Courseiva

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 901975

984 questions total · 14pages · All types, answers revealed

Page 12

Page 13 of 14

Page 14
901
MCQmedium

A UCS B-Series blade server shows high CPU latency when processing network I/O. The engineer suspects a bottleneck in the I/O subsystem. Which metric in UCS Manager should be examined first?

A.vNIC utilization percentage
B.Fabric port error counts
C.Memory usage statistics
D.Power consumption per server
AnswerB

Errors cause retransmissions and latency

Why this answer

Fabric port error counts directly reflect physical-layer issues (e.g., CRC errors, alignment errors, link flaps) that cause retransmissions and backpressure, leading to high CPU latency on the blade server. In UCS Manager, these counters are the first place to check when suspecting an I/O subsystem bottleneck because they pinpoint problems in the fabric interconnect or cabling before examining higher-layer metrics.

Exam trap

Cisco often tests the distinction between utilization metrics (which show load) and error metrics (which show health), so candidates mistakenly pick vNIC utilization thinking high usage equals a bottleneck, when the real issue is physical-layer errors causing retransmissions.

How to eliminate wrong answers

Option A is wrong because vNIC utilization percentage measures throughput usage, not errors or latency; high utilization alone does not cause CPU latency unless accompanied by errors or congestion. Option C is wrong because memory usage statistics indicate system memory pressure, which can affect overall performance but is not specific to the I/O subsystem or network latency. Option D is wrong because power consumption per server relates to thermal or power capacity issues, not to network I/O latency or fabric errors.

902
MCQeasy

An organization adopts Infrastructure as Code (IaC) for network automation. Which tool is commonly used to manage ACI fabric configuration declaratively?

A.Terraform
B.Python acitoolkit
C.NX-API CLI
D.Ansible
AnswerA

Terraform natively supports declarative configuration.

Why this answer

Terraform with the terraform-provider-aci allows declarative management of ACI objects.

903
Multi-Selectmedium

Which TWO statements correctly describe the benefits of thin provisioning in a storage array?

Select 2 answers
A.It eliminates the need for RAID protection
B.It improves performance by pre-allocating all storage upfront
C.It allows over-provisioning of logical capacity beyond physical capacity
D.It simplifies disaster recovery by replicating only allocated blocks
E.It reduces storage costs by allocating physical space only when data is written
AnswersC, E

Thin provisioning supports over-allocation, enabling administrators to present more capacity than physically available.

Why this answer

Thin provisioning allows over-allocation of storage capacity, reducing waste, and enables on-demand allocation of physical storage as data is written.

904
MCQhard

In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?

A.Taboo contract
B.No contract
C.Regular contract with a deny filter
D.Intra-EPG contract
AnswerA

Taboo contracts explicitly deny specified traffic between EPGs.

Why this answer

Taboo contracts are used to explicitly deny traffic between EPGs, overriding the default permit of a contract? Actually, by default, no traffic is permitted between EPGs unless a contract is applied. A taboo contract denies traffic, even if a regular contract exists? In ACI, the default is no communication; contracts permit traffic. To deny specific traffic, you use a taboo contract that explicitly denies.

905
MCQeasy

An engineer is configuring a UCS server profile for a database application that requires low latency. The server will use a Cisco UCS VIC 1340 adapter. Which vNIC placement policy should be selected to minimize latency?

A.Assigned
B.Any
C.Default
D.Round-Robin
AnswerA

Assigned placement pins the vNIC to a specific adapter port, reducing latency.

Why this answer

The Assigned vNIC placement policy binds each vNIC to a specific physical port on the Cisco UCS VIC 1340 adapter, ensuring deterministic traffic flow and predictable latency. For low-latency database applications, this eliminates the variability introduced by dynamic placement, allowing the engineer to align vNICs with the most direct PCIe path to the CPU or memory.

Exam trap

Cisco often tests the misconception that Round-Robin provides load balancing for low latency, but the trap here is that Round-Robin optimizes for bandwidth distribution, not latency minimization, and the Assigned policy is the only one that guarantees fixed path placement for deterministic performance.

How to eliminate wrong answers

Option B (Any) is wrong because it allows the system to dynamically assign vNICs to any available physical port, which can introduce latency variation and suboptimal traffic distribution. Option C (Default) is wrong because it typically applies a system-defined policy that may not guarantee the deterministic placement required for low-latency workloads. Option D (Round-Robin) is wrong because it distributes vNICs sequentially across ports without considering latency sensitivity, potentially causing mismatched traffic patterns and increased jitter.

906
MCQeasy

Which type of I/O module (IOM) is installed in a UCS 5108 blade chassis to provide connectivity between blade servers and the fabric interconnects?

A.MDS switch
B.CIMC
C.Nexus 2000
D.FEX (Fabric Extender)
AnswerD

The IOMs in UCS chassis are essentially fabric extenders that extend the FI fabric to the blades.

Why this answer

The IOMs in a 5108 chassis connect the blade midplane to the fabric interconnects via server ports. There are typically two IOMs for redundancy.

907
MCQmedium

Refer to the exhibit. A UCS B-Series blade shows a failed power supply. The blade is currently running. Which action should the engineer take to replace the power supply without causing service disruption?

A.Replace the power supply only after the blade is isolated from the fabric.
B.Replace the failed power supply in the chassis without affecting the blade.
C.Shut down the blade, replace the power supply, then power on.
D.Replace the failed power supply while the blade remains powered on.
AnswerD

The blade has redundant power supplies; hot-swap is supported.

Why this answer

UCS B-Series blades use a shared chassis power infrastructure with N+1 redundancy. The failed power supply can be hot-swapped while the blade remains powered on, as the remaining power supplies in the chassis will continue to provide power without interruption. No blade isolation or shutdown is required, as the chassis power subsystem is designed for concurrent maintenance.

Exam trap

Cisco often tests the misconception that a blade must be shut down or isolated before replacing a chassis-level component, but the key is understanding that UCS chassis power supplies are hot-swappable and redundant, so no blade-level action is needed.

How to eliminate wrong answers

Option A is wrong because isolating the blade from the fabric (disconnecting its virtual interfaces) is unnecessary for power supply replacement; the blade's power is independent of fabric connectivity. Option B is wrong because it implies the power supply can be replaced without any effect on the blade, but the correct procedure is to replace it while the blade is powered on, not just 'without affecting the blade' — the phrasing is misleading as the blade remains powered on during replacement. Option C is wrong because shutting down the blade is not required; the chassis power redundancy allows hot-swap of the power supply without powering down any blade.

908
Multi-Selecteasy

An engineer needs to collect streaming telemetry from a Nexus 9000 switch. Which two protocols can be used to transmit telemetry data to a collector? (Choose two.)

Select 2 answers
A.NETCONF
B.gNMI
C.HTTP
D.SNMP traps
E.gRPC
AnswersB, E

gNMI is designed for telemetry and management.

Why this answer

gNMI (gRPC Network Management Interface) and gRPC are both correct because they are the primary protocols used for streaming telemetry on Nexus 9000 switches. gNMI defines a standard model-driven telemetry subscription mechanism over gRPC, while gRPC provides the underlying high-performance transport for streaming telemetry data to collectors.

Exam trap

Cisco often tests the distinction between configuration protocols (NETCONF) and streaming telemetry protocols (gNMI/gRPC), and candidates mistakenly choose NETCONF because it supports YANG-push notifications, but the question specifically asks for 'streaming telemetry' which requires the persistent, high-frequency channel provided by gRPC/gNMI.

909
MCQmedium

In a private VLAN configuration, a host in a community VLAN needs to communicate with a host in the primary VLAN. What configuration is required on the switch?

A.The host in community VLAN must be on an isolated port
B.The host in primary VLAN must be on a promiscuous port
C.The host in community VLAN must be on a promiscuous port
D.The host in primary VLAN must be on a community port
AnswerB

The primary VLAN host must be on a promiscuous port to allow communication from community VLAN.

Why this answer

In a private VLAN configuration, a host in a community VLAN can communicate with a host in the primary VLAN only if the host in the primary VLAN is on a promiscuous port. The promiscuous port can communicate with all other ports in the private VLAN, including community and isolated ports, enabling inter-VLAN traffic through a Layer 3 gateway or a server connected to that port.

Exam trap

Cisco often tests the misconception that a community VLAN host can directly communicate with a primary VLAN host without a promiscuous port, or that the primary VLAN host must be on a community port, confusing the roles of promiscuous and community ports in private VLANs.

How to eliminate wrong answers

Option A is wrong because an isolated port can only communicate with promiscuous ports, not with community ports, so placing the community VLAN host on an isolated port would break its ability to communicate with the primary VLAN host. Option C is wrong because a community port can only communicate with other community ports in the same community VLAN and with promiscuous ports, but placing the community VLAN host on a promiscuous port would incorrectly allow it to communicate with all ports, violating the community VLAN's intended isolation. Option D is wrong because a primary VLAN host on a community port would restrict it to communicating only with other community ports in the same community VLAN and promiscuous ports, but it would not be able to communicate with hosts in other community VLANs or isolated ports, which is not the required behavior for a primary VLAN host.

910
MCQeasy

A network engineer wants to use Terraform to automate the creation of an Application Profile in ACI. Which provider should be used?

A.terraform-provider-aci
B.terraform-provider-apic
C.terraform-provider-nxos
D.terraform-provider-nexus
AnswerA

This provider is specifically for ACI automation.

Why this answer

The terraform-provider-aci is the official Terraform provider for Cisco ACI. terraform-provider-nxos is for Nexus switches. The other options are not valid.

911
MCQhard

A data center engineer is troubleshooting high CPU utilization on a Cisco Nexus 9000 switch. The engineer suspects a distributed denial-of-service (DDoS) attack targeting the switch. To mitigate the attack, the engineer configures a Control Plane Policing (CoPP) policy that drops all ICMP packets destined to the switch. The policy is applied to the control-plane using the 'service-policy input COPP' command. After applying the policy, the switch CPU utilization remains high, and ICMP traffic is still reaching the switch. The engineer verifies that the CoPP policy is applied and that the class-map matches ICMP. The policy-map has the correct police and drop actions. No other CoPP policies are applied. What is the most likely cause of the issue?

A.The switch requires a reload for the CoPP policy to take effect.
B.The attack traffic is entering through the management interface, which is not affected by CoPP.
C.The CoPP policy must be applied to the management VRF as well.
D.The class-map uses 'match protocol icmp' but the traffic uses a different protocol.
AnswerB

Management interfaces have separate control plane contexts; CoPP policies do not apply unless specifically configured for the management VRF.

Why this answer

The management interface (mgmt0) on Cisco Nexus 9000 switches operates in a separate management VRF and is not subject to Control Plane Policing (CoPP) policies applied to the default control-plane. CoPP only polices traffic that ingresses through data-plane interfaces (e.g., Ethernet, port-channel). If the DDoS attack is arriving via the management interface, the CoPP policy will not filter it, leaving CPU utilization high.

This is a common oversight when troubleshooting control-plane protection.

Exam trap

Cisco often tests the distinction between control-plane policing (CoPP) and management-plane protection, leading candidates to forget that the management interface operates in a separate VRF and is not subject to CoPP policies.

