Courseiva

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 226–300

984 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 14

Page 5
226
Multi-Selectmedium

An engineer is configuring a Fibre Channel SAN with a Cisco MDS switch. To ensure high availability and load balancing, the engineer plans to use PortChannels. Which two statements about Fibre Channel PortChannels are true? (Choose two.)

Select 2 answers
A.PortChannels provide redundancy by automatically failing over to another link.
B.PortChannels require the use of the LACP protocol.
C.All member ports must be in the same VSAN.
D.PortChannels are supported only between F-ports.
E.PortChannels can aggregate up to 4 physical links.
AnswersA, C

PortChannels provide redundancy by automatically failing over traffic to remaining links if one fails.

Why this answer

Fibre Channel PortChannels on Cisco MDS switches provide link redundancy by automatically redistributing traffic if a member link fails. All member ports must belong to the same VSAN for the PortChannel to operate correctly. PortChannels can aggregate up to 16 physical links, not 4.

LACP is not used in Fibre Channel; it is an Ethernet protocol. PortChannels are supported on both E-ports (inter-switch links) and F-ports (N-port connections).

Exam trap

Candidates might mistakenly think PortChannels are limited to a small number of links or require LACP. Ensure you know the actual maximum (16) and protocol requirements.

Full explanation →
227
MCQmedium

An engineer is configuring MST on a pair of Cisco Nexus switches that will be part of a vPC domain. The vPC peer-link will carry multiple MST instances. Which MST parameter must be identical on both vPC peers to ensure proper operation?

A.PortFast and BPDUguard settings
B.STP root bridge priority
C.MST region configuration (name, revision, mapping)
D.STP path cost for instance 0
AnswerC

These must match for switches to belong to the same MST region.

Why this answer

In a vPC domain with MST, both peers must share an identical MST region configuration (name, revision number, and VLAN-to-instance mapping) to ensure they agree on which VLANs belong to which MST instance. Without matching region configurations, the switches would treat each other as being in different MST regions, breaking the common spanning tree topology required for the vPC peer-link to properly carry multiple MST instances.

Exam trap

The trap here is that candidates often confuse MST region configuration with other STP parameters like root priority or path cost, assuming any STP-related value must match on both vPC peers, but only the region identity (name, revision, mapping) is critical for MST to function correctly across the peer-link.

How to eliminate wrong answers

Option A is wrong because PortFast and BPDUguard are per-port edge features that speed up convergence and protect against loops, but they are not required to be identical on vPC peers for MST operation. Option B is wrong because STP root bridge priority can differ between vPC peers; the vPC system acts as a single logical STP entity, and the root bridge priority is typically set on the primary vPC switch, not required to match on both. Option D is wrong because STP path cost for instance 0 (IST) is a per-interface parameter that can be tuned independently on each switch and does not need to be identical across vPC peers to ensure proper MST operation.

Full explanation →
228
MCQhard

A data center administrator needs to manage multiple UCS domains from a single pane of glass, including the ability to push global service profile policies. Which Cisco management tool should be used?

A.Cisco UCS Central
B.Cisco UCS Director
C.Cisco IMC Supervisor
D.Cisco UCS Manager
AnswerA

UCS Central enables multi-domain management with global service profile policies.

Why this answer

Cisco UCS Central provides centralized management for multiple UCS domains, enabling global policies and templates.

Full explanation →
229
MCQmedium

An MDS switch is configured with VSANs 100 and 200. The engineer wants to isolate traffic between two storage arrays on the same physical fabric. Which best practice should be applied?

A.Use zones within the same VSAN to separate arrays.
B.Place each array in a different VSAN.
C.Enable QoS to prioritize storage traffic.
D.Configure a port channel between the switches.
AnswerB

VSANs provide complete isolation.

Why this answer

VSANs provide complete isolation of traffic at Layer 2, creating separate fabric topologies within the same physical infrastructure. Placing each storage array in a different VSAN ensures that Fibre Channel frames from one array never reach the other, even though they share the same MDS switch hardware. This is the recommended best practice for separating storage traffic that must not interact.

Exam trap

The trap here is that candidates confuse zoning with VSAN isolation, thinking that zones within a single VSAN provide the same level of separation, when in fact zones only restrict end-device communication while leaving fabric services and control traffic shared across the entire VSAN.

How to eliminate wrong answers

Option A is wrong because zones within the same VSAN only control which initiators can talk to which targets; they do not isolate broadcast traffic, fabric services, or control-plane frames, so the arrays would still share the same VSAN domain and could be affected by each other's events. Option C is wrong because QoS prioritizes traffic but does not provide isolation; it only manages bandwidth and latency, not security or Layer 2 separation. Option D is wrong because a port channel aggregates bandwidth and provides link-level redundancy between switches; it does not separate traffic between storage arrays on the same physical fabric.

Full explanation →
230
MCQeasy

Which YANG model is commonly used for vendor-neutral network configuration and operations?

A.NETCONF
B.Cisco native YANG models
C.RESTCONF
D.OpenConfig YANG models
AnswerD

OpenConfig provides vendor-neutral YANG models.

Why this answer

OpenConfig is a vendor-neutral YANG model initiative. Cisco native YANG models are vendor-specific. NETCONF and RESTCONF are protocols, not models.

Full explanation →
231
Multi-Selectmedium

Which two of the following are benefits of using YANG data models for network automation? (Choose two.)

Select 2 answers
A.They enable network automation and multi-vendor interoperability
B.They are only supported by Cisco devices
C.They eliminate the need for any CLI commands
D.They require the use of NETCONF exclusively
E.They provide a structured, standardised representation of network configuration and state
AnswersA, E

Standard models like OpenConfig support multi-vendor.

Why this answer

YANG models provide structured, standardized data models, enabling automation and vendor interoperability. They reduce manual CLI commands and allow validation. YANG is not tied to a specific transport.

Full explanation →
232
MCQeasy

Which authentication protocol is recommended by Cisco for network device administration due to its separation of authentication, authorization, and accounting?

A.TACACS+
B.802.1X
C.RADIUS
D.LDAP
AnswerA

TACACS+ separates the AAA functions, making it the recommended protocol for network device administration.

Why this answer

TACACS+ separates the three AAA functions, while RADIUS combines authentication and authorization.

Full explanation →
233
MCQeasy

Which YANG-based protocol uses RESTful operations (GET, POST, PUT, DELETE) over HTTP/HTTPS for network configuration?

A.RESTCONF
B.SNMP
C.NETCONF
D.gRPC
AnswerA

Correct: RESTCONF uses REST over HTTP/HTTPS.

Why this answer

RESTCONF (RFC 8040) is a RESTful protocol that uses HTTP methods and YANG data models.

Full explanation →
234
MCQeasy

A UCS administrator needs to deploy 20 identical servers with the same firmware, BIOS, and boot order. Which approach is the most efficient?

A.Use a UUID suffix pool to auto-generate identities.
B.Use a Cisco UCS Central 'Gold' template to deploy the servers.
C.Create a service profile template and then generate service profiles from it.
D.Create a service profile for each server manually.
AnswerC

Templates allow centralized management and quick deployment.

Why this answer

Creating a service profile template and then generating service profiles from it is the most efficient approach because it allows you to define the firmware, BIOS, and boot order once in a reusable template, then automatically create multiple service profiles with unique identities (e.g., UUID, MAC, WWN) for each of the 20 identical servers. This leverages Cisco UCS Manager's built-in template-to-instance workflow, ensuring consistency and reducing manual effort.

Exam trap

Cisco often tests the distinction between a service profile template (used to generate multiple instances) and a UUID suffix pool (a component that only handles identity generation), leading candidates to mistakenly choose the pool as a complete deployment solution.

How to eliminate wrong answers

Option A is wrong because a UUID suffix pool auto-generates only the UUID portion of a service profile's identity, but it does not address the need to deploy firmware, BIOS, and boot order settings across multiple servers; it is a component within a service profile, not a deployment method. Option B is wrong because Cisco UCS Central is a multi-domain management tool, not a mechanism for deploying individual server configurations within a single UCS domain; a 'Gold' template in UCS Central is used for policy-based configuration across domains, not for generating service profiles for local server deployment. Option D is wrong because creating a service profile for each server manually is inefficient and error-prone for 20 identical servers, as it requires repetitive configuration of the same firmware, BIOS, and boot order settings, defeating the purpose of automation.

Full explanation →
235
MCQeasy

Which VLAN range is reserved by default on Cisco Nexus switches?

A.VLAN 1
B.VLAN 1002-1005
C.VLAN 3968-4047
D.VLAN 4094
AnswerA

VLAN 1 is the default and cannot be removed.

Why this answer

VLAN 1 is the default VLAN on Cisco Nexus switches and cannot be deleted or renamed. It is automatically created on all switches and carries all untagged traffic by default, making it a reserved VLAN that is always present in the VLAN database.

Exam trap

Cisco often tests the misconception that VLANs 1002-1005 are reserved on all platforms, but on Nexus switches these legacy VLANs are not present, and the trap is that candidates confuse classic IOS behavior with NX-OS behavior.

How to eliminate wrong answers

Option B is wrong because VLANs 1002-1005 are reserved for legacy Token Ring and FDDI networks on classic Cisco IOS switches, but on Nexus switches these VLANs are not reserved by default and are not present in the VLAN database. Option C is wrong because VLANs 3968-4047 are reserved for internal use by the switch (e.g., for multicast, Layer 3 interfaces, or system VLANs) and are not user-configurable, but they are not the default reserved VLAN range. Option D is wrong because VLAN 4094 is the extended VLAN ID used for the default VLAN on some platforms or for the native VLAN on trunk ports, but it is not the default reserved VLAN on Nexus switches; VLAN 1 holds that role.

Full explanation →
236
MCQhard

An engineer is writing a Python script to automate ACI fabric discovery using the APIC SDK. The script needs to wait until the fabric formation is complete before proceeding. Which approach is most reliable?

A.Implement asynchronous callbacks using the SDK
B.Periodically poll the fabric membership state via REST API
C.Use the configExportP object to monitor discovery
D.Use time.sleep() for a fixed duration
AnswerB

Polling is reliable and adaptive to actual state changes.

