Courseiva

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 301–375

984 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 14

Page 6
301
MCQhard

An organization is deploying a HyperFlex cluster for a database workload requiring low latency and high IOPS. Which node type should be selected?

A.Hybrid HDD/SSD nodes
B.All-flash nodes
C.Compute-only nodes
D.Witness VM nodes
AnswerB

All-flash nodes deliver the best performance for high IOPS and low latency.

Why this answer

All-flash nodes use only SSDs for both caching and persistent storage, delivering the lowest latency and highest IOPS required for demanding database workloads. In a HyperFlex cluster, all-flash configurations eliminate the rotational latency of HDDs, ensuring consistent sub-millisecond response times critical for OLTP databases.

Exam trap

Cisco often tests the misconception that hybrid nodes are sufficient for 'high performance' workloads, but the specific requirement for 'low latency and high IOPS' explicitly demands all-flash nodes to avoid HDD bottlenecks.

How to eliminate wrong answers

Option A is wrong because hybrid HDD/SSD nodes use HDDs for capacity storage, which introduces higher latency and lower IOPS compared to all-flash, making them unsuitable for low-latency database workloads. Option C is wrong because compute-only nodes lack local storage and rely on remote storage from other nodes, adding network latency that defeats the low-latency requirement. Option D is wrong because Witness VM nodes provide only quorum and cluster management functions, not data storage or compute resources, so they cannot contribute to IOPS or latency performance.

Full explanation →
302
MCQeasy

A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?

A.Configure the port connected to the DHCP server as trusted
B.Disable DHCP snooping on the DHCP server VLAN
C.Set the DHCP server IP address in the binding database
D.Enable DHCP snooping on all VLANs
AnswerA

Trusted ports are allowed to forward DHCP server messages, preventing rogue servers.

Why this answer

Configuring the port connected to the DHCP server as trusted is a best practice because DHCP snooping treats all ports as untrusted by default. Only trusted ports are allowed to forward DHCP server messages (OFFER, ACK, NAK), preventing rogue DHCP server attacks. This ensures that only the legitimate DHCP server can assign IP addresses, maintaining network integrity.

Exam trap

Cisco often tests the misconception that enabling DHCP snooping globally or on all VLANs is sufficient for server legitimacy, when the actual requirement is to explicitly configure the server-facing port as trusted.

How to eliminate wrong answers

Option B is wrong because disabling DHCP snooping on the DHCP server VLAN would remove all protection against rogue DHCP servers in that VLAN, defeating the purpose of the feature. Option C is wrong because the binding database is used to store DHCP client lease information (MAC-to-IP bindings), not to designate the DHCP server's IP address; the server is identified by trusted port configuration. Option D is wrong because while enabling DHCP snooping on all VLANs is a common practice, it does not by itself ensure DHCP server legitimacy; the critical step is marking the server-facing port as trusted.

Full explanation →
303
Multi-Selectmedium

A data center engineer is configuring VLANs in a Cisco UCS domain. Which TWO statements are true regarding VLAN configuration?

Select 2 answers
A.VLANs can be created directly within a service profile without prior global definition.
B.VLANs can be created only through the CLI of UCS Manager.
C.Service profiles can override the VLAN ID of a global VLAN definition.
D.Each vNIC must have a native VLAN specified for untagged traffic on that vNIC.
E.VLANs must be defined in the global VLAN database before they can be used in a service profile.
AnswersD, E

A native VLAN is required for untagged frames on a vNIC.

Why this answer

In a Cisco UCS environment, each vNIC must have a native VLAN specified to handle untagged traffic on that interface. The native VLAN is used for traffic that does not have an 802.1Q tag, and it must be explicitly defined in the vNIC configuration within the service profile to ensure proper handling of untagged frames.

Exam trap

Cisco often tests the misconception that VLANs can be created locally within a service profile or that the native VLAN is optional, when in fact it must be explicitly configured for each vNIC to handle untagged traffic correctly.

Full explanation →
304
MCQeasy

Which feature prevents IP spoofing by ensuring that a client uses only the IP address assigned by DHCP?

A.IP Source Guard
B.DHCP snooping
C.Port security
D.Dynamic ARP Inspection
AnswerA

IP Source Guard prevents IP spoofing.

Why this answer

IP Source Guard uses DHCP snooping binding to filter traffic based on source IP and MAC.

Full explanation →
305
MCQeasy

A data center uses VPC between two Nexus switches. Which statement is true about the VPC peer-link?

A.It must be a single link.
B.It carries only control traffic.
C.It is used only for orphan ports.
D.It carries both data and control traffic.
AnswerD

The VPC peer-link is used for both control plane communication (e.g., configuration synchronization) and data plane forwarding (e.g., for orphan ports or traffic requiring cross-peer forwarding).

Why this answer

The VPC peer-link is a critical component in a vPC domain, carrying both data traffic (e.g., traffic from orphan ports or traffic that must traverse the peer-link for forwarding) and control traffic (e.g., vPC keepalive messages and Cisco Fabric Services (CFS) synchronization). This dual role ensures that the two Nexus switches operate as a single logical entity for the downstream devices, providing loop-free Layer 2 multipathing.

Exam trap

Cisco often tests the misconception that the peer-link is only for control traffic, but the trap here is that candidates forget the peer-link also carries data traffic for orphan ports and for forwarding when a vPC member link fails.

How to eliminate wrong answers

Option A is wrong because the peer-link can consist of up to eight physical links bundled into a single port-channel (using LACP or static on), not a single link. Option B is wrong because the peer-link carries both control traffic (e.g., vPC keepalive, CFS) and data traffic (e.g., traffic for orphan ports, multicast, or broadcast frames). Option C is wrong because the peer-link is used for many purposes beyond orphan ports, including forwarding traffic for vPC member ports when the local link fails and synchronizing MAC address tables.

Full explanation →
306
MCQhard

In an FCoE environment, a CNA presents a VN-port to the network. Which protocol is used to establish the virtual link between the VN-port and the FCoE switch's VF-port?

A.ARP
B.FIP
C.LLDP
D.DHCP
AnswerB

FIP handles FCoE virtual link initialization.

Why this answer

FIP (FCoE Initialization Protocol) is used for discovery, login, and virtual link establishment between VN-ports and VF-ports. It replaces FC's fabric login (FLOGI) over Ethernet.

Full explanation →
307
Multi-Selecteasy

Which TWO commands are used on NX-OS to verify vPC status and consistency? (Choose two.)

Select 2 answers
A.show vpc consistency-parameters
B.show port-channel summary
C.show vpc
D.show running-config vpc
E.show vpc role
AnswersA, C

Displays consistency parameters for vPC member ports.

Why this answer

The 'show vpc' command displays the overall vPC status, including peer link and keepalive status, while 'show vpc consistency-parameters' verifies that both peers have matching configurations (e.g., STP, VLAN, MTU) to prevent traffic disruption. These two commands are essential for validating vPC operational health and configuration consistency.

Exam trap

Cisco often tests the distinction between commands that show configuration versus those that show operational status and consistency, leading candidates to mistakenly choose 'show running-config vpc' or 'show vpc role' instead of the correct verification commands.

Full explanation →
308
MCQhard

An engineer is troubleshooting a SAN that uses FCoE. The FCoE Initialization Protocol (FIP) discovery phase is failing for one server. The server is connected to a Cisco Nexus switch configured for FCoE. Which command should be checked first?

A.show vlan fcoe
B.show npv status
C.show dcbx parameters
D.show priority-flow-control
AnswerA

This command shows FCoE VLANs and VSAN mappings, which are critical for FIP.

Why this answer

The FCoE Initialization Protocol (FIP) discovery phase relies on FCoE VLANs being properly configured and active on the switch. The 'show vlan fcoe' command displays the FCoE VLANs and their status, which is the first place to check when FIP discovery fails because the server must be in the correct FCoE VLAN to discover the FCF (FCoE Forwarder). If the FCoE VLAN is missing or not mapped correctly, FIP discovery will fail.

Exam trap

Cisco often tests the distinction between FCoE VLAN configuration (show vlan fcoe) and DCBX/PFC settings, trapping candidates who confuse FIP discovery failures with lossless fabric issues.

How to eliminate wrong answers

Option B is wrong because 'show npv status' is used to verify N_Port Virtualization (NPV) mode, which is relevant only when the switch is operating as an NPV device (e.g., connecting to a core Fibre Channel switch), not for basic FCoE VLAN discovery. Option C is wrong because 'show dcbx parameters' displays Data Center Bridging Exchange (DCBX) parameters like CoS and PFC configurations, which are important for FCoE traffic but do not directly affect FIP discovery phase failures. Option D is wrong because 'show priority-flow-control' shows PFC settings per interface, which ensures lossless behavior for FCoE but is not the first command to check when FIP discovery fails; PFC misconfiguration would cause data corruption or timeouts, not a failure to discover the FCF.