How to eliminate wrong answers

Option A is wrong because CoPP policies on Cisco Nexus switches take effect immediately upon application; no reload is required. Option C is wrong because CoPP is applied to the control-plane of the default VRF, not to the management VRF; the management interface has its own dedicated control-plane context and is not affected by CoPP policies applied to the main control-plane. Option D is wrong because the engineer verified that the class-map matches ICMP, and the question states the policy is correctly matching ICMP traffic; the issue is not a protocol mismatch.

912
MCQhard

In an ACI fabric, an EPG is configured with a contract that provides a service to another EPG. The contract has a filter for TCP port 80. Which component defines the directionality of the communication between the provider and consumer EPG?

A.The filter direction specified in the contract
B.The BD subnets
C.The provider and consumer labels in the contract
D.The subject of the contract
AnswerC

Correct: provider/consumer relationship defines direction.

Why this answer

In Cisco ACI, the provider and consumer labels in the contract define the directionality of communication. The provider EPG offers a service, and the consumer EPG initiates the request; the contract's provider/consumer relationship determines which EPG can start the conversation and in which direction the filter (e.g., TCP port 80) applies. This is fundamental to ACI's policy model, where the contract is unidirectional from consumer to provider by default.

Exam trap

Cisco often tests the misconception that the filter direction (e.g., 'both' or 'uni') controls which EPG initiates traffic, when in fact it is the provider and consumer labels that define the directionality of the communication.

How to eliminate wrong answers

Option A is wrong because the filter direction in a contract (e.g., 'both' or 'uni') only specifies whether the filter applies to one or both directions of traffic, but it does not define which EPG is the provider or consumer; the directionality of the communication is set by the provider/consumer labels. Option B is wrong because BD subnets define the IP addressing and gateway for endpoints within a bridge domain, not the directionality of inter-EPG communication governed by contracts. Option D is wrong because the subject of the contract groups filters and actions but does not establish the provider/consumer relationship; it is the contract itself that carries the provider and consumer labels.

913
MCQeasy

Which component connects a UCS 5108 blade chassis to the Fabric Interconnects?

A.CIMC
B.Midplane
C.IOM (Input/Output Module)
D.FEX (Fabric Extender)
AnswerC

IOMs link the chassis to Fabric Interconnects.

Why this answer

IOMs (Input/Output Modules) in the chassis provide connectivity to the FIs.

914
MCQhard

You manage a UCS domain with two fabric interconnects (FI-A and FI-B) in an cluster. The domain contains 8 blade servers. After a power failure, both FIs come back online, but the cluster experiences a split-brain situation where both FIs claim to be primary. The subordinate FI (FI-B) shows all blades as 'Discovery' state. You suspect configuration mismatch. You have console access to both FIs. Which recovery procedure should be performed to restore a stable cluster?

A.Reset both FIs to factory defaults and reconfigure from backup
B.Boot the FIs into the EFI shell and clear the flash
C.Perform a stateful switchover (SSO) on both FIs
D.On the subordinate FI (FI-B), enter the recovery mode and force a re-initialization, then reset the cluster
AnswerD

Standard UCS split-brain recovery procedure

Why this answer

In a UCS split-brain scenario where the subordinate FI (FI-B) shows blades in 'Discovery' state due to a configuration mismatch, the proper recovery is to boot FI-B into recovery mode (using the 'recovery' boot option or pressing Ctrl+R at the appropriate prompt) and force a re-initialization, which resets its configuration to match the primary FI (FI-A). After re-initialization, resetting the cluster (via the 'cluster reset' command or equivalent) re-establishes the primary-subordinate relationship and synchronizes the configuration, restoring stable operation without affecting the primary FI's data or requiring a full factory reset.

Exam trap

Cisco often tests the misconception that a split-brain scenario requires a full factory reset or flash clearing, when in fact the targeted recovery of the subordinate FI via recovery mode and cluster reset is the correct, less destructive procedure.

How to eliminate wrong answers

Option A is wrong because resetting both FIs to factory defaults is overly destructive and unnecessary; it would lose all configuration on the primary FI (FI-A) and require a full backup restore, whereas the issue is isolated to the subordinate FI's configuration mismatch. Option B is wrong because booting into the EFI shell and clearing the flash is a low-level hardware recovery method typically used for unbootable FIs or firmware corruption, not for resolving a split-brain cluster state caused by configuration mismatch; it would erase all firmware and configuration, requiring a complete reimage. Option C is wrong because performing a stateful switchover (SSO) on both FIs is designed for planned maintenance or failover in a stable cluster, not for recovery from a split-brain scenario; SSO assumes both FIs are synchronized and operational, which they are not in this case.

915
MCQmedium

A Fibre Channel switch port is experiencing a high number of CRC errors. Which action should be taken to resolve this issue?

A.Replace the fiber optic cable between the switch and the storage device.
B.Reduce the port speed to 2 Gbps.
C.Reconfigure the zone to include only the affected device.
D.Increase the buffer credits on the port.
AnswerA

CRC errors typically indicate physical layer problems like bad cables.

Why this answer

CRC errors in Fibre Channel typically indicate physical-layer issues such as damaged or dirty fiber optic cables, faulty connectors, or signal degradation. Replacing the cable directly addresses the most common root cause of CRC errors, which is physical-layer corruption of frames. Other options like reducing speed or adjusting buffer credits do not fix the underlying physical integrity problem.

Exam trap

Cisco often tests the misconception that CRC errors are caused by software or configuration issues (like zoning or buffer credits), when in fact they are almost always a physical-layer problem requiring cable or connector inspection and replacement.

How to eliminate wrong answers

Option B is wrong because reducing port speed to 2 Gbps may mask CRC errors by lowering the signaling rate, but it does not resolve the physical-layer issue causing the errors; it only reduces the likelihood of errors at the cost of performance. Option C is wrong because reconfiguring zones only controls which devices can communicate; it has no effect on physical-layer errors like CRC, which occur regardless of zoning. Option D is wrong because increasing buffer credits manages flow control and helps with distance-related credit starvation, but CRC errors are caused by signal integrity problems, not buffer credit depletion.

916
MCQhard

In a VXLAN EVPN fabric using BGP as the control plane, which BGP address family is used to exchange MAC/VTEP reachability information between VTEPs?

A.IPv4 unicast
B.IPv6 unicast
C.VPNv4 unicast
D.L2VPN EVPN
AnswerD

L2VPN EVPN is the correct address family for VXLAN EVPN.

Why this answer

In a VXLAN EVPN fabric, the L2VPN EVPN address family (AFI 25, SAFI 70) is used to exchange MAC/VTEP reachability information between VTEPs. This address family carries BGP EVPN routes (type-2 for MAC/IP advertisements) that include the MAC address, VNI, and VTEP IP, enabling the control plane to distribute host reachability without flooding.

Exam trap

Cisco often tests the distinction between VPNv4 unicast (used for MPLS L3VPN) and L2VPN EVPN (used for VXLAN EVPN), so the trap here is confusing the control-plane address family for Layer 3 VPNs with the one for Layer 2 EVPN overlays.

How to eliminate wrong answers

Option A is wrong because IPv4 unicast (AFI 1, SAFI 1) is used for exchanging IPv4 prefix reachability, not MAC/VTEP information. Option B is wrong because IPv6 unicast (AFI 2, SAFI 1) is used for IPv6 prefix reachability, not for MAC/VTEP advertisements. Option C is wrong because VPNv4 unicast (AFI 1, SAFI 128) is used for MPLS L3VPN prefix exchange, not for Layer 2 MAC/VTEP information in VXLAN EVPN.

917
MCQmedium

In Cisco ACI, which component is responsible for translating EPG communication policies into concrete configuration on leaf switches?

A.Leaf switch
B.APIC controller
C.Spine switch
D.VMM domain
AnswerB

APIC translates the policy model into switch configurations.

Why this answer

The APIC controller is the centralized policy engine in Cisco ACI. It translates high-level EPG communication policies (contracts, filters, subjects) into the concrete switch configuration (e.g., OpFlex policy elements, VXLAN tunnel mappings, and hardware table entries) and pushes them to leaf switches via the OpFlex protocol. Without the APIC, leaf switches cannot autonomously interpret or apply these policies.

Exam trap

Cisco often tests the misconception that leaf switches are 'intelligent' enough to translate policies themselves, but in ACI the leaf is a stateless enforcement point that relies entirely on the APIC for policy translation and distribution.

How to eliminate wrong answers

Option A is wrong because leaf switches are the enforcement points that receive and apply the concrete configuration from the APIC, but they do not perform the translation from high-level policy to low-level configuration. Option C is wrong because spine switches in ACI handle only VXLAN-based fabric forwarding (e.g., MP-BGP EVPN control plane and underlay routing) and are not involved in translating EPG policies into leaf switch configuration. Option D is wrong because a VMM domain integrates ACI with hypervisors (e.g., VMware vSphere) to dynamically bind VMs to EPGs, but it does not translate EPG policies into leaf switch configuration; that translation is solely the APIC's responsibility.

918
MCQmedium

An administrator needs to replace a faulty UCS B200 M5 blade with a new blade of the same model. The original blade had a service profile associated. What is the minimum required action to allow the new blade to take over the workload with the same configuration?

A.Disassociate the service profile from the faulty blade and associate it with the new blade.
B.Clone the service profile and then associate the clone with the new blade.
C.Manually reconfigure the new blade via the KVM console.
D.Update the firmware on the new blade to match the service profile requirements.
AnswerA

This applies the same configuration to the new blade.

Why this answer

UCS service profiles provide hardware abstraction, making blades stateless. Simply inserting the new blade will not automatically associate the profile; the administrator must re-associate the service profile with the new blade. No other reconfiguration is needed if the new blade is identical.

919
MCQmedium

A storage administrator is configuring Fibre Channel zoning on a Cisco MDS switch. The administrator creates a zone, adds members, and activates the zone set. However, the hosts still cannot access the storage targets. What is the most likely cause?

A.The WWPNs are incorrectly typed.
B.The VSAN was not created.
C.The ports are in trunk mode.
D.The zone set was not activated.
AnswerD

The active zone set must be set; otherwise, zoning configuration is not applied.

Why this answer

Zoning changes only take effect when the zone set is activated. If the zone set is not activated, the zones are not enforced.

920
Multi-Selectmedium

Which two BGP features are commonly used in a Cisco Data Center spine-leaf fabric to achieve optimal ECMP load balancing? (Choose two.)

Select 2 answers
A.BGP add-path
B.BGP confederation
C.BGP multipath
D.BGP next-hop-self
E.BGP bestpath tie-break
AnswersA, C

Enables advertisement of multiple paths for load balancing.

Why this answer

BGP add-path (A) allows the advertisement of multiple paths for the same prefix to a peer, enabling the spine to install multiple equal-cost paths in its routing table for ECMP load balancing. BGP multipath (C) instructs the router to install multiple equal-cost BGP paths into the routing table, which is essential for distributing traffic across multiple spine links in a Clos fabric.

Exam trap

Cisco often tests the distinction between features that enable ECMP (add-path and multipath) versus features that affect path selection or IBGP topology (confederation, next-hop-self), leading candidates to confuse operational necessity with load-balancing capability.

