Courseiva

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 151–225

984 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 14

Page 4
151
MCQmedium

A data center engineer is designing a Fibre Channel SAN for high availability. The design includes two MDS 9710 directors connected to multiple storage arrays. Which best practice should be followed when configuring NPV mode on the switches connecting the hosts?

A.Enable VSAN interop on the NPV switch to support multiple storage arrays
B.Connect each NPV switch to a single core switch for simplicity
C.Use FC trunking between NPV and core switches to increase bandwidth
D.Dual-home each NPV switch to two separate core switches for redundancy
AnswerD

Dual-homing ensures high availability.

Why this answer

Dual-homing each NPV switch to two separate core switches ensures that if one core switch fails, the NPV switch can still forward traffic through the other core switch. In NPV mode, the switch acts as a passthrough, and connecting to two separate core directors provides path redundancy without requiring the NPV switch to perform full Fibre Channel routing. This design aligns with high-availability best practices for Fibre Channel SANs.

Exam trap

Cisco often tests the misconception that FC trunking alone provides redundancy, but trunking only increases bandwidth and link aggregation, not failover independence; dual-homing to separate core switches is required for true high availability.

How to eliminate wrong answers

Option A is wrong because VSAN interop is not a feature of NPV mode; NPV switches inherit the VSAN configuration from the core switch and do not need interop enabled to support multiple storage arrays. Option B is wrong because connecting each NPV switch to a single core switch creates a single point of failure, violating high-availability design principles. Option C is wrong because FC trunking is used to aggregate multiple physical links into a single logical link for bandwidth, but it does not provide the necessary redundancy; dual-homing is the correct method for redundancy.

Full explanation →
152
Multi-Selectmedium

A data center administrator is designing a HyperFlex cluster for a virtualized environment. The cluster must be able to tolerate the failure of any two nodes. Which two configuration choices are required? (Choose two.)

Select 2 answers
A.Cluster witness VM
B.Minimum of 4 nodes
C.Minimum of 5 nodes
D.Replication factor RF3
E.Replication factor RF2
AnswersC, D

With 5 nodes and RF3, quorum is 3; losing 2 leaves 3, maintaining quorum.

Why this answer

To tolerate two node failures, the cluster must have at least 5 nodes (with RF3, quorum requires >50% of total nodes; with 5 nodes, quorum is 3, and losing 2 leaves 3, maintaining quorum). RF3 replicates data three times, ensuring data remains available even after two failures.

Full explanation →
153
MCQhard

A network engineer is configuring an ACI contract between an EPG and an external EPG. Which construct is used to permit traffic from the external EPG to the internal EPG?

A.The internal EPG is the provider and the external EPG is the consumer.
B.Both EPGs are providers.
C.Both EPGs are consumers.
D.The external EPG is the provider and the internal EPG is the consumer.
AnswerD

Correct direction for inbound traffic.

Why this answer

In Cisco ACI, the provider EPG exposes a contract, and the consumer EPG consumes it. To permit traffic from an external EPG to an internal EPG, the internal EPG must be the consumer (initiating the communication) and the external EPG must be the provider (offering the contract). This aligns with the default directionality of contracts, where the provider's filter rules allow inbound traffic from the consumer.

Exam trap

Cisco often tests the misconception that the provider is always the server or internal resource, but in ACI, the provider is the entity that offers the contract and defines the traffic direction, which can be the external EPG when allowing inbound traffic.

How to eliminate wrong answers

Option A is wrong because if the internal EPG is the provider and the external EPG is the consumer, the contract would permit traffic initiated from the internal EPG to the external EPG, not the reverse. Option B is wrong because both EPGs cannot be providers simultaneously; a contract requires one provider and one consumer to define the direction of traffic flow. Option C is wrong because both EPGs cannot be consumers; a contract must have at least one provider to expose the filter rules.

Full explanation →
154
MCQeasy

An engineer is configuring AAA authentication on a Cisco MDS 9000 series switch. The goal is to authenticate users via RADIUS first, then local as a fallback. Which command sequence should be used?

A.aaa authentication login default group radius local
B.aaa authentication login default local radius
C.aaa authentication login default radius local
D.aaa authentication login console radius local
AnswerA

Correct syntax: 'default' login method, 'group' keyword, radius then local fallback.

Why this answer

The 'aaa authentication login default group radius local' command configures the switch to first attempt RADIUS authentication for all login methods (default), and if the RADIUS server is unreachable or returns an error (not a rejection), it falls back to the local user database. This matches the requirement of RADIUS first with local fallback.

Exam trap

Cisco often tests the distinction between 'default' (applies to all login methods) and specific method names like 'console' or 'ssh', and the requirement to use the 'group' keyword before the server group name, causing candidates to omit 'group' or choose a method-specific keyword incorrectly.

How to eliminate wrong answers

Option B is wrong because it places 'local' before 'radius', which would cause the switch to attempt local authentication first, not RADIUS first as required. Option C is wrong because it omits the 'group' keyword, which is required to specify a RADIUS server group; without 'group', the command is syntactically incorrect on Cisco MDS switches. Option D is wrong because it specifies 'console' instead of 'default', limiting the authentication method list to console logins only, rather than applying to all login methods (SSH, Telnet, console, etc.) as required.

Full explanation →
155
MCQeasy

A data center engineer is planning a Cisco UCS deployment for a virtualized environment. The requirement is to maximize performance for virtual machine traffic while minimizing latency. Which feature should be enabled on the UCS Manager to offload packet processing from the host CPU?

A.Data Center Ethernet (DCE) priority flow control
B.vNIC failover policy
C.Hardware VLAN tagging and checksum offload
D.Fibre Channel over Ethernet (FCoE) offload
AnswerC

These offloads reduce CPU utilization and improve throughput.

Why this answer

Hardware VLAN tagging and checksum offload offloads packet processing tasks (VLAN insertion/stripping and checksum calculation) from the host CPU to the Cisco UCS virtual interface card (VIC) adapter. This reduces CPU overhead and minimizes latency for virtual machine traffic, directly meeting the requirement to maximize performance in a virtualized environment.

Exam trap

The trap here is that candidates confuse 'offload' with any feature that improves performance, but only hardware VLAN tagging and checksum offload directly offloads packet processing from the host CPU, while options like FCoE offload are storage-specific and not applicable to general VM traffic.

How to eliminate wrong answers

Option A is wrong because Data Center Ethernet (DCE) priority flow control (PFC) is a Layer 2 flow control mechanism that prevents packet loss due to congestion, but it does not offload packet processing from the host CPU. Option B is wrong because vNIC failover policy provides redundancy by switching traffic to a standby vNIC on link failure, but it does not reduce CPU overhead or latency for packet processing. Option D is wrong because Fibre Channel over Ethernet (FCoE) offload is specific to storage traffic (SAN) and does not address general VM packet processing offload; it offloads FCoE encapsulation, not general network packet processing.

Full explanation →
156
MCQmedium

A Cisco UCS Manager administrator notices that a newly provisioned service profile is showing 'Config Error' for the vNIC. The vNIC is configured to use a dynamic MAC address from a pool that has no free addresses. What is the correct remediation?

A.Add more MAC addresses to the MAC pool used by the vNIC
B.Upgrade the firmware on the Fabric Interconnect
C.Change the vNIC to use a static MAC address
D.Reassociate the service profile to a different blade
AnswerA

Extending the pool provides available addresses for assignment.

Why this answer

The 'Config Error' for the vNIC indicates that the dynamic MAC address assignment failed because the MAC pool is exhausted. Adding more MAC addresses to the pool resolves the issue by providing available addresses for the vNIC to consume, allowing the service profile to deploy successfully.

Exam trap

Cisco often tests the misconception that a 'Config Error' on a vNIC is due to hardware or association issues, leading candidates to choose reassociation or firmware upgrades, when the actual cause is a resource pool exhaustion that requires pool expansion.

How to eliminate wrong answers

Option B is wrong because upgrading the Fabric Interconnect firmware does not address MAC pool exhaustion; it is unrelated to address allocation. Option C is wrong because changing to a static MAC address bypasses the pool but is not the correct remediation for a pool exhaustion issue—it is a workaround, not a fix. Option D is wrong because reassociating the service profile to a different blade does not resolve the underlying MAC pool depletion; the same error would occur on any blade if the pool has no free addresses.

Full explanation →
157
MCQhard

A large enterprise uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric. The underlay is OSPF. Each leaf switch has a loopback0 interface as the source interface for VXLAN tunnel endpoints. After a maintenance window, an engineer modifies the IP address of loopback0 on leaf-5 from 10.1.1.5/32 to 10.1.1.105/32. Subsequently, all VXLAN tunnels to leaf-5 go down. OSPF adjacencies between leaf-5 and the spines are still FULL. The engineer checks the NVE interface on leaf-5 and sees the source-interface is loopback0 but the interface status is up/up. However, pings from other leaves to 10.1.1.105 fail. What is the most likely cause?

A.The OSPF process on leaf-5 was not restarted after the IP change
B.The new loopback IP 10.1.1.105 is not included in the OSPF network statement under router ospf
C.The MTU on loopback0 is set too low causing OSPF hello drops
D.The VXLAN source-interface was automatically changed to a different loopback
AnswerB

The new IP subnet must be advertised via OSPF to be reachable by other leaves.

Why this answer

After changing the loopback0 IP address on leaf-5, the new IP 10.1.1.105/32 must be explicitly advertised into OSPF for other leaves to reach it. If the OSPF network statement under router ospf still references the old subnet or does not include 10.1.1.105/32, the route for this new loopback IP will not be installed in the OSPF database. Consequently, other leaves cannot route to the new VTEP IP, causing VXLAN tunnels to fail even though OSPF adjacencies remain FULL (since adjacencies are formed over physical interfaces, not the loopback).

Exam trap

Cisco often tests the distinction between OSPF adjacency status (which relies on physical interfaces) and route advertisement (which depends on network statements covering the loopback IP), leading candidates to incorrectly assume that FULL adjacencies guarantee reachability to the VTEP IP.