Why this answer

The most reliable method to wait for ACI fabric formation to complete is to periodically poll the fabric membership state via the REST API. The APIC SDK provides access to the fabric membership endpoint (e.g., /api/node/class/fabricNode.json), which returns the current state of each node. By polling this endpoint until all expected nodes report an 'active' or 'in-pod' status, the script can accurately determine when the fabric is fully formed, avoiding race conditions or incomplete discovery.

Exam trap

Cisco often tests the misconception that a fixed delay (time.sleep) or a configuration export object can reliably synchronize with asynchronous fabric discovery, when in fact only direct polling of the fabric membership state provides deterministic confirmation.

How to eliminate wrong answers

Option A is wrong because asynchronous callbacks in the APIC SDK are not designed for monitoring fabric discovery completion; they are typically used for event-driven notifications on specific object changes, not for polling the overall fabric formation state, and they may miss transient states or require complex setup. Option C is wrong because the configExportP object is used for exporting configuration snapshots, not for monitoring fabric discovery; it has no mechanism to indicate fabric formation status. Option D is wrong because using time.sleep() for a fixed duration is unreliable; fabric discovery time varies based on network conditions, hardware, and scale, so a fixed sleep may either waste time or proceed before discovery is complete, leading to script failures.

Full explanation →
237
MCQmedium

A UCS C-Series rack server is being integrated into UCS Manager. Which mode allows the server to be managed directly by UCS Manager using a Fabric Interconnect?

A.Cisco IMC Supervisor mode
B.Direct Connect mode
C.FEX mode
D.Standalone mode
AnswerB

Direct Connect mode exposes the server to UCS Manager for unified management.

Why this answer

When a UCS C-Series rack server is integrated into UCS Manager, Direct Connect mode allows the server to be managed directly by the Fabric Interconnect without requiring an intermediate FEX or IMC Supervisor. In this mode, the server's Cisco Integrated Management Controller (IMC) is discovered and managed through the Fabric Interconnect's management network, enabling unified policy-based management, firmware synchronization, and service profile association.

Exam trap

Cisco often tests the distinction between 'Direct Connect mode' and 'FEX mode' — the trap is that candidates confuse FEX mode (which requires a Fabric Extender) with the direct connection method, or assume that any rack server integration requires an external supervisor or standalone management.

How to eliminate wrong answers

Option A is wrong because Cisco IMC Supervisor is a separate management platform for standalone C-Series servers, not a mode for integrating a server into UCS Manager via Fabric Interconnect. Option C is wrong because FEX mode is used for connecting servers through a Fabric Extender (FEX) to the Fabric Interconnect, not for direct management of a C-Series server by UCS Manager. Option D is wrong because Standalone mode means the server operates independently with its own IMC management, without being managed by UCS Manager or connected to a Fabric Interconnect.

Full explanation →
238
MCQeasy

Which of the following is a benefit of using Fibre Channel over Ethernet (FCoE) in a data center?

A.It increases the maximum distance of Fibre Channel links.
B.It reduces cabling complexity by using a unified fabric.
C.It provides native Fibre Channel security.
D.It eliminates the need for zoning.
AnswerB

Convergence reduces cabling.

Why this answer

FCoE encapsulates Fibre Channel frames over Ethernet networks, allowing storage and data traffic to share the same physical infrastructure. This consolidation reduces cabling complexity and the number of required switches, adapters, and power/cooling overhead, which is the core benefit of a unified fabric.

Exam trap

Cisco often tests the misconception that FCoE eliminates Fibre Channel management features like zoning or security, when in fact it preserves them while only consolidating the physical transport layer.

How to eliminate wrong answers

Option A is wrong because FCoE does not increase the maximum distance of Fibre Channel links; native Fibre Channel can already reach up to 10 km (standard) or more with repeaters, while FCoE is typically limited to the same data center or campus Ethernet distance constraints (100 m for copper, up to 10 km with fiber). Option C is wrong because FCoE does not provide native Fibre Channel security; it inherits Ethernet security mechanisms (e.g., ACLs, 802.1AE MACsec) but does not include FC-SP (Fibre Channel Security Protocol) natively. Option D is wrong because FCoE still requires zoning (via ENode or FCoE-specific constructs like FCoE VLANs and FCoE Initialization Protocol) to control which initiators can access which targets, just as in native Fibre Channel.

Full explanation →
239
MCQhard

A DevOps engineer is building a CI/CD pipeline for network changes. After a configuration change is pushed to a Nexus switch, which step should be included to verify that the change did not cause any operational issues?

A.Manual verification by an engineer
B.Immediate rollback to previous configuration
C.Logging the change without verification
D.Automated validation using show commands or telemetry
AnswerD

Automated validation ensures the change is safe.

Why this answer

Automated validation using show commands or YANG-based telemetry can confirm operational state. Manual verification defeats automation. Rolling back without validation may be premature.

Logging is passive.

Full explanation →
240
MCQmedium

Which NX-OS feature ensures that vPC member ports on both peers are configured identically to prevent inconsistencies that could lead to traffic black-holing?

A.vPC peer-link
B.vPC consistency check
C.vPC peer-keepalive
D.vPC auto-recovery
AnswerB

Consistency checks ensure parameter matching between peers.

Why this answer

The vPC consistency check ensures that critical parameters (e.g., VLAN configuration, STP settings, interface properties) are identical on both vPC peer switches. If a mismatch is detected, the vPC member port is suspended to prevent traffic black-holing caused by asymmetric forwarding. This mechanism is enforced by the Cisco NX-OS vPC Type-1 and Type-2 consistency checks.

Exam trap

Cisco often tests the distinction between the vPC peer-link (data/control plane) and the vPC peer-keepalive (heartbeat), leading candidates to mistakenly associate the keepalive with configuration synchronization.

How to eliminate wrong answers

Option A is wrong because the vPC peer-link is the inter-switch link used for control-plane communication and data traffic between peers, not a mechanism to enforce identical configurations. Option C is wrong because the vPC peer-keepalive is a Layer 3 heartbeat link that detects peer failures, not a configuration validation tool. Option D is wrong because vPC auto-recovery is a feature that allows a vPC peer to resume forwarding after a peer-link failure, not a consistency verification mechanism.

Full explanation →
241
Multi-Selecteasy

Which TWO of the following are required components for a Cisco ACI contract to allow communication between EPGs?

Select 2 answers
A.A filter that specifies the traffic parameters.
B.A subject that defines the filter.
C.A tenant.
D.A QoS class.
E.A VRF.
AnswersA, B

Filter defines allowed traffic.

Why this answer

A filter in Cisco ACI defines the specific traffic parameters—such as IP protocol, source/destination ports, and EtherType—that are permitted or denied between EPGs. Without a filter, the contract has no criteria to match traffic, so communication cannot be allowed. Option B is correct because a subject binds one or more filters to a contract and specifies the direction (consumer-to-provider or bidirectional) in which the filter is applied, making it an essential component for the contract to function.

Exam trap

Cisco often tests the misconception that a tenant or VRF is a required component of a contract, when in fact the contract only requires a filter and a subject to define the traffic rules, while tenants and VRFs are separate constructs that provide logical isolation and routing context.

Full explanation →
242
MCQmedium

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

A.The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract
B.The contract is applied but not enforced due to a configuration error
C.The VRF has a default route that bypasses contract enforcement
D.A preferred group contract is applied to the VRF
AnswerA

ACI allows intra-BD communication by default; contracts are needed for inter-BD or inter-VRF traffic.

Why this answer

In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.

Exam trap

Cisco often tests the misconception that contracts are required for all EPG-to-EPG communication, but the trap here is that intra-BD traffic is an exception where no contract is needed by default.

How to eliminate wrong answers

Option B is wrong because if a contract were applied but not enforced due to a configuration error, the traffic would still be blocked or behave unpredictably, not consistently work; ACI enforces contracts at the leaf switch level, and a misconfiguration would typically cause a deny, not an allow. Option C is wrong because a default route in the VRF does not bypass contract enforcement; contracts are enforced at the EPG level regardless of routing, and a default route only affects Layer 3 forwarding, not policy enforcement. Option D is wrong because a preferred group contract would explicitly allow all traffic within the VRF, but the question states no contract is applied; a preferred group contract is a contract that must be explicitly configured, and its absence means it cannot be the reason.

Full explanation →
243
MCQhard

In a Cisco UCS Central environment, which feature enables global consistency of boot order and firmware policies across multiple UCS domains?

A.Global Service Profile Templates
B.Cisco IMC Supervisor
C.Fabric Interconnect Interconnectivity
D.UCS Manager Backup and Restore
AnswerA

Correct. These templates define policies that span domains.

Why this answer

UCS Central allows defining global service profile policies that can be applied to multiple UCS domains, ensuring consistency. Policies such as boot order, firmware, and BIOS can be created centrally and pushed to domains.

Full explanation →
244
MCQhard

In a HyperFlex cluster with replication factor 3 (RF3), a node fails completely. The cluster has five nodes. What is the minimum number of nodes that must be operational for the cluster to continue serving data without interruption?

A.4 nodes
B.3 nodes
C.5 nodes
D.2 nodes
AnswerB

With RF3, as long as at least 3 nodes are operational (the replicas exist on other nodes), data is available.

Why this answer

With RF3, data is replicated on three nodes. If one node fails, the cluster can continue serving data as long as at least three nodes (including the failed node's replicas on other nodes) are available. Since the cluster has five nodes, even with one failure, four nodes remain, which is sufficient.

Full explanation →
245
MCQmedium

An organization is migrating from traditional SNMP monitoring to model-driven telemetry on their Nexus 9000 switches. They have configured a telemetry destination using gRPC and have defined sensor paths for interface statistics. After several hours, the collector (a Linux server running Telegraf) reports no data received. The engineer verifies that the switch can reach the collector via ICMP. On the switch, 'show telemetry data collector details' indicates the destination is 'connected', but the 'last data sent' timestamp is several hours old. Which action should the engineer take next?

A.Change the transport protocol from gRPC to HTTP
B.Reboot the switch to reset the telemetry process
C.Verify that the sensor paths are correct and that the data is being generated
D.Increase the telemetry sampling interval to reduce load
AnswerC

Most likely cause: sensor path not matching actual data.

