish a TCP connection.

Why this answer

In BGP EVPN, the 'Active' state indicates that the BGP speaker is actively trying to establish a TCP connection with the peer but has not yet completed the three-way handshake. This means the TCP session is not established, which is a prerequisite for BGP session establishment. The peer remains in 'Active' until the TCP connection is successfully formed.

Exam trap

The trap here is that candidates often confuse 'Active' with 'Connect' or think it means the session is actively exchanging routes, when in fact it indicates a TCP connection failure that must be resolved before BGP can proceed.

How to eliminate wrong answers

Option A is wrong because the 'Active' state specifically indicates that the TCP connection is not yet established, not that the session is in the process of being established (which would be 'Connect' or 'OpenSent' states). Option B is wrong because a session that is up and exchanging prefixes would be in the 'Established' state, not 'Active'. Option C is wrong because a configuration mismatch typically results in the session flapping or staying in 'Idle' state, not 'Active'; 'Active' is a TCP connection issue, not a configuration mismatch.

Full explanation →

Page 12 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

Network Storage Network Automation Compute Security

See all domains with question counts →