Full explanation →
309
MCQhard

Your company integrates UCS B-Series blades with VMware vSphere using UCS Manager and vCenter. You have configured a UCS service profile with a boot policy that boots from SAN. The virtual infrastructure administrator reports that a new ESXi host (blade 6) fails to meet host profile compliance for the 'Boot Device' policy. The host profile requires the boot LUN to be set to 'VMware LUN' but the UCS boot policy uses a generic 'SAN Target' setting. The ESXi host boots and runs, but compliance checks fail. You cannot modify the host profile because it is managed by a separate team. Which action should you take to resolve the compliance failure while maintaining boot functionality?

A.Create a new vCenter cluster with a different host profile
B.Use a local disk boot policy and install ESXi locally
C.Request the host profile to be updated to accept generic SAN targets
D.Change the UCS boot policy to use the 'VMware LUN' target type and ensure the LUN is presented correctly
AnswerD

Aligns with host profile requirement

Why this answer

The host profile compliance failure is caused by the UCS boot policy using a generic 'SAN Target' type instead of the 'VMware LUN' target type. By changing the boot policy to 'VMware LUN' and ensuring the correct LUN is presented, the ESXi host will boot from the same LUN but now the boot device name will match what the host profile expects, resolving the compliance check without affecting boot functionality.

Exam trap

Cisco often tests the distinction between 'functional boot' and 'compliance check'—candidates may assume that because the host boots fine, no change is needed, but the question explicitly requires resolving the compliance failure while maintaining boot functionality, meaning the boot policy must be adjusted to match the host profile's expected target type.

How to eliminate wrong answers

Option A is wrong because creating a new vCenter cluster with a different host profile does not address the root cause—the mismatch between the UCS boot policy and the existing host profile; it also introduces unnecessary administrative overhead and does not fix the compliance issue for the current host. Option B is wrong because using a local disk boot policy would require a complete reinstallation of ESXi and would change the boot method entirely, which is not required and would break the existing SAN boot configuration; the host profile still expects a specific boot LUN type, not local storage. Option C is wrong because the host profile is managed by a separate team and cannot be modified per the question constraints; requesting a change may be a valid long-term process but is not an immediate action the engineer can take to resolve the compliance failure.

Full explanation →
310
MCQeasy

In a spine-leaf architecture, what is the primary advantage of having multiple spine switches?

A.Redundancy and load balancing
B.Lower latency
C.Simplified management
D.Increased oversubscription
AnswerA

Spines provide multiple paths for redundancy and ECMP.

Why this answer

In a spine-leaf architecture, multiple spine switches provide redundancy by ensuring that if one spine fails, traffic can still flow through other spines. They also enable load balancing because leaf switches can use equal-cost multipath (ECMP) routing to distribute traffic across all available spine uplinks, maximizing bandwidth utilization and preventing congestion on any single path.

Exam trap

Cisco often tests the misconception that multiple spines primarily reduce latency, but the real advantage is redundancy and load balancing through ECMP, not a reduction in per-hop forwarding delay.

How to eliminate wrong answers

Option B is wrong because lower latency is primarily achieved by the single-hop nature of spine-leaf (every leaf is one hop from any spine), not by having multiple spines; adding more spines does not reduce per-hop latency. Option C is wrong because multiple spine switches increase management complexity (more devices to configure, monitor, and troubleshoot), not simplify it. Option D is wrong because increased oversubscription would be a disadvantage, not an advantage; multiple spines actually reduce oversubscription by providing more uplink bandwidth between leaf and spine layers.

Full explanation →
311
MCQmedium

In the context of ACI L3Out, which object is used to advertise external networks into the ACI fabric and is associated with a VRF?

A.Bridge Domain
B.L3Out
C.Contract
D.External EPG
AnswerB

L3Out defines the external connectivity and routing protocol.

Why this answer

In ACI, an L3Out is the logical construct that provides connectivity from the ACI fabric to external Layer 3 networks. It is associated with a VRF to define the routing context, and it is the object under which external networks are advertised into the fabric via route redistribution or static routes. The L3Out contains the external EPGs and the protocol profiles (e.g., OSPF, BGP, EIGRP) that control the advertisement.

Exam trap

Cisco often tests the misconception that an External EPG is the object associated with the VRF for route advertisement, but in reality, the L3Out is the parent object that holds the VRF association and controls the routing protocols.

How to eliminate wrong answers

Option A is wrong because a Bridge Domain is a Layer 2 forwarding construct within a VRF that defines a subnet and flooding scope; it does not advertise external networks into the fabric. Option C is wrong because a Contract is a policy object that defines allowed traffic flows between EPGs, not a routing construct for external network advertisement. Option D is wrong because an External EPG is a child object of an L3Out that represents external subnets or IP prefixes, but it is the L3Out itself that is associated with the VRF and is the primary object used to advertise those networks into the fabric.

Full explanation →
312
MCQhard

A storage administrator is troubleshooting a connectivity issue between a server and a storage array over Fibre Channel. The server is connected to an NPV edge switch, which uplinks to a core switch. The server's WWPN is registered in the zone, but the server cannot see the target. The administrator notices that the core switch does not see the server's WWPN in its FC name server database. What is the most likely cause?

A.The host is using an incorrect FCID
B.The VSAN mismatch between edge and core switches
C.The NPV edge switch does not register host WWPNs in the core fabric's name server; only the NP-port WWPN is registered
D.The zone set is not activated on the edge switch
AnswerC

NPV mode causes the edge switch to proxy the host's login, but the host's WWPN is not registered on the core.

Why this answer

In NPV mode, the edge switch does not propagate WWPNs to the core's name server; instead, the NP-port's WWPN is seen. The core sees the edge switch's NP-port WWPN, not the host's WWPN.

Full explanation →
313
MCQmedium

A network engineer is configuring OSPF on a Nexus switch. To ensure fast convergence in case of a link failure, which OSPF feature should be enabled?

A.OSPF authentication
B.OSPF Fast Hello
C.OSPF stub area
D.OSPF route summarization
AnswerB

Fast Hello allows sub-second hello intervals for faster failure detection.

Why this answer

OSPF Fast Hello (B) is the correct feature to enable for fast convergence on a Nexus switch because it reduces the dead interval to less than one second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF neighbors to detect a link failure much faster than the default 40-second dead interval on broadcast networks, triggering quicker SPF recalculation and route convergence.

Exam trap

Cisco often tests the distinction between features that improve convergence speed (like Fast Hello or BFD) versus features that improve scalability or security (like stub areas, summarization, or authentication), leading candidates to mistakenly choose options that optimize the OSPF database rather than accelerate failure detection.

How to eliminate wrong answers

Option A is wrong because OSPF authentication (MD5 or SHA) provides security by verifying neighbor identity and preventing route injection, but it does not affect convergence speed or failure detection. Option C is wrong because an OSPF stub area reduces the size of the LSDB by blocking Type 5 LSAs and using a default route, which improves scalability and memory usage but does not accelerate failure detection or convergence. Option D is wrong because OSPF route summarization (via area-range commands) reduces routing table size and limits LSA flooding across areas, but it does not directly reduce the time to detect a link failure or trigger SPF recalculation.

Full explanation →
314
MCQmedium

An engineer needs to deploy a stateless UCS B-series blade with a boot from SAN configuration. Which components must be defined in the service profile to achieve this?

A.iSCSI vNIC and IQN
B.vNIC and MAC address
C.vHBA and WWPN
D.Local disk configuration
AnswerC

vHBA with WWPN is required for Fibre Channel boot.

Why this answer

For a stateless UCS B-series blade with boot from SAN, the service profile must define a vHBA (virtual Host Bus Adapter) with a WWPN (World Wide Port Name). The WWPN is used by the SAN fabric to identify the server and present the correct LUN for booting, enabling stateless boot without local storage. iSCSI and MAC addresses are irrelevant for Fibre Channel SAN boot, and local disk configuration is not used in a stateless boot-from-SAN design.

Exam trap

Cisco often tests the distinction between vNIC (Ethernet) and vHBA (Fibre Channel) in boot-from-SAN scenarios, leading candidates to mistakenly choose vNIC and MAC address when the question specifies SAN boot.