921
MCQmedium

A data center team is planning a Fibre Channel fabric with multiple Cisco MDS switches. They want to ensure that all switches share the same configuration and that zone changes are propagated automatically. Which feature should be enabled?

A.NPV mode
B.Fibre Channel Security Protocol (FC-SP)
C.VSAN trunking (EISL)
D.Cisco Fabric Services (CFS)
AnswerD

CFS enables automatic distribution of configurations like zoning.

Why this answer

Cisco Fabric Services (CFS) distributes configuration changes across all switches in the fabric, including zone changes.

922
Multi-Selecteasy

Which TWO components are required in a HyperFlex cluster to provide both compute and storage functionality?

Select 2 answers
A.UCS Manager
B.Storage Controller VM (SCVM)
C.Hypervisor (e.g., VMware ESXi)
D.CIMC
E.Witness VM
AnswersB, C

SCVM provides the storage data plane.

Why this answer

HyperFlex converged nodes provide both compute and storage. The controller VM (SCVM) manages storage, and the hypervisor (e.g., ESXi) runs workloads.

923
MCQhard

A Nexus switch configured with 'feature nxapi' and 'nxapi https port 443' fails to respond to REST API calls from a monitoring system. The engineer can ping the management IP. Which troubleshooting step should be taken first?

A.Check if the monitoring system is using the correct HTTP method
B.Review the switch's ACL for the management VRF
C.Verify that the NX-API process is running with 'show nxapi'
D.Confirm that the SSL certificate is trusted
AnswerC

Quick check of API status.

Why this answer

The first step when NX-API is configured but not responding is to verify that the NX-API process is actually running. The 'feature nxapi' command enables the feature, but the NX-API service may not have started due to a configuration error, resource issue, or process crash. The 'show nxapi' command displays the operational status of the NX-API service, including whether it is listening on the configured port (443 in this case).

Since the engineer can ping the management IP, basic network connectivity exists, so the issue is likely at the application layer.

Exam trap

Cisco often tests the distinction between enabling a feature with a command and the actual process running; candidates assume that 'feature nxapi' guarantees the service is operational, but the trap is that the process may not start automatically, and 'show nxapi' is the correct verification step.

How to eliminate wrong answers

Option A is wrong because the HTTP method (GET, POST, etc.) is a client-side concern; if the NX-API service is not running, no HTTP method will work, so checking the method is premature. Option B is wrong because ACLs for the management VRF would block pings as well, but the engineer can ping the management IP, indicating that Layer 3 connectivity is intact and no ACL is blocking traffic at that level. Option D is wrong because SSL certificate trust is only relevant after the HTTPS connection is established; if the NX-API process is not running, the server never presents a certificate, so trust is not the issue.

924
MCQmedium

An engineer wants to run a Python script on a Nexus switch without copying it to the bootflash. The script interacts with the switch's CLI and file system. Which feature allows this?

A.OnEX
B.NX-API REST
C.Guest shell
D.EEM with Python applets
AnswerC

Guest shell provides bash environment for Python scripts.

Why this answer

Guest shell provides a Linux environment on Nexus where Python scripts can run directly.

925
MCQeasy

An engineer is configuring a Fibre Channel PortChannel between two Cisco MDS switches. What is the maximum number of physical links that can be aggregated into a single PortChannel in Fibre Channel?

A.8
B.32
C.4
D.16
AnswerD

Cisco MDS switches support up to 16 links per PortChannel.

Why this answer

Cisco MDS switches support up to 16 physical links per PortChannel for Fibre Channel.

926
MCQmedium

Refer to the exhibit. A host with WWPN 10:00:00:00:c9:29:3b:23 can only see its own WWPN but not the target. What is the likely cause?

A.The host is in a different VSAN.
B.The target is missing from the zone.
C.The zoneset is not the full zoneset.
D.The host's FLOGI is rejected.
E.The zone is not activated.
AnswerB

Zone_C has no target member, so the host cannot access any storage.

Why this answer

The host can see its own WWPN but not the target, which indicates that the host has successfully logged into the fabric (FLOGI accepted) and is in the correct VSAN. The most likely cause is that the target WWPN is not included in the zone that contains the host. In Fibre Channel zoning, only members within the same zone can communicate; if the target is missing from the zone, the host cannot discover or access it.

Exam trap

Cisco often tests the distinction between 'zone not activated' and 'target missing from zone' — the trap here is that candidates assume a zone must be activated for any visibility, but in reality, a host can see its own WWPN even if the zone is inactive, as long as it has successfully logged into the fabric.

How to eliminate wrong answers

Option A is wrong because if the host were in a different VSAN, it would not see its own WWPN either, as VSANs provide complete isolation. Option C is wrong because the zoneset not being the full zoneset would affect all zones, not just the host's ability to see the target; the host would still see its own WWPN. Option D is wrong because if the host's FLOGI were rejected, the host would not be able to see any WWPNs, including its own.

Option E is wrong because if the zone were not activated, the host would not be able to see any WWPNs in that zone, including its own; the zone activation is required for the zone to take effect.

927
Multi-Selecthard

Which THREE of the following must be enabled to implement 802.1X authentication with MAB fallback on a Cisco Nexus switch for a mixed environment of 802.1X-capable and non-802.1X endpoints? (Choose three.)

Select 3 answers
A.MACsec encryption on the port
B.AAA authentication with a RADIUS server
C.A RADIUS server configured with the MAC addresses of non-802.1X devices
D.A VLAN ACL to redirect traffic
E.802.1X globally enabled on the switch
AnswersB, C, E

AAA is required to authenticate users and devices.

Why this answer

802.1X authentication requires AAA to communicate with a RADIUS server. The RADIUS server validates the credentials (EAP over RADIUS) and returns an Accept or Reject, which the switch uses to authorize the port. Without AAA and a RADIUS server, the switch has no external authentication authority to process 802.1X requests or MAB fallback.

Exam trap

Cisco often tests the misconception that MACsec or VLAN ACLs are prerequisites for 802.1X with MAB, when in fact they are optional features that can be layered on top of the authentication process.

928
Multi-Selectmedium

A network automation engineer is writing an Ansible playbook to configure Nexus switches. Which three modules are available to manage NX-OS configuration? (Choose three.)

Select 3 answers
A.eos_config
B.nxos_config
C.nxos_interface
D.nxos_vlan
E.ios_config
AnswersB, C, D

Manages NX-OS configuration.

Why this answer

The `nxos_config` module is the primary Ansible module for managing NX-OS device configurations, allowing you to apply, replace, or merge configuration snippets directly onto Nexus switches. It is part of the `cisco.nxos` collection and is specifically designed for NX-OS, unlike `ios_config` which targets Cisco IOS/IOS-XE devices.

Exam trap

Cisco often tests the distinction between platform-specific Ansible modules (e.g., `nxos_*` vs `ios_*` vs `eos_*`), and the trap here is that candidates may confuse `ios_config` as being compatible with NX-OS due to a superficial similarity in CLI syntax, ignoring the underlying platform-specific module requirements.

929
MCQeasy

An engineer wants to automate the configuration of VLANs on a Nexus switch using Ansible. Which module from the cisco.nxos collection should be used?

A.nxos_config
B.nxos_vlan
C.nxos_bgp
D.nxos_interface
AnswerB

Correct module for VLAN management.

Why this answer

The nxos_vlan module is specifically designed to manage VLANs on Cisco NX-OS devices.

930
MCQmedium

A UCS B-Series blade server (blade 5) has been running a database application for months. Recently, the storage team upgraded the SAN firmware. Since then, the blade experiences intermittent 'SCSI command timeout' errors in the system logs. The application performance degrades periodically. You check the UCS Manager performance data and see that the vHBA statistics show a high number of 'Link Reset' events. The storage array logs show no errors. The fibre channel cables are new. Which step should you take to resolve the issue?

A.Delete and recreate the vHBA in the service profile
B.Replace the fibre channel cables between the IOM and storage
C.Update the HBA firmware on the blade to match the SAN compatibility matrix
D.Rezone the SAN fabric to use a different target port
AnswerC

Firmware mismatch after SAN upgrade is a common cause

Why this answer

The SAN firmware upgrade likely introduced a change in the Fibre Channel protocol behavior (e.g., link initialization or error recovery) that is incompatible with the current HBA firmware on the blade. The high 'Link Reset' events indicate that the vHBA is repeatedly reinitializing the link, which directly causes SCSI command timeouts. Updating the HBA firmware to match the SAN compatibility matrix ensures the HBA can properly negotiate and interoperate with the upgraded SAN fabric, resolving the intermittent timeouts.

Exam trap

The trap here is that candidates assume physical cabling or zoning is the cause of link resets, but Cisco often tests the concept that firmware mismatches after a SAN upgrade can cause intermittent FC link issues without any physical layer faults.

How to eliminate wrong answers

Option A is wrong because deleting and recreating the vHBA would not address the underlying firmware incompatibility; it would only reset the vHBA configuration, which would likely result in the same link reset behavior. Option B is wrong because the fibre channel cables are new and the storage array logs show no errors, indicating the physical layer is not the issue. Option D is wrong because rezoning the SAN fabric to use a different target port would not fix the HBA-to-switch link reset problem; the issue is at the HBA level, not the zoning or target port selection.

931
MCQhard

An engineer is configuring Fibre Channel PortChannels on a Cisco MDS switch. Which statement about Fibre Channel PortChannels is true?

A.They require all member ports to be on the same VSAN.
B.They can include both E-ports and F-ports in the same PortChannel.
C.They load-balance based on the source and destination WWPNs.
D.They are supported only in NPV mode.
AnswerC

Fibre Channel PortChannels use a hash of source and destination IDs (WWPNs) for load balancing.

Why this answer

Fibre Channel PortChannels require all member ports to be of the same type (e.g., all E-ports). They load-balance across links and are compatible with VSAN trunking. They do not require the same speed on all ports, but it is recommended.

932
MCQhard

In Cisco ACI, when integrating with VMware vSphere via VMM domain, what is the purpose of the 'vCenter Domain' policy?

A.To replace the need for VXLAN overlay in the fabric
B.To automatically configure virtual switch port groups and EPGs based on VM attributes
C.To manage storage connectivity for VMware clusters
D.To enable virtual machine mobility (vMotion) across data centers
AnswerB

VMM domain automates network provisioning for VMs.

Why this answer

The 'vCenter Domain' policy in Cisco ACI integrates with VMware vSphere by automatically creating and mapping virtual switch port groups to EPGs based on VM attributes such as VM name, operating system, or custom tags. This eliminates manual port group configuration and ensures consistent policy enforcement as VMs are deployed or moved within the VMM domain.

Exam trap

Cisco often tests the misconception that the VMM domain replaces the overlay or handles storage/vMotion, when in fact it is purely about automating EPG-to-port group mapping based on VM attributes.