Why this answer

The 'show telemetry data collector details' output shows the destination is 'connected' and the switch can reach the collector, ruling out network or connectivity issues. The stale 'last data sent' timestamp indicates the telemetry process is running but no data is being published, which typically means the configured sensor paths are not producing data—either because the paths are incorrect, the MIB objects are not supported, or the interfaces are not generating the expected statistics. Option C is correct because verifying the sensor paths and ensuring data generation addresses the root cause without unnecessary changes or reboots.

Exam trap

Cisco often tests the misconception that a 'connected' telemetry destination implies data is flowing, when in fact the connection state only reflects the gRPC session, not the subscription health—candidates may waste time on transport or connectivity fixes instead of verifying the sensor paths.

How to eliminate wrong answers

Option A is wrong because changing the transport protocol from gRPC to HTTP would not fix the issue; the problem is that no data is being sent, not that the transport is failing (the collector is reachable and the destination shows 'connected'). Option B is wrong because rebooting the switch is an extreme, unnecessary step that would disrupt operations and does not address the likely misconfiguration of sensor paths; the telemetry process is already running (destination 'connected'). Option D is wrong because increasing the sampling interval would reduce the frequency of data collection, but if no data is being generated at all, changing the interval will not cause data to appear—it would only delay the problem further.

Full explanation →
246
MCQmedium

An engineer is deploying Cisco TrustSec in a data center. Which technology uses Security Group Tags (SGTs) to enforce east-west traffic policies without relying on IP addresses?

A.ACI contracts
B.VLAN ACLs
C.SGACL
D.Port security
AnswerC

SGACLs enforce policies based on SGTs, enabling identity-based security.

Why this answer

SGACLs use SGTs to define policies based on group membership, independent of IP addresses.

Full explanation →
247
MCQeasy

In a HyperFlex cluster, what is the function of the witness VM?

A.To store backup copies of all cluster data
B.To offload data replication processing
C.To provide a centralized management interface
D.To act as a tie-breaker for cluster quorum
AnswerD

The witness ensures cluster availability by voting in the event of a failure.

Why this answer

The witness VM in a HyperFlex cluster is a lightweight virtual machine that participates in the cluster's quorum process. It provides a tie-breaking vote when the cluster experiences a split-brain scenario, ensuring that only one side of the cluster remains operational and data integrity is maintained. Without the witness, the cluster could become unavailable if an even number of nodes lose connectivity.

Exam trap

Cisco often tests the misconception that the witness VM is used for backup or management, but its sole purpose is to provide a quorum vote in split-brain scenarios, not to store data or offload processing.

How to eliminate wrong answers

Option A is wrong because the witness VM does not store any cluster data; it only holds cluster state information and quorum votes, not backup copies. Option B is wrong because data replication processing is handled by the HyperFlex Data Platform (HXDP) across the cluster nodes, not offloaded to the witness VM. Option C is wrong because the centralized management interface for HyperFlex is provided by the HyperFlex Connect or Cisco Intersight, not the witness VM.

Full explanation →
248
MCQeasy

A Cisco MDS switch is connected to a Fibre Channel storage array and a host. The host cannot see the storage LUNs. The 'show flogi database' command on the MDS shows the host's WWPN, but the 'show fcns database' does not show the storage target. What is the most likely cause?

A.The zone configuration is incorrect.
B.The host and target are in different VSANs.
C.The storage target is not logged into the fabric.
D.The host is not in the name server database.
AnswerC

The 'show fcns database' shows only devices that have logged into the fabric; if the target is not logged in, it won't appear.

Why this answer

The 'show flogi database' command displays all devices that have completed the Fabric Login (FLOGI) process, which the host has done. However, the 'show fcns database' command lists only devices that have registered with the Fabric Name Server (via FDISC or FLOGI with PLOGI). Since the storage target is not in the name server database, it means the target has not logged into the fabric (or has not registered its FC-4 type/SCSI features), preventing the host from discovering its LUNs.

This is the most likely cause because the host can see its own WWPN in the FLOGI database but cannot see the target in the FCNS database.

Exam trap

Cisco often tests the distinction between FLOGI (physical login) and FCNS registration (name server entry), leading candidates to incorrectly assume that a device visible in 'show flogi database' must also be in the fabric name server database.

How to eliminate wrong answers

Option A is wrong because an incorrect zone configuration would still allow the host and target to appear in the FCNS database (zoning only restricts access, not registration); the issue is that the target is not even registered. Option B is wrong because if the host and target were in different VSANs, the host's FLOGI would not appear in the same VSAN's FLOGI database as the target's VSAN, but the host's WWPN is visible, implying they are in the same VSAN. Option D is wrong because the host is already in the name server database (as shown by the FLOGI entry, which typically triggers name server registration), so the problem is the target's absence, not the host's.

Full explanation →
249
MCQmedium

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

A.TACACS+
B.RADIUS
C.LDAP
D.DIAMETER
AnswerB

RADIUS is the standard protocol for 802.1X authentication.

Why this answer

802.1X uses RADIUS for communication between the authenticator and the authentication server.

Full explanation →
250
MCQmedium

Which encryption technology is used to secure Fibre Channel traffic in flight between storage and switches?

A.SSL
B.SED
C.FC-SP-2
D.IPsec
AnswerC

FC-SP-2 encrypts Fibre Channel traffic.

Why this answer

FC-SP-2 (Fibre Channel Security Protocol) provides authentication and encryption for Fibre Channel frames.

Full explanation →
251
Multi-Selectmedium

Which TWO of the following are best practices when interconnecting two Cisco MDS 9700 directors via Fibre Channel ISLs?

Select 2 answers
A.Enable NPIV on the ISL ports to allow multiple FCIDs
B.Use Fibre Channel port channels to bundle multiple ISLs
C.Configure the ISL ports as trunking E_ports
D.Configure the ISL ports as F_ports to increase scalability
E.Use E_port configuration (not F_port) for inter-switch links
AnswersC, E

Trunking E_ports allow multiple VSANs on a single link.

Why this answer

Trunking E_ports (TE_ports) are the standard configuration for inter-switch links (ISLs) in Cisco MDS fabrics. TE_ports enable the exchange of fabric services, VSAN trunking, and support for multiple VSANs over a single ISL, which is essential for scalable and efficient Fibre Channel SAN designs.

Exam trap

Cisco often tests the distinction between E_ports (for ISLs) and F_ports (for end devices), and the trap here is that candidates may confuse NPIV (a host-side feature) with trunking, or assume that port channels are a mandatory best practice rather than an optional enhancement.

Full explanation →
252
MCQmedium

A UCS C-Series server is initially deployed in standalone mode using CIMC. Later, the server is moved into a UCS domain managed by UCS Manager. What must be done to the CIMC configuration to allow UCS Manager to take control?

A.Disable the CIMC interface and use only UCS Manager.
B.Change the CIMC management mode from standalone to UCS-managed.
C.Update the CIMC firmware to the latest version.
D.Install a Cisco VIC adapter in the server.
AnswerB

The CIMC mode must be switched to allow UCS Manager to manage it.

Why this answer

To integrate a standalone C-Series server into UCS Manager, the server must be reset to factory defaults (or the management mode changed to UCS-managed) and then discovered by the Fabric Interconnect.

Full explanation →
253
MCQeasy

Which Fibre Channel addressing component identifies a specific port on a host or storage device uniquely in the fabric?

A.WWPN
B.WWNN
C.VSAN ID
D.FCID
AnswerA

WWPN uniquely identifies each FC port.

Why this answer

WWPN (World Wide Port Name) is a unique 64-bit identifier assigned to each FC port.

Full explanation →
254
MCQmedium

A network engineer is configuring a Fabric Extender (FEX) to connect to a parent switch. Which best practice should be followed for FEX host interfaces?

A.Configure all host interfaces as trunk ports.
B.Use the same FEX ID for redundancy.
C.Use LACP for the FEX uplinks.
D.Enable Virtual Port Channel (vPC) on the parent switch.
E.Disable spanning-tree on FEX host interfaces.
AnswerD

vPC provides active-active redundancy for FEX uplinks.

Why this answer

Enabling Virtual Port Channel (vPC) on the parent switch is a best practice for FEX host interfaces because it allows the FEX to be dual-homed to two separate parent switches, providing link-level redundancy and active-active forwarding. Without vPC, the FEX would rely on a single parent switch, creating a single point of failure and potentially causing traffic black-holing during a parent switch failure.

Exam trap

Cisco often tests the misconception that FEX uplinks require LACP or that FEX IDs can be shared for redundancy, when in fact FEX uplinks use static fabric channels and each FEX must have a unique ID.

How to eliminate wrong answers

Option A is wrong because configuring all host interfaces as trunk ports is not a best practice; FEX host interfaces should typically be configured as access ports or host-facing ports (using the 'switchport host' macro) to optimize STP and port-channel settings, and trunk ports are only needed if the downstream device requires multiple VLANs. Option B is wrong because using the same FEX ID for redundancy is not possible; each FEX must have a unique FEX ID to be properly identified by the parent switch, and redundancy is achieved through vPC or dual-homing, not by sharing IDs. Option C is wrong because LACP is not used for FEX uplinks; FEX uplinks use a proprietary fabric channel (FabricPortChannel) that does not support LACP, and the FEX-to-parent switch link is a static port-channel or individual fabric links.

Option E is wrong because disabling spanning-tree on FEX host interfaces is dangerous and not a best practice; while FEX host interfaces can use the 'spanning-tree portfast' feature to bypass listening/learning states, completely disabling spanning-tree would risk loops if a downstream device is misconfigured or a cable is looped.

Full explanation →
255
Multi-Selecthard

An engineer is configuring a UCS server for VMware ESXi. The service profile must support NPIV for virtual machine SAN connectivity. Which two conditions must be met? (Choose two.)

Select 2 answers
A.The WWPN must be unique per virtual machine
B.The vHBA must be associated with a VSAN
C.The vHBA must be set to 'Fabric: A' only
D.The vHBA must be set to 'Fabric: dual' mode
E.The vHBA must be created with a fabric failover policy
AnswersA, B

NPIV assigns unique WWPNs to each VM for SAN access.

Why this answer

NPIV (N_Port ID Virtualization) requires each virtual machine to have a unique World Wide Port Name (WWPN) so that the SAN fabric can distinguish and manage each VM's storage traffic independently. This allows multiple virtual machines to share a single physical HBA while each appears as a separate initiator to the SAN.