How to eliminate wrong answers

Option A is wrong because iSCSI vNIC and IQN are used for iSCSI-based storage, not for Fibre Channel SAN boot; UCS B-series blades typically use Fibre Channel or FCoE for SAN connectivity. Option B is wrong because a vNIC and MAC address are for Ethernet network connectivity, not for SAN boot; boot from SAN requires Fibre Channel identifiers (WWPN) via a vHBA. Option D is wrong because local disk configuration is not needed for a stateless boot-from-SAN deployment; the blade boots entirely from a remote LUN presented over the SAN fabric.

Full explanation →
315
Multi-Selectmedium

Which TWO statements are true regarding VXLAN BUM traffic handling? (Choose two.)

Select 2 answers
A.Ingress replication requires the ingress VTEP to maintain a list of remote VTEPs.
B.Multicast-based replication requires a multicast routing protocol like PIM in the underlay.
C.Ingress replication scales better than multicast in large fabrics.
D.Multicast-based replication uses IGMP snooping to build replication lists.
E.Ingress replication is only supported with OSPF underlay.
AnswersA, B

The ingress VTEP replicates to all known remote VTEPs for the VNI.

Why this answer

In ingress replication, the ingress VTEP must know all remote VTEPs in the VXLAN segment to unicast-encapsulate and send BUM traffic to each one individually. This list is typically learned via the control plane (e.g., BGP EVPN) or statically configured. Without this list, the ingress VTEP cannot replicate BUM frames to the correct remote destinations.

Exam trap

Cisco often tests the misconception that ingress replication scales better than multicast, but the trap is that ingress replication actually consumes more bandwidth and CPU on the ingress VTEP, making it less scalable in large fabrics compared to multicast-based replication.

Full explanation →
316
Multi-Selecteasy

Which TWO of the following are valid methods to configure zoning in a Cisco MDS 9000 series switch?

Select 2 answers
A.IP address zoning
B.MAC address zoning
C.Domain/port (DID) zoning
D.Interface (fc-port) zoning
E.pWWN zoning
AnswersC, E

Uses FC domain ID and port number, another standard method.

Why this answer

C is correct because Domain/Port (DID) zoning uses the Fibre Channel domain ID and port number to identify members, which is a standard zoning method on Cisco MDS switches. DID zoning is configured using the `zone` command with the `domain-id,port-number` syntax, providing a hardware-based zoning approach that does not rely on WWNs.

Exam trap

Cisco often tests the distinction between Fibre Channel zoning methods and Ethernet-based concepts; candidates mistakenly choose IP or MAC zoning because they are familiar with network-layer segmentation, but Fibre Channel zoning operates at the FC-2 layer using WWNs or DIDs.

Full explanation →
317
MCQhard

In a Cisco ACI fabric, a tenant has multiple bridge domains in the same VRF all with 'Unicast Routing' enabled and hardware proxy mode. However, endpoints in different BDs within the same VRF cannot communicate even with a contract. What is a possible reason?

A.The 'L3 Unknown Multicast Flooding' is set to flood.
B.The 'ARP Flooding' is enabled.
C.The contracts are unidirectional.
D.The bridge domains are in different subnets.
AnswerB

In hardware proxy mode, ARP flooding should be disabled to enable proxy ARP. If enabled, the leaf will flood ARP requests and proxy behavior may not function, potentially breaking communication.

Why this answer

When 'Unicast Routing' is enabled on a bridge domain (BD) in hardware proxy mode, the ACI fabric relies on hardware proxy for forwarding. In this mode, ARP flooding should be disabled to prevent excessive flooding and allow the fabric to properly resolve ARP via the COOP database. If 'ARP Flooding' is enabled, the fabric floods ARP requests across all BDs, which can cause ARP resolution to fail for endpoints in different BDs because the hardware proxy expects ARP to be handled differently.

This prevents inter-BD communication even with a contract in place. Therefore, having 'ARP Flooding' enabled is a possible reason for the communication failure.

Exam trap

A common misconception is that 'ARP Flooding' must be enabled to allow endpoint discovery, but in hardware proxy mode with Unicast Routing enabled, ARP Flooding should be disabled to allow the spine proxy to handle ARP resolution for inter-BD communication.

How to eliminate wrong answers

Option A is wrong because 'L3 Unknown Multicast Flooding' set to flood controls how unknown multicast traffic is handled at Layer 3, not ARP or unicast routing between BDs; it does not affect inter-BD unicast communication. Option C is wrong because contracts in ACI are inherently unidirectional by design (a contract provides a direction from provider to consumer), but this does not prevent communication; a contract must be applied correctly with both directions considered, but the issue here is ARP resolution, not contract directionality. Option D is wrong because bridge domains in different subnets are expected for inter-BD routing; the problem is not subnet mismatch but the lack of ARP flooding to resolve endpoints across BDs.

Full explanation →
318
MCQeasy

In a Cisco ACI fabric, which component acts as the centralized policy and management controller?

A.Spine switch
B.APIC
C.DCNM
D.Leaf switch
AnswerB

APIC is the centralized policy controller in ACI.

Why this answer

The APIC (Application Policy Infrastructure Controller) is the centralized policy and management controller in a Cisco ACI fabric. It serves as the single point of configuration, policy definition, and monitoring for the entire fabric, managing all leaf and spine switches through a declarative model. The APIC does not handle data-plane forwarding but orchestrates the application of policies via the OpFlex protocol and the ACI object model.

Exam trap

Cisco often tests the misconception that the spine switch is the central controller because it is the top-level device in the fabric topology, but in reality, the spine is a pure data-plane element with no policy or management role.

How to eliminate wrong answers

Option A is wrong because spine switches in ACI are pure forwarding elements that provide high-speed connectivity between leaf switches and handle east-west traffic; they do not run any centralized policy or management functions. Option C is wrong because DCNM (Data Center Network Manager) is a legacy management tool for traditional NX-OS environments and is not used in ACI; the APIC replaces DCNM for ACI fabric management. Option D is wrong because leaf switches are edge devices that connect servers and enforce policies locally based on instructions from the APIC, but they do not act as the centralized controller.

Full explanation →
319
MCQmedium

A network administrator needs to automate ACI configuration using a Python library that abstracts the APIC REST API. Which library should be used?

A.acitoolkit
B.cisco_nxapi
C.Ansible
D.Cobra SDK
AnswerA

acitoolkit is a Python library for ACI automation.

Why this answer

The acitoolkit is a Python library that provides an abstraction layer over the APIC REST API. Cobra SDK is a lower-level Python SDK. cisco_nxapi is for Nexus, not ACI. Ansible is not a Python library.

Full explanation →
320
MCQeasy

In a VXLAN EVPN fabric, which protocol is used to exchange MAC and IP address reachability information among VTEPs?

A.BGP
B.IS-IS
C.EIGRP
D.OSPF
AnswerA

BGP EVPN is the standard control plane for VXLAN.

Why this answer

In a VXLAN EVPN fabric, BGP (Border Gateway Protocol) is used as the control plane protocol to exchange MAC and IP address reachability information among VTEPs. Specifically, MP-BGP (Multiprotocol BGP) with EVPN address family (AFI L2VPN / SAFI EVPN) carries Type-2 routes (MAC/IP advertisement) to distribute host reachability across the overlay network, enabling efficient MAC learning and ARP suppression.

Exam trap

Cisco often tests the distinction between underlay routing protocols (OSPF, IS-IS, EIGRP) and the overlay control plane (MP-BGP EVPN), leading candidates to mistakenly select an IGP that handles only underlay IP reachability rather than the protocol that actually exchanges MAC/IP information in the overlay.

How to eliminate wrong answers

Option B (IS-IS) is wrong because IS-IS is a link-state IGP used for underlay routing (e.g., IP reachability between VTEPs) but does not carry MAC/IP reachability information in the overlay; EVPN requires MP-BGP for this purpose. Option C (EIGRP) is wrong because EIGRP is a Cisco-proprietary distance-vector IGP that operates only in the underlay and lacks the multiprotocol extensions and EVPN address family needed to exchange MAC/IP routes. Option D (OSPF) is wrong because OSPF is a link-state IGP used for underlay IP routing and cannot transport Layer 2 MAC or host IP information; it does not support the EVPN NLRI or BGP-based control plane required for VXLAN EVPN fabrics.

Full explanation →
321
Multi-Selecteasy

An engineer is troubleshooting a VXLAN network where traffic between two VTEPs in the same VNI is not being forwarded. The underlay network is operational and IP connectivity exists between the VTEPs. Which two actions should the engineer take to verify the VXLAN configuration?