How to eliminate wrong answers

Option A is wrong because the VMM domain does not replace the VXLAN overlay; ACI uses VXLAN (with IS-IS for underlay) as its fabric encapsulation, and the VMM domain simply extends policy to the hypervisor. Option C is wrong because storage connectivity for VMware clusters is managed by separate storage policies (e.g., VSAN or NFS), not by the vCenter Domain policy. Option D is wrong because vMotion across data centers requires Layer 2 extension (e.g., OTV or VXLAN EVPN) and is not a function of the vCenter Domain policy, which operates within a single ACI fabric and vCenter instance.

933
MCQhard

An Ansible playbook using the cisco.nxos.nxos_config module fails with the error: 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting'. What is the most likely cause?

A.The SSH key authentication is misconfigured.
B.The playbook includes an invalid parameter 'connection: network_cli' inside the task block.
C.The module is not installed correctly.
D.The playbook is targeting a device running an unsupported NX-OS version.
AnswerB

The 'connection' parameter is a play-level attribute, not a task parameter for nxos_config.

Why this answer

The error 'Unsupported parameters for (cisco.nxos.nxos_config) module: connection type setting' occurs because the `connection: network_cli` parameter is being passed inside the task block of the playbook. The `cisco.nxos.nxos_config` module does not accept a `connection` parameter at the task level; connection settings must be defined at the play or inventory level. This is a common syntax error when using Ansible network modules.

Exam trap

Cisco often tests the distinction between play-level and task-level parameters, specifically that `connection` is not a valid parameter for network modules at the task level, leading candidates to incorrectly attribute the error to module installation or device compatibility.

How to eliminate wrong answers

Option A is wrong because SSH key authentication misconfiguration would typically cause an authentication or permission denied error, not an 'unsupported parameters' error related to connection type. Option B is wrong because it is actually the correct answer; the error is caused by an invalid parameter inside the task block. Option C is wrong because if the module were not installed correctly, the error would be 'module not found' or 'could not locate module', not an unsupported parameters error.

Option D is wrong because an unsupported NX-OS version would result in a module execution failure or a device-specific error, not a parameter validation error from the Ansible controller.

934
MCQmedium

A data center engineer notices that a UCS B-Series blade server is failing to boot from a SAN LUN that is correctly mapped to the server's WWPN. The SAN switch shows that the LUN is accessible and the zone is configured correctly. The UCS Manager shows the server's vNIC is associated with a vHBA that has the correct WWPN, but the server's BIOS does not list the Fibre Channel boot target. Which configuration is most likely missing?

A.The SAN connectivity policy is missing the Fibre Channel uplink pinning.
B.The vNIC/vHBA placement policy is incorrectly set to 'Express' mode.
C.A QoS policy is not applied to the vHBA.
D.The boot policy is not defined or not attached to the service profile.
AnswerD

UCS B-Series requires a boot policy to specify the boot order and target LUN.

Why this answer

The boot policy defines the boot order and parameters (such as the SAN LUN target WWPN and LUN ID) for the server. If the boot policy is not defined or not attached to the service profile, the UCS Manager will not program the BIOS with the Fibre Channel boot target information, even though the SAN zoning and vHBA WWPN are correct. Without this policy, the server's BIOS has no instruction to attempt a SAN boot, resulting in the failure described.

Exam trap

Cisco often tests the distinction between SAN connectivity (zoning, WWPN) and the boot policy configuration, trapping candidates who assume that correct zoning and vHBA setup alone are sufficient for SAN boot.

How to eliminate wrong answers

Option A is wrong because the SAN connectivity policy with Fibre Channel uplink pinning controls how uplinks are mapped to fabric interconnects for load balancing or failover, not the boot target configuration. Option B is wrong because the vNIC/vHBA placement policy set to 'Express' mode affects how virtual interfaces are placed on the mezzanine cards or adapters, but does not prevent the BIOS from seeing a Fibre Channel boot target. Option C is wrong because a QoS policy applied to a vHBA manages traffic prioritization and bandwidth limits, not the presence or absence of a boot LUN in the BIOS boot list.

935
MCQmedium

A storage engineer needs to isolate two Fibre Channel fabrics within the same physical infrastructure using Cisco MDS switches. Which feature allows the creation of multiple logical Fibre Channel networks on the same set of switches?

A.NPV
B.PortChannels
C.Zoning
D.VSANs
AnswerD

VSANs create separate logical FC fabrics on the same physical switches.

Why this answer

VSANs (Virtual SANs) provide isolation similar to VLANs in Ethernet, allowing multiple separate FC fabrics to operate on the same physical switches.

936
MCQhard

Refer to the exhibit. An engineer is using an Ansible playbook to configure a Nexus switch. The playbook task uses the nxos_config module to set an MTU value on an interface. What is the most likely issue?

A.Add the 'provider' parameter with connection details.
B.Correct the spelling of the MTU parameter to 'mtu_size'.
C.Use the nxos_mtu module instead of nxos_config to configure MTU.
D.Verify that the switch supports MTU configuration via Ansible.
AnswerC

The nxos_config module does not support MTU; the nxos_mtu module is designed for this purpose.

Why this answer

The nxos_config module is a generic module for applying arbitrary configuration commands, but it does not validate or handle the specific semantics of MTU configuration. The nxos_mtu module is purpose-built to manage MTU settings on Nexus interfaces, ensuring correct syntax and idempotent behavior. Therefore, using nxos_mtu is the appropriate approach for this task.

Exam trap

Cisco often tests the distinction between generic configuration modules (nxos_config) and specialized modules (nxos_mtu, nxos_vlan, etc.), trapping candidates who assume any configuration can be done with nxos_config alone.

How to eliminate wrong answers

Option A is wrong because the 'provider' parameter is deprecated in modern Ansible versions; connection details are now handled via the 'connection: local' or 'ansible_connection' variable, not a separate provider parameter. Option B is wrong because the correct parameter name for MTU in the nxos_config module is 'mtu', not 'mtu_size', and the issue is not a spelling error but a module mismatch. Option D is wrong because Nexus switches universally support MTU configuration via Ansible; the issue is the module choice, not hardware or software compatibility.

937
MCQmedium

Refer to the exhibit. An automation script is used to configure a new VLAN 40 on Eth1/2 trunk. The script sends the following NX-API command: 'switchport trunk allowed vlan add 40'. After execution, the engineer runs 'show running-config interface eth1/2' and sees that the trunk allowed VLAN list shows '10,20,30'. The automation script logs indicate success for adding VLAN 40, but the running config does not show the change. What is the most likely issue?

A.The command syntax is incorrect; 'add' is not a valid keyword.
B.The engineer is viewing a different switch or the configuration was reverted by another process.
C.The script actually removed the existing VLANs and replaced them with only VLAN 40.
D.The NX-API command was sent to the wrong interface.
AnswerB

If the script succeeded but the running config on the inspected device lacks the change, the most likely cause is that the engineer is viewing a different switch or the configuration was reverted after the script completed.

Why this answer

The running config output shows that VLAN 40 is not included in the allowed list (10,20,30), indicating the command did not take effect on this device. The script logs showing success suggest the command was executed successfully on some device, but likely not the one the engineer is viewing. This could be due to a configuration rollback or the engineer viewing a different switch.

Therefore, option B is correct.

Exam trap

Cisco often tests the candidate's ability to distinguish between a command that fails silently versus a command that succeeds but the result is not visible due to environmental factors (e.g., wrong device, configuration rollback), rather than a syntax or interface error.

How to eliminate wrong answers

Option A is wrong because 'switchport trunk allowed vlan add 40' is valid NX-OS syntax; the 'add' keyword is used to append VLANs to the existing allowed list. Option C is wrong because if the script had replaced the list with only VLAN 40, the running config would show '40' alone, not '10,20,30,40'. Option D is wrong because the running config shows the change on Eth1/2, confirming the command was sent to the correct interface.

938
Multi-Selecthard

Which three of the following are characteristics of the ACI Management Information Tree (MIT)? (Choose three.)

Select 3 answers
A.It is a hierarchical tree structure
B.The APIC REST API interacts with the MIT using JSON or XML
C.It can be accessed via SNMP
D.It is a flat database without hierarchy
E.Objects are identified by a distinguished name (DN)
AnswersA, B, E

The MIT is organized as a tree.

Why this answer

The MIT is a hierarchical tree with objects like Tenant, AP, EPG, BD. Each object has a distinguished name (DN). The APIC REST API uses JSON/XML.

SNMP is not used for ACI management. The MIT is not flat; it is hierarchical.

939
MCQhard

An organization is deploying a new ACI fabric. The design requires that traffic between EPGs in the same bridge domain be allowed by default, but traffic between EPGs in different bridge domains must be denied unless explicitly permitted. Which contract scope configuration meets this requirement?

A.Context (default)
B.Application-profile
C.Global
D.VRF
AnswerD

VRF scope allows contracts to apply across bridge domains within the same VRF; without a contract, traffic is denied, and with a contract, permitted.

Why this answer

The VRF (private L3 context) is the correct scope because contract scope determines the boundary within which a contract is effective. By setting the contract scope to VRF, the contract applies only to EPGs within the same VRF. Since EPGs in different bridge domains are typically in the same VRF, you must explicitly configure contracts to permit inter-EPG traffic; otherwise, it is denied by default.

This matches the requirement that traffic between EPGs in the same bridge domain is allowed by default (via the default intra-EPG and intra-bridge domain forwarding), while traffic between EPGs in different bridge domains requires an explicit contract.

Exam trap

Cisco often tests the misconception that 'context' is a separate scope option, when in fact the default contract scope is VRF (context), and the exam expects you to know that VRF is the correct term for the private L3 network boundary that enforces the deny-by-default inter-EPG behavior.

How to eliminate wrong answers

Option A (Context/default) is wrong because the default contract scope is actually 'context' (VRF), not a separate scope; the term 'Context' is ambiguous and not a distinct contract scope in ACI—the default behavior is VRF-level scoping, which already denies inter-EPG traffic without a contract. Option B (Application-profile) is wrong because contract scope at the application-profile level would restrict the contract to EPGs within the same application profile, but this does not address the requirement for bridge-domain-level isolation; it is too narrow and would not allow default intra-bridge domain traffic across different application profiles. Option C (Global) is wrong because a global contract scope makes the contract apply across all VRFs, which would permit traffic between EPGs in different VRFs (and thus different bridge domains) without explicit permission, violating the requirement that such traffic must be denied by default.

940
MCQmedium

A storage engineer is planning to migrate from an existing 2 Gbps Fibre Channel fabric to a new 16 Gbps fabric while maintaining connectivity during the cutover. The legacy and new switches are connected via ISL and use the same VSAN. What is a best practice to ensure a seamless migration?

A.Assign the new switches to a separate VSAN to prevent mixing
B.Set the ISL port speed to 2 Gbps on both sides until the migration is complete
C.Use a dedicated ISL for the migration and move zones gradually
D.Disable zoning on both fabrics and re-apply after migration
AnswerB

Ensures compatibility and stable fabric merge.

Why this answer

Setting the ISL port speed to 2 Gbps on both sides ensures that the new 16 Gbps switch negotiates down to the legacy fabric's speed, preventing buffer-to-buffer credit mismatches and frame corruption during the cutover. This allows both fabrics to operate at a common speed, maintaining stable connectivity until all devices are migrated and the ISL speed can be safely increased.