How to eliminate wrong answers

Option A is wrong because restarting the OSPF process is not required after a loopback IP change; OSPF dynamically detects interface IP changes and updates LSAs accordingly, provided the new IP is covered by an existing network statement. Option C is wrong because MTU misconfiguration on loopback0 would not selectively cause OSPF hello drops only after an IP change; OSPF hellos are sent over the physical underlay interfaces, not the loopback, and a low MTU on loopback0 would not affect OSPF adjacencies that are already FULL. Option D is wrong because the VXLAN source-interface is explicitly configured under the NVE interface and does not automatically change; the engineer confirmed the source-interface remains loopback0 and the NVE interface is up/up.

Full explanation →
158
MCQeasy

Which statement about Fibre Channel buffer credits is true?

A.They are used for load balancing across multiple paths.
B.They control the flow of frames between directly connected ports.
C.They are allocated per VSAN.
D.They detect CRC errors in frames.
AnswerB

Buffer credits manage the number of outstanding frames.

Why this answer

Fibre Channel buffer credits implement a credit-based flow control mechanism between directly connected ports (Nx_Port to Fx_Port or E_Port to E_Port). Each port advertises its available buffer credits (BB_Credit) to the directly attached peer, and the sender can only transmit a frame when it has a positive credit count. This prevents frame loss due to buffer overflow at the receiver, ensuring lossless transmission over the link.

Exam trap

Cisco often tests the distinction between flow control (buffer credits) and error detection (CRC) or fabric-level features (VSANs, load balancing), so the trap here is confusing a link-level mechanism with higher-layer or fabric-wide functions.

How to eliminate wrong answers

Option A is wrong because load balancing across multiple paths is handled by multipathing software (e.g., EMC PowerPath, native OS MPIO) or Fibre Channel fabric-level routing (e.g., FSPF), not by buffer credits. Option C is wrong because buffer credits are allocated per physical port or per virtual interface (e.g., NPIV), not per VSAN; VSANs are logical fabric partitions that do not directly affect port-level buffer credit allocation. Option D is wrong because CRC error detection is performed by the Fibre Channel frame header and CRC field, verified by the receiving port hardware; buffer credits are a flow control mechanism, not an error detection mechanism.

Full explanation →
159
MCQmedium

In a Fibre Channel SAN, flow control is managed by buffer credits. Which statement about buffer credits is accurate?

A.Buffer credits are allocated per VSAN to isolate traffic
B.Increasing buffer credits always improves I/O performance
C.Buffer credits are used in FCoE to ensure lossless delivery
D.Buffer credits help manage congestion and ensure lossless delivery over distance
AnswerD

BB_credits allow a sender to send multiple frames without waiting for acknowledgment.

Why this answer

Buffer credits are a flow control mechanism in Fibre Channel that manage congestion by tracking the number of frames a sender can transmit before receiving an acknowledgment. They ensure lossless delivery over distance by preventing buffer overflow at the receiver, which is critical for maintaining data integrity in SANs. Option D correctly states this dual role of congestion management and lossless delivery.

Exam trap

Cisco often tests the distinction between Fibre Channel buffer credits and FCoE's Priority Flow Control (PFC), so the trap here is confusing the two lossless mechanisms and assuming buffer credits apply to FCoE.

How to eliminate wrong answers

Option A is wrong because buffer credits are allocated per port, not per VSAN; VSANs isolate traffic at the fabric level, but buffer credits operate at the physical link level to manage frame flow. Option B is wrong because increasing buffer credits does not always improve I/O performance; it can help over long distances but may waste memory if set too high for short links, and performance gains depend on other factors like link speed and application workload. Option C is wrong because FCoE uses a different lossless mechanism based on IEEE 802.1Qbb Priority Flow Control (PFC), not Fibre Channel buffer credits; buffer credits are native to Fibre Channel, not FCoE.

Full explanation →
160
MCQhard

An engineer is designing a Fibre Channel fabric with two Cisco MDS switches for redundancy. The switches are connected via two ISLs. The engineer wants to aggregate the ISLs for higher throughput and load balancing. Which feature should be used?

A.EISL trunking
B.VSAN load balancing
C.PortChannel
D.NPV mode
AnswerC

PortChannel aggregates multiple ISLs for bandwidth and redundancy.

Why this answer

Fibre Channel PortChannels allow aggregation of multiple physical ISLs into a single logical link, providing increased bandwidth and load balancing.

Full explanation →
161
MCQhard

A company is designing a HyperFlex cluster with 4 nodes and wants to tolerate the failure of any two nodes simultaneously while maintaining data availability. Which replication factor and cluster configuration should be used?

A.RF3 with 3 nodes
B.RF3 with 4 nodes
C.RF2 with 5 nodes
D.RF2 with 4 nodes
AnswerB

RF3 replicates data three times, so the cluster can survive two simultaneous node failures.

Why this answer

HyperFlex HXDP uses replication factor (RF) to determine data copies. RF3 replicates data three times, allowing the cluster to survive up to two concurrent node failures (if the cluster has at least 3 nodes). With 4 nodes, RF3 meets the requirement.

Full explanation →
162
MCQhard

A company is deploying a new SAN with two MDS 9148S switches in a single VSAN. They want to ensure that a failure of one switch does not affect storage traffic. Which technology should be implemented?

A.Implement FCoE to Ethernet storage.
B.Enable NPIV on all ports.
C.Configure a port channel between the switches.
D.Create a redundant fabric by connecting both switches to each storage array and host via multiple paths.
AnswerD

This provides path redundancy; if one switch fails, the other continues.

Why this answer

Implementing a redundant fabric by connecting both switches to each storage array and host via multiple paths ensures that if one switch fails, the other switch continues to carry storage traffic. This is achieved through multipathing software (e.g., Fibre Channel multipathing) and redundant physical connections, which provide active-active or active-passive failover without disrupting the SAN.

Exam trap

Cisco often tests the distinction between link-level redundancy (port channels) and fabric-level redundancy (multiple switches/paths), leading candidates to mistakenly choose port channels as a solution for switch failure.

How to eliminate wrong answers

Option A is wrong because FCoE (Fibre Channel over Ethernet) is a protocol for encapsulating Fibre Channel frames over Ethernet networks, not a redundancy mechanism; it does not address switch failure in a Fibre Channel SAN. Option B is wrong because NPIV (N_Port ID Virtualization) allows a single physical N_Port to register multiple FC IDs, enabling virtualization, but it does not provide switch-level redundancy or failover. Option C is wrong because a port channel between the switches (ISL) aggregates bandwidth and provides link-level redundancy, but it does not protect against a complete switch failure; if one switch fails, the ISL is lost and traffic through that switch stops.

Full explanation →
163
MCQmedium

An engineer is implementing VXLAN in a data center. The network must handle BUM traffic without relying on IP multicast in the underlay. Which BUM handling method should be chosen?

A.ARP suppression
B.Head-end replication
C.Multicast group
D.Ingress replication
AnswerD

Ingress replication uses unicast tunnels to replicate BUM traffic, no multicast needed.

Why this answer

In VXLAN environments that must avoid IP multicast in the underlay, ingress replication is the correct BUM handling method. It replicates broadcast, unknown unicast, and multicast (BUM) traffic at the ingress VTEP and sends a copy to each remote VTEP via unicast encapsulation, eliminating the need for multicast group membership in the underlay.

Exam trap

Cisco often tests the distinction between 'ingress replication' and 'head-end replication'—while they are functionally similar, the exam expects 'Ingress replication' as the correct Cisco term for unicast-only BUM handling, and 'Head-end replication' is a distractor that may confuse candidates into thinking it is a different method.

How to eliminate wrong answers

Option A is wrong because ARP suppression is a feature that reduces broadcast traffic by caching ARP replies at the VTEP, but it does not handle all BUM traffic (e.g., unknown unicast or multicast) and still requires a BUM replication method for traffic that is not suppressed. Option B is wrong because head-end replication is a generic term that can refer to ingress replication, but in Cisco VXLAN documentation, 'head-end replication' is often used interchangeably with ingress replication; however, the specific answer choice 'Head-end replication' is ambiguous and not the standard Cisco term for the unicast-only BUM method—Cisco explicitly uses 'Ingress replication' in the 350-601 exam context. Option C is wrong because multicast group relies on IP multicast in the underlay (e.g., PIM), which the question explicitly states must be avoided.

Full explanation →
164
Multi-Selectmedium

A network engineer is planning to implement VPC in a Cisco Nexus data center. Which two statements about VPC components are true? (Choose two.)

Select 2 answers
A.VPC member ports can be configured on only one of the VPC peers to avoid loops.
B.VPC consistency checks ensure that both peers have identical configurations for VPC member ports.
C.The VPC peer-keepalive link is used to monitor the liveness of the VPC peer.
D.VPC requires an IGP routing protocol between the peers to exchange MAC addresses.
E.The VPC peer-link carries only control-plane traffic between the VPC peers.
AnswersB, C

Correct. Consistency checks prevent misconfigurations that could cause loops.

Why this answer

VPC consistency checks are a critical feature that ensures both VPC peers have identical configurations for member ports, such as VLANs, allowed VLAN lists, and interface parameters. If configurations diverge, the VPC will suspend member ports to prevent traffic disruption or loops. This check is performed via the Cisco NX-OS Consistency Checker, which validates parameters like STP settings, port type, and allowed VLANs.

Exam trap

Cisco often tests the misconception that the peer-link carries only control-plane traffic, but in reality it also carries data-plane traffic for orphan ports and traffic that needs to reach the other VPC peer.

Full explanation →
165
MCQmedium

An administrator needs to configure zoning on a Cisco MDS switch. After creating zones and adding members, what must be done to activate the zoning configuration?

A.Reboot the switch for changes to take effect.
B.Assign zones to a zone set and then activate the zone set.
C.Activate the zone set using the 'zone activate' command.
D.Save the configuration to startup-config.
AnswerB

Zones must be in a zone set, and the zone set must be activated.

Why this answer

Zone sets must be activated to enforce zoning. The active zone set is the currently enforced zoning configuration. Multiple zone sets can be configured, but only one can be active.