Select 2 answers
A.Verify that the multicast group for BUM traffic is reachable.
B.Verify that the NVE interface is configured with the correct source-interface.
C.Verify that the VXLAN tunnel endpoint IP addresses are in the same subnet.
D.Verify that the VNI is mapped to the correct VLAN on the local VTEP.
E.Verify that the VXLAN routing table is populated correctly.
AnswersB, D

The NVE interface must have a valid source-interface to encapsulate VXLAN packets.

Why this answer

The NVE interface's source-interface (typically a loopback) defines the local VTEP IP address used for VXLAN encapsulation. If this source-interface is misconfigured or not reachable from the remote VTEP, VXLAN packets will not be sourced from the correct IP, breaking traffic forwarding even when underlay IP connectivity exists.

Exam trap

Cisco often tests the misconception that VXLAN requires multicast or that VTEPs must be in the same subnet, but in reality VXLAN operates over a routed underlay and can use unicast or EVPN for BUM traffic.

Full explanation →
322
Multi-Selectmedium

Which TWO of the following are valid methods to run Python scripts on a Cisco Nexus switch? (Choose two.)

Select 2 answers
A.Cobra SDK
B.NX-API REST
C.acitoolkit
D.OnEX
E.Guest Shell
AnswersD, E

Correct: OnEX is a native Python interpreter on NX-OS.

Why this answer

Guest Shell provides a Linux environment for Python, and OnEX is a Python interpreter built into NX-OS.

Full explanation →
323
Multi-Selecthard

Which THREE are valid characteristics of using Terraform for ACI automation? (Choose three.)

Select 3 answers
A.Terraform configuration files are written in HashiCorp Configuration Language (HCL).
B.Terraform can create, update, and delete ACI resources.
C.Terraform uses a state file to track the current state of infrastructure.
D.Terraform follows an imperative approach where you specify steps to achieve configuration.
E.Terraform requires an agent to be installed on the APIC controller.
AnswersA, B, C

Correct. Terraform uses HCL.

Why this answer

Terraform uses a declarative approach, defining desired state. It manages the full lifecycle of infrastructure. It uses HCL for configuration, not JSON.

Terraform state is used to track real-world resources. Terraform is not agent-based; it uses APIs.

Full explanation →
324
Multi-Selectmedium

Which TWO features are commonly used together to prevent IP spoofing on a Nexus switch? (Choose two.)

Select 2 answers
A.VLAN ACL
B.Port Security
C.CoPP
D.DHCP Snooping
E.IP Source Guard
AnswersD, E

DHCP snooping provides the binding database for IP Source Guard and DAI.

Why this answer

DHCP snooping builds a binding database used by IP Source Guard and DAI.

Full explanation →
325
Multi-Selecthard

Which TWO statements about Cisco TrustSec in a data center are true?

Select 2 answers
A.TrustSec can replace 802.1X authentication in the data center.
B.SGTs are 32-bit values assigned to users or devices.
C.SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.
D.TrustSec is primarily designed for wireless networks.
E.TrustSec uses Security Group Tags (SGTs) to enforce access control policies.
AnswersC, E

SXP allows SGT propagation without hardware support.

Why this answer

SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Exam trap

Cisco often tests the distinction between SGT size (16-bit vs 32-bit) and the role of SXP as a propagation mechanism for non-inline devices, leading candidates to confuse SGT values with other metadata or assume TrustSec replaces authentication protocols like 802.1X.

Full explanation →
326
MCQmedium

A data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?

A.permit ip any any deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255 permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
B.permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22 permit ip any any deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
C.permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22 deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255 permit ip any any
D.deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255 permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22 permit ip any any
AnswerC

Correct order: permit specific, deny source, permit rest.

Why this answer

ACLs are processed top-down, and the first match wins. The explicit permit for SSH from the jump host (10.10.1.100) must come before the deny for the entire 10.10.0.0/16 range to ensure the exception is honored. The final permit ip any any allows all other non-management traffic, which is necessary to avoid dropping legitimate traffic on the management interface.

Exam trap

The trap here is that candidates often place the deny rule first, forgetting that ACLs are first-match and that the exception for the jump host must be evaluated before the broader deny rule.

How to eliminate wrong answers

Option A is wrong because the 'permit ip any any' at the top would match all traffic first, including the management traffic that should be denied, making the subsequent deny and permit entries irrelevant. Option B is wrong because the 'permit ip any any' in the middle would match all traffic before the deny rule, again bypassing the intended restriction. Option D is wrong because the 'deny ip 10.10.0.0/16 to 192.168.1.0/24' is placed first, which would block SSH from the jump host (10.10.1.100) before the permit rule for that host is evaluated, violating the requirement to allow SSH from the jump host.

Full explanation →
327
MCQmedium

An organization is deploying Cisco UCS and needs to ensure that server personality is maintained even after a new server is added to the chassis. Which policy should be configured to achieve this?

A.UUID Suffix Pool
B.Maintenance Policy
C.Boot Policy
D.Server Pool Policy
AnswerD

Server pool allows assigning a specific server to a profile, maintaining identity.

Why this answer

The Server Pool Policy is correct because it defines a logical grouping of servers that can be dynamically assigned to service profiles. When a new server is added to the chassis and matches the pool criteria, the policy ensures that the server automatically inherits the correct personality (e.g., UUID, WWN, MAC addresses) from the associated service profile template, maintaining consistency without manual intervention.

Exam trap

Cisco often tests the distinction between policies that manage identity (UUID Suffix Pool) versus policies that manage assignment (Server Pool Policy), leading candidates to confuse the UUID pool as the mechanism for maintaining personality when it is actually the server pool that drives the assignment and inheritance.

How to eliminate wrong answers

Option A is wrong because a UUID Suffix Pool only provides unique UUIDs for server identity but does not control server assignment or personality retention when a new server is added. Option B is wrong because a Maintenance Policy defines how the server handles firmware upgrades or reboots (e.g., user acknowledgment or immediate reboot), not server personality persistence. Option C is wrong because a Boot Policy specifies the boot order and boot parameters (e.g., SAN, local disk, network) but does not manage server assignment or personality inheritance.

Full explanation →
328
MCQmedium

In a spine-leaf architecture, the oversubscription ratio between leaf switches and spine switches is 3:1. Each leaf has 48 x 10G server ports and 4 x 40G uplinks to the spine. What is the oversubscription ratio at the leaf level?

A.1:1
B.4:1
C.2:1
D.3:1
AnswerD

480/160 = 3:1.

Why this answer

The oversubscription ratio at the leaf level is calculated by comparing the total bandwidth of the server-facing ports to the total bandwidth of the uplink ports. Each leaf has 48 x 10G server ports (480 Gbps) and 4 x 40G uplinks (160 Gbps). The ratio is 480:160, which simplifies to 3:1.

This matches the given spine-leaf oversubscription ratio, confirming that the leaf-level ratio is 3:1.

Exam trap

Cisco often tests the distinction between per-port bandwidth and total bandwidth, and the trap here is that candidates might incorrectly calculate the ratio by comparing the number of ports (48:4 = 12:1) instead of the aggregate bandwidth, or they might misinterpret the given 3:1 spine-leaf ratio as the leaf-level ratio without performing the calculation.

How to eliminate wrong answers

Option A is wrong because 1:1 would require the total uplink bandwidth to equal the total server bandwidth (480 Gbps), but the uplinks only provide 160 Gbps. Option B is wrong because 4:1 would imply 640 Gbps of server bandwidth for 160 Gbps of uplink bandwidth, which is not the case here. Option C is wrong because 2:1 would require 320 Gbps of uplink bandwidth, but the actual uplink capacity is only 160 Gbps.

Full explanation →
329
MCQhard

A network engineer needs to automate the configuration of BGP on a Nexus 9000 switch using Ansible. The playbook uses the cisco.nxos.nxos_bgp module. Which of the following parameters is required in the module to specify the local AS number?

A.vrf
B.as_number
C.local_as
D.bgp_as
AnswerC

Correct: 'local_as' is the parameter in nxos_bgp.

Why this answer

The nxos_bgp module requires the 'local_as' parameter to configure the BGP autonomous system number.

Full explanation →
330
MCQeasy

Which Ansible module from the cisco.nxos collection is used to apply a set of CLI commands on a Nexus switch?

A.nxos_vlan
B.nxos_interface
C.nxos_bgp
D.nxos_config
AnswerD

nxos_config applies CLI commands to NX-OS.

Why this answer

nxos_config applies raw CLI commands or configuration snippets. nxos_vlan, nxos_interface, and nxos_bgp are purpose-built for specific features.

Full explanation →
331
MCQeasy

A Cisco UCS C-Series rack server requires remote management with KVM and virtual media. Which feature must be enabled?

