Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 76–150

The FCoE feature must be enabled globally on the Cisco MDS switch using the 'feature fcoe' command. This activates the FCoE protocol stack and allows the switch to process FCoE frames, which is a prerequisite for any FCoE deployment.

Synchronous replication writes data to both local and remote storage before acknowledging the write, ensuring zero data loss (RPO=0). Asynchronous replication may have some data loss depending on the lag.

In ingress replication, the ingress VTEP (VXLAN Tunnel Endpoint) receives a BUM (Broadcast, Unknown unicast, Multicast) packet and creates multiple unicast-encapsulated copies, sending one copy to each remote VTEP in the same VXLAN network identifier (VNI) segment. This method does not rely on any multicast protocol in the underlay; instead, it leverages the VTEP's knowledge of all remote VTEPs (typically learned via the EVPN control plane, such as Type 3 Inclusive Multicast Ethernet Tag routes) to replicate traffic. Option B correctly describes this behavior.

B is correct because BGP EVPN (Ethernet VPN) uses the L2VPN address family (l2vpn evpn) to carry MAC/VXLAN routing information between spine and leaf switches. This address family is mandatory for EVPN control plane operation in a VXLAN fabric, enabling MAC address learning and advertisement via MP-BGP.

When a new spine switch is added to a VXLAN EVPN fabric with an OSPF underlay, the leaf switches may experience routing instability because the new spine advertises routes with a lower cost, causing traffic to shift abruptly. Increasing the OSPF cost on the leaf-to-spine links makes those paths less preferred, stabilizing the routing table by preventing flapping and ensuring a more gradual convergence.

RAID 5 uses block-level striping with distributed parity, allowing recovery from a single disk failure with good storage efficiency (one disk worth of parity).

Cisco IMC provides KVM console and virtual media mounting, as well as remote firmware upgrade. These are common out-of-band management features.

In a vPC domain, the peer-link carries only specific VLANs that are allowed on the trunk. By default, the peer-link is configured as a trunk allowing VLANs 1-100, and the native VLAN is not included in this allowed list because the peer-link uses a dedicated VLAN for control traffic (typically VLAN 4094) and does not forward native VLAN traffic. Option C is correct because the default allowed VLAN list on a vPC peer-link is VLANs 1-100, as shown in the exhibit.

In a VXLAN centralized routing gateway deployment, ingress replication is a valid method for handling BUM traffic where the ingress VTEP sends a unicast copy of the BUM packet to each remote VTEP. This is correct because it eliminates the need for multicast in the underlay, making option B accurate. Ingress replication consumes more bandwidth on the source VTEP uplinks than multicast because it generates multiple unicast copies, whereas multicast sends a single stream that is replicated by the network, making option C correct.

NPV (N-Port Virtualization) mode is enabled globally on a Cisco MDS switch using the 'npv enable' command. This command places the entire switch into NPV mode, allowing it to function as an NPV proxy that forwards FLOGI requests from downstream F ports to the core Fibre Channel switch. NPV mode is not a per-VSAN configuration; it is a global switch-level setting.

VXLAN VNI 10030 is operationally down because the VLAN that maps to this VNI is either not created or not associated with the VNI under the NVE interface. In Cisco NX-OS, a VNI becomes operationally up only when the corresponding VLAN exists and is properly mapped via the `member vni 10030 associate-vrf` or `member vni 10030` command under the NVE interface. Without this mapping, the NVE cannot forward traffic for that VNI, leaving it in a down state.

The 'show ip ospf neighbors' command is the correct NX-OS command to display the current OSPF neighbor states, including the neighbor ID, interface, state (e.g., FULL, 2WAY, DOWN), and adjacency details. This command directly queries the OSPF process for the neighbor state machine, which is essential for verifying OSPF adjacency formation and troubleshooting Layer 3 connectivity.

NPIV (N_Port ID Virtualization) allows a single Fibre Channel N_Port to register multiple N_Port IDs (FCIDs) with the fabric. This enables a host with one physical port to appear as multiple virtual initiators, each connecting to different targets, which is essential for virtualized environments like VMware ESXi with multiple VMs requiring separate FC connections.

Soft zoning using WWPN is correct because it identifies zone members by their World Wide Port Name (WWPN) and enforces access through name server queries rather than switch port information. In soft zoning, the fabric does not actively block traffic; instead, it relies on the initiator to query the name server and only communicate with allowed WWPNs, making it a software-enforced access control method.

VPC performs consistency checks on member ports to ensure both peers have identical configurations for certain parameters. A mismatch in STP port type (e.g., one peer configured as 'edge' and the other as 'network') will cause the vPC member port to fail the consistency check and remain down, as STP port type affects BPDU handling and loop prevention.