Exam trap

Cisco often tests the misconception that simply connecting a higher-speed switch to a lower-speed fabric via ISL will auto-negotiate correctly, but the trap here is that without manually setting the speed, the link may fail to establish or cause instability due to incompatible buffer-to-buffer credit management.

How to eliminate wrong answers

Option A is wrong because assigning the new switches to a separate VSAN would isolate them from the legacy fabric, preventing any communication or gradual migration of devices across the ISL. Option C is wrong because using a dedicated ISL does not address the fundamental speed mismatch; without speed negotiation, the 16 Gbps port may not properly interoperate with the 2 Gbps port, leading to link instability or failure. Option D is wrong because disabling zoning on both fabrics would expose all devices to each other, creating a security risk and potential data corruption; zoning should remain active and be migrated incrementally.

941
MCQhard

During an FCoE deployment, the server team reports that hosts can reach the storage array but performance is intermittent with periodic timeouts. The network team sees no errors on the FCoE VLAN. The DCB configuration on the upstream switch shows that PFC is enabled for CoS 3. What should the engineer check next?

A.Verify that jumbo frames are enabled on the storage array
B.Confirm that the VSAN is appropriately sized for the number of hosts
C.Ensure that the FCoE VLAN is enabled for FCoE on the server's vNIC
D.Check if the PFC configuration matches on both ends and that PFC is enabled on the FCoE VLAN interfaces
AnswerD

PFC must be consistent across all hops.

Why this answer

D is correct because PFC (Priority Flow Control) must be consistently configured on both ends of an FCoE link to prevent frame loss. If PFC is enabled for CoS 3 on the upstream switch but not on the server's vNIC or the FCoE VLAN interfaces, the lack of lossless behavior causes intermittent timeouts and performance degradation, even if the FCoE VLAN shows no errors.

Exam trap

Cisco often tests the misconception that FCoE performance issues are due to VLAN or VSAN misconfiguration, when the real culprit is mismatched PFC settings between endpoints.

How to eliminate wrong answers

Option A is wrong because jumbo frames are not required for FCoE; FCoE typically uses 2500-byte frames, but the issue is about lossless delivery, not MTU size. Option B is wrong because VSAN sizing relates to zoning and fabric management, not to PFC or link-level flow control; the problem is at Layer 2, not VSAN capacity. Option C is wrong because the FCoE VLAN must be enabled on the switch port, not the server's vNIC; the server team already reports reachability, indicating the VLAN is active, so this is a misdirection about where the configuration is applied.

942
MCQmedium

Refer to the exhibit. An engineer configured NX-API on a Nexus 9000 switch. The REST API client receives 'SSL_ERROR_BAD_CERT_DOMAIN'. What is the most likely cause?

A.HTTP is enabled which conflicts with HTTPS
B.The key file is missing
C.The certificate file is corrupted
D.The certificate does not match the switch's hostname
AnswerD

SSL_ERROR_BAD_CERT_DOMAIN specifically indicates domain mismatch.

Why this answer

The SSL_ERROR_BAD_CERT_DOMAIN error indicates that the certificate presented by the Nexus 9000 switch does not match the hostname used in the REST API client's request. When NX-API uses HTTPS, the client validates the server's certificate against the requested domain; a mismatch triggers this error. This is a common TLS/SSL certificate validation issue, not a problem with HTTP conflicts, missing keys, or corrupted files.

Exam trap

Cisco often tests the distinction between certificate validation errors (domain mismatch, expiry, untrusted CA) and other TLS/SSL failures (missing key, corrupted file), expecting candidates to recognize that 'SSL_ERROR_BAD_CERT_DOMAIN' specifically points to a hostname mismatch rather than a general certificate problem.

How to eliminate wrong answers

Option A is wrong because enabling HTTP alongside HTTPS does not cause SSL certificate domain validation errors; the error is specific to TLS handshake and certificate trust, not protocol conflicts. Option B is wrong because a missing key file would prevent the switch from establishing any HTTPS connection (e.g., 'no key' or 'unable to load private key' errors), not a domain mismatch error. Option C is wrong because a corrupted certificate file would typically cause a 'bad certificate' or 'certificate verify failed' error during the TLS handshake, not a domain mismatch error which is a hostname validation failure.

943
MCQhard

Refer to the exhibit. An engineer notices intermittent packet loss on interface Ethernet 1/1 of the Fabric Interconnect. Based on the transceiver statistics shown, which condition is the most likely cause?

A.The receive power is below the low warning threshold.
B.The supply voltage is out of range.
C.The transmit power is too low.
D.The transceiver temperature is too high.
AnswerA

The receive power is -16.3 dBm, which is below the low warning threshold of -13.3 dBm, indicating a weak optical signal causing packet loss.

Why this answer

The exhibit shows that the receive power is -16.3 dBm, which is below the low warning threshold of -13.3 dBm. This indicates the incoming optical signal is too weak, causing intermittent packet loss due to bit errors or link flaps. The transceiver statistics confirm that the receive power is the only parameter breaching its threshold, making it the most likely cause.

Exam trap

Cisco often tests the distinction between warning and alarm thresholds, and candidates mistakenly assume any parameter outside a threshold causes the issue, but here only the receive power is below its warning threshold, while the other values are within normal ranges.

How to eliminate wrong answers

Option B is wrong because the supply voltage is 3.29 V, which is within the normal operating range (typically 3.1 V to 3.5 V for SFP+ optics), so it is not out of range. Option C is wrong because the transmit power is -2.4 dBm, which is above the low warning threshold of -5.3 dBm, indicating the transmitter is functioning correctly. Option D is wrong because the transceiver temperature is 42.5°C, which is well below the high warning threshold of 75°C, so overheating is not an issue.

944
Drag & Dropmedium

Order the steps for troubleshooting a Fibre Channel link that is not coming up.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Troubleshooting FC link starts with physical, then interface, VSAN/zoning, FLOGI, and logs.

945
MCQeasy

Which component in a UCS 5108 blade chassis provides the connectivity between the blade servers and the Fabric Interconnects?

A.Chassis management controller (CMC)
B.Midplane
C.I/O Module (IOM)
D.Fabric Extender (FEX)
AnswerC

IOMs provide the network connectivity between blades and FIs.

Why this answer

The I/O Module (IOM) in the UCS 5108 chassis provides the uplink ports that connect to the Fabric Interconnects and the downlink ports that connect to the blade servers.

946
MCQmedium

Refer to the exhibit. A network engineer notices that traffic for VNI 10000 is not being encapsulated. What is the most likely reason?

A.BGP EVPN is not configured.
B.VNI 10000 is not configured under the nve interface.
C.The VRF association is incorrect.
D.The source-interface is not reachable.
AnswerB

The show output clearly does not include member vni 10000.

Why this answer

VNI 10000 must be explicitly mapped to an NVE interface under the 'interface nve1' configuration using the 'member vni 10000' command. Without this mapping, the NVE interface does not know which VNI to encapsulate traffic for, even if the VNI exists in the network. Option B correctly identifies this missing configuration as the most likely cause.

Exam trap

Cisco often tests the distinction between control-plane (BGP EVPN) and data-plane (NVE interface) configurations, trapping candidates who assume that a VNI configured in the VRF or advertised via EVPN automatically enables encapsulation on the NVE interface.

How to eliminate wrong answers

Option A is wrong because BGP EVPN is the control plane protocol used to advertise VNI reachability, but traffic encapsulation itself is a data-plane function performed by the NVE interface; the absence of BGP EVPN would prevent route distribution but not directly block encapsulation if the VNI is already configured under NVE. Option C is wrong because VRF association is a Layer 3 construct that maps a VRF to a VNI for routing, but encapsulation failure for VNI 10000 specifically points to the NVE interface configuration, not the VRF mapping. Option D is wrong because if the source-interface were unreachable, no VNI traffic would be encapsulated at all, not just VNI 10000; the issue is isolated to a single VNI, indicating a configuration omission rather than a reachability problem.

947
MCQhard

A large financial institution has a Cisco ACI fabric with multiple tenants. The security team requires that all management access to the APIC controllers be authenticated via multi-factor authentication (MFA) using a RADIUS server. The RADIUS server is configured to send a One-Time Password (OTP) challenge during authentication. The current configuration uses local authentication. The engineer needs to implement RADIUS authentication with MFA for APIC GUI and CLI access. The RADIUS server is reachable at 10.10.10.10, shared secret 'SecureSecret123'. The APIC is running software version 4.2(3). The engineer must ensure that local authentication is used as fallback if the RADIUS server is unreachable. Which of the following actions should the engineer take?

A.Configure TACACS+ as the authentication protocol and set the server IP and secret.
B.Enable local authentication only and require strong passwords.
C.Add a RADIUS provider with IP 10.10.10.10 and secret 'SecureSecret123', create a login domain with realm 'radius', set fallback to 'local', and assign the domain to users.
D.Configure LDAP authentication with the RADIUS server acting as an LDAP proxy.
AnswerC

Correct: RADIUS with PAP is used for MFA and fallback to local.

Why this answer

It follows the required steps to configure RADIUS authentication with MFA on Cisco APIC: adding a RADIUS provider with the correct IP and shared secret, creating a login domain with realm 'radius', setting fallback to 'local', and assigning the domain to users. This ensures that the APIC sends authentication requests to the RADIUS server, which can issue an OTP challenge for MFA, and falls back to local authentication if the RADIUS server is unreachable.

Exam trap

Cisco often tests the requirement to create a login domain and assign it to users, as many candidates mistakenly think simply adding a RADIUS provider is sufficient without configuring the domain and fallback.

How to eliminate wrong answers

Option A is wrong because TACACS+ is not supported for APIC authentication; APIC only supports RADIUS, LDAP, and local authentication for management access. Option B is wrong because enabling only local authentication with strong passwords does not implement MFA via RADIUS, which is a specific requirement. Option D is wrong because LDAP authentication cannot use a RADIUS server as an LDAP proxy; LDAP and RADIUS are separate protocols with different purposes and configurations.

948
MCQeasy

In ACI, which model is used for micro-segmentation to allow traffic between EPGs?

A.Blacklist model using taboo contracts
B.IP-based ACLs on leaf switches
C.VRF leaking
D.Whitelist model using contracts
AnswerD

Correct: ACI contracts define permitted traffic.

Why this answer

ACI uses a whitelist model via contracts to permit traffic between EPGs.

949
MCQeasy

A storage administrator wants to ensure that only designated initiators can access a specific target in a Fibre Channel SAN. Which mechanism enforces this policy?

A.IVR
B.Port channel
C.Zoning
D.VSAN
E.Credit recovery
AnswerC

Zoning defines which initiators can talk to which targets.

Why this answer

Zoning is the correct mechanism because it restricts Fibre Channel (FC) communication to only those initiators and targets that are members of the same zone. By defining a zone that includes only the designated initiator WWPNs and the target WWPN, the switch enforces access control at the fabric level, preventing any unauthorized device from discovering or communicating with the target.

Exam trap

Cisco often tests the distinction between VSAN (which isolates traffic at the fabric level) and zoning (which controls device-level access within a VSAN), leading candidates to incorrectly select VSAN when the question specifically asks about restricting access to a target.