Exam trap

Cisco often tests the misconception that NPIV requires a fabric failover policy or dual-fabric mode, when in fact NPIV only requires unique WWPNs and proper VSAN association, with failover handled at the fabric level or by the hypervisor.

Full explanation →
256
MCQeasy

An engineer needs to secure the management plane on a Cisco Nexus 9000 switch. Which feature should be configured to restrict access to the switch's management interface based on source IP?

A.Enable DHCP snooping on the management VLAN.
B.Enable port security on the management interface.
C.Configure AAA to require two-factor authentication.
D.Configure a management CoPP policy to rate-limit and permit only specific source IPs.
AnswerD

CoPP can filter management traffic to the switch.

Why this answer

A management Control Plane Policing (CoPP) policy on a Cisco Nexus 9000 switch allows the engineer to explicitly permit or deny traffic destined to the management interface based on source IP addresses. CoPP applies QoS policies to control plane traffic, effectively restricting management plane access by rate-limiting or dropping packets from unauthorized sources before they reach the CPU.

Exam trap

Cisco often tests the distinction between data-plane security features (DHCP snooping, port security) and control-plane security mechanisms (CoPP), leading candidates to mistakenly choose a Layer 2 feature for a management plane access restriction question.

How to eliminate wrong answers

Option A is wrong because DHCP snooping is a Layer 2 security feature that filters untrusted DHCP messages and builds a binding database to prevent rogue DHCP servers; it does not restrict access to the management interface based on source IP. Option B is wrong because port security limits the number of MAC addresses allowed on a switchport and prevents MAC flooding attacks, but it operates at Layer 2 and cannot filter management plane access based on source IP addresses. Option C is wrong because AAA with two-factor authentication controls user authentication and authorization after a connection is established, but it does not restrict which source IPs can initiate a connection to the management interface.

Full explanation →
257
MCQeasy

A Fibre Channel switch port is experiencing high latency due to insufficient buffer credits. What is the most likely cause?

A.CRC errors on the fibre optic cable
B.High oversubscription ratio on the port
C.Long-distance link between switches
D.VSAN ID mismatch between end devices
AnswerC

Correct: Long-distance links require more buffer credits to maintain throughput.

Why this answer

In Fibre Channel (FC) networks, buffer credits are a flow control mechanism that allows a sender to transmit frames without waiting for an acknowledgment. Long-distance links require more buffer credits to keep the link fully utilized because the round-trip time (RTT) is higher. If insufficient buffer credits are allocated, the port will experience high latency as it must wait for credits to be returned before sending more frames.

Exam trap

Cisco often tests the distinction between congestion (oversubscription) and flow control (buffer credits), and the trap here is that candidates mistakenly associate high latency with oversubscription (Option B) rather than recognizing that long-distance links specifically require more buffer credits to avoid credit starvation.

How to eliminate wrong answers

Option A is wrong because CRC errors on the fibre optic cable indicate physical layer issues such as signal degradation or faulty transceivers, which cause frame corruption, not a shortage of buffer credits. Option B is wrong because a high oversubscription ratio on the port refers to the ratio of bandwidth demand to available bandwidth, which can cause congestion but does not directly cause insufficient buffer credits; buffer credit depletion is a separate flow control problem. Option D is wrong because a VSAN ID mismatch between end devices prevents them from communicating at all (zoning and fabric isolation), but it does not cause high latency due to buffer credit starvation.

Full explanation →
258
MCQmedium

Ansible playbook that deploys VLANs on NX-OS fails on a particular switch with 'privilege escalation required'. What should be checked first?

A.The 'host_key_checking' setting
B.The 'ansible_become_password' or 'enable' password in the playbook
C.The 'ansible_user' variable
D.The inventory file syntax
AnswerB

This is required for privilege escalation on NX-OS.

Why this answer

The error 'privilege escalation required' indicates that Ansible cannot execute commands with the necessary elevated privileges on the NX-OS switch. In Ansible, privilege escalation is handled via the 'become' mechanism, and for network devices like NX-OS, the 'ansible_become_password' (or 'enable' password) is required to enter privileged EXEC mode. Without this password, Ansible remains in user EXEC mode, which lacks the authority to apply VLAN configurations.

Exam trap

Cisco often tests the distinction between authentication (ansible_user/ansible_password) and authorization (ansible_become_password), leading candidates to mistakenly check SSH credentials or inventory syntax instead of the privilege escalation password.

How to eliminate wrong answers

Option A is wrong because 'host_key_checking' controls SSH host key verification, not privilege escalation; disabling it would only skip SSH fingerprint prompts. Option C is wrong because 'ansible_user' specifies the SSH username for login, which is unrelated to the privilege level after authentication. Option D is wrong because inventory file syntax errors would cause a parsing failure or host unreachability, not a specific 'privilege escalation required' message during task execution.

Full explanation →
259
MCQmedium

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

A.The spanning-tree port type edge trunk is causing BPDU guard to block the port.
B.The port is in err-disabled state due to a loop.
C.VLAN 1 is not allowed on the trunk, so untagged frames are dropped.
D.The port is administratively down.
AnswerC

Untagged frames are placed in native VLAN 1, but VLAN 1 is not in the allowed list.

Why this answer

The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1.

This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Exam trap

Cisco often tests the misconception that untagged frames are always allowed on a trunk port, but the trap here is that the native VLAN must be explicitly permitted in the allowed VLAN list; otherwise, untagged frames are dropped even if the port is up and configured as a trunk.

How to eliminate wrong answers

Option A is wrong because spanning-tree port type edge trunk enables PortFast and BPDU guard on a trunk, but BPDU guard would only block the port if a BPDU is received, not because of VLAN 1 untagged traffic. Option B is wrong because the port is not in err-disabled state; the exhibit shows the port is up/up, and a loop would cause a different error condition like a spanning-tree loop or err-disable due to a loop guard violation. Option D is wrong because the port is administratively up; the exhibit shows the port status as 'connected' or 'up/up', not 'administratively down'.

Full explanation →
260
MCQhard

A storage engineer is configuring replication between two data centers. The distance is 500 km with a round-trip latency of 10 ms. The application requires zero data loss in the event of a primary site failure. Which replication method should be chosen?

A.Synchronous replication
B.Snapshot-based replication
C.Asynchronous replication
D.RAID-10 mirroring
AnswerA

Synchronous replication provides zero data loss, but performance may suffer due to latency.

Why this answer

Synchronous replication ensures zero data loss (RPO=0) as writes are acknowledged only after being committed on both sites. However, it is sensitive to latency; with 10 ms RTT, performance may degrade but it meets the requirement.

Full explanation →
261
MCQeasy

A data center network uses VXLAN EVPN for network virtualization. Which component is responsible for advertising MAC addresses and host routes across the fabric?

A.Static routing.
B.MP-BGP EVPN address family.
C.OSPF.
D.VXLAN VTEP.
AnswerB

MP-BGP EVPN is the control plane for VXLAN EVPN.

Why this answer

In a VXLAN EVPN fabric, the MP-BGP EVPN address family (AFI L2VPN / SAFI EVPN) is the control plane protocol that distributes MAC addresses, IP-to-MAC bindings, and host routes (Type-2 routes) across all VTEPs. This enables each VTEP to build its forwarding table dynamically without relying on data-plane learning or flooding, ensuring optimal east-west traffic forwarding.

Exam trap

Cisco often tests the distinction between the data-plane function (VTEP encapsulation) and the control-plane function (MP-BGP EVPN), so the trap here is that candidates mistakenly think the VTEP itself advertises MAC addresses, when in fact it relies on MP-BGP EVPN for that role.

How to eliminate wrong answers

Option A is wrong because static routing is a manual configuration method that cannot dynamically advertise MAC addresses or host routes across a VXLAN EVPN fabric; it lacks the control-plane intelligence needed for EVPN route distribution. Option C is wrong because OSPF is an interior gateway protocol (IGP) designed for IPv4/IPv6 unicast routing, not for advertising Layer 2 MAC addresses or EVPN-specific routes like Type-2 or Type-3. Option D is wrong because a VXLAN VTEP is a data-plane endpoint that encapsulates/decapsulates VXLAN frames; it does not itself advertise MAC addresses or host routes—that function is performed by the control plane (MP-BGP EVPN).

Full explanation →
262
Multi-Selecteasy

Which TWO of the following Fibre Channel port types are used to connect end devices such as hosts or storage?

Select 2 answers
A.FL port
B.E port
C.N port
D.F port
E.NP port
AnswersC, D

N port is on the end device.

Why this answer

(N port) is correct because an N_port (Node port) is the Fibre Channel port type used on end devices such as hosts (HBAs) or storage controllers to connect to a Fibre Channel switch. Option D (F port) is correct because an F_port (Fabric port) is the switch-side port that connects to an N_port, forming a point-to-point link between the end device and the fabric. Together, N_port and F_port enable standard fabric login (FLOGI) and frame exchange.

Exam trap

Cisco often tests the distinction between N_port and FL_port, trapping candidates who confuse the point-to-point fabric connection (N_port to F_port) with the older Arbitrated Loop topology (NL_port to FL_port).

Full explanation →
263
MCQmedium

A Cisco MDS switch has two VSANs (VSAN 10 and VSAN 20). The engineer wants to connect two switches using a single ISL that carries both VSANs. Which configuration is required on the ISL interface?

A.Use two separate ISLs, one for each VSAN.
B.Configure the port as a trunk port (EISL).
C.Create a PortChannel and add the ISL.
D.Configure the port as a regular E-port.
AnswerB

Trunk port (EISL) allows multiple VSANs over a single ISL.

Why this answer

An EISL (Extended ISL) is a trunk port that carries multiple VSANs. The interface must be configured as a trunk port using the 'switchport mode trunk' command (or 'trunk mode on' in some contexts) to allow multiple VSANs.

Full explanation →
264
MCQhard

Refer to the exhibit. An engineer applies this QoS policy to a Cisco Nexus 9000 switch in a data center. After applying the policy, storage traffic (iSCSI) is experiencing high latency and occasional drops. The engineer verifies that the iSCSI traffic is not matching the 'BulkData' class. What is the most likely cause of the issue?