Full explanation →
166
MCQmedium

A company is deploying FCoE in their data center. The design includes a Cisco Nexus 9000 switch with FEX modules. The storage team insists on using dedicated FCoE VLANs. Which best practice should be followed to ensure lossless behavior for FCoE traffic?

A.Configure traffic shaping on FCoE interfaces
B.Use the same VLAN for FCoE and IP traffic to reduce VLAN count
C.Disable flow control on all interfaces
D.Enable PFC on the switch for the FCoE VLAN
AnswerD

PFC provides lossless behavior for the CoS used by FCoE.

Why this answer

FCoE requires lossless transport to prevent frame drops that could corrupt Fibre Channel frames. Priority Flow Control (PFC), defined in IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured with a dedicated priority class that receives no-drop treatment. On Cisco Nexus 9000 switches, this is achieved by enabling PFC on the specific VLAN used for FCoE traffic, ensuring lossless behavior without affecting other traffic classes.

Exam trap

Cisco often tests the misconception that flow control (IEEE 802.3x) is sufficient for FCoE, but the trap here is that standard link-level flow control pauses all traffic on the link, whereas PFC provides granular per-priority lossless handling required for FCoE.

How to eliminate wrong answers

Option A is wrong because traffic shaping is a rate-limiting mechanism that smooths bursts but does not guarantee lossless delivery; FCoE relies on PFC for per-priority pause, not shaping. Option B is wrong because using the same VLAN for FCoE and IP traffic would mix lossless and lossy traffic, causing congestion and frame drops for FCoE; dedicated FCoE VLANs are a best practice to isolate lossless traffic. Option C is wrong because disabling flow control entirely removes the ability to pause traffic, which would cause FCoE frames to be dropped under congestion, violating the lossless requirement.

Full explanation →
167
Multi-Selectmedium

An engineer is designing a SAN for a virtualized environment. Which two best practices should be followed for Fibre Channel zoning?

Select 2 answers
A.Use single-initiator zoning.
B.Use multiple initiators in a single zone.
C.Use soft zoning exclusively.
D.Disable zoning for performance.
E.Zone by WWPN rather than WWNN.
AnswersA, E

Simplifies troubleshooting and security.

Why this answer

Single-initiator zoning (also known as one-to-one zoning) is a best practice because it restricts each Fibre Channel zone to exactly one initiator (host HBA) and one or more target ports. This eliminates the risk of RSCN storms propagating across multiple initiators, reduces fabric instability, and simplifies troubleshooting by ensuring clear, predictable paths between each host and its storage.

Exam trap

Cisco often tests the misconception that soft zoning is sufficient for security, but the trap here is that soft zoning only filters name server queries and does not prevent a device from directly addressing another device's port if it knows the Fibre Channel address.

Full explanation →
168
MCQeasy

A network engineer is configuring a UCS service profile for a B-series blade server. The goal is to allow the blade to be replaced without requiring reconfiguration of network identities. Which UCS feature enables this capability?

A.Fabric Interconnect failover
B.Stateless computing via service profile
C.CIMC out-of-band management
D.UCS Central global policies
AnswerB

Correct. Stateless computing decouples the OS from hardware, allowing blade replacement without reconfiguration.

Why this answer

Stateless computing abstracts hardware identities such as MAC addresses and WWNNs into the service profile, so a replacement blade inherits the same identities.

Full explanation →
169
MCQmedium

A Nexus switch is configured with DHCP snooping. Which switchport mode is required for trusted ports to prevent rogue DHCP server attacks?

A.ip dhcp snooping trust
B.trunk
C.access
D.spanning-tree portfast
AnswerA

This interface command marks the port as trusted.

Why this answer

DHCP snooping treats ports as untrusted by default. Trusted ports are explicitly configured, typically on uplink interfaces.

Full explanation →
170
MCQhard

In a Cisco Application Centric Infrastructure (ACI) fabric, a tenant has two EPGs: Web and App. A contract is created between Web (consumer) and App (provider) with a filter that permits TCP port 8080 (the only port used by the application). However, traffic from App to Web is failing. The application requires bidirectional communication: Web initiates requests to App on TCP 8080, and App responds on the same connection (stateful). The engineer verifies that the filter is correctly applied and that both EPGs are in the same VRF. The contract is applied in the direction Web -> App. What is the most efficient way to resolve this issue without compromising security?

A.Verify that no higher-priority contract is overriding; if not, the issue is elsewhere.
B.Set the contract to 'allow any' between the EPGs to bypass filtering.
C.Create a second contract from App to Web with the same filter, and apply it to App as consumer and Web as provider.
D.Modify the existing filter to allow TCP 8080 from App to Web as well.
AnswerC

This adds the reverse direction explicitly, allowing return traffic.

Why this answer

In Cisco ACI, contracts are unidirectional by default. Even though the filter permits TCP 8080 from Web to App, the return traffic from App to Web is not implicitly allowed because ACI does not perform stateful inspection for TCP connections; it relies on explicit contract rules for each direction. Option C correctly creates a second contract from App (consumer) to Web (provider) with the same filter, allowing the bidirectional communication required for the application's stateful TCP session without over-permitting.

Exam trap

Cisco often tests the misconception that ACI contracts are stateful like a firewall, leading candidates to assume return traffic is automatically allowed; the trap here is that ACI requires explicit contracts for each direction, even for TCP connections.

How to eliminate wrong answers

Option A is wrong because the issue is not about contract priority; the filter is correctly applied and no override is needed—the fundamental problem is the lack of a return direction contract. Option B is wrong because setting the contract to 'allow any' would bypass all security filtering, violating the principle of least privilege and unnecessarily exposing the EPGs. Option D is wrong because modifying the existing filter to allow TCP 8080 from App to Web would still not create a contract in the reverse direction; filters are applied per contract direction, and without a contract from App to Web, the filter change has no effect.

Full explanation →
171
MCQmedium

Which technology provides at-rest encryption for disk drives in UCS servers?

A.IPsec
B.FC-SP-2
C.SSL
D.SED
AnswerD

SEDs encrypt data at rest.

Why this answer

Self-encrypting drives (SED) provide at-rest encryption.

Full explanation →
172
MCQmedium

Refer to the exhibit. A network engineer notices that the VPC peer status is down, and the peer-keepalive is not reachable. Based on the configuration, what is the likely issue?

A.The peer-link port-channel10 has VLAN 100-110 allowed, but the peer-keepalive uses a separate VLAN.
B.The peer-keepalive destination must be on the management VRF.
C.The VPC domain priority should be lower.
D.The peer-keepalive source and destination are swapped.
AnswerB

Nexus requires the peer-keepalive to be sent via the management VRF, which is not specified here. The command should include 'vrf management'.

Why this answer

The peer-keepalive link must be routed via the management VRF to ensure it remains independent of the data-plane and peer-link state. If the peer-keepalive destination is not in the management VRF, the keepalive packets may be dropped or unreachable, causing the VPC peer status to remain down. The configuration shown likely omits the 'vrf member management' under the peer-keepalive configuration, or the destination IP is not reachable through the management interface.

Exam trap

Cisco often tests the requirement that peer-keepalive must use the management VRF (or a dedicated VRF) and not rely on the peer-link or any data VLAN, leading candidates to incorrectly focus on VLAN allowed lists or priority values instead of the VRF configuration.

How to eliminate wrong answers

Option A is wrong because the peer-link port-channel VLAN allowed list does not affect peer-keepalive reachability; peer-keepalive uses a separate Layer 3 path (typically management VRF) and is not dependent on the VLANs allowed on the peer-link. Option C is wrong because the VPC domain priority determines which switch is the primary for role election, not the peer-keepalive status; a lower priority would not fix an unreachable peer-keepalive destination. Option D is wrong because swapping the source and destination IP addresses would still result in an unreachable path if the destination is not in the correct VRF; the core issue is the VRF mismatch, not the direction of the addresses.

Full explanation →
173
Multi-Selectmedium

An engineer is configuring a storage network with FCoE and must ensure that the FCoE traffic does not interfere with standard LAN traffic. Which two mechanisms should be implemented?

Select 2 answers
A.Use the same VLAN for FCoE and LAN.
B.Disable flow control on FCoE VLAN.
C.Enable PFC on the FCoE VLAN.
D.Assign FCoE traffic to a dedicated VLAN.
E.Use jumbo frames for LAN traffic only.
AnswersC, D

Provides lossless Ethernet.

Why this answer

FCoE requires lossless transport to prevent frame drops that would corrupt Fibre Channel frames. Priority Flow Control (PFC), defined by IEEE 802.1Qbb, enables pause frames on a per-priority basis, allowing the FCoE VLAN to be configured as lossless while standard LAN traffic remains best-effort. This ensures FCoE traffic does not interfere with LAN traffic by isolating the flow control behavior.

Exam trap

The trap here is that candidates often think disabling flow control (Option B) is necessary to avoid interference, but FCoE actually requires flow control (PFC) to be enabled, and the key is to isolate it to a dedicated VLAN.

Full explanation →
174
MCQmedium

A company plans to deploy multiple UCS domains across different geographical locations. They want a single pane of glass to manage service profiles globally. Which Cisco solution should be used?

A.UCS Manager
B.HyperFlex Connect
C.Cisco IMC Supervisor
D.UCS Central
AnswerD

UCS Central aggregates multiple UCS domains for unified management.

Why this answer

UCS Central provides centralized management of multiple UCS domains, enabling global service profile policies and management across domains.

Full explanation →
175
MCQmedium

Which FC addressing component is used to uniquely identify a host bus adapter (HBA) port in a Fibre Channel fabric, and is often used for zoning?

A.World Wide Port Name (WWPN)
B.World Wide Node Name (WWNN)
C.Fibre Channel ID (FCID)
D.Domain ID
AnswerA

WWPN uniquely identifies a port and is used for zoning.

Why this answer

The World Wide Port Name (WWPN) is a globally unique 64-bit identifier assigned to each Fibre Channel port, commonly used for hard zoning.