How to eliminate wrong answers

Option A (IVR) is wrong because Inter-VSAN Routing (IVR) enables selective communication between devices in different VSANs, not access control within a single VSAN or target. Option B (Port channel) is wrong because it aggregates multiple physical links into a single logical link for bandwidth and redundancy, not for enforcing initiator-to-target access policies. Option D (VSAN) is wrong because a VSAN creates an isolated virtual fabric, but within a VSAN all devices can communicate unless further restricted by zoning; VSAN alone does not enforce per-initiator access to a specific target.

Option E (Credit recovery) is wrong because it is a buffer-to-buffer credit recovery mechanism (BB_CR) used to recover lost credits in FC links, unrelated to access control.

950
MCQmedium

A data center uses NPV to connect edge switches to a core Fibre Channel switch. The edge switches report that some servers cannot log in. What is a likely cause?

A.Overlapping VSAN IDs between edge and core
B.F port binding on the edge switch
C.Trunking mode not enabled on the core switch
D.NPIV not enabled on the core switch
AnswerD

Correct: NPIV must be enabled on core switches to support NPV.

Why this answer

In an NPV environment, the edge switch (NPV mode) relies on the core Fibre Channel switch to handle fabric login (FLOGI) and name server registration. NPIV (N_Port ID Virtualization) must be enabled on the core switch to allow multiple N_Port IDs to be assigned to a single physical N_Port, which is essential for NPV to function. If NPIV is not enabled on the core, the core switch cannot accept FLOGI requests from the NPV edge switch, preventing servers from logging into the fabric.

Exam trap

Cisco often tests the misconception that trunking mode or VSAN mismatches are the primary cause of NPV login failures, but the critical requirement is NPIV on the core switch, as NPV relies on it to handle multiple virtual N_Port IDs over a single physical link.

How to eliminate wrong answers

Option A is wrong because overlapping VSAN IDs between edge and core are not inherently problematic; NPV requires the VSANs to match between the edge and core for traffic to be forwarded correctly, but overlapping IDs are expected and do not cause login failures. Option B is wrong because F port binding on the edge switch restricts which devices can connect via F ports but does not prevent servers from logging in through NPV; it would only block specific WWNs, not cause a general login failure. Option C is wrong because trunking mode (E_port trunking) is used to aggregate multiple ISLs between switches, but it is not required for basic NPV operation; the core switch can operate with standard E_ports and still support NPV logins.

951
MCQeasy

In a UCS service profile, which construct is used to abstract the network interface configuration so that the same profile can be used with different blade models?

A.Boot policy
B.Local disk policy
C.Server pool policy
D.vNIC template
AnswerD

vNIC templates provide standardized network interface configurations.

Why this answer

vNIC templates define network interface properties (MAC address, VLANs, fabric assignment) and can be policy-based, allowing hardware abstraction.

952
MCQmedium

A Cisco MDS 9000 switch is used in a storage network. The security policy requires that a junior administrator named 'user1' can view zone configurations but cannot make any changes. Currently, 'user1' is assigned the default 'network-operator' role, which allows read-only access to most configuration, but the engineer wants to ensure that zone modification is explicitly denied. The engineer creates a custom role named 'zone-viewer' and assigns it to 'user1'. The role should permit viewing of the running configuration related to zones but deny any command that modifies zone or zoneset configurations. Which configuration best achieves this objective?

A.role name zone-viewer feature zone; permit command configure terminal ; zone name etc.
B.role name zone-viewer permit command show zone*; permit command show zoneset*
C.role name zone-viewer rule 1 permit read-write; feature zone
D.role name zone-viewer permit command zone; permit command zoneset; permit command zone-create
AnswerB

Permits show commands for zone and zoneset, denying configuration commands by default.

Why this answer

It uses the 'permit command' statements with wildcard patterns ('show zone*' and 'show zoneset*') to explicitly allow only show commands related to zones and zonesets. By not including any 'permit' or 'deny' statements for configuration commands (like 'configure terminal', 'zone', or 'zoneset'), the role implicitly denies all other commands, including those that modify zone or zoneset configurations. This matches the requirement to allow viewing but deny modifications.

Exam trap

Cisco often tests the implicit deny behavior of RBAC, where candidates mistakenly think they must explicitly deny modification commands, when in fact only permitting the desired show commands is sufficient to block all other commands.

How to eliminate wrong answers

Option A is wrong because it includes 'permit command configure terminal' and 'zone name etc.' which would allow the user to enter configuration mode and potentially modify zone configurations, violating the security policy. Option C is wrong because 'rule 1 permit read-write' grants full read-write access to the zone feature, allowing modifications, and does not restrict to read-only. Option D is wrong because it permits 'zone', 'zoneset', and 'zone-create' commands, which are used to create and modify zones and zonesets, directly contradicting the requirement to deny modifications.

953
MCQmedium

Which ECMP load-balancing method is recommended for data center spine-leaf fabrics to ensure optimal traffic distribution?

A.Per-flow load balancing based on src-dst IP
B.Per-packet load balancing
C.Weighted load balancing
D.Per-flow load balancing based on src-dst MAC
AnswerA

This ensures packets of the same flow take the same path.

Why this answer

Per-flow load balancing based on src-dst IP ensures that all packets belonging to the same flow (identified by source and destination IP addresses) follow the same path, preventing packet reordering while still distributing different flows across multiple equal-cost paths. In spine-leaf fabrics, this method provides optimal traffic distribution because it leverages the IP header information that is consistently available across Layer 3 boundaries, aligning with the fabric's routing-based forwarding model.

Exam trap

Cisco often tests the misconception that per-packet load balancing is more granular and therefore better for distribution, but the trap is that it ignores the critical requirement of packet ordering for TCP performance, making per-flow the only viable choice for production data center fabrics.

How to eliminate wrong answers

Option B is wrong because per-packet load balancing sends individual packets of the same flow over different paths, causing severe packet reordering and performance degradation in TCP/IP networks. Option C is wrong because weighted load balancing is used when paths have unequal costs (e.g., with the 'bandwidth' parameter in OSPF or EIGRP), but ECMP in spine-leaf fabrics assumes equal-cost paths, making weighting unnecessary. Option D is wrong because per-flow load balancing based on src-dst MAC is only effective within a Layer 2 domain; in a routed spine-leaf fabric, MAC addresses change at each Layer 3 hop (due to next-hop MAC rewrite), making them unreliable for consistent flow identification across the fabric.

954
MCQeasy

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

A.show aaa authentication
B.show dot1x interface ethernet 1/1
C.show authentication interface ethernet 1/1
D.show port-security interface ethernet 1/1
AnswerB

This command displays the 802.1X authentication details for the specified interface on Nexus switches, making it the correct choice for verifying a specific interface's authentication status.

Why this answer

The correct command on Cisco Nexus switches to verify 802.1X authentication status on a specific interface is 'show dot1x interface ethernet 1/1'. This command displays the 802.1X state, authorized status, and other details for the specified interface. Option B, 'show dot1x interface ethernet 1/1', is correct.

Option C is incorrect because 'show authentication interface' is not a valid command on Nexus NX-OS; it is used on IOS-based switches. Option A is unrelated to 802.1X, and option D shows port security, not authentication status.

Exam trap

Cisco often tests the distinction between the legacy 'show dot1x' command and the modern unified 'show authentication interface' command, trapping candidates who memorize the older command without realizing that newer IOS versions (e.g., IOS-XE 16.x+) consolidate all authentication status under the 'show authentication' hierarchy.

How to eliminate wrong answers

Option A is wrong because 'show aaa authentication' displays the global AAA authentication method lists and their order, not the per-interface authentication status or 802.1X state. Option B is wrong because 'show dot1x' without an interface keyword shows global 802.1X parameters, not the detailed per-interface status; even 'show dot1x interface ethernet 1/1' is deprecated in favor of the unified 'show authentication interface' command in newer IOS versions. Option D is wrong because 'show port-security interface ethernet 1/1' shows port security violation counts and secure MAC addresses, which is unrelated to 802.1X authentication state machines or EAPOL exchanges.

955
MCQeasy

A network engineer is configuring a new UCS B-series blade server. The engineer wants the server to automatically inherit network and storage settings without manual configuration when replaced. Which UCS technology enables this capability?

A.Service profile template
B.Fabric Interconnect failover
C.Cisco IMC Supervisor
D.Cisco UCS Manager
AnswerA

Service profiles and templates provide hardware abstraction, enabling stateless computing.

Why this answer

Service profile templates in Cisco UCS Manager allow administrators to define a reusable configuration for network and storage settings. When a server fails or is replaced, the template is applied to the new blade, automatically inheriting all settings without manual intervention. This capability is central to UCS's stateless computing model, where hardware identity and policies are abstracted from the physical server.

Exam trap

Cisco often tests the distinction between the management platform (UCS Manager) and the specific feature (service profile template) that enables stateless computing and automatic configuration inheritance.

How to eliminate wrong answers

Option B is wrong because Fabric Interconnect failover provides high availability for the UCS fabric, not automatic server configuration inheritance upon replacement. Option C is wrong because Cisco IMC Supervisor is a management tool for standalone (non-UCS) servers, not for B-series blades in a UCS domain. Option D is wrong because Cisco UCS Manager is the overall management platform, but the specific feature that enables automatic inheritance of settings on server replacement is the service profile template, not the manager itself.

956
MCQhard

A large enterprise runs a multi-site Cisco ACI fabric with APICs in a cluster. The automation team uses Python scripts with the Cobra SDK to create and manage tenant policies. Recently, after upgrading the APIC firmware from version 4.2(3) to 5.2(1), a script that previously worked now fails with an 'Unauthorized' error when calling the APIC REST API. The script uses a service account with a locally stored password. The automation engineer verifies that the account credentials are correct and that the account is not locked. The script was not modified during the upgrade. Which action should the engineer take to resolve the issue?

A.Change the authentication method in the script from password-based to certificate-based authentication.
B.Upgrade the Python requests library to version 2.25.0 or later that supports TLS 1.3.
C.Regenerate the API key for the service account and update the script with the new key.
D.Disable TLS 1.3 on the APIC by setting the 'ssl-protocols' parameter to TLSv1.2 only.
AnswerB

Upgrading the library ensures TLS 1.3 compatibility, preserving security.

Why this answer

APIC firmware 5.2(1) enforces TLS 1.3 by default, and older Python requests libraries (pre-2.25.0) do not support TLS 1.3, causing the handshake to fail with an 'Unauthorized' error despite valid credentials. Upgrading the requests library to version 2.25.0 or later adds TLS 1.3 support, allowing the script to authenticate successfully.

Exam trap

The trap here is that candidates assume the 'Unauthorized' error is due to invalid credentials or authentication method, when in fact it is caused by a TLS protocol version mismatch between the client library and the upgraded APIC.

How to eliminate wrong answers

Option A is wrong because changing from password-based to certificate-based authentication is unnecessary; the credentials are valid and the issue is a TLS version mismatch, not an authentication method problem. Option C is wrong because the service account uses a password, not an API key, and regenerating a non-existent key would not resolve the TLS 1.3 handshake failure. Option D is wrong because disabling TLS 1.3 on the APIC is a workaround that reduces security and is not the recommended fix; the proper solution is to update the client library to support the newer protocol.