A.vMedia
B.CIMC
C.BIOS
D.SOL
AnswerB

CIMC is the base management interface that offers KVM and virtual media.

Why this answer

The Cisco Integrated Management Controller (CIMC) is the dedicated management interface on UCS C-Series rack servers that provides out-of-band remote management capabilities, including KVM console access and virtual media (vMedia) for mounting ISO images. Without CIMC enabled, these remote management features are unavailable, as they rely on its embedded web GUI, CLI, or API.

Exam trap

Cisco often tests the distinction between a feature (vMedia) and the platform that provides it (CIMC), leading candidates to select vMedia as the answer when the question asks which feature must be enabled to support both KVM and virtual media.

How to eliminate wrong answers

Option A is wrong because vMedia is a feature of CIMC that enables virtual media mounting (e.g., ISO, floppy), not a standalone management feature that must be enabled separately. Option C is wrong because the BIOS handles hardware initialization and boot settings, not remote KVM or virtual media services. Option D is wrong because SOL (Serial Over LAN) provides serial console redirection via IPMI, not KVM video or virtual media functionality.

Full explanation →
332
Multi-Selectmedium

A storage engineer is planning an FCoE deployment in a data center. The network must support lossless Ethernet for Fibre Channel traffic. Which three Data Center Bridging (DCB) features are required? (Choose three.)

Select 3 answers
A.Priority Flow Control (PFC)
B.Link Aggregation Control Protocol (LACP)
C.Enhanced Transmission Selection (ETS)
D.Spanning Tree Protocol (STP)
E.Data Center Bridging Exchange (DCBX)
AnswersA, C, E

PFC ensures no frame loss for FCoE traffic.

Why this answer

PFC (Priority Flow Control) provides per-priority pause for lossless transmission. ETS (Enhanced Transmission Selection) allocates bandwidth among traffic classes. DCBX (Data Center Bridging Exchange) allows peers to exchange DCB configuration parameters.

Full explanation →
333
MCQhard

A Cisco MDS switch is configured as an NPV switch to connect to a core switch. Which statement about NPV operation is true?

A.The NPV switch allocates FC IDs to end devices from its own pool.
B.The NPV switch uses FDISC to register multiple N-Port IDs from a single physical link.
C.The NPV switch requires at least one VSAN to be defined as a fabric VSAN.
D.The NPV switch performs fabric login (FLOGI) on behalf of all attached end devices.
AnswerB

NPV uses FDISC to multiplex multiple N-Port IDs over the NP uplink to the core.

Why this answer

In N_Port Virtualization (NPV) mode, a Cisco MDS switch acts as a passthrough device that aggregates multiple end-device N_Ports onto a single uplink to a core Fibre Channel switch. The NPV switch uses the Fabric Discovery (FDISC) protocol to register multiple N_Port IDs (NPIV) from a single physical link, allowing each end device to obtain its own FC ID from the core switch. This is correct because NPV does not assign FC IDs itself but relies on the core switch for fabric login and address assignment.

Exam trap

Cisco often tests the misconception that an NPV switch performs fabric login or assigns FC IDs locally, when in fact it only forwards FLOGI/FDISC requests to the core switch and never allocates addresses itself.

How to eliminate wrong answers

Option A is wrong because an NPV switch does not allocate FC IDs from its own pool; it forwards FLOGI/FDISC requests to the core switch, which assigns FC IDs from the fabric's address space. Option C is wrong because NPV does not require any VSAN to be defined as a fabric VSAN; NPV switches operate in a passthrough mode and do not participate in fabric services like VSAN-based zoning or name server. Option D is wrong because the NPV switch does not perform FLOGI on behalf of end devices; each end device performs its own FLOGI (or FDISC for NPIV) to the core switch, and the NPV switch merely forwards these requests.

Full explanation →
334
MCQmedium

An organization is deploying Cisco ACI in a brownfield data center. They have existing VLANs that need to be mapped to ACI EPGs. The network team notices that some VLANs are used across multiple tenants. How should the engineer design the VLAN pool to support overlapping VLANs?

A.Configure the VLANs as part of the EPG static binding without a pool.
B.Create separate VLAN pools per tenant, each containing the required VLANs.
C.Create one VLAN pool per physical domain and assign tenants to that domain.
D.Create a global VLAN pool with all VLANs and assign it to all tenants.
AnswerB

Each tenant gets its own VLAN pool, allowing reuse.

Why this answer

In Cisco ACI, VLAN pools are scoped to a physical domain, and overlapping VLANs across tenants require separate VLAN pools per tenant. Each tenant's EPG is statically bound to its own VLAN pool, ensuring isolation and preventing VLAN conflicts. This design aligns with ACI's multi-tenant architecture where VLAN IDs must be unique within a domain but can be reused across different domains.

Exam trap

Cisco often tests the misconception that a single VLAN pool can be shared across tenants with overlapping VLANs, but in reality, VLAN pools are domain-scoped and overlapping IDs require separate pools to maintain isolation.

How to eliminate wrong answers

Option A is wrong because EPG static binding without a pool does not support overlapping VLANs; static bindings still require a VLAN pool for encapsulation and cannot bypass the pool's scope. Option C is wrong because creating one VLAN pool per physical domain and assigning multiple tenants to that domain would cause VLAN ID conflicts if the same VLAN is used across tenants, as the pool is shared. Option D is wrong because a global VLAN pool assigned to all tenants would force all tenants to use unique VLAN IDs, preventing overlapping VLANs and violating the requirement.

Full explanation →
335
Multi-Selectmedium

An engineer is deploying iSCSI storage in a data center. Which two features should be configured to improve performance and redundancy? (Choose two.)

Select 2 answers
A.Jumbo frames (MTU 9000)
B.VSAN
C.CHAP authentication
D.FCoE
E.MPIO
AnswersA, E

Jumbo frames improve performance by reducing overhead.

Why this answer

MPIO provides path redundancy and load balancing; jumbo frames reduce CPU overhead and improve throughput.

Full explanation →
336
MCQhard

A UCS Central administrator is creating a global service profile policy that applies to multiple UCS domains. The policy must include boot order settings. What is the recommended approach to ensure consistency across domains?

A.Use UCS Central to create a global boot policy and assign it to service profiles
B.Rely on default boot policy
C.Define the boot order directly in the service profile template
D.Create a local boot policy in each UCS domain
AnswerA

UCS Central can create and distribute global policies.

Why this answer

UCS Central allows creation of global policies that are applied to service profiles in multiple domains, ensuring consistency.

Full explanation →
337
MCQhard

In a VXLAN BGP EVPN fabric, which component is responsible for handling BUM traffic using ingress replication, and how does the VTEP learn the list of remote VTEPs to replicate to?

A.The ingress VTEP learns remote VTEPs via IGMP snooping.
B.The egress VTEP sends unicast copies to all other VTEPs.
C.The ingress VTEP learns remote VTEPs via MP-BGP EVPN Type 3 routes.
D.The spine switch performs replication to all leaf VTEPs.
AnswerC

Type 3 routes advertise VNI and VTEP IP, enabling ingress replication list.

Why this answer

In a VXLAN BGP EVPN fabric, ingress replication is the default method for handling BUM traffic, where the ingress VTEP replicates packets and sends unicast copies to each remote VTEP. The ingress VTEP learns the list of remote VTEPs from MP-BGP EVPN Type 3 routes (Inclusive Multicast routes), which advertise the VNI and the originating VTEP's IP address, allowing the ingress VTEP to build its replication list.

Exam trap

Cisco often tests the misconception that the spine switch performs replication or that IGMP snooping is used for VTEP discovery, when in fact the ingress VTEP uses MP-BGP EVPN Type 3 routes to learn remote VTEPs and handle BUM traffic via ingress replication.

How to eliminate wrong answers

Option A is wrong because IGMP snooping is used for optimizing multicast group membership in Layer 2 networks, not for learning remote VTEPs in an EVPN fabric; VTEP discovery relies on BGP EVPN Type 3 routes. Option B is wrong because egress VTEPs do not send unicast copies to other VTEPs; replication is performed by the ingress VTEP, not the egress. Option D is wrong because the spine switch in a VXLAN EVPN fabric acts as a route reflector and does not perform data-plane replication; replication is handled by the ingress VTEP using ingress replication.

Full explanation →
338
MCQhard

A UCS Manager administrator is deploying a service profile for a boot-from-SAN environment. The SAN switch is configured with NPV mode. The administrator notices that the WWPN of the vHBA in the service profile is not being recognized by the SAN switch. What is the most likely cause?