A.The policy-map does not specify a priority queue for latency-sensitive traffic.
B.The policy-map is applied at the system level, but iSCSI traffic is not classified under any class-map.
C.The bandwidth percent for class-default is too low, causing iSCSI to be starved.
D.The class-map 'BulkData' does not match the correct traffic because the match statement uses qos-group instead of dscp.
AnswerA

iSCSI requires low latency; without a priority queue, it competes with other traffic.

Why this answer

ISCSI is a latency-sensitive storage protocol that requires a strict priority queue to ensure low latency and minimal jitter. Without a priority queue configured in the policy-map, iSCSI traffic competes with other traffic classes on a best-effort basis, leading to high latency and drops even if it is not matching the 'BulkData' class.

Exam trap

Cisco often tests the misconception that simply classifying traffic into a class-map is sufficient, but the trap here is that without a priority queue, latency-sensitive traffic like iSCSI will still suffer from high latency and drops even if correctly classified.

How to eliminate wrong answers

Option B is wrong because the policy-map is applied at the system level, but iSCSI traffic not being classified under any class-map would cause it to fall into class-default, not directly cause high latency if bandwidth is properly allocated. Option C is wrong because the bandwidth percent for class-default being too low would affect all default traffic equally, but the issue is specifically with iSCSI latency and drops, not starvation. Option D is wrong because the class-map 'BulkData' uses a match statement that is irrelevant to iSCSI traffic; the issue is not about incorrect matching but the lack of a priority queue for latency-sensitive traffic.

Full explanation →
265
Multi-Selectmedium

Which TWO of these are best practices for securing the Cisco ACI fabric?

Select 2 answers
A.Use security domains to control RBAC.
B.Use in-band management for APIC connectivity.
C.Enable certificate-based authentication for APIC access.
D.Leave default passwords for fabric discovery.
E.Place APIC controllers in a DMZ.
AnswersA, C

Security domains isolate tenant administration.

Why this answer

Security domains in Cisco ACI provide role-based access control (RBAC) by partitioning the fabric into logical groups, allowing administrators to restrict user permissions to specific tenants, EPGs, or policies. This is a core best practice to enforce least-privilege access and prevent unauthorized configuration changes across the fabric.

Exam trap

Cisco often tests the misconception that in-band management is acceptable for APIC connectivity, but the correct practice is to use out-of-band management to keep APIC traffic separate from the data plane and reduce attack surface.

Full explanation →
266
MCQhard

During a security audit, you discover that a Cisco Nexus 9000 switch is allowing traffic between two ports in the same VLAN despite having a VLAN ACL that should deny it. The VACL is applied correctly, and the ACL entries are properly configured. What is the most likely reason for this behavior?

A.VACLs only filter traffic between VLANs, not within the same VLAN.
B.The VACL requires Layer 3 inspection to be enabled.
C.The switch does not support hardware VACL processing.
D.Spanning-tree is bypassing the VACL for PortFast ports.
AnswerA

VACLs filter inter-VLAN traffic; intra-VLAN traffic is not affected.

Why this answer

VLAN ACLs (VACLs) operate at Layer 2 and filter traffic entering or leaving a VLAN, but they only apply to traffic that crosses VLAN boundaries (i.e., inter-VLAN routing). Traffic between two ports within the same VLAN is bridged at Layer 2 and never traverses the VACL enforcement point, so the ACL entries have no effect on intra-VLAN communication. This is a fundamental design limitation of VACLs on Cisco Nexus switches.

Exam trap

Cisco often tests the misconception that VACLs filter all traffic within a VLAN, when in fact they only apply to traffic crossing VLAN boundaries, leading candidates to overlook the intra-VLAN limitation.

How to eliminate wrong answers

Option B is wrong because VACLs do not require Layer 3 inspection; they are applied at Layer 2 and filter based on MAC addresses, IP addresses, or other fields without needing routing or Layer 3 forwarding. Option C is wrong because the Cisco Nexus 9000 series fully supports hardware-based VACL processing using TCAM, and this is not a limitation that would cause the described behavior. Option D is wrong because Spanning Tree Protocol (STP) and PortFast do not bypass VACLs; PortFast only accelerates the transition to forwarding state and does not affect ACL enforcement.

Full explanation →
267
Multi-Selectmedium

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

Select 2 answers
A.Port Security
B.IP Source Guard
C.Private VLANs
D.Dynamic ARP Inspection
E.MACsec
AnswersB, D

IP Source Guard uses the DHCP snooping binding to permit only valid IP/MAC addresses.

Why this answer

IP Source Guard (IPSG) uses the DHCP snooping binding table to validate the source IP address of packets received on untrusted ports. It drops any packet whose source IP does not match an entry in the binding table, preventing IP spoofing attacks. Dynamic ARP Inspection (DAI) also relies on the DHCP snooping binding table to validate ARP packets, ensuring that the sender MAC and IP addresses match a legitimate binding, thereby blocking ARP poisoning attacks.

Exam trap

Cisco often tests the dependency of IP Source Guard and Dynamic ARP Inspection on the DHCP snooping binding table, and the trap here is that candidates confuse Port Security or MACsec as features that also rely on DHCP snooping, when in fact they operate independently.

Full explanation →
268
Drag & Dropmedium

Arrange the steps to configure a port-channel (LAG) on a Cisco Nexus switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Port-channel creation involves interface creation, mode setting, member addition, and verification.

Full explanation →
269
MCQhard

A large enterprise uses Cisco Nexus 5548UP switches in FCoE mode. The storage array is connected via native FC to an MDS 9700. The FCoE switches are connected to the MDS via FC uplinks. Recently, the storage team deployed a new FCoE initiator that requires access to a specific LUN. After configuring the zone and VSAN, the initiator cannot discover the target. The zone includes the pWWN of the target and the FCoE initiator's pWWN (derived from its MAC address). The initiator is in VSAN 100, and the target is in the same VSAN. The MDS show flogi database shows the initiator. The show fcoe database on the Nexus shows the initiator but the session is not active (state: FIP-VN_Port not logged in). The engineer checks the FIP snooping policy and notices that the FCoE VLAN to VSAN mapping is correct. What is the most likely issue?

A.The MDS does not have a route to the FCoE initiator's VSAN
B.The FCoE initiator is not using the correct VN_Port MAC address
C.The FIP snooping policy is blocking the FLOGI
D.The FCoE NPV is not enabled on the Nexus
AnswerC

FIP snooping uses ACLs to enforce zoning; if misconfigured, it can drop FLOGI frames.

Why this answer

The FCoE initiator appears in the FCoE database but is not logged in, indicating the FLOGI is being dropped. The FIP snooping policy on the Nexus switch may be blocking the FLOGI traffic because the initiator's MAC address is not in the allowed FCoE MAC list or the policy is misconfigured. Incorrect VN_Port MAC would prevent FCoE database entry, NPV is not required for FCoE native mode, and routing is not an issue within the same VSAN.

Full explanation →
270
Multi-Selectmedium

A network engineer is configuring 802.1Q trunking between a Nexus switch and a server. Which TWO statements are true regarding 802.1Q trunking?

Select 2 answers
A.The native VLAN is tagged by default
B.The VLAN ID is 12 bits long
C.A 4-byte tag is inserted into the Ethernet frame
D.Trunks can only carry one VLAN
E.The frame check sequence (FCS) is recalculated after tagging
AnswersB, E

Correct — the VLAN ID field is 12 bits long.

Why this answer

802.1Q trunking uses a 4-byte tag to carry VLAN information, but the native VLAN is sent untagged, so not all frames receive the tag. The VLAN ID field is 12 bits (B), and after tagging, the FCS must be recalculated (E). Option A is false because the native VLAN is untagged.

Option C is false because only non-native VLAN frames are tagged. Option D is false because trunks can carry multiple VLANs.

Exam trap

Candidates often assume every frame on a trunk gets a 4-byte tag, but the native VLAN is always untagged. The question asks for two true statements; B and E are correct, and C is a common trap.

Full explanation →
271
MCQeasy

Which command displays the VLANs allowed on a trunk interface?

A.show running-config interface
B.show vlan
C.show interface switchport
D.show interface trunk
AnswerD

This command directly shows trunk status and allowed VLANs.

Why this answer

The 'show interface trunk' command displays trunk parameters, including the VLANs allowed on the trunk interface. This command shows the trunking mode, encapsulation (e.g., 802.1Q), and the allowed VLAN list for each trunk port. It is the direct command to verify which VLANs are permitted on a specific trunk link.

Exam trap

The trap here is that candidates often confuse 'show interface switchport' (which shows trunking status and native VLAN) with 'show interface trunk' (which shows the allowed VLAN list), leading them to choose option C instead of D.

How to eliminate wrong answers

Option A is wrong because 'show running-config interface' displays the running configuration for an interface, which may include the 'switchport trunk allowed vlan' command if configured, but it does not show the dynamic or negotiated allowed VLAN list, and it is not the standard command to view active trunk parameters. Option B is wrong because 'show vlan' displays VLAN information and which ports are members of each VLAN, but it does not show the allowed VLAN list on a trunk interface; it shows access VLAN membership. Option C is wrong because 'show interface switchport' displays administrative and operational switchport modes, including trunking status, but it does not show the allowed VLAN list; it shows the native VLAN and trunk encapsulation but not the permitted VLANs.

Full explanation →
272
MCQeasy

In a Cisco ACI fabric, which component is responsible for policy enforcement and management of the entire infrastructure?

A.Leaf switch
B.DCNM
C.APIC controller
D.Spine switch
AnswerC

The APIC is the central policy and management controller in ACI.

Why this answer

The APIC (Application Policy Infrastructure Controller) is the central policy and management entity in Cisco ACI. It enforces the application-centric policy model, manages the fabric's operational state, and provides the single point of configuration and monitoring for the entire ACI fabric. Without the APIC, the leaf and spine switches operate as standalone devices with no centralized policy enforcement.

Exam trap

Cisco often tests the misconception that leaf switches perform policy enforcement independently, but in ACI, leaf switches are policy-enforcement points that receive all policy definitions from the APIC, not autonomous decision-makers.

How to eliminate wrong answers

Option A is wrong because leaf switches are data-plane devices that forward traffic and enforce policies received from the APIC, but they do not manage or originate policies for the entire infrastructure. Option B is wrong because DCNM (Data Center Network Manager) is a legacy management tool for traditional NX-OS environments and is not used for ACI fabric policy management; ACI uses the APIC exclusively for policy and management. Option D is wrong because spine switches provide high-speed interconnectivity between leaf switches and handle fabric forwarding (e.g., using IS-IS for underlay routing), but they have no role in policy enforcement or centralized management.