957
MCQhard

An engineer is troubleshooting a BGP EVPN issue where leaf switches are not learning remote MAC addresses. The underlay is reachable and BGP sessions are established. What is a likely cause?

A.Missing 'address-family l2vpn evpn' under the BGP neighbor configuration
B.NVE interface not enabled
C.Incorrect VNI configuration
D.MTU mismatch on the underlay
AnswerA

This address family must be activated to exchange EVPN routes.

Why this answer

Even when the underlay is reachable and BGP sessions are established, the BGP EVPN control plane requires the 'address-family l2vpn evpn' to be explicitly activated under the BGP neighbor configuration. Without this, the leaf switch will not exchange EVPN routes (Type-2 MAC/IP advertisement routes) with its peers, so remote MAC addresses are never learned. This is a common misconfiguration because BGP sessions may appear up but are not carrying the necessary EVPN address family.

Exam trap

Cisco often tests the distinction between a BGP session being 'established' and the specific address family being activated, leading candidates to overlook the missing 'address-family l2vpn evpn' under the neighbor configuration.

How to eliminate wrong answers

Option B is wrong because the NVE interface is the data-plane tunnel endpoint; if it were not enabled, VXLAN traffic would not be forwarded, but the issue here is specifically about learning remote MAC addresses via the control plane, not data-plane forwarding. Option C is wrong because an incorrect VNI configuration would cause traffic to be mapped to the wrong VXLAN segment or dropped, but it would not prevent the BGP control plane from learning remote MAC addresses if the EVPN address family is properly configured. Option D is wrong because an MTU mismatch on the underlay would cause packet fragmentation or drops for large data-plane packets, but it does not affect the BGP control-plane exchange of EVPN routes, which uses smaller TCP segments.

958
MCQmedium

An engineer is configuring Cisco ACI to secure inter-tenant traffic. Tenants 'TenantA' and 'TenantB' need to communicate via a shared service, such as a DNS server in TenantA. How should the contract be configured?

A.Create a contract in TenantA and apply it to the VRF shared between tenants.
B.Create a contract in TenantA. Set the DNS EPG as provider. In TenantB, create a consumer EPG and provide the contract from TenantA.
C.Create a contract in TenantB. Set the DNS EPG as consumer. In TenantA, create a provider EPG and provide the contract from TenantB.
D.Create a contract in TenantA. Set both DNS EPG and TenantB EPG as providers.
AnswerB

Standard shared service design: provider's tenant contains the contract.

Why this answer

In Cisco ACI, inter-tenant communication via a shared service requires the contract to be created in the tenant that owns the shared service (provider). The provider EPG (DNS server in TenantA) is set as the provider, and the consumer EPG (in TenantB) consumes the contract from TenantA. This allows TenantB to access the DNS service without exposing its own EPGs, maintaining security isolation while enabling necessary traffic.

Exam trap

Cisco often tests the misconception that the contract must be created in the consumer's tenant or applied to the VRF, but the correct approach is to create the contract in the provider's tenant and explicitly define the provider EPG.

How to eliminate wrong answers

Option A is wrong because applying a contract to the VRF shared between tenants does not define the provider/consumer relationship; contracts must be applied to EPGs, not VRFs, and the provider EPG must be explicitly set. Option C is wrong because the contract should be created in the tenant that owns the shared service (TenantA), not TenantB, and the DNS EPG should be the provider, not the consumer. Option D is wrong because setting both EPGs as providers would create a symmetric relationship, which is incorrect for a shared service scenario where one EPG provides and the other consumes; this would also break the intended unidirectional traffic flow.

959
MCQeasy

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

A.RADIUS
B.LDAP
C.SSH
D.TACACS+
AnswerD

TACACS+ encrypts entire packet except header and separates AAA functions.

Why this answer

TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.

Exam trap

Cisco often tests the misconception that RADIUS encrypts all communication because it uses a shared secret, but in reality RADIUS only encrypts the password field, not the entire payload, making TACACS+ the correct choice for full-packet encryption beyond the header.

How to eliminate wrong answers

Option A (RADIUS) is wrong because it combines authentication and authorization into a single process, does not separate them, and only encrypts the password field in the Access-Request packet, leaving other attributes like username and accounting data in cleartext. Option B (LDAP) is wrong because it is a directory access protocol used for querying and modifying directory services, not a AAA protocol; it does not natively separate authentication, authorization, and accounting, nor does it encrypt all communication beyond the header by default. Option C (SSH) is wrong because it is a secure transport protocol for remote CLI access and file transfer, not a AAA protocol; it does not provide separate authentication, authorization, and accounting functions as a service.

960
MCQmedium

An engineer is deploying a HyperFlex cluster with three nodes using all-flash storage and replication factor 2 (RF2). What is the minimum number of nodes required to tolerate a single node failure?

A.3
B.2
C.5
D.4
AnswerA

Correct. Three nodes with RF2 can tolerate one failure.

Why this answer

With RF2, data is replicated to two nodes. If one node fails, the other node still holds a copy, so the cluster continues. However, for strict fault tolerance, a witness VM is needed to avoid split-brain.

Three nodes with RF2 can tolerate one node failure.

961
MCQeasy

An administrator configures 'aaa authentication login default group tacacs+ local'. What happens if the TACACS+ server is unreachable?

A.The switch uses no authentication
B.Authentication fails
C.The switch tries the next method in the group
D.Local username database is used
AnswerD

The config includes 'local' as a fallback method after group tacacs+.

Why this answer

The command 'aaa authentication login default group tacacs+ local' configures a method list where the first method is TACACS+ and the second is local. If the TACACS+ server is unreachable (not responding, not rejecting), the switch falls back to the next method in the list, which is local authentication using the local username database. This fallback behavior is defined by Cisco IOS/IOS-XE authentication method lists, where 'local' acts as a backup when the primary method is unavailable.

Exam trap

Cisco often tests the distinction between a server being unreachable (fallback occurs) versus a server rejecting credentials (authentication fails immediately), causing candidates to incorrectly assume that any TACACS+ issue results in authentication failure.

How to eliminate wrong answers

Option A is wrong because the switch does not use 'no authentication'; the 'default' method list requires authentication, and fallback to local ensures authentication still occurs. Option B is wrong because authentication does not fail outright; failure only occurs if all methods in the list are exhausted or if the server explicitly rejects the credentials (e.g., via a 'DENIED' response). Option C is wrong because 'group tacacs+' is a single method group; the switch does not try 'the next method in the group'—it tries the next method in the list, which is 'local', not another server within the same group.

962
MCQeasy

An engineer needs to ensure that only authorized servers can connect to a specific switch port in a data center. The port connects to a critical database server with fixed MAC address 00:1a:2b:3c:4d:5e. Which configuration is most appropriate?

A.switchport port-security switchport port-security mac-address 001a.2b3c.4d5e switchport port-security violation shutdown
B.switchport port-security switchport port-security maximum 1 switchport port-security violation shutdown
C.no switchport port-security spanning-tree portfast
D.switchport port-security switchport port-security maximum 2 switchport port-security violation protect
AnswerA

Statically configures the authorized MAC, exactly meeting the requirement.

Why this answer

It explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.

Exam trap

Cisco often tests the distinction between specifying a static MAC address versus relying on dynamic learning with a maximum count, where candidates mistakenly think limiting to one MAC is sufficient without binding the specific authorized address.

How to eliminate wrong answers

Option B is wrong because it only limits the maximum number of MAC addresses to 1 without specifying the allowed MAC address, so the port will learn the first MAC it sees, which could be an unauthorized device if it connects first. Option C is wrong because it disables port security entirely and enables spanning-tree portfast, which provides no MAC-based access control and allows any device to connect. Option D is wrong because it sets the maximum to 2, allowing two MAC addresses, and uses the protect violation mode, which simply drops frames from unauthorized sources without alerting or disabling the port, failing to ensure only the authorized server can connect.

963
MCQeasy

What is the primary function of the Cisco Integrated Management Controller (CIMC) on UCS C-series rack servers?

A.To manage the server's power and cooling via IPMI
B.To provide in-band management through the host OS
C.To provide out-of-band management with KVM, virtual media, and remote firmware update
D.To integrate the rack server into UCS Manager fabric
AnswerC

Correct. CIMC enables remote management even if the host OS is offline.

Why this answer

CIMC provides out-of-band management capabilities such as remote KVM, virtual media, and firmware updates, allowing administrators to manage the server independently of the host OS.

964
MCQeasy

Which management interface is used for out-of-band configuration and remote KVM access to a standalone UCS C-series rack server?

A.UCS Central
B.CIMC
C.Cisco IMC Supervisor
D.UCS Manager
AnswerB

Correct. CIMC is the embedded management controller for rack servers.

Why this answer

Cisco Integrated Management Controller (CIMC) provides out-of-band management, including remote KVM, virtual media, and firmware updates.

965
MCQmedium

In a vPC setup, what is the purpose of the vPC peer-keepalive link?

A.To detect the failure of a vPC peer
B.To exchange routing protocol updates
C.To synchronize MAC address tables
D.To forward data traffic between vPC peers
AnswerA

Keepalive is a heartbeat mechanism.

Why this answer

The vPC peer-keepalive link is a dedicated Layer 3 link used exclusively to monitor the health of the vPC peer. Its primary purpose is to detect a peer failure (e.g., a supervisor crash or complete switch failure) so that the remaining peer can take appropriate actions, such as disabling its own vPC member ports to prevent loops. This is distinct from the vPC peer-link, which carries control and data traffic between peers.

Exam trap

Cisco often tests the distinction between the vPC peer-link (which carries data and control traffic) and the peer-keepalive link (which is only for liveness detection), leading candidates to mistakenly assign data-forwarding or synchronization roles to the keepalive link.

How to eliminate wrong answers

Option B is wrong because routing protocol updates are exchanged over the vPC peer-link (Layer 2 trunk) or via a separate Layer 3 link, not over the peer-keepalive link which only carries keepalive messages (UDP packets). Option C is wrong because MAC address table synchronization occurs over the vPC peer-link using Cisco Fabric Services (CFS), not over the peer-keepalive link. Option D is wrong because the peer-keepalive link never forwards data traffic; it is a control-plane link that only sends periodic keepalive messages (default 1-second interval) to verify peer liveness.

966
Multi-Selectmedium

Which TWO statements correctly describe the difference between synchronous and asynchronous replication?

Select 2 answers
A.Asynchronous replication requires dedicated links
B.Asynchronous replication has lower impact on application performance
C.Synchronous replication provides zero recovery point objective (RPO)
D.Synchronous replication is more tolerant of high latency links
E.Asynchronous replication guarantees zero data loss
AnswersB, C

Asynchronous replication does not wait for remote acknowledgment, reducing latency impact.

Why this answer

Synchronous replication has zero RPO but can impact performance due to latency, while asynchronous replication has a lower performance impact but may have some data loss (nonzero RPO).

967
MCQeasy

A data center switch has multiple access ports configured with spanning-tree portfast. A new server is connected to one of these ports and immediately causes a network loop. What is the most likely cause?