A Fabric Port Channel with LACP allows multiple uplink ports to be aggregated into a single logical link, providing load balancing across the physical links based on a hash algorithm (e.g., source/destination MAC or IP). This is a standard method for distributing traffic from a specific VLAN across both uplinks to the upstream network in a UCS domain configured with two fabric interconnects in end-host mode.

In a UCS system with two Fabric Interconnects in active-active mode, both FIs forward data traffic simultaneously. However, for management functions such as chassis discovery and firmware management, only one FI acts as the primary management controller at a time, while the other is standby. This ensures consistency and avoids conflicts in managing the chassis and blades.

PortChannels in FC provide increased aggregate bandwidth by combining multiple links, and they offer redundancy: if one link fails, traffic is distributed among the remaining links.

NPV mode allows an edge switch to forward traffic to the core without participating in fabric services, reducing domain IDs and simplifying management.

The WWPN (World Wide Port Name) is a unique 64-bit identifier assigned to each Fibre Channel port. The WWNN identifies the node.

Port Security limits MAC addresses per port; DHCP Snooping filters DHCP messages and builds a binding database; Dynamic ARP Inspection validates ARP packets; IP Source Guard filters traffic based on binding table. Common confusions include mixing DHCP Snooping with DAI and Port Security with DHCP Snooping.

In ACI, contracts are the mechanism used to enable communication between EPGs. By default, all traffic is denied, and a contract must be explicitly applied to allow traffic flow between EPGs, enforcing a zero-trust model.

The 'show vpc' command (without any keyword) displays the overall Virtual Port Channel (vPC) status, including peer-link status, consistency parameters, and per-VLAN/vPC operational state. This is the most comprehensive single command for verifying vPC health and configuration consistency between peer switches.

The oversubscription ratio for each leaf is calculated by dividing the total downlink bandwidth by the total uplink bandwidth. Each leaf has 40 downlinks at 25 Gbps each, totaling 1000 Gbps, and 8 uplinks at 100 Gbps each, totaling 800 Gbps. Thus, 1000 / 800 = 1.25, giving a 1.25:1 ratio.

The external routed network (L3Out) is the fundamental construct that defines the Layer 3 connectivity from the ACI fabric to an external router or network. It specifies the routing protocol (e.g., OSPF, BGP, or static), the external interfaces, and the protocol policies required for the ACI spine switches to exchange routes with external devices. Without defining the L3Out object, the fabric has no configured path or policy to reach external destinations.

In a Cisco UCS environment, the Fabric Interconnect (FI) is the component that provides Fibre Channel connectivity to SAN switches when using FCoE. The FI integrates both Ethernet and Fibre Channel traffic, performing FCoE encapsulation and forwarding the Fibre Channel frames to the SAN via its native Fibre Channel uplink ports. This allows the UCS domain to connect directly to Fibre Channel SAN fabrics without requiring external FCoE-capable switches.

In NPV mode, the edge switch presents an NP-port (N-port proxy) to the core switch's F-port. The NP-port behaves like an N-port but aggregates traffic from multiple downstream N-ports.

A QoS Policy is the correct attachment because it defines traffic classification, marking, and queuing behavior at the interface level within a UCS service profile template. By applying a QoS Policy, the engineer ensures uniform traffic management across all servers by controlling bandwidth allocation, priority, and drop preferences consistently. This policy directly maps to the system class definitions in UCS Manager, enabling per-interface QoS settings that are inherited by all service profiles using the template.

In a HyperFlex cluster with replication factor 2 (RF2), each data block is stored on two different nodes. To survive a single node failure, the cluster must have at least three nodes: two nodes to hold the two replicas of the data, and a third node to provide a witness (or tie-breaker) for cluster quorum and to ensure data availability during the failure. With only two nodes, a single failure would leave only one replica, violating the RF2 requirement and potentially causing data loss or cluster unavailability.

In VXLAN EVPN fabrics, Type-2 (MAC/IP Advertisement) routes are specifically used to advertise MAC addresses and their associated IP addresses between VTEPs. When a new leaf switch needs Layer 2 connectivity to a VM on a different leaf, it must learn the VM's MAC address via a Type-2 route from the remote VTEP. Without this route, the new leaf cannot populate its MAC table for that VM, preventing Layer 2 communication.

ACI uses a whitelist model. To allow only HTTP, a contract with a subject and filter for HTTP is applied, and no other filters are included.

The VMM domain (Option B) is the core integration object that defines the VMware vCenter connection and policy enforcement boundary. It must be configured to enable the APIC to discover VMs and their attributes, which is the prerequisite for dynamic EPG assignment based on VM properties such as VM name, OS type, or custom tags.