Full explanation →
176
MCQhard

A CCNP engineer is troubleshooting a UCS environment where a server is stuck in 'Discovery: In Progress' state. The chassis has been power-cycled, but the issue persists. FEX fabric port is configured correctly. What is the most likely cause?

A.Incorrect IP address on the Fabric Interconnect management interface.
B.Firmware version mismatch between the server's CIMC and the Fabric Interconnect.
C.The chassis is not connected to the FI via a valid fabric cable.
D.The server's service profile is not associated.
AnswerB

CIMC firmware must match the FI's supported version for discovery to complete.

Why this answer

When a server is stuck in 'Discovery: In Progress' state and the chassis has been power-cycled with correct FEX fabric port configuration, the most likely cause is a firmware version mismatch between the server's Cisco Integrated Management Controller (CIMC) and the Fabric Interconnect (FI). During discovery, the FI attempts to inventory and manage the server via CIMC; if the firmware versions are incompatible, the discovery process cannot complete, leaving the server in a perpetual 'In Progress' state.

Exam trap

Cisco often tests the misconception that a server stuck in discovery is due to a physical connectivity issue (Option C) or a service profile association problem (Option D), when in fact the root cause is a firmware version mismatch that prevents the FI from completing the inventory handshake.

How to eliminate wrong answers

Option A is wrong because the Fabric Interconnect management interface IP address is used for out-of-band management access (e.g., SSH, GUI) and does not affect server discovery, which occurs over the fabric data path. Option C is wrong because the chassis is already connected to the FI via a valid fabric cable (as stated in the question), and power-cycling the chassis would have resolved any transient connectivity issues. Option D is wrong because a service profile association is required for the server to be operational, but the server must first complete discovery before it can be associated; being stuck in discovery prevents association, not the other way around.

Full explanation →
177
MCQmedium

An engineer applies an IPv4 ACL to a Nexus switch interface. The ACL must permit traffic from host 10.1.1.1 to host 10.2.2.2 on TCP port 443 and deny all other traffic. Which configuration is correct?

A.ip access-list WEB; permit ip 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0
B.ip access-list WEB; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443
C.ip access-list WEB; deny ip any any; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443
D.ip access-list WEB; permit tcp any any eq 443
AnswerB

This ACL permits the specified traffic, and the implicit deny blocks everything else.

Why this answer

ACLs are processed top-down; a permit statement for the desired traffic followed by an implicit deny all other traffic.

Full explanation →
178
MCQmedium

An engineer is configuring a Cisco MDS switch to connect two SAN islands using a Fibre Channel ISL. The interfaces on both switches are set to auto mode. However, the link does not come up. What is the most likely cause?

A.Both switches have the same domain ID.
B.The ISL link requires a minimum speed of 8 Gbps.
C.The ports are in auto mode and neither side is configured as E-port.
D.The ports are configured in F-port mode.
AnswerC

Auto mode may not reliably form an E-port; at least one side should be set to E-port to establish an ISL.

Why this answer

On Cisco MDS switches, ports in auto mode negotiate to become F-ports by default. For an ISL, at least one side must be configured as E-port to force the link to become an E-port.

Full explanation →
179
MCQhard

A data center architect is designing a Fibre Channel fabric using Cisco MDS switches. To reduce the number of domain IDs and simplify management, the edge switches will operate in NPV mode. However, the core switches must be configured appropriately. Which port type must be used on the core switches to connect to NPV edge switches?

A.N-port
B.F-port
C.E-port
D.NP-port
AnswerB

The core switch must have F-ports to connect to NP-ports from the NPV edge switch.

Why this answer

In NPV mode, the edge switch uses NP-ports to connect to the core. The core switch must have F-ports to accept these connections.

Full explanation →
180
MCQeasy

An engineer is configuring a Fibre Channel over Ethernet (FCoE) deployment. The network must ensure lossless transport for FCoE traffic. Which Data Center Bridging (DCB) feature must be enabled to provide no-drop service for FCoE frames?

A.Jumbo frames
B.Priority Flow Control (PFC)
C.Enhanced Transmission Selection (ETS)
D.Data Center Bridging Exchange (DCBX)
AnswerB

PFC enables lossless transport by pausing traffic on a per-priority basis when congestion occurs.

Why this answer

Priority Flow Control (PFC) is a DCB mechanism that provides per-priority pause to ensure lossless delivery for FCoE traffic.

Full explanation →
181
MCQeasy

A network administrator wants to send NX-OS CLI commands to a Nexus switch via HTTP/HTTPS. Which API should be used?

A.NETCONF
B.RESTCONF
C.NX-API CLI
D.APIC REST API
AnswerC

Correct API for CLI commands over HTTP/HTTPS.

Why this answer

NX-API CLI allows sending NX-OS commands via HTTP/HTTPS in either XML or JSON format.

Full explanation →
182
MCQeasy

Which of the following is a required characteristic of an FCoE SAN?

A.Jumbo frames must be enabled.
B.Spanning Tree Protocol must be disabled.
C.Link aggregation (LACP) is required.
D.Lossless Ethernet (PFC) must be enabled.
AnswerD

FCoE requires no-drop.

Why this answer

FCoE (Fibre Channel over Ethernet) requires a lossless Ethernet fabric to prevent frame drops, which would corrupt Fibre Channel frames. Priority Flow Control (PFC), defined in IEEE 802.1Qbb, enables lossless operation by pausing traffic on individual CoS queues, ensuring no-drop behavior for FCoE traffic. Without PFC, standard Ethernet's best-effort delivery would cause frame loss, breaking FCoE's reliability requirements.

Exam trap

Cisco often tests the misconception that jumbo frames are mandatory for FCoE, but the actual required characteristic is lossless Ethernet via PFC, as jumbo frames are optional and only improve efficiency.

How to eliminate wrong answers

Option A is wrong because jumbo frames are not a required characteristic of an FCoE SAN; while they can improve efficiency by reducing per-frame overhead, FCoE can operate with standard 1500-byte MTU, and the mandatory requirement is lossless Ethernet via PFC. Option B is wrong because Spanning Tree Protocol (STP) is not required to be disabled for FCoE; in fact, FCoE can run over STP-enabled networks, though dedicated FCoE SANs often use STP-disabled designs (e.g., vPC or FabricPath) for convergence, but disabling STP is not a mandatory characteristic. Option C is wrong because link aggregation (LACP) is not required for FCoE; FCoE can operate over single links or port channels, and while LACP can provide redundancy and bandwidth, it is not a prerequisite for FCoE functionality.

Full explanation →
183
MCQeasy

Which feature on Nexus switches prevents ARP spoofing attacks by validating ARP packets?

A.Dynamic ARP Inspection
B.DHCP Snooping
C.Port Security
D.IP Source Guard
AnswerA

DAI validates ARP packets.

Why this answer

Dynamic ARP Inspection (DAI) intercepts ARP packets and validates them against the DHCP snooping binding database.

Full explanation →
184
Multi-Selectmedium

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

Select 2 answers
A.The underlay network provides IP connectivity between VTEPs
B.BGP EVPN advertises MAC addresses and IP addresses as routes
C.VXLAN encapsulates Ethernet frames in IP packets using MPLS labels
D.VXLAN uses a 32-bit network identifier (VNI)
E.The control plane is responsible for actual data forwarding
AnswersA, B

Underlay routing (e.g., IS-IS, OSPF) enables VTEP-to-VTEP reachability.

Why this answer

The VXLAN underlay network (typically an IP-based fabric using protocols like OSPF or IS-IS) provides IP connectivity between VTEPs, enabling them to encapsulate and decapsulate VXLAN packets. Without this underlay reachability, VTEPs cannot communicate, making it a foundational requirement for VXLAN operation.

Exam trap

Cisco often tests the distinction between the 24-bit VNI (VXLAN Network Identifier) and the 32-bit VXLAN segment ID used in some older documentation, leading candidates to mistakenly select a 32-bit identifier.

Full explanation →
185
MCQmedium

In ACI, what is the purpose of a contract?

A.Isolate tenants
B.Define routing between VRF
C.Allow or deny traffic between EPGs
D.Provide external connectivity
AnswerC

Contracts are the policy mechanism.

Why this answer

In Cisco ACI, a contract is a policy construct that defines how communication is allowed or denied between Endpoint Groups (EPGs). Contracts specify the subjects, filters, and actions (permit or deny) that govern traffic flows, enabling granular security and segmentation within the fabric. Without a contract, EPGs in different bridge domains or VRFs cannot communicate by default.

Exam trap

Cisco often tests the misconception that contracts are used for routing or tenant isolation, when in fact they are strictly a policy mechanism for traffic filtering between EPGs, not a routing or tenancy construct.

How to eliminate wrong answers

Option A is wrong because isolating tenants is achieved through tenant constructs and VRFs, not contracts; contracts control inter-EPG traffic, not tenant isolation. Option B is wrong because routing between VRFs is handled by a VRF route leak or a routed outside connection, not by a contract; contracts operate at Layer 4–7 policy level, not Layer 3 routing. Option D is wrong because external connectivity is provided by external routed networks (L3Out) or Layer 2 outside (L2Out) configurations, not by contracts; contracts only define policy for traffic between EPGs or between an EPG and an external network.

Full explanation →
186
MCQhard

In a Cisco ACI fabric, the administrator notices that traffic between two endpoints in different EPGs but on the same leaf switch is being dropped when a contract is applied. The endpoints are in the same VRF but different bridge domains. What is the likely cause?

A.The VRF is not configured correctly.
B.The bridge domains are not in the same network.
C.The leaf switch is missing a route to the destination.
D.The contract does not allow communication between those EPGs.
AnswerD

Contracts must explicitly permit inter-EPG traffic.

Why this answer

In Cisco ACI, inter-EPG communication is governed by contracts. Even when endpoints reside on the same leaf switch, same VRF, and different bridge domains, traffic is dropped unless a contract explicitly permits the communication between the source and destination EPGs. The contract defines the filter (e.g., IP protocol, ports) and the direction (provider/consumer) required for traffic to flow.