Full explanation →
273
MCQhard

A data center uses FCoE on Nexus 9000 switches. The storage team reports inconsistent performance during peak times. Queuing drops are seen on the FCoE-enabled interfaces. Which QoS configuration change would best address the issue?

A.Enable WRED on the FCoE class
B.Increase MTU on the FCoE VLAN
C.Ensure sufficient buffer allocation for the no-drop class
D.Increase the number of pause frames on the no-drop class
AnswerC

Correct: Allocating more buffers to the no-drop class prevents drops.

Why this answer

In FCoE networks, lossless behavior is required for storage traffic, which is enforced by priority flow control (PFC) on the no-drop class. Queuing drops on FCoE-enabled interfaces indicate that the no-drop class is experiencing buffer exhaustion under congestion. Increasing buffer allocation for the no-drop class ensures that FCoE frames are not dropped, maintaining the lossless fabric required by Fibre Channel over Ethernet.

Exam trap

Cisco often tests the misconception that pause frames alone guarantee lossless delivery, but the trap is that insufficient buffer allocation for the no-drop class will still cause drops under burst conditions, regardless of pause frame configuration.

How to eliminate wrong answers

Option A is wrong because WRED (Weighted Random Early Detection) is a congestion avoidance mechanism for drop-tolerant traffic (e.g., best-effort), and enabling it on the FCoE no-drop class would cause random drops, violating the lossless requirement of FCoE. Option B is wrong because increasing MTU on the FCoE VLAN does not address queuing drops caused by buffer congestion; FCoE already uses jumbo frames (typically 2500 bytes), and MTU changes affect frame size, not buffer allocation or drop behavior. Option D is wrong because increasing the number of pause frames on the no-drop class would not solve buffer exhaustion; pause frames are used by PFC to signal backpressure, but if the buffer is already full, additional pause frames cannot prevent drops—proper buffer sizing is needed to absorb bursts.

Full explanation →
274
MCQmedium

A network automation engineer wants to use EEM with Python applets on a Nexus switch to trigger a script when an interface goes down. Which EEM configuration is required to invoke the Python script?

A.action 1.0 cli python bootflash:script.py
B.action 1.0 bash python bootflash:script.py
C.action 1.0 event manager python script.py
D.action 1.0 python bootflash:script.py
AnswerD

Correct: This runs the Python script in the Guest Shell or OnEX.

Why this answer

EEM applets can use the 'action' command with 'python' to run a Python script in the Guest Shell or OnEX environment.

Full explanation →
275
Multi-Selecthard

Which THREE statements about Cisco UCS Manager automation using XML API are correct? (Choose three.)

Select 3 answers
A.Operations can be made idempotent by using the 'dn' (distinguished name) to specify the exact object.
B.The XML API is based on a management information model (MIT) similar to ACI.
C.The API uses XML for both request and response payloads.
D.The API uses SNMP for configuration changes.
E.The UCS Manager XML API uses RESTful JSON format.
AnswersA, B, C

Idempotency is achieved by targeting specific objects.

Why this answer

The Cisco UCS Manager XML API allows operations to be idempotent by using the 'dn' (distinguished name) attribute to target a specific managed object. When you include the 'dn' in an XML request, the operation applies only to that exact object, so repeating the same request produces the same result without side effects. This is a key design principle of the management information model (MIT) that ensures predictable and safe automation.

Exam trap

Cisco often tests the distinction between XML-based APIs (like UCS Manager) and RESTful JSON APIs (like Cisco DNA Center or ACI REST API), so the trap here is assuming that UCS Manager uses JSON or SNMP for configuration, when it strictly uses XML over HTTP/HTTPS.

Full explanation →
276
MCQhard

A data center architect is designing security for a Cisco ACI fabric that must comply with PCI DSS. The requirement is to encrypt all traffic between EPGs within the same tenant. Which solution should be used?

A.Enable port security on the leaf switch interfaces.
B.Use a contract with the 'encrypt' flag enabled between the EPGs.
C.Create separate VRFs for each EPG and route traffic through a firewall.
D.Configure a site-to-site VPN between the leaf switches.
AnswerB

ACI contracts support encryption enforcement using MACsec or IPsec.

Why this answer

Cisco ACI supports encryption of traffic between EPGs within the same tenant using a contract with the 'encrypt' flag enabled. This leverages the ACI fabric's built-in capability to apply AES-based encryption (e.g., AES-256-GCM) at the leaf switch level, ensuring data confidentiality for PCI DSS compliance without requiring external devices or complex routing changes.

Exam trap

The trap here is that candidates may assume encryption requires an external firewall or VPN, but Cisco ACI natively supports contract-based encryption using MACsec, which is the correct and simplest solution for intra-tenant EPG traffic encryption.

How to eliminate wrong answers

Option A is wrong because port security on leaf switch interfaces controls MAC address flooding and prevents MAC spoofing, but it does not provide any encryption of traffic between EPGs. Option C is wrong because creating separate VRFs and routing through a firewall adds complexity and potential latency, but it does not inherently encrypt traffic within the ACI fabric; encryption would require additional VPN or IPsec configuration on the firewall, which is not a native ACI solution. Option D is wrong because a site-to-site VPN between leaf switches is not a supported or practical configuration in ACI; VPNs are designed for inter-site or remote connectivity, not for intra-fabric EPG-to-EPG traffic encryption.

Full explanation →
277
MCQmedium

Which Nexus feature dynamically validates ARP packets to prevent man-in-the-middle attacks?

A.Dynamic ARP Inspection
B.DHCP snooping
C.IP Source Guard
D.Port security
AnswerA

DAI validates ARP packets.

Why this answer

Dynamic ARP Inspection (DAI) intercepts ARP packets and validates them against DHCP snooping bindings.

Full explanation →
278
MCQmedium

An engineer needs to connect a Cisco MDS switch to a core Fibre Channel fabric using NPV mode. What port type will the edge switch's uplink ports assume in this scenario?

A.NP-port
B.N-port
C.E-port
D.F-port
AnswerA

NP-port is the uplink port type in NPV mode.

Why this answer

In NPV mode, the edge switch presents NP-ports to the core fabric, which appear as N-ports to the core switch.

Full explanation →
279
MCQmedium

In a HyperFlex cluster configured with replication factor 2 (RF2), a storage node fails. What is the impact on data availability?

A.Data is lost because only one copy remains.
B.Data remains available, but the cluster is degraded and cannot tolerate another node failure until repaired.
C.The cluster stops serving data until the failed node is replaced.
D.The cluster automatically switches to RF3 to maintain redundancy.
AnswerB

The data is still accessible, but if another node fails, data could be lost since only one copy remains.

Why this answer

With RF2, data is replicated across two nodes. If one node fails, the data remains available on the other node. However, the cluster enters a degraded state until the node is replaced and data is re-replicated.

Full explanation →
280
Multi-Selectmedium

An administrator is configuring CHAP authentication for iSCSI. Which two statements about CHAP are correct? (Choose two.)

Select 2 answers
A.CHAP authentication is optional and can be disabled.
B.CHAP provides encryption of iSCSI data.
C.CHAP authentication is only used for discovery sessions.
D.CHAP requires a shared secret between initiator and target.
E.CHAP uses a digital certificate for authentication.
AnswersA, D

CHAP can be enabled or disabled per iSCSI session.

Why this answer

CHAP uses a three-way handshake (challenge, response, verification) and can be configured as one-way (target authenticates initiator) or mutual (both authenticate).

Full explanation →
281
MCQmedium

You are a data center engineer at a financial company. The production environment uses UCS B-Series blades with fabric interconnects in a clustered configuration. One of the blades (blade 3) is running a critical trading application. The server is associated with a service profile that boots from SAN using a single HBA path. During a routine network upgrade, the storage administrator reports that LUN 0 on the primary storage array is no longer accessible from blade 3. The server is still powered on, but the application is unresponsive. You check UCS Manager and see that the vHBA for blade 3 is in an 'Unavailable' state. The fabric interconnect ports show no errors. The storage array logs show that the target port is active. Which action should you take to restore connectivity with minimal downtime?

A.Change the boot policy to use a secondary LUN on the same array
B.Unassign and reassign the vHBA's WWPN from the pool in the service profile
C.Reset the fabric interconnect to restore cluster state
D.Reboot the server to force re-initialization of the HBA
AnswerB

This forces the fabric to re-establish zoning and access

Why this answer

The vHBA being in an 'Unavailable' state while the fabric interconnect ports and storage target are healthy indicates a WWPN (World Wide Port Name) conflict or corruption at the fabric level. Unassigning and reassigning the vHBA's WWPN from the pool forces UCS Manager to generate a new WWPN and re-login to the SAN fabric, re-establishing the Fibre Channel session without requiring a server reboot or service profile re-association, minimizing downtime for the critical trading application.

Exam trap

Cisco often tests the misconception that a vHBA 'Unavailable' state requires a server reboot or fabric interconnect reset, when in fact the solution is to reassign the WWPN from the pool to resolve fabric login issues without disrupting the server's power state.

How to eliminate wrong answers

Option A is wrong because changing the boot policy to use a secondary LUN does not resolve the vHBA's 'Unavailable' state; the issue is at the HBA fabric login level, not the LUN path, and the application is already unresponsive due to lost connectivity. Option C is wrong because resetting the fabric interconnect would disrupt all blades and storage traffic in the cluster, causing widespread downtime, and the logs show no port errors or cluster state issues, so this is an unnecessary and destructive action. Option D is wrong because rebooting the server would force a re-initialization of the HBA, but it would still use the same problematic WWPN, likely resulting in the same 'Unavailable' state, and it would cause application downtime that can be avoided with a WWPN reassignment.

Full explanation →
282
Multi-Selecthard

Which TWO are valid methods to configure a Cisco UCS service profile for stateless computing? (Choose two.)

Select 2 answers
A.Create a service profile from a template
B.Use boot from SAN to store OS images
C.Assign persistent WWPNs to vHBAs
D.Configure local storage on the blade
E.Update the service profile template and re-apply to existing profiles
AnswersA, E

A derived template inherits settings that can be updated centrally.