The cisco_nxapi library provides methods to call NX-API REST endpoints from Python.

The collection includes modules like nxos_config and nxos_vlan, and it is supported on NX-OS platforms.

NPIV allows a single physical Fibre Channel N_Port to register multiple unique N_Port IDs (FCIDs) with the fabric. This is essential for virtualizing Fibre Channel connectivity, enabling multiple virtual machines or logical partitions to share one physical HBA port while each appearing as a distinct initiator to the SAN.

NPIV (N_Port ID Virtualization) allows a single physical Fibre Channel N_Port to register multiple unique WWPNs (World Wide Port Names), enabling a tape library with multiple LUNs to present each LUN as a separate target to the host. Without NPIV, the host would see only one WWPN for the tape library, limiting LUN access and management flexibility.

The interface state 'Offline' in VSAN 100 indicates a Layer 1 or Layer 2 issue, often caused by a speed mismatch between the FC initiator and the switch interface. Configuring the port speed manually on the switch interface forces the link to negotiate at a specific speed, resolving the mismatch and bringing the interface online. This is a common fix when auto-negotiation fails or the initiator does not support the default speed settings.

FCoE requires a Converged Network Adapter (CNA) that supports both Ethernet and FCoE, DCB-enabled switches to provide lossless Ethernet (PFC, DCBX, ETS), and FCoE initialisation (FIP) to establish virtual links.

The FCoE link failing to come up despite the interface being up/up indicates a Layer 2 or FCoE-specific issue, not a physical or basic connectivity problem. The 'show fcoe database' command displays the FCoE login information and the state of virtual links (VFCs) mapped to the physical interface, which is essential for diagnosing why the FCF-to-storage array FCoE session is not established.

CIMC provides virtual media functionality, allowing mounting ISO images as virtual CD/DVD drives over the network.

The configuration shows interface fc1/1 with the command 'switchport mode E', which explicitly configures it as an E-port (expansion port). E-ports are used to interconnect two Fibre Channel switches, not to connect a storage target. When a target is connected to an E-port, the link will not come up properly because the target expects to be connected to an F-port (fabric port) or FL-port, preventing discovery by the initiator.

NX-API provides a RESTful API interface on Cisco Nexus switches, enabling programmatic access to CLI commands and returning structured data in formats like JSON or XML. This is essential for data center automation because it allows external tools (e.g., Ansible, Python scripts) to configure and retrieve state from the switch without requiring interactive CLI sessions, directly supporting infrastructure-as-code workflows.

In a brownfield Nexus 9000 fabric, the operational state (e.g., interface status, routing table) must be modeled against the device-specific YANG model to detect and correct configuration drift. NETCONF uses YANG models to define both configuration and operational data, but only the device-specific native model accurately reflects the actual running state. Without this alignment, automated remediation may push incorrect configurations, leading to network instability.

During re-replication, there is increased I/O and CPU load. Additionally, if the replacement node is slower (e.g., fewer SSDs) or if the cluster is rebalancing, performance can suffer.

Synchronous replication writes data to both arrays before acknowledging the write, ensuring zero data loss but adding latency and requiring high bandwidth.

The 'authentication failed action authorize vlan 999' command configures the switch port to place endpoints that fail both 802.1X and MAB into a restricted VLAN (VLAN 999). This directly meets the security policy requirement for endpoints that cannot authenticate via either method.

IP Source Guard (IPSG) uses the DHCP snooping binding database to validate the source IP address in data packets received on untrusted ports. If a packet's source IP does not match an entry in the binding table, IPSG drops the packet, preventing IP spoofing attacks.

Stateless computing means that all configuration (BIOS, firmware, network, storage settings) is stored in the service profile on UCS Manager, not on the server. Thus, a failed blade can be replaced without reconfiguration.

Thin provisioning allows over-allocation, reduces upfront capacity costs, and improves storage utilization by allocating space on demand.

In Cisco ACI, a network policy is defined by the combination of a Tenant and a Bridge Domain. The Tenant is the top-level container that isolates policies and configurations, while the Bridge Domain defines the Layer 2 forwarding boundary and associates the subnet, enabling communication within the fabric. Without these two objects, a network policy cannot be fully realized.

Reducing the link speed is a valid method to recover from buffer credit loss because it decreases the number of frames transmitted per unit time, allowing the receiver's buffer credits to replenish and preventing further overrun. This is a temporary workaround that reduces the effective bandwidth but can stabilize the link when buffer credit starvation occurs due to distance or congestion.

Hard zoning based on WWPN is persistent across port changes, while soft zoning based on port ID is less secure and changes if the device moves.

vHBA failover policy allows a secondary vHBA to assume the WWPN of the primary if it fails.