Exam trap

Cisco often tests the misconception that endpoints in the same VRF can always communicate, but in ACI, contracts override Layer 3 reachability, and candidates mistakenly blame routing or subnet mismatches instead of the missing contract.

How to eliminate wrong answers

Option A is wrong because the VRF configuration is irrelevant; both endpoints are in the same VRF, and the issue is not about VRF reachability but about policy enforcement. Option B is wrong because bridge domains can be in different subnets; ACI routes between them using the VRF, and the contract is the gatekeeper, not the subnet. Option C is wrong because the leaf switch does not need a separate route; ACI uses a distributed anycast gateway and the leaf already has the endpoint's location learned via COOP, so routing is not the issue.

Full explanation →
187
Multi-Selecthard

Which three components are part of the ACI Management Information Tree (MIT)? (Choose three.)

Select 3 answers
A.Endpoint Group (EPG)
B.VRF
C.Application Profile
D.Tenant
E.Routed Outside
AnswersA, C, D

EPG is a child of AP.

Why this answer

Tenant, Application Profile, and Endpoint Group are managed objects in the MIT hierarchy.

Full explanation →
188
MCQhard

A UCS administrator wants to deploy a Cisco UCS C-Series rack server in a UCS Manager-managed environment. The server is currently in standalone mode using CIMC. Which step is required to integrate the C-Series server into UCS Manager?

A.Configure the server in direct connect mode with the Fabric Interconnects.
B.Install an I/O Module in the rack server to enable Fabric Interconnect connectivity.
C.Adopt the server into UCS Manager by reinitializing CIMC and connecting it to the Fabric Interconnects.
D.Use Cisco IMC Supervisor to connect the server to UCS Manager.
AnswerC

Correct. This process allows UCS Manager to manage the server.

Why this answer

To integrate a C-series rack server into UCS Manager, the server must be adopted by the UCS Manager, which involves reinitializing the CIMC to connect to the Fabric Interconnects. This enables management through UCS Manager with service profiles.

Full explanation →
189
MCQmedium

Which Cisco DCNM feature allows centralized management and monitoring of multiple NX-OS fabrics?

A.vCenter
B.NX-API
C.APIC controller
D.DCNM
AnswerD

DCNM manages multiple NX-OS fabrics centrally.

Why this answer

Cisco DCNM (Data Center Network Manager) is the correct answer because it is the centralized management platform specifically designed to manage, monitor, and provision multiple NX-OS fabrics, including LAN and SAN, from a single pane of glass. It supports fabric discovery, configuration compliance, and health monitoring across multiple switches and fabrics, which aligns directly with the question's requirement.

Exam trap

Cisco often tests the distinction between management platforms (DCNM) and controllers (APIC), so the trap here is that candidates confuse APIC (for ACI) with DCNM (for NX-OS fabrics), especially since both are Cisco data center management tools.

How to eliminate wrong answers

Option A (vCenter) is wrong because it is VMware's management tool for vSphere environments, not a Cisco DCNM feature; it manages virtual machines and ESXi hosts, not NX-OS fabrics. Option B (NX-API) is wrong because it is a programmatic interface (REST API) on NX-OS switches for automation and configuration, not a centralized management platform for multiple fabrics. Option C (APIC controller) is wrong because it is the controller for Cisco ACI (Application Centric Infrastructure) fabrics, not for traditional NX-OS fabrics; APIC manages ACI leaf/spine topologies, not standalone NX-OS switches or fabrics.

Full explanation →
190
MCQmedium

An iSCSI storage array is being deployed with two network interfaces for redundancy. The hosts also have two iSCSI initiators. To ensure load balancing and failover, which feature should be configured?

A.MPIO
B.Jumbo frames
C.VLAN tagging
D.CHAP authentication
AnswerA

MPIO enables the use of multiple physical paths for I/O to achieve failover and load balancing.

Why this answer

Multipath I/O (MPIO) allows multiple paths between initiator and target for redundancy and load balancing.

Full explanation →
191
Multi-Selecthard

An organization wants to encrypt data at rest in a storage array. Which two technologies can be used? (Choose two.)

Select 2 answers
A.SAN array encryption
B.MACsec
C.IPsec
D.FC-SP-2
E.Self-encrypting drives (SED)
AnswersA, E

Array-based encryption encrypts at the storage controller.

Why this answer

Self-encrypting drives (SEDs) and array-based encryption (e.g., EMC/NetApp) are common methods.

Full explanation →
192
MCQmedium

A storage network engineer notices high buffer credit starvation counters on an inter-switch link. What is the most effective solution to reduce this issue?

A.Change the ISL port mode from E to F.
B.Reduce the ISL speed to 1 Gbps.
C.Increase the number of buffer credits on the ISL.
D.Enable QoS to prioritize buffer credit recovery.
AnswerC

More buffer credits accommodate longer distances and reduce starvation.

Why this answer

High buffer credit starvation counters on an inter-switch link (ISL) indicate that the switch is running out of buffer credits to send frames, causing pauses in transmission. Increasing the number of buffer credits on the ISL directly addresses this by providing more credit pool for the link, allowing the switch to send more frames before needing acknowledgment, thus reducing starvation and improving throughput.

Exam trap

Cisco often tests the misconception that reducing speed or using QoS can fix buffer credit issues, but the correct solution is always to increase buffer credits or use extended credits for long-distance links.

How to eliminate wrong answers

Option A is wrong because changing the ISL port mode from E (expansion) to F (fabric) would disable the ISL functionality, breaking the inter-switch link entirely, and does not address buffer credit starvation. Option B is wrong because reducing the ISL speed to 1 Gbps would lower the bandwidth and increase latency, potentially worsening buffer credit starvation by reducing the rate at which credits can be replenished. Option D is wrong because QoS does not manage buffer credits; buffer credit recovery is a hardware-level flow control mechanism (BB_Credit) and cannot be prioritized by QoS, which deals with traffic classification and scheduling.

Full explanation →
193
Matchingmedium

Match each Cisco data center high availability feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

First-hop redundancy for default gateway

Multi-chassis link aggregation with loop prevention

Transparent interconnection of lots of links (TRILL-based)

Non-Stop Forwarding during supervisor switchover

Stateful Switchover for control plane redundancy

Why these pairings

The correct matches are: VRRP is an open standard protocol for router redundancy; GLBP provides load balancing across gateways; NSF allows forwarding to continue during switchover; VPC bundles links from two switches. Common confusions include mistaking HSRP for VRRP (HSRP is proprietary) and confusing SSO (state synchronization) with NSF (forwarding continuity).

Full explanation →
194
MCQhard

An administrator is configuring a HyperFlex cluster with 4 nodes. To ensure data availability in the event of two simultaneous node failures, what replication factor should be configured?

A.RF3
B.RF2
C.RF4
D.RF1
AnswerA

Correct. RF3 can tolerate two concurrent node failures.

Why this answer

With RF3, each data block is stored on three nodes, allowing the cluster to survive two node failures (provided the witness is available for quorum).

Full explanation →
195
MCQhard

An engineer is designing an ACI fabric and needs to provide connectivity to an external Layer 3 network. Which construct must be configured to achieve this?

A.VMM domain
B.EPG
C.L3Out
D.VXLAN tunnel
AnswerC

L3Out provides external Layer 3 connectivity via routed interfaces or subinterfaces.

Why this answer

To connect an ACI fabric to an external Layer 3 network, you must configure an L3Out. An L3Out defines the external routed connectivity by associating a VRF with external interfaces, routing protocols (e.g., OSPF, BGP, EIGRP), and subnets that are advertised into or from the fabric. This construct allows ACI to exchange routes with the external Layer 3 domain.

Exam trap

Cisco often tests the distinction between internal fabric constructs (EPGs, VMM domains) and external connectivity constructs (L3Out), so the trap here is confusing an EPG or VMM domain as the solution for Layer 3 external routing when they serve entirely different purposes within the ACI architecture.

How to eliminate wrong answers

Option A is wrong because a VMM domain integrates ACI with hypervisor managers (e.g., VMware vCenter) for virtual machine networking, not for external Layer 3 connectivity. Option B is wrong because an EPG (Endpoint Group) is a logical grouping of endpoints within a tenant, used for intra-fabric policy enforcement, not for routing to external networks. Option D is wrong because a VXLAN tunnel is the underlying encapsulation used for overlay traffic within the ACI fabric; external Layer 3 connectivity requires routed interfaces and routing protocols, not a VXLAN tunnel.

Full explanation →
196
Multi-Selecteasy

Which TWO methods are supported by Cisco NX-API for automating Nexus switches? (Choose two.)

Select 2 answers
A.NX-API CLI
B.NX-API REST
C.SNMP
D.RESTCONF
E.NETCONF
AnswersA, B

Correct. NX-API CLI sends NX-OS commands via API.

Why this answer

NX-API supports both REST (JSON/XML over HTTP/HTTPS) and CLI (sending NX-OS commands via API). NETCONF and RESTCONF are separate protocols, not part of NX-API. SNMP is not a NX-API method.

Full explanation →
197
Multi-Selecthard

A Cisco MDS switch is configured with an ISL trunk between two switches. The administrator wants to enable multiple VSANs over the same physical link. Which two actions must be taken? (Choose two.)

Select 2 answers
A.Create a PortChannel for the ISL.
B.Configure the ISL port as an F-port.
C.Configure the port in NPV mode.
D.Enable VSAN trunking on the port.
E.Configure the ISL port in trunk mode.
AnswersD, E

VSAN trunking allows the port to carry multiple VSANs.

Why this answer

EISL (Enhanced ISL) allows multiple VSANs to share an ISL. To use EISL, the ISL must be configured in trunk mode, and VSANs must be allowed on the trunk. The switch port must be set to 'E' port mode (or auto) to support trunking.

Full explanation →
198
MCQhard

An engineer is configuring BGP EVPN for VXLAN in a spine-leaf fabric. The leaf switches must advertise host IP-to-MAC mappings to the control plane. Which BGP address family should be enabled on the leaf switches?