Why this answer

Creating a service profile from a template is a core method for stateless computing in Cisco UCS. Stateless computing abstracts hardware identity (e.g., WWPNs, MAC addresses, UUIDs) from physical blades, allowing a service profile to be applied to any compatible blade without reconfiguration. Templates enable rapid, consistent deployment of these stateless profiles across multiple servers.

Exam trap

Cisco often tests the distinction between a method to configure a service profile (e.g., using a template) versus a specific attribute or feature within a profile (e.g., persistent WWPNs or boot from SAN), leading candidates to confuse configuration methods with profile properties.

Full explanation →
283
MCQmedium

A network engineer is hardening a Nexus 9000 switch. Which action is most effective in reducing the attack surface?

A.Configuring a strong enable password
B.Implementing CoPP
C.Enabling SNMP v3 with secure keys
D.Disabling all unused services
AnswerD

This reduces attack surface directly.

Why this answer

Disabling unused services reduces the number of potential attack vectors.

Full explanation →
284
MCQeasy

An engineer notices that a Fibre Channel link between two Cisco MDS 9000 series switches is flapping every few minutes. The interface counters show a high number of CRC errors. What is the most likely cause of this issue?

A.NPV mode enabled on the switch
B.Incorrect zoning configuration
C.Faulty SFP or optical cable
D.VSAN mismatch between switches
AnswerC

CRC errors point to physical layer problems.

Why this answer

CRC errors on a Fibre Channel link indicate physical-layer corruption of frames, typically caused by faulty optics, dirty or damaged fiber cables, or marginal signal integrity. Flapping occurs because the link repeatedly fails to maintain proper synchronization due to excessive bit errors, triggering port reset or re-initialization. A faulty SFP or optical cable directly introduces noise or attenuation that corrupts the data stream, leading to CRC errors and link instability.

Exam trap

Cisco often tests the distinction between physical-layer issues (CRC errors, flapping) and logical/configuration issues (VSAN mismatch, zoning, NPV), tempting candidates to select a configuration-based answer when the symptoms clearly point to a hardware fault.

How to eliminate wrong answers

Option A is wrong because NPV (N_Port Virtualization) mode is a switch feature that allows a switch to act as a proxy for end devices, reducing domain IDs; it does not cause physical-layer CRC errors or link flapping. Option B is wrong because incorrect zoning configuration affects which devices can communicate (access control) but does not introduce bit errors or physical-layer corruption on the link. Option D is wrong because a VSAN mismatch between switches prevents the link from coming up at all (the port will be isolated or disabled), not cause intermittent flapping with CRC errors.

Full explanation →
285
MCQeasy

Refer to the exhibit. The TACACS+ server at 10.1.1.1 is unreachable. What will happen when a user tries to authenticate to the switch using SSH?

A.Authentication will use the local user database as a fallback.
B.Authentication will be denied immediately.
C.Authentication will be attempted against the TACACS+ server repeatedly until timeout.
D.Authentication will be attempted against the TACACS+ server without fallback because 'fallback-to-local' is not configured.
AnswerA

The 'local' keyword provides fallback.

Why this answer

When the TACACS+ server at 10.1.1.1 is unreachable, the switch will fall back to the local user database for authentication because the 'fallback-to-local' feature is enabled by default in Cisco IOS/IOS-XE for TACACS+ configurations. This behavior ensures that administrative access is not completely blocked if the remote AAA server becomes unavailable, allowing authentication against locally configured usernames and passwords.

Exam trap

Cisco often tests the misconception that 'fallback-to-local' must be explicitly configured for TACACS+ fallback to work, when in reality the fallback is determined by the order of methods in the AAA authentication command, and 'local' as a subsequent method provides the fallback automatically.

How to eliminate wrong answers

Option B is wrong because authentication is not denied immediately; Cisco switches are designed to attempt fallback mechanisms to maintain availability. Option C is wrong because the switch does not repeatedly attempt TACACS+ authentication until timeout; instead, it will fail over to the local database after a single failed attempt or after the server is marked dead. Option D is wrong because 'fallback-to-local' is enabled by default for TACACS+ in Cisco IOS/IOS-XE, so even without explicit configuration, the switch will use the local database as a fallback when the TACACS+ server is unreachable.

Full explanation →
286
MCQhard

In ACI, when integrating with VMware vSphere, which component is used to automatically push port group configurations to virtual switches?

A.APIC
B.VMM domain
C.Tenant
D.L3Out
AnswerB

VMM domain handles integration with hypervisors.

Why this answer

The VMM (Virtual Machine Manager) domain in ACI is the integration point with VMware vSphere. It automatically pushes port group configurations to virtual switches by leveraging the VMware vCenter API, ensuring that ACI network policies are consistently applied to the hypervisor's virtual switches without manual intervention.

Exam trap

Cisco often tests the misconception that APIC directly pushes configurations to vSphere, but the VMM domain is the actual integration component that abstracts and automates the port group push via vCenter APIs.

How to eliminate wrong answers

Option A is wrong because APIC is the centralized controller for ACI policy management, not the component that directly pushes port group configurations to virtual switches; the VMM domain handles that integration. Option C is wrong because a Tenant is a logical container for policies (e.g., EPGs, contracts) and does not directly interact with vSphere to push port group configurations. Option D is wrong because L3Out is used for external Layer 3 connectivity (e.g., routing to outside networks) and has no role in VMware vSphere integration or port group automation.

Full explanation →
287
MCQhard

Refer to the exhibit. An engineer is creating a service profile template in Cisco UCSM. What is the effect of setting the vnet to 'VM_Network' for vNIC_A?

A.The VM_Network VLAN is a pre-defined FCoE VLAN for storage traffic.
B.The vNIC_A will be placed in VLAN 1 (default) if VM_Network does not exist.
C.The VM_Network VLAN will be created automatically as a standard VLAN.
D.The VM_Network VLAN must be previously defined in the global VLAN database.
AnswerD

UCS requires VLANs to be defined globally before they can be assigned to vNICs.

Why this answer

In Cisco UCS Manager, when you assign a VLAN to a vNIC in a service profile template, that VLAN must already exist in the global VLAN database. The VM_Network VLAN is not automatically created; it must be pre-defined under the LAN > VLANs section. Option D correctly states this requirement.

Exam trap

Cisco often tests the misconception that VLANs can be dynamically created or auto-provisioned when referenced in a service profile, but in UCSM, all VLANs must be explicitly defined in the global database before they can be assigned to vNICs.

How to eliminate wrong answers

Option A is wrong because VM_Network is not a pre-defined FCoE VLAN; FCoE VLANs are specifically configured for storage traffic and are distinct from standard Ethernet VLANs like VM_Network. Option B is wrong because if VM_Network does not exist in the global VLAN database, the vNIC will not fall back to VLAN 1; instead, the service profile association will fail or the vNIC will be placed in an error-disabled state. Option C is wrong because VLANs are not created automatically when referenced in a vNIC; they must be explicitly defined in the global VLAN database before they can be used.

Full explanation →
288
MCQeasy

A network engineer is designing a Cisco HyperFlex cluster for a virtualized environment. The cluster will run VDI workloads. Which storage policy should be selected to ensure that all VMs have the highest possible performance while maintaining data redundancy?

A.Triple replication with RAID 5 parity
B.Erasure coding with deduplication
C.Dual replication with deduplication and compression
D.No replication with compression
AnswerC

Dual replication provides redundancy, and deduplication/compression reduce capacity, while caching maintains performance.

Why this answer

For VDI workloads in a Cisco HyperFlex cluster, the storage policy must balance performance and data redundancy. Dual replication with deduplication and compression provides the highest performance by using two copies of data (mirroring) for redundancy, while deduplication and compression reduce storage overhead without the write penalty of parity-based schemes. This avoids the performance degradation of RAID 5 parity or erasure coding, which are unsuitable for latency-sensitive VDI.

Exam trap

Cisco often tests the misconception that erasure coding or RAID parity is always better for space efficiency, but in VDI scenarios, the write penalty of these methods makes dual replication the correct choice for performance-sensitive workloads.

How to eliminate wrong answers

Option A is wrong because triple replication with RAID 5 parity introduces significant write overhead and latency due to parity calculations, which is detrimental to VDI performance. Option B is wrong because erasure coding, while space-efficient, imposes a high computational and I/O penalty on writes, making it unsuitable for the random write-heavy nature of VDI workloads. Option D is wrong because no replication provides zero data redundancy, violating the requirement for data protection in a production VDI environment.

Full explanation →
289
MCQhard

A company has two data centers connected via a WAN link using an FCIP tunnel between two Cisco MDS 9700 switches. The FCIP link is configured on a GigabitEthernet port with an MTU of 1500 bytes and uses IPSec for encryption. Recently, storage replication traffic has become slow, and the administrator notices high TCP retransmissions on the FCIP interface. The administrator checks the bandwidth utilization and sees it is only 50% of the link capacity. The storage arrays report no errors or performance issues on their local switches. The administrator also verifies that the FCIP profile is configured correctly and that compression is enabled but not causing any errors. What is the most likely cause of the TCP retransmissions?

A.The WAN link has packet loss due to a duplex mismatch.
B.IPSec encryption introduces too much overhead.
C.The FCIP profile is configured with compression that is causing delays.
D.The TCP window size is too small for the latency.
AnswerD

A TCP window size that is too small for the latency prevents the sender from transmitting enough data to fill the pipe. This leads to underutilization (50%) and can cause retransmissions when the retransmission timer expires because the sender is waiting for ACKs. In FCIP, it is crucial to tune the TCP window to the bandwidth-delay product.

Why this answer

High TCP retransmissions and 50% utilization on an FCIP link over a high-latency WAN are classic symptoms of a TCP window size that is too small for the latency. When the TCP window is insufficient, the sender cannot keep the pipe full, leading to idle periods and retransmissions when the sender's retransmission timer expires while waiting for acknowledgments. In FCIP, the TCP window should be adjusted based on the bandwidth-delay product.

A duplex mismatch would cause collisions and errors, but the absence of reported errors and only 50% utilization suggests the issue is not physical layer. IPSec overhead adds processing delay but rarely causes retransmissions. Compression delays are not significant enough to cause retransmissions.

