Cisco DCCOR / CCNP Data Center Core 350-601 350-601 Questions 976–984 | Page 14/14

976

MCQmedium

A storage administrator needs to isolate traffic between two departments on the same Fibre Channel SAN infrastructure. Each department has its own storage array and hosts. Which technology should be used to create separate logical fabrics without additional hardware?

A.NPV

B.VSANs

C.Zoning

D.PortChannels

AnswerB

VSANs create isolated logical fabrics over a physical infrastructure.

Why this answer

VSANs (Virtual SANs) allow partitioning of a single physical Fibre Channel fabric into multiple isolated logical fabrics, similar to VLANs in Ethernet.

Full explanation →

977

MCQmedium

A data center engineer is troubleshooting connectivity issues between two EPGs in the same tenant on a Cisco ACI fabric. The first EPG 'web_epg' is in VLAN 100 and the second EPG 'db_epg' is in VLAN 200. The contract 'web_to_db' allows TCP port 3306 from web_epg to db_epg. The EPGs are in the same VRF. The engineer has verified that the physical connectivity is correct and the endpoints are learning their IP addresses. However, traffic from web_epg to db_epg is not reaching the destination. The engineer checks the contract and sees that the subject 'mysql_access' has filter 'mysql' with direction 'both'. The provider is db_epg and consumer is web_epg. The engineer also notices that the default action in the contract is 'deny'. What is the most likely cause of the issue?

A.The contract direction is reversed: the provider should be the destination of the traffic. Since web_epg initiates to db_epg, web_epg should be the provider.

B.The VRF is not correctly associated with the EPGs.

C.A Layer 3 Outside (L3Out) is required for communication between EPGs in the same VRF.

D.The filter 'mysql' does not match TCP port 3306.

AnswerA

In ACI, the provider offers a service; the consumer initiates. Here web_epg initiates, so web_epg should be provider.

Why this answer

In Cisco ACI, the provider EPG is the one that offers a service (the destination of the traffic), and the consumer EPG is the one that initiates the connection. Since web_epg initiates TCP traffic to db_epg, db_epg should be the provider and web_epg the consumer. The contract is reversed, so the default deny action blocks the traffic because the consumer (web_epg) is not allowed to initiate toward the provider (db_epg) under the reversed roles.

Exam trap

Cisco often tests the provider/consumer directionality in ACI contracts, and the trap here is that candidates assume the provider is the source (initiator) of traffic, when in fact the provider is the destination (service offerer).

How to eliminate wrong answers

Option B is wrong because the VRF association is correct—both EPGs are in the same VRF, and the endpoints are learning IP addresses, indicating the VRF is properly configured. Option C is wrong because an L3Out is only needed for communication with external networks (outside the fabric), not between EPGs in the same VRF; intra-VRF communication uses contracts directly. Option D is wrong because the filter 'mysql' is a predefined filter that matches TCP port 3306, so it correctly permits the required traffic.

Full explanation →

978

MCQhard

A Nexus switch experiences high CPU utilization due to excessive ICMP traffic. An engineer applies a CoPP policy that includes a class matching ICMP with a drop action. After applying, legitimate OSPF hello packets are also being dropped. What is the most likely cause?

A.The CoPP policy is applied to the wrong interface

B.The CoPP policy rate-limits all traffic including OSPF below its needed rate

C.OSPF packets match the default class which has a drop action

D.The class-map matches multiple protocols including OSPF

AnswerC

If the default class action is drop, any traffic not explicitly matched (including OSPF) will be dropped. This is a common misconfiguration.

Why this answer

When a CoPP policy is applied, traffic that does not match any explicit class-map falls into the default class. If the default class has a drop action, all unmatched traffic—including OSPF hello packets (which use IP protocol 89)—will be dropped. The class-map matching ICMP (typically based on protocol or DSCP) does not match OSPF, so OSPF packets are handled by the default class, causing the observed behavior.

Exam trap

Cisco often tests the concept that the default class in CoPP is not automatically 'permit' and must be explicitly configured; the trap here is assuming that only the matched class (ICMP) is affected, while forgetting that unmatched traffic falls to the default class, which can have a drop action.

How to eliminate wrong answers

Option A is wrong because CoPP policies are applied globally to the control plane (via 'control-plane' and 'service-policy input'), not to individual interfaces; applying to the wrong interface would not affect control-plane traffic. Option B is wrong because the policy explicitly drops ICMP traffic, not rate-limits it; OSPF packets are not rate-limited but dropped entirely due to the default class action, not because of insufficient rate. Option D is wrong because the class-map matches only ICMP (e.g., match protocol icmp or match ip dscp cs0), and OSPF uses IP protocol 89, which is distinct; the class-map does not include OSPF.

Full explanation →

979

MCQmedium

A storage array supports RAID-5, RAID-6, and RAID-10. The array has 12 disks of equal size. The requirement is to maximize usable capacity while tolerating up to two simultaneous disk failures without data loss. Which RAID level should be chosen?

A.RAID-10

B.RAID-5

C.RAID-6

D.RAID-0

AnswerC

RAID-6 tolerates up to two failures with better capacity efficiency than RAID-10.

Why this answer

RAID-6 can tolerate two disk failures with parity overhead of 2 disks, providing high usable capacity. RAID-5 tolerates only one failure; RAID-10 tolerates multiple failures but capacity is 50%.

Full explanation →

980

MCQeasy

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

A.LDAP

B.RADIUS

C.Kerberos

D.TACACS+

AnswerD

Cisco recommends TACACS+ for device admin.