A.address-family vpnv4 unicast
B.address-family ipv4 unicast
C.address-family link-state
D.address-family l2vpn evpn
AnswerD

The `address-family l2vpn evpn` enables BGP to carry Network Layer Reachability Information (NLRI) for MAC/IP advertisement routes, which directly satisfies the requirement for leaf switches to advertise host IP-to-MAC mappings in a VXLAN EVPN fabric. This address family uses Route Type 2 (MAC/IP Advertisement) to encode both the MAC address and the associated host IP, allowing the control plane to distribute these bindings without flooding data-plane traffic.

Why this answer

In a VXLAN BGP EVPN fabric, leaf switches must advertise host IP-to-MAC mappings using the BGP EVPN address family. This is enabled with the command 'address-family l2vpn evpn' under the BGP configuration, which carries Type-2 routes (MAC/IP advertisement routes) that contain both the MAC address and the associated IP address of the host.

Exam trap

Cisco often tests the distinction between 'address-family l2vpn evpn' and 'address-family vpnv4 unicast' to trap candidates who confuse EVPN with traditional MPLS L3VPN or who assume that any VPN-related address family works for VXLAN.

How to eliminate wrong answers

Option A is wrong because 'address-family vpnv4 unicast' is used for MPLS Layer 3 VPNs to carry IPv4 routes with VPN labels, not for VXLAN EVPN host IP-to-MAC mappings. Option B is wrong because 'address-family ipv4 unicast' carries standard IPv4 unicast routes and does not support the advertisement of MAC addresses or EVPN NLRI. Option C is wrong because 'address-family link-state' is used for OSPF or IS-IS link-state information distribution, typically in segment routing or traffic engineering contexts, and has no role in VXLAN EVPN control plane operations.

Full explanation →
199
MCQmedium

An engineer is integrating a UCS C-series rack server into UCS Manager. The server is currently managed by CIMC. Which mode must be enabled on the C-series server to allow UCS Manager to discover and manage it?

A.Standalone mode
B.Cisco IMC Supervisor mode
C.UCS-Managed mode
D.Direct Connect mode
AnswerC

Correct. This mode allows UCS Manager to control the server via a service profile.

Why this answer

UCS Manager can manage C-series servers in UCS-Managed mode, which requires the server to be in UCSM mode via CIMC.

Full explanation →
200
MCQmedium

A network engineer is configuring micro-segmentation in an ACI fabric. Two EPGs, Web and App, must communicate via HTTPS only. Which type of contract should be applied between the EPGs?

A.Regular contract with a filter allowing HTTPS
B.Taboo contract
C.Intra-EPG contract
D.Filter contract
AnswerA

The regular contract with a filter for HTTPS permits the desired traffic.

Why this answer

ACI contracts use a whitelist model: a contract between EPGs explicitly permits desired traffic. A taboo contract would deny specific traffic, not permit.

Full explanation →
201
MCQeasy

Refer to the exhibit. What is the intended effect of this Ansible playbook task?

A.It deletes VLAN 10 from all switches.
B.It saves the running configuration to startup.
C.It reboots the Nexus switches after applying the configuration.
D.It ensures VLAN 10 exists with the name 'Automation_VLAN' on the target switches.
AnswerD

The nxos_config module pushes the provided lines, ensuring they are present.

Why this answer

The Ansible playbook task uses the `cisco.nxos.nxos_vlans` module with the `state: merged` directive, which ensures that the specified VLAN configuration (VLAN 10 with name 'Automation_VLAN') is present on the target Nexus switches. If VLAN 10 does not exist, it will be created; if it exists with a different name, it will be updated. The `merged` operation does not delete or reboot; it only applies the configuration to align the device's state with the playbook's desired state.

Exam trap

Cisco often tests the distinction between `merged`, `replaced`, `overridden`, and `deleted` states in Ansible modules, and the trap here is that candidates mistakenly associate any configuration task with a reboot or save operation, or assume `merged` implies deletion of existing configuration.

How to eliminate wrong answers

Option A is wrong because the `state: merged` operation adds or updates configuration, not deletes; deleting VLANs would require `state: absent` or a separate task. Option B is wrong because saving the running configuration to startup is not part of the `nxos_vlans` module; it would require a separate task using `cisco.nxos.nxos_config` with `save_when: always` or the `nxos_command` module to issue `copy running-config startup-config`. Option C is wrong because rebooting switches is not an action of the `nxos_vlans` module; a reboot would require a task using `nxos_reboot` or `nxos_command` with a reload command, and the `merged` state does not trigger any reboot.

Full explanation →
202
MCQmedium

An administrator needs to limit the number of MAC addresses learned on a Nexus access port to prevent MAC flooding attacks. Which feature should be configured?

A.Port Security
B.DHCP Snooping
C.Dynamic ARP Inspection
D.IP Source Guard
AnswerA

Port security limits MAC addresses.

Why this answer

Port security limits MAC addresses per port.

Full explanation →
203
MCQmedium

A Nexus switch is experiencing high CPU utilization due to control plane traffic. Which feature should be configured to protect the CPU?

A.Control Plane Policing
B.IP Source Guard
C.Dynamic ARP Inspection
D.DHCP snooping
AnswerA

CoPP protects the control plane.

Why this answer

CoPP (Control Plane Policing) rate-limits control plane traffic.

Full explanation →
204
MCQeasy

An engineer needs to isolate storage traffic for different departments using Fibre Channel switches. Which technology should be used?

A.Zoning
B.Trunking
C.NPV (N-Port Virtualization)
D.VSAN (Virtual SAN)
AnswerD

Correct: VSANs create separate Fibre Channel fabrics for isolation.

Why this answer

VSAN (Virtual SAN) is the correct technology because it allows the engineer to create multiple isolated virtual SANs on a single physical Fibre Channel fabric. Each VSAN operates as an independent SAN with its own fabric services, security policies, and traffic isolation, enabling different departments to have dedicated storage traffic without interference.

Exam trap

Cisco often tests the distinction between zoning and VSANs, where candidates mistakenly believe that zoning alone provides full traffic isolation, but zoning only controls device communication within a single VSAN and does not isolate fabric services or management domains.

How to eliminate wrong answers

Option A is wrong because zoning only controls which devices can communicate within a single VSAN, but does not provide the complete isolation of fabric services and traffic that is required for separate departments. Option B is wrong because trunking in Fibre Channel refers to carrying multiple VSANs over a single ISL (Inter-Switch Link), not to isolating storage traffic for different departments. Option C is wrong because NPV (N-Port Virtualization) is used to aggregate multiple N-Ports into a single physical link to reduce domain IDs in a fabric, not to isolate traffic between departments.

Full explanation →
205
MCQeasy

An administrator wants to ensure that a specific initiator can only access a single target LUN. Which zoning approach satisfies this requirement?

A.Use LUN zoning to map the initiator to a specific LUN ID.
B.Implement soft zoning based on domain IDs.
C.Configure a zone with the initiator WWPN and the target WWPN.
D.Place the initiator and target in different VSANs.
AnswerA

LUN zoning restricts access to a specific LUN on the target.

Why this answer

LUN zoning (also known as LUN masking) allows the administrator to map a specific initiator to a particular LUN ID on a target, ensuring that the initiator can only access that single LUN. This is achieved by configuring access control at the storage array level, typically using the target's LUN masking feature, which restricts visibility to only the assigned LUN. Unlike WWPN zoning, which controls fabric-level access, LUN zoning provides granular per-LUN access control.

Exam trap

Cisco often tests the misconception that WWPN zoning alone restricts LUN access, but in reality, WWPN zoning only controls fabric-level connectivity, not SCSI-level LUN visibility, which requires LUN masking or LUN zoning.

How to eliminate wrong answers

Option B is wrong because soft zoning based on domain IDs only restricts communication at the fabric level by filtering zone members based on domain IDs, but it does not control access to individual LUNs; it still allows the initiator to see all LUNs on the target. Option C is wrong because configuring a zone with the initiator WWPN and the target WWPN only permits fabric-level communication between the two devices, but the initiator will still be able to see all LUNs presented by that target unless additional LUN masking is applied. Option D is wrong because placing the initiator and target in different VSANs would completely prevent any communication between them, which does not satisfy the requirement of allowing access to a single target LUN.

Full explanation →
206
MCQmedium

A network engineer needs to automate the configuration of BGP on a Nexus switch using Ansible. Which Ansible module from the cisco.nxos collection is appropriate for managing BGP configuration?

A.nxos_vlan
B.nxos_bgp
C.nxos_config
D.nxos_interface
AnswerB

Directly manages BGP configuration.

Why this answer

The nxos_bgp module is specifically designed to manage BGP settings on NX-OS devices.

Full explanation →
207
MCQhard

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

A.Add 'spanning-tree guard loop' to the interface.
B.Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.
C.Add 'spanning-tree bpdufilter enable' on the interface.
D.Change the port type to 'spanning-tree port type network trunk'.
AnswerC

BPDU filter on an edge port prevents the switch from sending/receiving BPDUs, maintaining edge status.

Why this answer

Enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Exam trap

Cisco often tests the distinction between BPDU guard and BPDU filter, where candidates mistakenly choose BPDU guard (which errdisables the port) instead of BPDU filter (which silently ignores BPDUs) when the goal is to maintain connectivity while preventing spanning-tree disruption.

How to eliminate wrong answers

Option A is wrong because 'spanning-tree guard loop' is not a valid command; the correct command is 'spanning-tree guard loopguard', which prevents alternate or root ports from becoming designated in the absence of BPDUs, but does not address BPDUs received from a server causing blocking. Option B is wrong because removing 'spanning-tree port type edge trunk' and configuring 'spanning-tree port type normal' would cause the port to participate in spanning-tree convergence, potentially leading to blocking states and slower convergence, not solving the issue of BPDUs from the server. Option D is wrong because 'spanning-tree port type network trunk' is used for ports connected to other switches (network-facing) and would cause the port to participate in spanning-tree, likely resulting in blocking when BPDUs are received from the server, and it does not prevent the issue.

Full explanation →
208
Multi-Selecthard

A storage architect is designing a disaster recovery solution with a storage array supporting replication. Which three factors should be considered when choosing between synchronous and asynchronous replication? (Choose three.)