Therefore, option D is correct.

Full explanation →
290
Multi-Selectmedium

Which two statements correctly describe VXLAN BUM traffic handling? (Choose two.)

Select 2 answers
A.Ingress replication sends unicast copies of the BUM traffic to each remote VTEP.
B.BUM traffic is dropped by default.
C.Multicast group is used to distribute BUM traffic to all VTEPs that need it.
D.Ingress replication sends a single multicast packet to all VTEPs.
E.Multicast is required for VXLAN BUM handling.
AnswersA, C

Correct description.

Why this answer

In VXLAN, BUM traffic (Broadcast, Unknown unicast, Multicast) can be handled using ingress replication, where the ingress VTEP creates multiple unicast copies of the packet and sends them directly to each remote VTEP. This is the default mode in many VXLAN implementations, especially in EVPN-based fabrics, and does not require a multicast group in the underlay. Option A correctly describes this behavior.

Exam trap

Cisco often tests the misconception that multicast is mandatory for VXLAN BUM handling, but the exam expects you to know that ingress replication is a valid and commonly used alternative, especially in EVPN-based designs.

Full explanation →
291
Multi-Selecthard

Which three actions can be taken when a port security violation occurs? (Choose three.)

Select 3 answers
A.Shutdown
B.Restrict
C.Protect
D.Errdisable recovery
E.Log
AnswersA, B, C

Disables the port in errdisable state.

Why this answer

When a port security violation occurs, the switch can be configured to take one of three actions: shutdown, restrict, or protect. The shutdown action (A) immediately disables the port and places it in an errdisable state, which is the default behavior. This is correct because it provides the most secure response by completely blocking traffic from the violating MAC address.

Exam trap

Cisco often tests the distinction that errdisable recovery is a recovery mechanism, not a violation action, and that logging is a behavior of restrict, not a separate configurable action.

Full explanation →
292
MCQmedium

An engineer needs to deploy a new UCS C-Series standalone server in a remote branch without local IT staff. Which technology allows remote firmware upgrade and hardware monitoring without requiring a dedicated management IP?

A.Cisco Integrated Management Controller (CIMC) GUI
B.UCS Manager
C.Data Center Network Manager (DCNM)
D.Cisco Intersight
AnswerD

Intersight can manage C-Series servers remotely via device connector.

Why this answer

Cisco Intersight is a cloud-based management platform that provides out-of-band management for UCS C-Series standalone servers without requiring a dedicated management IP address. It uses a device connector embedded in the CIMC to establish a secure connection to the Intersight cloud, enabling remote firmware upgrades, hardware monitoring, and lifecycle management over the internet. This eliminates the need for a separate management network or local IT staff at the remote branch.

Exam trap

Cisco often tests the distinction between traditional out-of-band management (CIMC GUI requiring a dedicated IP) and cloud-based management (Intersight using a device connector without a dedicated IP), leading candidates to incorrectly choose CIMC GUI for remote management scenarios.

How to eliminate wrong answers

Option A is wrong because the CIMC GUI requires a dedicated management IP address to be accessed locally or remotely, which contradicts the requirement of not needing a dedicated management IP. Option B is wrong because UCS Manager is designed for managing UCS B-Series blade servers and fabric interconnects in a centralized domain, not for standalone C-Series servers, and it also requires a dedicated management IP. Option C is wrong because Data Center Network Manager (DCNM) is a network management tool for Cisco Nexus switches and ACI fabrics, not for UCS server management or firmware upgrades.

Full explanation →
293
MCQeasy

Which FC port type is used for end-device connection in Fibre Channel fabric, and is typically found on a host bus adapter?

A.NP-port
B.E-port
C.F-port
D.N-port
AnswerD

N-port is the node port on end devices like HBAs.

Why this answer

N-port is the standard port type for end devices in Fibre Channel.

Full explanation →
294
Drag & Dropmedium

Sequence the steps to configure a Cisco UCS Fabric Interconnect (FI) for the first time.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Initial FI setup involves IP assignment, cluster mode, user creation, uplink config, and verification.

Full explanation →
295
MCQhard

In a multipath Fibre Channel SAN, which component is responsible for selecting the active path for I/O operations?

A.The storage target
B.The Fibre Channel switch
C.The fabric name server
D.The initiator (host HBA and multipath driver)
AnswerD

Multipath software on the host decides which path to use.

Why this answer

In a multipath Fibre Channel SAN, the initiator (host HBA and multipath driver) is responsible for selecting the active path for I/O operations. The multipath driver, such as Cisco MDS N-Port Virtualization or native OS multipathing (e.g., Linux DM-Multipath), uses path selection policies (e.g., round-robin, least-queued, or active/passive) to choose the path for each I/O request. The storage target, switch, and fabric name server do not make per-I/O path decisions; they only provide connectivity or discovery services.

Exam trap

Cisco often tests the misconception that the Fibre Channel switch or storage array controls path selection, but in reality, the initiator's multipath driver is the sole decision-maker for active I/O paths.

How to eliminate wrong answers

Option A is wrong because the storage target (LUN or array controller) presents logical units but does not select the active path for I/O; it responds to commands sent by the initiator. Option B is wrong because the Fibre Channel switch forwards frames based on destination addresses and does not perform per-I/O path selection; it is unaware of multipath policies. Option C is wrong because the fabric name server provides device discovery and address resolution (e.g., FCNS queries) but does not participate in I/O path selection.

Full explanation →
296
MCQhard

An ACI fabric administrator wants to enable microsegmentation for workloads in a Virtual Routing and Forwarding (VRF) instance. The security policy must allow communication between two endpoints based on their EPG (Endpoint Group) membership, regardless of IP address. Which construct must be used?

A.Contract with filter and subject
B.vzAny
C.VRF
D.Bridge Domain (BD)
AnswerA

Contracts in ACI define allowed traffic between EPGs based on filters.

Why this answer

A contract with a filter and subject is required to enable microsegmentation in ACI because it defines the explicit rules for communication between EPGs. The contract specifies which EPGs can talk to each other, the filter defines the L4/L7 parameters (e.g., protocol, ports), and the subject binds the filter to the contract, allowing policy enforcement regardless of IP address. This is the only construct that supports EPG-based security policies for intra-VRF microsegmentation.

Exam trap

Cisco often tests the misconception that vzAny or the VRF itself can replace a contract for EPG-to-EPG microsegmentation, but the trap is that vzAny is a global policy object and the VRF is only a routing context—neither provides the granular, EPG-specific permit/deny rules that a contract with filter and subject enforces.

How to eliminate wrong answers

Option B (vzAny) is wrong because vzAny is a special object that represents all endpoints in a VRF, used to apply contracts to all EPGs at once, but it does not enable microsegmentation between specific EPGs based on their membership; it is a shortcut for global policy, not a granular EPG-to-EPG rule. Option C (VRF) is wrong because a VRF is a Layer 3 routing and forwarding domain that isolates traffic at the network layer, but it does not contain security policy constructs; contracts and EPGs are applied within a VRF, not by the VRF itself. Option D (Bridge Domain) is wrong because a Bridge Domain defines a Layer 2 forwarding boundary and subnet configuration, but it has no role in security policy enforcement; microsegmentation is a Layer 3+ policy function handled by contracts, not BDs.

Full explanation →
297
Multi-Selecthard

Which THREE components are required to successfully use NETCONF for configuration automation on a Nexus 9000 switch?

Select 3 answers
A.The NX-API must be enabled as a fallback
B.SSH connectivity must be established to the switch
C.The NETCONF agent must be enabled via 'feature netconf' configuration
D.YANG models must be installed or supported for the target configurations
E.The switch must be running the NX-OS Essentials license
AnswersB, C, D

NETCONF uses SSH as its transport protocol (RFC 6242).

Why this answer

B is correct because NETCONF operates over SSH as its transport protocol (RFC 6242), so SSH connectivity to the switch is mandatory for establishing the NETCONF session. Without SSH, the NETCONF client cannot connect to the NETCONF server running on the Nexus 9000.

Exam trap

Cisco often tests the misconception that NX-API is a prerequisite or fallback for NETCONF, but in reality they are independent automation interfaces with different transport and data encoding methods.

Full explanation →
298
MCQeasy

Which of the following is a benefit of using OpenConfig YANG models for network automation?

A.They replace the need for NETCONF or RESTCONF.
B.They provide a standard, vendor-neutral data model.
C.They only support read-only operations.
D.They are specific to Cisco devices only.
AnswerB

Correct: OpenConfig models are vendor-agnostic.

Why this answer

OpenConfig YANG models are vendor-neutral, allowing consistent configuration across multi-vendor environments.

Full explanation →
299
MCQhard

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

A.It forwards the traffic to the Cisco ISE for policy decision
B.It applies an IP ACL based on the SGT
C.It uses the SGACL to permit HTTP and deny other traffic
D.It drops all traffic between different SGTs unless a contract exists
AnswerC

SGACLs are directly enforced.

Why this answer

SGACLs enforce policy based on SGTs, not IP addresses.

Full explanation →
300
Multi-Selecteasy

A UCS administrator is configuring a service profile for a VMware ESXi host. Which TWO of the following configuration items must be included to enable Fibre Channel SAN boot?

Select 2 answers
A.QoS policy for vHBA
B.WWPN pool for vHBA
C.vNIC with MAC pool
D.FCoE VLAN configuration
E.SAN boot policy with target WWPN
AnswersB, E

A WWPN pool provides the WWPNs for the vHBA that connects to the SAN.

Why this answer

For Fibre Channel SAN boot on a UCS-managed VMware ESXi host, the service profile must include a WWPN pool for the vHBA (Option B) to assign unique World Wide Port Names, and a SAN boot policy specifying the target WWPN (Option E) to define the storage target from which the host boots. These two elements are essential because the vHBA requires a WWPN for fabric login, and the boot policy directs the host to the correct LUN on the SAN.

Exam trap

Cisco often tests the distinction between Fibre Channel SAN boot and FCoE SAN boot, leading candidates to incorrectly select FCoE VLAN configuration (Option D) when the question explicitly states 'Fibre Channel SAN boot' without mentioning FCoE.

Full explanation →
Page 3

Page 4 of 14

Page 5

All pages

1234567891011121314

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

NetworkStorage NetworkAutomationComputeSecurity
See all domains with question counts →