A.The WWPN pool has been exhausted and the server cannot obtain a new WWPN
B.The vHBA is not bound to a SAN pin-group
C.The vHBA speed is set to auto-negotiation but the SAN switch is set to a fixed speed
D.The upstream SAN switch has NPIV disabled
AnswerD

In NPV mode, the SAN switch requires NPIV on the upstream switch to register the initiator WWPNs.

Why this answer

In a boot-from-SAN environment with NPV mode on the SAN switch, the upstream switch must have NPIV (N_Port ID Virtualization) enabled to allow multiple FCIDs to be assigned to a single physical link. Without NPIV, the upstream switch rejects the WWPN of the vHBA because it cannot support the virtualized N_Port IDs required for the service profile's vHBA to log in. This is the most likely cause of the WWPN not being recognized.

Exam trap

Cisco often tests the distinction between NPV and NPIV, where candidates mistakenly think NPV alone enables virtualized logins, but NPIV must be explicitly enabled on the upstream switch for vHBA WWPNs to be recognized.

How to eliminate wrong answers

Option A is wrong because a WWPN pool exhaustion would prevent a new WWPN from being assigned, but the administrator notes the WWPN is not being recognized by the SAN switch, not that it is unavailable. Option B is wrong because pin-groups are used for fabric failover or path selection in UCS, not for WWPN recognition; a vHBA does not need to be bound to a pin-group to be recognized by the SAN switch. Option C is wrong because speed mismatch between the vHBA and SAN switch would cause link issues or performance degradation, not a failure of the SAN switch to recognize the WWPN; WWPN recognition is independent of negotiated speed.

Full explanation →
339
Multi-Selectmedium

A data center administrator is deploying a HyperFlex cluster and needs to choose between hybrid (HDD+SSD) and all-flash node configurations. Which two factors should be considered when making this decision? (Choose two.)

Select 2 answers
A.Hybrid nodes are more cost-effective for large storage capacities.
B.All-flash nodes provide lower latency for write-intensive workloads.
C.All-flash nodes support higher replication factors than hybrid nodes.
D.Hybrid nodes require more power and cooling than all-flash nodes.
E.Hybrid nodes cannot be used in a cluster with all-flash nodes.
AnswersA, B

HDDs provide lower cost per GB compared to SSDs.

Why this answer

Hybrid nodes offer lower cost per terabyte but lower performance for write-intensive workloads. All-flash nodes provide higher performance and lower latency but at a higher cost. Both support replication factors and clustering.

Full explanation →
340
MCQmedium

Which statement about RSTP (802.1w) is true?

A.RSTP reduces convergence time by using a proposal/agreement handshake
B.RSTP uses a timer-based convergence similar to STP
C.RSTP requires explicit configuration of edge ports to prevent loops
D.RSTP elects the root bridge based on the highest MAC address
AnswerA

The handshake allows rapid transition to forwarding.

Why this answer

RSTP (802.1w) significantly reduces convergence time compared to legacy STP by using a proactive proposal/agreement handshake mechanism. Instead of relying on timers (like STP's 30-50 second convergence), RSTP switches immediately negotiate port roles and transition to forwarding by exchanging proposal and agreement BPDUs, enabling sub-second convergence in a properly designed network.

Exam trap

Cisco often tests the misconception that RSTP eliminates all timers, but the trap here is that RSTP still uses timers (e.g., hello time, forward delay) as a backup mechanism when the handshake fails, such as over half-duplex links or when a switch does not support RSTP.

How to eliminate wrong answers

Option B is wrong because RSTP does not rely on timer-based convergence like STP; it uses the proposal/agreement handshake to achieve rapid convergence, though it still uses timers as a fallback for certain scenarios (e.g., max age for BPDU loss). Option C is wrong because RSTP edge ports (configured with 'spanning-tree portfast') are not required to prevent loops; they are an optimization to immediately transition to forwarding on access ports, but RSTP still prevents loops through its normal operation on non-edge ports. Option D is wrong because RSTP elects the root bridge based on the lowest bridge ID (bridge priority + MAC address), not the highest MAC address; the root bridge is the switch with the smallest bridge ID value.

Full explanation →
341
MCQmedium

A network engineer needs to retrieve the operational state of interfaces from a Nexus switch using a YANG-based protocol. Which protocol should be used to get structured data via REST?

A.NETCONF
B.RESTCONF
C.NX-API CLI
D.SNMP
AnswerB

RESTCONF is RESTful and supports YANG data models.

Why this answer

RESTCONF uses RESTful operations and can return data in JSON or XML over HTTP/HTTPS. NETCONF uses SSH. NX-API CLI returns text.

SNMP is not YANG-based.

Full explanation →
342
MCQeasy

In a UCS 5108 chassis, which component provides the connectivity between the blade servers and the Fabric Interconnects?

A.Midplane
B.IOM (FEX)
C.Chassis management controller
D.Fabric Interconnect
AnswerB

The IOM aggregates traffic from blades to the FIs.

Why this answer

The IOM (Input/Output Module) in the chassis connects to the Fabric Interconnects via server ports and provides connectivity to each blade slot.

Full explanation →
343
MCQhard

A data center administrator is using UCS Central to manage multiple UCS domains. They need to create a global service profile policy that defines the boot order for all blades across domains. What is the correct approach?

A.Define the boot policy as a global policy in UCS Central and associate it with service profiles
B.Use Cisco IMC Supervisor to manage boot policies across domains
C.Create a local boot policy in each UCS Manager and replicate manually
D.Configure the boot policy directly on the blade's CIMC
AnswerA

UCS Central supports global policies that can be used across domains.

Why this answer

UCS Central allows creation of global policies that can be applied across domains. A global boot policy can be defined in UCS Central and then associated with service profiles in different UCS domains.

Full explanation →
344
MCQeasy

Which Fibre Channel addressing component uniquely identifies a port on a storage array and is used for zoning and target identification?

A.FCID
B.WWPN
C.WWN
D.WWNN
AnswerB

WWPN uniquely identifies a Fibre Channel port.

Why this answer

A WWPN (World Wide Port Name) is a globally unique 64-bit identifier assigned to each Fibre Channel port. It is used for zoning and target identification.

Full explanation →
345
MCQmedium

During a network upgrade, an engineer applies a new OSPF configuration on a Nexus 9000 spine. After the change, several leaf switches lose connectivity to each other. The engineer examines the logs and sees OSPF adjacency flapping. What is the most likely cause?

A.Duplicate router IDs.
B.OSPF hello timer mismatch.
C.MTU mismatch on the fabric links.
D.Incorrect area configuration.
AnswerA

Duplicate router IDs cause OSPF neighbors to flap.

Why this answer

Duplicate router IDs cause OSPF adjacency flapping because OSPF uses the Router ID (RID) to uniquely identify each router in the OSPF domain. When two routers share the same RID, they reject each other's Hello packets, leading to repeated adjacency resets. In a Nexus 9000 spine-leaf topology, this often occurs when the spine's RID is accidentally configured to match an existing leaf's RID, disrupting the entire fabric's OSPF convergence.

Exam trap

Cisco often tests the distinction between 'adjacency flapping' (caused by duplicate RIDs or mismatched authentication) and 'failure to form adjacency' (caused by hello/dead timer or MTU mismatches), so candidates mistakenly choose MTU or timer issues when the symptom is flapping rather than non-formation.

How to eliminate wrong answers

Option B is wrong because an OSPF hello timer mismatch prevents adjacency formation entirely (neighbors remain in INIT state), not flapping; flapping implies adjacency is established and then breaks. Option C is wrong because an MTU mismatch on fabric links typically causes OSPF to fail to form adjacency (stuck in EXSTART/EXCHANGE) due to database descriptor packet rejection, not flapping. Option D is wrong because an incorrect area configuration would cause a type mismatch in Hello packets (area ID field), preventing adjacency from forming at all, not causing established adjacencies to flap.

Full explanation →
346
MCQeasy

Which Fibre Channel port type is used to connect two Cisco MDS switches together to form an inter-switch link (ISL)?

A.N-port
B.E-port
C.NP-port
D.F-port
AnswerB

E-port is the correct type for ISL connections.

Why this answer

An E-port (Expansion port) is used for links between Fibre Channel switches to form the fabric.

Full explanation →
347
MCQmedium

An engineer needs to protect the control plane of a Nexus 9000 switch from CPU-targeted attacks. Which feature should be configured?

A.DHCP snooping
B.Port security
C.IP Source Guard
D.CoPP
AnswerD

CoPP polices traffic to the control plane.

Why this answer

Control Plane Policing (CoPP) applies QoS policies to control plane traffic to prevent DoS attacks.