Select 3 answers
A.Fibre Channel zoning configuration
B.Network bandwidth availability
C.Storage array RAID level
D.Distance between sites
E.Recovery Point Objective (RPO) requirements
AnswersB, D, E

Synchronous requires high bandwidth and low latency.

Why this answer

Synchronous replication provides zero RPO but impacts performance over distance; asynchronous has higher RPO but lower latency impact and can be used over longer distances.

Full explanation →
209
Multi-Selectmedium

Which TWO statements are true about VPC consistency checks? (Choose two.)

Select 2 answers
A.All configuration parameters must match exactly on both peers.
B.Consistency check is optional and disabled by default.
C.The 'show vpc consistency-parameters' command displays the status.
D.Consistency check is performed only when the peer-link comes up.
E.Inconsistency can cause the VPC member port to be suspended.
AnswersC, E

This command shows which parameters are consistent.

Why this answer

The 'show vpc consistency-parameters' command is the primary tool used to verify that the VPC peer switches have matching configurations for critical parameters. This command displays the status of each consistency check parameter, allowing an administrator to identify mismatches that could disrupt VPC operation.

Exam trap

Cisco often tests the misconception that all parameters must match (A) or that checks are only at peer-link bring-up (D), when in reality only type-1 parameters are enforced and checks are continuous.

Full explanation →
210
MCQeasy

Which component provides out-of-band management for Cisco UCS C-Series rack servers, including KVM console access?

A.Cisco IMC Supervisor
B.UCS Manager
C.Cisco UCS Central
D.Cisco Integrated Management Controller (CIMC)
AnswerD

CIMC is the embedded management controller on C-Series servers.

Why this answer

Cisco Integrated Management Controller (CIMC) provides remote management capabilities like KVM, virtual media, and firmware updates.

Full explanation →
211
MCQeasy

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

A.Tail drop with DSCP-based classification.
B.Weighted Round Robin (WRR) with three queues.
C.Priority Flow Control (PFC) with a no-drop queue for iSCSI.
D.Policing at the ingress and marking at the egress.
AnswerC

PFC enables lossless Ethernet by pausing traffic when buffers are full.

Why this answer

Priority Flow Control (PFC) is the IEEE 802.1Qbb mechanism designed to provide lossless behavior for specific traffic classes, such as iSCSI storage traffic, on Nexus 9000 switches. By creating a no-drop queue for iSCSI, PFC uses pause frames on a per-priority basis to prevent buffer overflow, ensuring zero packet loss required by storage protocols.

Exam trap

Cisco often tests the misconception that any queuing or scheduling algorithm (like WRR or tail drop) can provide lossless behavior, but the trap here is that only PFC with a dedicated no-drop queue satisfies the strict no-loss requirement for storage traffic like iSCSI or FCoE.

How to eliminate wrong answers

Option A is wrong because tail drop is a simple congestion avoidance mechanism that drops packets indiscriminately when a queue is full, which cannot guarantee lossless behavior for iSCSI; DSCP-based classification alone does not prevent drops. Option B is wrong because Weighted Round Robin (WRR) is a scheduling algorithm that services multiple queues based on weights, but it does not provide per-priority pause or lossless guarantees; iSCSI requires a no-drop queue, not just weighted servicing. Option D is wrong because policing at the ingress drops excess traffic to enforce a rate limit, which contradicts the requirement for lossless behavior; marking at the egress only sets QoS markings and does not prevent drops.

Full explanation →
212
MCQhard

Refer to the exhibit. A Python script is processing the response from NX-API. It attempts to extract the interface state using `response['ins_api']['outputs']['output']['body']['ROW_interface']['state']` but receives a KeyError. What is the most likely reason?

A.The 'output' key is a list, not a dictionary.
B.The JSON structure has an extra level 'TABLE_interface' before 'ROW_interface'.
C.The 'ins_api' key is nested inside another object.
D.The 'body' key is missing because the command failed.
AnswerB

Some NX-API outputs wrap rows in a table key; the script missed that level.

Why this answer

The NX-API response for interface commands includes a 'TABLE_interface' key that wraps the 'ROW_interface' key. The script attempts to access 'ROW_interface' directly under 'body', but the correct path is `response['ins_api']['outputs']['output']['body']['TABLE_interface']['ROW_interface']['state']`. Option B correctly identifies this missing intermediate level.

Exam trap

The trap here is that candidates assume the JSON path directly mirrors the CLI output structure, forgetting that NX-API wraps tabular data in an intermediate 'TABLE_' key that must be included in the dictionary traversal.

How to eliminate wrong answers

Option A is wrong because the 'output' key is a dictionary, not a list; if it were a list, the error would be a TypeError, not a KeyError. Option C is wrong because the 'ins_api' key is at the top level of the JSON response, not nested inside another object. Option D is wrong because if the command had failed, the 'body' key would still exist but contain an error message or be empty; a missing 'body' would cause a different error, not a KeyError on 'ROW_interface'.

Full explanation →
213
MCQeasy

A network engineer is implementing port security on a Cisco Nexus 9000 switch to limit the number of MAC addresses learned on a single access port. The switchport is configured as follows: interface Ethernet 1/2 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security violation shutdown switchport port-security mac-address sticky After connecting two authorized devices, a third unauthorized device is connected, causing the port to enter the err-disabled state. The engineer needs to restore connectivity for the two authorized devices as quickly as possible, while maintaining the security posture. What is the best practice to recover the port automatically in the future?

A.Manually shut down and then no shutdown the interface to recover from err-disabled state.
B.Remove port-security configuration entirely to prevent future err-disables.
C.Configure 'errdisable recovery cause psecure-violation' to automatically recover the port after the configured interval.
D.Increase the maximum MAC address limit to 3 to accommodate the third device.
AnswerC

This automatically brings the port out of errdisabled state after a timer, maintaining security while enabling quick recovery.

Why this answer

The 'errdisable recovery cause psecure-violation' command enables automatic recovery from the err-disabled state caused by a port-security violation. This allows the port to come back up after a default or configured interval (typically 300 seconds) without manual intervention, restoring connectivity for the two authorized devices while maintaining the security posture of limiting MAC addresses to two.

Exam trap

Cisco often tests the distinction between manual recovery (shut/no shut) and automatic recovery (errdisable recovery), and the trap here is that candidates may choose manual recovery as 'quickest' without realizing the question asks for automatic future recovery, or they may incorrectly think increasing the MAC limit is a valid security compromise.

How to eliminate wrong answers

Option A is wrong because manually shutting down and then no shutting the interface is a manual recovery method, not an automatic one, and does not address the requirement to recover the port automatically in the future. Option B is wrong because removing port-security configuration entirely eliminates the security posture, which contradicts the requirement to maintain security while restoring connectivity. Option D is wrong because increasing the maximum MAC address limit to 3 would allow the unauthorized device, violating the security policy and not maintaining the intended security posture.

Full explanation →
214
MCQmedium

A Cisco MDS switch is connected to another MDS via a Fibre Channel link. The two switches need to carry traffic for multiple VSANs over a single physical link. Which feature should be configured?

A.EISL trunking
B.NPV mode
C.PortChannel
D.VSAN-based zoning
AnswerA

EISL trunking enables multiple VSANs over a single ISL.

Why this answer

EISL (Enhanced ISL) allows multiple VSANs to be trunked over a single ISL.

Full explanation →
215
MCQeasy

A data center runs OSPF as the underlay for an EVPN-VXLAN fabric. The fabric includes two spine switches and eight leaf switches. After adding a new leaf switch, the network team notices that some EVPN routes are missing from the other leaves. The new leaf has established BGP EVPN sessions to both spines and the BGP sessions are up. The spines report receiving all routes from the new leaf, but the other leaves do not receive certain prefixes. The engineer checks the BGP configuration on the new leaf and sees the address-family l2vpn evpn is configured under router bgp. Which action should the engineer take to resolve the issue?

A.Check the new leaf's BGP router ID for uniqueness
B.Verify the new leaf has the address-family l2vpn evpn activated under the neighbor configuration
C.Ensure the new leaf's BGP next-hop-self is enabled
D.Verify the cluster ID on the route reflectors is consistent
AnswerB

The address-family must be activated under each neighbor to advertise routes.

Why this answer

The issue is that the new leaf has BGP EVPN sessions to both spines, but other leaves do not receive certain prefixes. Since the spines (acting as route reflectors) receive all routes from the new leaf but do not propagate them to other leaves, the most likely cause is that the address-family l2vpn evpn is not activated under the neighbor configuration on the new leaf. Without this activation, the new leaf does not advertise its EVPN routes to the spines, even though the BGP session is up and the address-family is configured globally under router bgp.

Exam trap

Cisco often tests the distinction between configuring the address-family globally under router bgp versus activating it under a specific neighbor, leading candidates to assume global configuration is sufficient.

How to eliminate wrong answers

Option A is wrong because a duplicate BGP router ID would cause session flapping or instability, not a selective missing of certain prefixes while the BGP sessions remain up. Option C is wrong because next-hop-self is not required in an EVPN-VXLAN fabric with an OSPF underlay; the spines (route reflectors) typically handle next-hop processing, and the issue is about route advertisement, not next-hop reachability. Option D is wrong because the cluster ID on route reflectors must be consistent to prevent loops, but inconsistent cluster IDs would cause all reflected routes to be affected, not just certain prefixes, and the spines are already receiving all routes from the new leaf.

Full explanation →
216
MCQhard

A company is deploying UCS C-Series rack servers and wants to integrate them into UCS Manager for centralized management. The servers are currently managed individually via CIMC. Which integration mode must be configured on the C-Series servers to allow UCS Manager to discover and manage them?

A.IMC Supervisor mode
B.Direct connect mode
C.UCS Managed mode
D.Standalone mode
AnswerC

UCS Managed mode allows the C-Series server to be managed by UCS Manager.

Why this answer

C-Series servers can be integrated into UCS Manager by enabling UCS Managed mode in the server's CIMC. This allows the FI to discover and manage the server as part of the UCS domain.