When a UCS C-Series rack server with a boot-from-SAN policy fails to discover the LUN during POST, the most direct troubleshooting step is to review the SAN boot target configuration in Cisco IMC. The HBA is already correctly zoned, so the issue likely lies in the boot target parameters (e.g., WWPN, LUN ID, or target name) configured in the IMC's SAN boot settings, which the HBA uses during the BIOS-level boot process. Verifying these settings ensures the HBA can properly address and log into the storage target.

The VNI (VXLAN Network Identifier) is a 24-bit field in the VXLAN header that uniquely identifies a Layer 2 overlay network segment, analogous to a VLAN ID in traditional networking. It allows multiple tenants or broadcast domains to coexist over a shared underlay network by isolating traffic at the overlay level.

The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

Self-encrypting drives (SEDs) provide hardware-based encryption for data at rest.

Since the service profile is associated, the boot policy is set to SAN Boot, and the LUN is properly mapped to the WWPN, the most likely cause is a physical or Layer 2 connectivity issue between the UCS Fabric Interconnect and the SAN switches. Without this link, the fabric interconnect cannot forward FCP frames to the storage array, preventing the blade from discovering the boot LUN. Verifying this connection is the logical first step before investigating other configuration or zoning issues.

In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

In UCS Manager, the vNIC placement policy determines how vNICs are assigned to fabric interconnects. Selecting 'fabric failover' allows a vNIC to fail over to the other FI, but for active-active use, multiple vNICs are needed. The correct approach is to use a vNIC placement policy that assigns each vNIC to a specific fabric without failover, combined with proper fabric pinning in the LAN connectivity policy.

The Fabric Interconnect (A) is the core switching component in Cisco UCS, providing both network and storage connectivity over a unified fabric, typically using Fibre Channel over Ethernet (FCoE) to consolidate LAN and SAN traffic. The I/O Module (IOM) (C) connects blade servers to the Fabric Interconnects, extending the unified fabric by aggregating traffic from the chassis and forwarding it to the Fabric Interconnects, thereby eliminating the need for separate network and storage switches.

NETCONF uses XML over SSH (RFC 6241) for secure transport.

The initial discovery process relies on the IOM (Fabric Interconnect) establishing a link to the blade server through the chassis midplane. If the physical cabling between the IOM and the fabric interconnect is faulty, loose, or using incorrect transceivers, the discovery will fail. Verifying this cabling is a fundamental first step in troubleshooting discovery failures.

VXLAN uses UDP encapsulation (destination port 4789 by default) to transport Layer 2 Ethernet frames over a Layer 3 IP network. This allows the overlay to leverage existing IP routing infrastructure while preserving the original MAC addresses and VLAN information, enabling network virtualization and scalability beyond traditional VLAN limits.

The 'nxos_config' module's 'backup' option saves the running configuration to a file before applying changes. This ensures that if a switch fails to apply the configuration correctly, the original configuration is preserved for rollback, enabling consistent recovery across all switches. Without this, some switches may have partial or incorrect configurations that cannot be easily reverted.

Ingress replication (Option D) is the correct method because it requires the ingress VTEP to maintain a list of all remote VTEPs in the VXLAN segment and replicate each BUM packet individually to each remote VTEP. This is a unicast-based replication approach that does not rely on multicast in the underlay, making it suitable for networks where multicast is not enabled or desired.

The vHBA WWPN must be properly zoned on the SAN switches to allow the blade to discover and connect to the storage target. Without correct zoning, the Fibre Channel initiator cannot communicate with the target, preventing SAN boot. This is a fundamental prerequisite for any Fibre Channel-based boot.

NX-API CLI allows sending NX-OS CLI commands via HTTP/HTTPS using XML or JSON.

In NPV mode, the edge switch registers with the core switch using NPIV. The core switch sees the NPV switch as a host and the port connecting to it must be an F-port.

In a Cisco HyperFlex cluster, the data plane replication across nodes is handled by the HX Data Platform, which is a distributed, log-structured file system that synchronously replicates data at the hypervisor level. This platform manages all I/O operations and ensures data consistency across the cluster without relying on external storage protocols like Fibre Channel or iSCSI.

In end-host mode, the Fabric Interconnect (FI) acts as a Layer-2 forwarding device that learns server MAC addresses on the server-facing ports to build its forwarding table. This is required because the FI does not run Spanning Tree Protocol (STP) on those ports; instead, it relies on MAC learning to forward traffic correctly between servers and the upstream network.

Zoning by name using zone aliases decouples the zone configuration from the physical port or WWN, allowing administrators to group initiators and targets into separate aliases. When new members are added to an alias, the zone automatically includes them without manual zone reconfiguration, minimizing administrative overhead while supporting multiple initiators and multiple targets.