Full explanation →
348
MCQhard

An engineer notices that a UCS server with a service profile using a QoS policy for FC traffic experiences excessive latency during heavy workloads. The Fibre Channel fabric is configured for lossless operation. Which design issue is most likely causing the latency?

A.The MTU on the Ethernet uplink from the FI is set to 1500 bytes.
B.The QoS policy for FC traffic does not allocate enough buffer for the no-drop class.
C.Fibre Channel buffer-to-buffer credit recovery is disabled on the upstream switch.
D.The vHBA is configured for 16 Gbps but the upstream switch port is 8 Gbps.
AnswerB

Insufficient buffer allocation in the no-drop class can cause pause frames and increased latency.

Why this answer

The excessive latency during heavy workloads in a lossless Fibre Channel fabric is most likely due to insufficient buffer allocation for the no-drop class in the QoS policy. In UCS, the no-drop class (typically class-fcoe) must have adequate buffer space to prevent frame drops that trigger retransmissions and latency. Without enough buffer, the switch cannot absorb bursts, leading to congestion and increased latency even though the fabric is lossless.

Exam trap

Cisco often tests the misconception that latency in a lossless fabric is caused by external factors like MTU or speed mismatches, rather than the internal QoS buffer allocation for the no-drop class, which is the critical design parameter for FC traffic in UCS.

How to eliminate wrong answers

Option A is wrong because the MTU on the Ethernet uplink from the FI being set to 1500 bytes would affect jumbo frame support for Ethernet traffic, but Fibre Channel over Ethernet (FCoE) traffic uses a separate encapsulation and is not directly impacted by the Ethernet MTU; the FCoE MTU is typically 2500 bytes and is handled independently. Option C is wrong because Fibre Channel buffer-to-buffer credit recovery is a mechanism to recover lost credits and is not directly related to QoS buffer allocation; disabling it could cause credit starvation but not the specific latency issue described. Option D is wrong because a speed mismatch between the vHBA (16 Gbps) and the upstream switch port (8 Gbps) would cause link negotiation to the lower speed, not excessive latency; the link would operate at 8 Gbps, which might reduce throughput but not inherently cause latency due to buffer exhaustion.

Full explanation →
349
MCQhard

An engineer is troubleshooting a DHCP issue in a data center VLAN. Clients are unable to obtain IP addresses from the DHCP server. The switch has DHCP snooping enabled on the VLAN, and the DHCP server is connected to a trusted port. The clients are on untrusted ports. Which additional security feature is most likely causing the problem if the DHCP server is on a different subnet and the switch is not configured as a DHCP relay?

A.DHCP snooping with no IP helper address configured
B.Dynamic ARP Inspection (DAI)
C.Control Plane Policing (CoPP) dropping DHCP packets
D.Port security with maximum MAC limit
AnswerA

DHCP snooping on untrusted ports drops DHCPOFFER from outside the subnet unless relay is set up.

Why this answer

When the DHCP server resides on a different subnet and the switch lacks an IP helper address (ip helper-address) configuration, DHCP snooping will not forward the DHCP broadcast from the client to the server. DHCP snooping relies on the switch to relay DHCP packets across subnets; without the helper address, the broadcast is dropped at the VLAN interface, preventing clients from obtaining IP addresses.

Exam trap

Cisco often tests the misconception that DHCP snooping alone handles cross-subnet DHCP, when in fact it requires an IP helper address or a dedicated DHCP relay agent to forward broadcasts between subnets.

How to eliminate wrong answers

Option B is wrong because Dynamic ARP Inspection (DAI) validates ARP packets based on DHCP snooping bindings, but it does not affect DHCP packet forwarding between subnets; it only prevents ARP spoofing. Option C is wrong because Control Plane Policing (CoPP) protects the control plane from excessive traffic, but it is not a common cause of DHCP failure in this scenario unless misconfigured to rate-limit DHCP packets, which is less likely than the missing relay. Option D is wrong because port security with a maximum MAC limit restricts the number of MAC addresses on a port, but it does not block DHCP broadcasts or prevent relay across subnets.

Full explanation →
350
MCQeasy

Refer to the exhibit. The interface fc1/1 is configured as an E_port. The connected switch also has an E_port configured. However, the interface shows an 'init' state. What is the most likely cause?

A.The domain ID is not configured on either switch.
B.The speed on the remote switch interface is set to 8000 Mbps.
C.The port VSAN on the local interface is different from the remote.
D.The remote switch interface is not configured as a trunk.
AnswerB

E_ports require matching speed settings to establish a link.

Why this answer

The 'init' state on an E_port indicates that the link is up but the port is still initializing the Exchange Link Parameters (ELP) and Exchange Switch Capabilities (ESC) protocols. If the remote switch interface speed is set to 8000 Mbps (8 Gbps) while the local interface is configured for a different speed (e.g., 4 Gbps or 16 Gbps), the speed negotiation will fail, preventing the E_port from transitioning to the 'online' state. Cisco MDS switches require matching speed settings on both ends of an E_port for successful initialization.

Exam trap

Cisco often tests the distinction between 'init' and 'isolated' states, where candidates mistakenly attribute VSAN mismatch or domain ID issues to 'init', but the correct cause is often a speed mismatch or incompatible port parameters during ELP negotiation.

How to eliminate wrong answers

Option A is wrong because the domain ID is assigned dynamically via the principal switch selection process during fabric formation; an unconfigured domain ID does not prevent E_port initialization but may cause a domain ID conflict later. Option C is wrong because a mismatched port VSAN between local and remote interfaces would cause the port to enter an 'isolated' state, not 'init', as VSAN mismatch is detected after ELP exchange. Option D is wrong because E_ports are inherently trunk ports in Fibre Channel; the concept of a 'trunk' in this context refers to VSAN trunking, which is optional and not required for basic E_port operation.

Full explanation →
351
MCQmedium

An engineer needs to trigger a Python script on a Nexus switch when a specific syslog message appears. Which Cisco technology allows event-driven execution of Python applets?

A.Guest shell
B.OnEX
C.EEM
D.Ansible
AnswerC

EEM can trigger actions based on events like syslog patterns.

Why this answer

EEM (Embedded Event Manager) with Python applets can monitor syslog events and run scripts.

Full explanation →
352
MCQmedium

A UCS domain is configured with multiple service profile templates. An engineer wants to ensure that when a template is updated, all associated service profiles are automatically updated. Which property must be enabled in the template?

A.'Auto update'
B.'Update on deployment'
C.'Enforce consistency'
D.'Synchronize to templates'
AnswerB

When enabled, profiles derived from the template are automatically updated upon template changes.

Why this answer

The 'Update on deployment' property, when enabled in a service profile template, ensures that any changes made to the template are automatically applied to all associated service profiles during the next deployment or re-deployment. This is the correct mechanism in Cisco UCS Manager to propagate template updates to existing service profiles without manual intervention.

Exam trap

Cisco often tests the distinction between 'Update on deployment' and 'Enforce consistency', where candidates may confuse the automatic update mechanism with a compliance-checking policy, leading them to select the wrong option.

How to eliminate wrong answers

Option A is wrong because 'Auto update' is not a valid property in UCS service profile templates; it is a generic term that does not correspond to any specific UCS feature. Option C is wrong because 'Enforce consistency' is a policy used in UCS to validate configuration compliance, not to automatically update service profiles from a template. Option D is wrong because 'Synchronize to templates' is not a real property; the correct direction is from template to service profiles, and this option implies the reverse, which is not supported.

Full explanation →
353
MCQmedium

Refer to the exhibit. A new host is connected to interface fc1/3. It is not appearing in the flogi database. The switch is in NPV mode. What is the most likely reason?

A.The FCID is already allocated.
B.The host's WWPN is already in use by another device.
C.The interface is configured as an NP port.
D.The interface is in a different VSAN than the host's FLOGI.
E.The host's HBA is not compatible with NPV.
AnswerC

An NP port expects connection to a core switch, not a host; thus hosts cannot log in through it.

Why this answer

In NPV mode, a switch operates as a proxy for FLOGI requests, forwarding them upstream to the core switch. For an interface to accept a host FLOGI, it must be configured as an F port. If the interface is configured as an NP port (which is intended for uplink to the core), it will not accept or forward FLOGI frames from the host.

Therefore, the host never appears in the flogi database.

Exam trap

Candidates often misunderstand NPV port roles, incorrectly thinking that an NP port is used for host connections. In reality, NP ports are for upstream links, while host-facing ports must be F ports.