Full explanation →
217
MCQeasy

Which feature in UCS Manager allows centralized management of firmware policies across multiple chassis without creating a separate policy for each chassis?

A.Maintenance Policy
B.Firmware Policy
C.Host Firmware Package
D.Adapter Policy
AnswerB

Can be shared across many service profiles.

Why this answer

B is correct because a Firmware Policy in UCS Manager allows you to define a single firmware version and package that can be applied to multiple chassis or service profiles. This centralized approach eliminates the need to create a separate firmware policy for each chassis, as the policy is simply associated with the desired chassis or service profile templates.

Exam trap

Cisco often tests the distinction between a Firmware Policy (which defines the firmware version) and a Host Firmware Package (which is applied to a server within a service profile), causing candidates to confuse the scope of each object.

How to eliminate wrong answers

Option A is wrong because a Maintenance Policy controls the reboot behavior (e.g., immediate or user-acknowledged) during firmware updates, not the firmware version or package selection. Option C is wrong because a Host Firmware Package is used to specify the firmware bundle for a server (compute node) within a service profile, not for centralized management across multiple chassis. Option D is wrong because an Adapter Policy configures the properties of the virtual interface card (VIC) adapter, such as failover and offload settings, and has no role in firmware version management.

Full explanation →
218
MCQhard

During a SAN performance analysis, a Fibre Channel link shows a high number of CRC errors. The link operates at 16 Gbps over a 10 km dark fiber. Which corrective action is least likely to resolve the issue?

A.Increase the buffer-to-buffer credit count on the link.
B.Replace the fiber cable with a single-mode fiber cable if multimode is used.
C.Clean all fiber connectors and inspect for damage.
D.Verify that the SFP+ optics match the fiber type and distance.
AnswerA

Buffer credits affect flow control, not physical errors.

Why this answer

CRC errors are physical layer issues caused by signal integrity problems such as dirty connectors, wrong fiber type, or excessive distance. Increasing the buffer-to-buffer credit count adjusts flow control and does not address signal integrity, making it the least likely to resolve CRC errors. The other options—replacing with single-mode fiber if multimode is used, cleaning connectors, and verifying SFP+ optics—directly target physical layer issues and are more likely to help.

Full explanation →
219
Multi-Selectmedium

Which three EVPN route types are essential for VXLAN EVPN operation in a typical data center fabric? (Choose three.)

Select 3 answers
A.Type-3 (Inclusive Multicast Ethernet Tag)
B.Type-2 (MAC/IP Advertisement)
C.Type-4 (Ethernet Segment)
D.Type-5 (IP Prefix Advertisement)
E.Type-1 (Ethernet Auto-Discovery)
AnswersA, B, D

Required for BUM traffic forwarding.

Why this answer

Type-3 (Inclusive Multicast Ethernet Tag) routes are essential for VXLAN EVPN because they enable BUM traffic replication across the underlay network by advertising the VNI and multicast group mapping, allowing VTEPs to join the correct multicast tree for flooding unknown unicast, broadcast, and multicast frames.

Exam trap

Cisco often tests the misconception that Type-1 and Type-4 are required for all VXLAN EVPN deployments, but they are only mandatory for multi-homing (EVPN-MH) or MPLS interworking, not for a typical single-homed data center fabric.

Full explanation →
220
MCQhard

In a HyperFlex cluster, what is the function of the cluster witness VM when replication factor 3 (RF3) is used?

A.It stores a third replica of all data to reduce storage requirements.
B.It handles storage replication tasks.
C.It serves as a backup node for failover.
D.It provides a quorum vote to prevent split-brain scenarios.
AnswerD

Correct. The witness votes for cluster decisions.

Why this answer

With RF3, data is replicated to three nodes. The witness VM is still needed for quorum and to prevent split-brain scenarios, especially when the cluster has an even number of nodes. For a 4-node cluster with RF3, a witness helps maintain availability.

Full explanation →
221
MCQhard

In an ACI fabric, an automation engineer needs to deploy tenant policies in an idempotent manner. Which approach is most aligned with best practices?

A.Use the REST API with POST method for each creation
B.Use Ansible with state: present in the cisco.aci collections
C.Write CLI scripts using expect or pexpect
D.Use Python SDK with a check-and-create loop
AnswerB

Ansible modules are idempotent and widely used in ACI automation.

Why this answer

Ansible's `state: present` in the `cisco.aci` collection inherently provides idempotency: it checks the current state of the ACI object and only applies changes if the desired state differs, ensuring no duplicate or conflicting configurations. This aligns with best practices for automation, as it avoids manual error handling and guarantees consistent policy deployment without side effects.

Exam trap

The trap here is that candidates often assume any API-based approach (like REST POST or Python SDK) is inherently idempotent, but Cisco tests the understanding that true idempotency requires a declarative or state-checking mechanism, which Ansible's `state: present` provides out-of-the-box.

How to eliminate wrong answers

Option A is wrong because the REST API POST method is not idempotent by default; repeated POST requests create duplicate objects or cause errors unless the client implements explicit pre-checks, which violates the principle of idempotent deployment. Option C is wrong because CLI scripts using expect or pexpect are inherently non-idempotent; they rely on screen scraping and sequential commands, which can fail unpredictably due to timing issues or state changes, and they lack built-in state reconciliation. Option D is wrong because while a Python SDK with a check-and-create loop can achieve idempotency, it requires custom error handling and is less maintainable than using a declarative tool like Ansible, which abstracts the idempotency logic and is a recognized best practice in ACI automation.

Full explanation →
222
MCQeasy

An engineer needs to connect a new server to an existing FC SAN. The server is located 50 km away from the data center. Which technology should be used to extend the FC SAN over this distance?

A.iSCSI
B.FCIP
C.FCoE
D.Direct FC connection with 10km optics
AnswerB

FCIP is designed to extend FC over long distances using IP networks.

Why this answer

FCIP (Fibre Channel over IP) is the correct choice because it encapsulates Fibre Channel frames inside TCP/IP packets, enabling the extension of FC SANs over long distances (beyond the 10 km limit of standard optics) by leveraging existing IP WAN infrastructure. This allows the 50 km connection while preserving native Fibre Channel semantics and fabric services.

Exam trap

Cisco often tests the distinction between FC extension protocols (FCIP) and alternative storage protocols (iSCSI, FCoE), trapping candidates who confuse 'extending FC' with 'replacing FC' or who assume long-reach optics can overcome distance limits without protocol adaptation.

How to eliminate wrong answers

Option A (iSCSI) is wrong because it is a storage networking protocol that carries SCSI commands over IP networks, not Fibre Channel frames, so it cannot extend an existing FC SAN; it would require native iSCSI initiators and targets. Option C (FCoE) is wrong because it maps Fibre Channel over Ethernet but is limited to data center bridging (DCB) environments with a maximum reach of typically 10 km over dark fiber, not 50 km. Option D (Direct FC connection with 10km optics) is wrong because standard Fibre Channel optics (e.g., 10 km SFP+) cannot achieve a 50 km link; even long-reach optics (e.g., 40 km) are impractical without repeaters, and FC is not designed for such distances without protocol extension.

Full explanation →
223
MCQeasy

Which statement accurately describes the APIC REST API?

A.It uses JSON over HTTPS and interacts with the MIT.
B.It uses XML over SSH for communication.
C.It is only used for monitoring, not configuration.
D.It requires the use of the Cobra SDK.
AnswerA

Correct description.

Why this answer

APIC REST API is a RESTful API that uses JSON over HTTPS and allows management of the ACI fabric.

Full explanation →
224
MCQhard

A company uses Cisco ISE for 802.1X authentication on data center edge switches. After a recent upgrade, some endpoints that previously authenticated successfully now fail. The ISE logs show the endpoint is in the wrong authorization profile. What is the most likely cause?

A.The switch port is in multi-authentication mode
B.The switch has incorrect RADIUS shared secret
C.The endpoint posture assessment is failing
D.The ISE policy is using a different identity source
AnswerC

Posture assessment can change the authorization result, assigning a restricted profile if requirements aren't met.

Why this answer

A failing posture assessment can cause ISE to apply a different authorization profile (e.g., a quarantine or remediation profile) instead of the expected one, even though the endpoint previously authenticated successfully. Posture checks occur after 802.1X authentication and can change the authorization result based on endpoint compliance, which aligns with the symptom of the endpoint being in the wrong profile after an upgrade.

Exam trap

The trap here is that candidates often confuse authentication success with authorization success, overlooking that posture assessment is a separate step that can override the initial authorization profile, especially after an upgrade that changes posture requirements.

How to eliminate wrong answers

Option A is wrong because multi-authentication mode allows multiple endpoints on a single port with individual authentication, but it does not cause an endpoint to be placed in the wrong authorization profile; it affects how many devices can authenticate, not which profile is applied. Option B is wrong because an incorrect RADIUS shared secret would cause authentication failures (Access-Reject) or no response, not a successful authentication with the wrong authorization profile; the logs show the endpoint is in the wrong profile, not failing authentication. Option D is wrong because using a different identity source would typically result in authentication failure (if the endpoint is not found) or a different identity group, but the logs indicate the endpoint is in the wrong authorization profile, not that authentication succeeded with a different identity; the identity source affects who is authenticated, not the authorization profile directly.

Full explanation →
225
Multi-Selectmedium

Which two advantages does thin provisioning provide in a storage array? (Choose two.)

Select 2 answers
A.Allows over-provisioning of storage capacity.
B.Improves storage utilization by allocating disk space on demand.
C.Increases write performance by using faster disks.
D.Reduces the need for snapshots.
E.Eliminates the need for RAID protection.
AnswersA, B

Thin provisioning enables presenting more capacity than physically available.

Why this answer

Thin provisioning allows over-allocation of storage capacity, presenting more space to applications than physically available, improving utilization. It also reduces power and cooling costs by using fewer physical disks initially.

Full explanation →
Page 2

Page 3 of 14

Page 4

All pages

1234567891011121314

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

NetworkStorage NetworkAutomationComputeSecurity
See all domains with question counts →