A.The portfast feature is disabled by default on the switch.
B.The server sends BPDUs.
C.The port is not configured with BPDUguard.
D.The switch is running MSTP instead of PVST+.
AnswerC

Without BPDUguard, the port stays up when a BPDU is received, potentially causing a loop.

Why this answer

Spanning Tree Protocol (STP) PortFast immediately transitions a port to the forwarding state, bypassing the listening and learning phases. However, PortFast alone does not protect against loops if a rogue device (like a server) inadvertently connects two switch ports or sends BPDUs. BPDUguard must be explicitly configured on the port to disable it upon receiving any BPDU, preventing a loop.

Without BPDUguard, the switch will process the BPDU and may re-enter STP convergence, potentially causing a loop if the server is misconfigured or bridging traffic.

Exam trap

Cisco often tests the misconception that PortFast alone prevents loops, but the trap here is that PortFast only speeds up initial convergence; without BPDUguard, a PortFast port can still participate in STP and cause a loop if it receives a BPDU.

How to eliminate wrong answers

Option A is wrong because PortFast is not disabled by default on a switch; it is a per-port feature that must be explicitly enabled with the 'spanning-tree portfast' interface command. Option B is wrong because the server sending BPDUs is the trigger for the loop, not the cause of the loop itself—the root cause is the lack of BPDUguard to protect the PortFast port from those BPDUs. Option D is wrong because MSTP (Multiple Spanning Tree Protocol) and PVST+ (Per-VLAN Spanning Tree Plus) both support PortFast and BPDUguard; the protocol variant does not inherently cause loops when PortFast is enabled without BPDUguard.

968
Multi-Selectmedium

Which TWO of the following are benefits of using Smart Zoning in Cisco MDS switches?

Select 2 answers
A.Reduces number of zone objects
B.Provides faster FLOGI processing
C.Simplifies zone management for large fabrics
D.Eliminates the need for VSANs
E.Allows automatic LUN masking
AnswersA, C

Smart Zoning combines multiple zones into a single object, reducing overhead.

Why this answer

Smart Zoning reduces the number of zone objects by automatically grouping initiator-target pairs into a single zone entry, rather than requiring a separate zone for each pair. This minimizes the size of the zone database and reduces the processing overhead on the switch during fabric reconfigurations.

Exam trap

Cisco often tests the misconception that Smart Zoning improves FLOGI processing speed or eliminates VSANs, when in reality it only optimizes zone object management and does not alter fundamental fabric services.

969
MCQmedium

An engineer is designing a Layer 3 network for a data center using OSPF. The core switches are connected to aggregation switches. To optimize convergence, which OSPF network type should be used on the links between core and aggregation?

A.broadcast
B.non-broadcast
C.point-to-multipoint
D.point-to-point
AnswerD

Eliminates DR election, reduces convergence time.

Why this answer

In a data center spine-leaf architecture, the links between core (spine) and aggregation (leaf) switches are typically point-to-point Layer 3 links. Configuring OSPF network type point-to-point (option D) on these interfaces eliminates the need for DR/BDR election, reduces hello and dead timers (default 10s/40s vs 30s/120s for broadcast), and allows faster convergence because OSPF immediately forms a neighbor adjacency without waiting for election delays.

Exam trap

Cisco often tests the misconception that broadcast is the default and therefore best for Ethernet links, but in a data center spine-leaf design, point-to-point is preferred because it eliminates DR/BDR election overhead and provides faster convergence.

How to eliminate wrong answers

Option A is wrong because broadcast network type requires a Designated Router (DR) and Backup Designated Router (BDR) election, which adds unnecessary convergence delay and overhead on point-to-point links between core and aggregation switches. Option B is wrong because non-broadcast network type is used for NBMA environments (e.g., Frame Relay) where neighbors must be manually configured and DR/BDR election still occurs, making it unsuitable for direct point-to-point Ethernet links. Option C is wrong because point-to-multipoint is designed for hub-and-spoke topologies where a single interface connects to multiple neighbors, not for the direct point-to-point links between core and aggregation switches.

970
MCQmedium

Which NX-OS command is used to display the consistency status of Virtual Port Channel (vPC) parameters across both vPC peers?

A.show vpc peer-keepalive
B.show vpc brief
C.show running-config vpc
D.show vpc consistency-parameters
AnswerD

This command shows consistency checks for vPC.

Why this answer

The 'show vpc consistency-parameters' command is specifically designed to verify that all required VPC configuration parameters (such as allowed VLANs, STP settings, and port-channel modes) are identical on both VPC peers. Inconsistent parameters can cause VPC traffic disruption or failover issues, and this command provides a detailed per-interface or global consistency check.

Exam trap

Cisco often tests the distinction between 'show vpc brief' (which shows operational status) and 'show vpc consistency-parameters' (which shows configuration alignment), leading candidates to mistakenly choose the former when asked about parameter consistency.

How to eliminate wrong answers

Option A is wrong because 'show vpc peer-keepalive' only displays the status of the peer-keepalive link (e.g., UDP heartbeat), not the consistency of VPC configuration parameters. Option B is wrong because 'show vpc brief' shows a summary of VPC status, role, and peer-link state, but does not compare parameter consistency between peers. Option C is wrong because 'show running-config vpc' displays the local VPC configuration only, and does not compare or validate consistency against the peer's configuration.

971
Drag & Dropmedium

Sequence the steps for configuring OSPF on a Cisco Nexus switch in a data center fabric.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

OSPF configuration involves creating the process, setting router ID, enabling on interfaces, and verification.

972
MCQhard

Refer to the exhibit. A UCS domain shows a 'Major' NVRAM backup failure alarm in Intersight. What is the best immediate action?

A.Attempt a manual NVRAM configuration backup from the primary Fabric Interconnect to the secondary.
B.Perform a factory reset on both Fabric Interconnects.
C.Reboot the primary Fabric Interconnect.
D.Reclaim the UCS domain from Intersight and register again.
AnswerA

Manual backup can jumpstart the failed backup process and clear the alarm.

Why this answer

A 'Major' NVRAM backup failure alarm in Intersight indicates that the automatic periodic backup of the UCS domain's configuration from the primary Fabric Interconnect (FI) to the secondary FI has failed. The best immediate action is to attempt a manual NVRAM configuration backup from the primary FI to the secondary, as this directly addresses the backup failure without disrupting domain operations or requiring re-registration.

Exam trap

Cisco often tests the distinction between a configuration backup failure and a hardware or connectivity failure, leading candidates to choose disruptive actions like rebooting or factory resetting when a simple manual backup retry is the correct first step.

How to eliminate wrong answers

Option B is wrong because performing a factory reset on both Fabric Interconnects is a drastic, destructive action that would erase all configuration and cause significant downtime, which is unnecessary for a backup failure that can be resolved manually. Option C is wrong because rebooting the primary Fabric Interconnect would disrupt traffic and may not resolve the backup failure; the issue is likely with the backup process or connectivity, not the FI's operational state. Option D is wrong because reclaiming the UCS domain from Intersight and registering again would remove the domain from management and require re-establishing connectivity, which is an overreaction for a backup failure that can be addressed with a manual backup attempt.

973
MCQmedium

A server team reports that after connecting a new server to a switchport, the server can receive traffic but cannot send traffic. The port is configured with port security. What is the most likely cause?

A.The port is in errdisable state
B.The port security violation mode is set to protect
C.The port security maximum is set to 1 and another device is connected
D.The server MAC address is not in the allowed list
AnswerB

Protect mode drops offending frames silently, allowing the server to receive but not send traffic from an unknown MAC.

Why this answer

When port security violation mode is set to 'protect', the switch drops traffic from unauthorized MAC addresses without generating a syslog message or incrementing the violation counter. In this scenario, the server can receive traffic because the switch still forwards broadcast and unknown unicast frames to the port, but the server's transmitted frames are silently dropped because the switch does not learn the server's MAC address or forward its frames. This matches the symptom of one-way communication where the server can receive but not send.

Exam trap

Cisco often tests the distinction between the three port security violation modes (protect, restrict, shutdown) by presenting a symptom of one-way traffic, which candidates mistakenly attribute to a shutdown or restrict mode rather than the silent dropping behavior of protect.

How to eliminate wrong answers

Option A is wrong because an errdisable state would cause the port to be completely shut down, preventing both sending and receiving traffic, not just one-way communication. Option C is wrong because if the maximum MAC count is set to 1 and another device is connected, the violation action would trigger based on the configured mode (shutdown, restrict, or protect), but the symptom described (receive but not send) is specific to the protect mode, not a simple count limit. Option D is wrong because port security does not use an 'allowed list' of MAC addresses by default; it learns MAC addresses dynamically unless a static secure MAC address is configured, and even then, a mismatch would trigger the violation mode, not result in one-way traffic.

974
MCQeasy

A data center automation script uses Python's requests library to call the NX-API for a Nexus 9000 switch. The script works but returns HTTP 400. Which is a likely cause?

A.The request payload is malformed
B.The switch has no management IP
C.The script uses HTTP instead of HTTPS
D.The API is not enabled
AnswerA

400 Bad Request is client error.

Why this answer

HTTP 400 indicates a bad request, which in the context of NX-API typically means the JSON or XML payload sent to the switch does not conform to the expected schema. Common issues include missing required fields (e.g., 'ins_api' version, 'type', 'chunk', 'sid', 'input', 'outputformat'), incorrect JSON syntax, or invalid values for parameters like 'version' or 'type'. The requests library successfully delivered the HTTP request, but the NX-API rejected it due to malformed content.

Exam trap

Cisco often tests the distinction between HTTP status codes (400 vs. 404 vs. connection errors) to see if candidates understand that a 400 specifically points to payload issues, not network or configuration problems.

How to eliminate wrong answers

Option B is wrong because if the switch had no management IP, the script would fail with a connection error (e.g., 'No route to host' or timeout), not an HTTP 400 response. Option C is wrong because using HTTP instead of HTTPS would result in a different error, such as a redirect (301/302) or a connection refused if HTTPS is enforced, but the NX-API can accept HTTP requests if configured; HTTP 400 is unrelated to protocol choice. Option D is wrong because if the API were not enabled, the switch would return an HTTP 404 (Not Found) or a connection reset, not a 400 Bad Request.

975
MCQhard

An engineer is deploying a HyperFlex cluster and needs to ensure that if a disk fails in a hybrid node, the system can rebuild the data from parity. Which RAID configuration is required on the disk controller for the cache SSD and HDDs in a HyperFlex hybrid node?

A.RAID 6 for SSD and RAID 0 for HDDs
B.RAID 0 for SSD and RAID 5 for HDDs
C.RAID 10 for both SSD and HDDs
D.RAID 1 for SSD and RAID 5 for HDDs
AnswerB

RAID 0 on SSD provides maximum performance; RAID 5 on HDDs provides redundancy.

Why this answer

In HyperFlex hybrid nodes, the cache SSD is configured as RAID 0 (striping without parity) for performance, while the HDDs can be configured as RAID 5 or RAID 6 for redundancy. For the SSD cache, RAID 0 is typically used because data is replicated at the cluster level.

Page 12

Page 13 of 14

Page 14

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

See all domains with question counts →