Why this answer

TACACS+ encrypts the entire packet and separates AAA functions.

Full explanation →

981

MCQmedium

An engineer is deploying FCoE on a Cisco Nexus 9000v switch in a converged network. The storage array is connected via native Fibre Channel to an MDS switch, and the MDS is connected to the Nexus using an FCoE link. The engineer creates a virtual Fibre Channel (VFC) interface on the Nexus, binds it to an Ethernet interface, and maps VSAN 200 to VLAN 200. The MDS side has an FCoE port configured and enabled. Servers connected to the Nexus with FCoE initiators can successfully log into the storage targets, but performance is very poor and intermittent. The engineer checks for drops on all interfaces and finds none. The engineer also verifies that the FCoE VLAN is not blocked by spanning tree. What is the most likely cause of the performance issue?

A.The Ethernet interface MTU is set to 1500 instead of 2500.

B.The FCoE VLAN is blocking spanning tree.

C.The MDS has not enabled FCoE on the interface.

D.The VFC interface is not bound to the correct port-channel.

AnswerA

FCoE requires jumbo frames; 1500 MTU causes fragmentation.

Why this answer

FCoE requires a jumbo MTU (typically 2500 bytes) to encapsulate Fibre Channel frames without fragmentation. An MTU of 1500 forces fragmentation and reassembly, causing retransmissions and poor performance. Option B is incorrect because the engineer verified that the FCoE VLAN is not blocked by spanning tree.

Option C is incorrect because servers can log in, indicating FCoE is enabled on the MDS interface. Option D is incorrect because the VFC binding was already verified as correct.

Full explanation →

982

MCQeasy

Refer to the exhibit. A network engineer has configured a port-channel for OSPF adjacency. What additional configuration is required for the port-channel to operate correctly?

A.Set the OSPF priority.

B.No additional configuration needed.

C.Enable OSPF on the port-channel with `ip router ospf process`.

D.Configure the channel-group mode on member interfaces.

AnswerD

Member interfaces must be assigned to the port-channel using `channel-group`.

Why this answer

For a port-channel to form an OSPF adjacency, the member interfaces must be configured with a channel-group mode (e.g., 'channel-group 1 mode active') to bundle them into a logical port-channel interface. Without this, the interfaces remain individual Layer 2 or Layer 3 links, and OSPF cannot establish adjacency over the port-channel as a single logical link.

Exam trap

Cisco often tests the misconception that creating the port-channel interface alone is sufficient, when in fact the member interfaces must be explicitly assigned to the port-channel using the channel-group command.

How to eliminate wrong answers

Option A is wrong because OSPF priority is used for Designated Router (DR) and Backup Designated Router (BDR) election on multiaccess networks, not for enabling or operating a port-channel. Option B is wrong because additional configuration is indeed required: the member interfaces must be assigned to the port-channel using the channel-group command; simply creating the port-channel interface does not bundle the physical links. Option C is wrong because 'ip router ospf process' is used to enable OSPF on an interface, but the port-channel interface itself must first exist and be properly formed; the missing step is bundling the member interfaces, not enabling OSPF on the port-channel.

Full explanation →

983

MCQmedium

An engineer needs to automate a repetitive configuration task on a Nexus switch. Which method is most suitable for programmatic access?

A.FTP file transfer

B.NX-API

C.CLI scripting with Tcl

D.SNMP v3

AnswerB

NX-API allows JSON/XML-based API calls for configuration and monitoring.

Why this answer

NX-API provides a RESTful interface that allows programmatic access to Nexus switches using HTTP/HTTPS methods (GET, POST, DELETE) with JSON or XML payloads. This makes it the most suitable method for automating repetitive configuration tasks because it supports modern scripting languages (Python, Ansible) and enables idempotent, structured configuration changes without requiring interactive CLI sessions.

Exam trap

Cisco often tests the distinction between monitoring protocols (SNMP) and programmatic configuration interfaces (NX-API), leading candidates to mistakenly choose SNMP v3 because it supports secure access, even though it cannot perform configuration changes.

How to eliminate wrong answers

Option A is wrong because FTP is a file transfer protocol used for bulk image or configuration file transfers, not for programmatic, real-time configuration automation; it lacks the structured API calls needed for granular task automation. Option C is wrong because CLI scripting with Tcl runs within the switch's CLI environment and is not a programmatic access method—it is an interactive scripting tool that does not expose a RESTful API for external automation frameworks. Option D is wrong because SNMP v3 is designed for monitoring and retrieving MIB objects, not for making configuration changes; it is read-heavy and lacks the transactional, idempotent write capabilities required for automating configuration tasks.

Full explanation →

984

MCQhard

An engineer observes that ARP packets are being dropped. Based on the exhibit, what is the drop rate percentage for ARP packets?

A.75%

B.25%

C.50%

D.100%

AnswerC

Half of the packets exceed the police rate and are dropped.

Why this answer

The exhibit shows that out of 1000 total ARP packets, 500 were dropped. The drop rate percentage is calculated as (dropped packets / total packets) * 100, which is (500/1000)*100 = 50%. Therefore, option C is correct.

Exam trap

Cisco often tests the ability to correctly compute a percentage from raw drop and total counts, where candidates might misread the exhibit or confuse drop rate with success rate, leading to incorrect answers like 25% or 75%.

How to eliminate wrong answers

Option A is wrong because 75% would require 750 dropped packets out of 1000, not 500. Option B is wrong because 25% would require 250 dropped packets out of 1000, not 500. Option D is wrong because 100% would require all 1000 packets to be dropped, but only 500 were dropped.

Full explanation →

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 976–984