How to eliminate wrong answers

Option A is wrong because an FCID allocation conflict would generate a specific error during FLOGI, but the host is not even appearing in the flogi database, indicating the FLOGI never reached the fabric. Option B is wrong because a duplicate WWPN would cause a login rejection or conflict, but again the host would still attempt FLOGI and appear briefly; the absence from the database suggests no FLOGI was processed. Option D is wrong because VSAN mismatch would cause the FLOGI to be dropped or rejected, but the host would still attempt to send a FLOGI and the interface would show some activity; the complete lack of appearance points to a port-mode issue.

Option E is wrong because HBA compatibility with NPV is not a common restriction; NPV is designed to work with standard Fibre Channel HBAs, and incompatibility would manifest as link issues, not a silent failure to appear in the flogi database.

Full explanation →
354
MCQeasy

Which Cisco UCS feature allows a failed blade server to be replaced with a new one without any reconfiguration, because all identity and configuration information is abstracted?

A.Firmware auto-sync
B.Service profile
C.Fabric failover
D.Dynamic vNIC connection policy
AnswerB

Service profiles provide stateless abstraction.

Why this answer

Stateless computing via service profiles abstracts the blade's identity (MAC, WWPN, UUID) so that replacing the hardware does not require reconfiguration.

Full explanation →
355
MCQmedium

An organization is deploying UCS B-series blades in a 5108 chassis connected to Fabric Interconnects A and B. Each blade has two vNICs. How should the vNICs be connected to the fabric to ensure maximum redundancy and bandwidth?

A.vNIC0 to FI A, vNIC1 to FI A via different ports
B.vNIC0 to FI A, vNIC1 to FI B, both active-active
C.vNIC0 to FI A, vNIC1 to FI B with active-standby
D.Both vNICs connected to Fabric Interconnect A with active-standby failover
AnswerB

Correct. This provides redundancy and load balancing across both fabrics.

Why this answer

For redundancy, vNICs should be connected to separate fabric interconnects (A and B) and active-active failover is recommended.

Full explanation →
356
MCQhard

A data center architect is designing an FCoE deployment. The network must support lossless Ethernet for storage traffic. Which set of IEEE standards must be enabled on the Ethernet switches to meet this requirement?

A.802.3ae (10GbE), 802.3ba (40/100GbE), 802.3by (25GbE)
B.802.1Q (VLAN tagging), 802.1p (CoS), 802.3ad (LACP)
C.802.1X (port security), 802.1AE (MACsec), 802.1AR (secure device identity)
D.802.1Qbb (PFC), 802.1Qaz (ETS, DCBX)
AnswerD

These are the DCB standards that enable lossless Ethernet for FCoE.

Why this answer

FCoE requires lossless Ethernet provided by Priority Flow Control (PFC - 802.1Qbb), Enhanced Transmission Selection (ETS - 802.1Qaz), and Data Center Bridging Exchange (DCBX - 802.1Qaz).

Full explanation →
357
MCQmedium

A UCS administrator wants to apply a consistent set of QoS policies across multiple UCS domains. Which tool should be used to centrally manage these policies?

A.UCS Central
B.UCS Manager
C.CIMC
D.HyperFlex Connect
AnswerA

Correct. UCS Central manages policies globally across domains.

Why this answer

UCS Central provides global policy management across multiple UCS domains, including QoS policies.

Full explanation →
358
MCQmedium

Refer to the exhibit. The interface shows CRC errors. What is the most likely cause of these errors?

A.Insufficient buffer credits for the distance.
B.The port is configured as F port but should be E port.
C.Speed mismatch between the ports.
D.Faulty SFP or fiber cable.
AnswerD

CRC errors are typically caused by signal degradation from hardware.

Why this answer

CRC errors indicate that frames are being received with invalid checksums, which is typically caused by physical-layer issues such as a faulty SFP module or damaged fiber cable. These errors occur when the cyclic redundancy check computed by the receiver does not match the CRC appended by the sender, pointing to corruption during transmission. In Fibre Channel storage networks, a faulty SFP or cable is the most common root cause of CRC errors, as they directly affect signal integrity.

Exam trap

Cisco often tests the distinction between physical-layer errors (CRC, alignment errors) and flow-control issues (buffer credits, credit loss), leading candidates to mistakenly attribute CRC errors to buffer credit problems or port configuration mismatches.

How to eliminate wrong answers

Option A is wrong because insufficient buffer credits cause credit starvation and frame drops, not CRC errors; CRC errors are a physical-layer issue, not a flow-control issue. Option B is wrong because configuring a port as F port instead of E port would cause a port type mismatch and prevent link initialization, not generate CRC errors on an established link. Option C is wrong because a speed mismatch between ports would prevent the link from coming up entirely or cause link flaps, not produce CRC errors on a stable link; CRC errors occur on a link that is already up and passing traffic.

Full explanation →
359
MCQhard

On a Cisco MDS 9700, an engineer configures an FC port channel with 4 member interfaces. The connected storage array also supports port channels. Which load-balancing algorithm provides the best distribution of I/O when the array uses multiple LUNs per target?

A.Source ID (SID) and Destination ID (DID)
B.Source and destination port ID
C.Source FC ID (OXID) and destination FC ID (RXID)
D.Source and destination WWPN
AnswerC

Using exchange IDs (OXID/RXID) provides per-exchange load balancing, spreading I/O across LUNs better.

Why this answer

The OXID (Originator Exchange ID) and RXID (Responder Exchange ID) provide per-exchange granularity, which distributes I/O across all member links in the FC port channel. When multiple LUNs are presented under a single target (same DID), algorithms based on SID/DID or WWPN would hash all traffic to the same link, causing imbalance. The OXID/RXID algorithm ensures that each Fibre Channel exchange (e.g., each SCSI command) can be load-balanced independently, maximizing throughput.

Exam trap

Cisco often tests the distinction between static identifiers (SID, DID, WWPN) and dynamic per-exchange identifiers (OXID/RXID), trapping candidates who assume that any source-destination pair will distribute I/O evenly across a port channel, ignoring the reality of multiple LUNs behind a single target.

How to eliminate wrong answers

Option A is wrong because SID and DID are static identifiers per initiator-target pair; with multiple LUNs under one target, all I/O would hash to the same link, offering no distribution. Option B is wrong because source and destination port IDs (FC port addresses) are also static per fabric login, leading to the same imbalance as SID/DID. Option D is wrong because source and destination WWPNs are globally unique but static per N-port; all traffic between a given initiator and target WWPN would hash to a single link, failing to leverage multiple LUNs for load balancing.

Full explanation →
360
MCQhard

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

A.Assign the 'read-only' role to the user within the tenant.
B.Create a separate VRF for each tenant and assign admin to that VRF.
C.Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.
D.Assign the 'tenant-admin' role to the user globally.
AnswerC

Security domains limit the scope of roles to specific tenants.

Why this answer

Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

Exam trap

Cisco often tests the distinction between network-level segmentation (e.g., VRFs) and administrative-level isolation (e.g., security domains), and the trap here is that candidates mistakenly choose VRF-based isolation for RBAC, not realizing that VRFs only separate data plane traffic, not management access.

How to eliminate wrong answers

Option A is wrong because the 'read-only' role only permits viewing objects, not managing them, so it fails to meet the requirement for a tenant admin to manage their own tenant's objects. Option B is wrong because VRFs (Virtual Routing and Forwarding) are used for network segmentation of traffic, not for RBAC or administrative access control; assigning an admin to a VRF does not restrict their ability to manage objects outside that VRF. Option D is wrong because assigning the 'tenant-admin' role globally grants the user administrative privileges across all tenants, violating the requirement to isolate tenant traffic management to a single tenant.

Full explanation →
361
Matchingmedium

Match each Cisco UCS component to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Unified I/O and management for server chassis

Connects blade servers to fabric interconnects

Virtual interface card supporting multiple adapters

Out-of-band management controller for UCS servers

Enclosure that houses blade servers and IOMs

Why these pairings

The correct matches are: Fabric Interconnect provides network connectivity and management; UCS Manager provides unified management; Blade Chassis houses servers and provides power/cooling. Common confusions include swapping functions with I/O Module or between chassis and interconnect.

Full explanation →
362
MCQmedium

An iSCSI storage array is configured to support multipath I/O (MPIO) for high availability. The administrator needs to configure the initiator to use multiple network paths. What must be ensured for MPIO to work correctly?

A.The initiator must have multiple network interfaces and the storage must support multiple connections to the same LUN.
B.CHAP authentication must be disabled for MPIO.
C.All paths must use the same IP address on the initiator.
D.The storage array must present each LUN with a different LUN ID on each path.
AnswerA

MPIO requires multiple paths from initiator to target.

Why this answer

For MPIO to function, the initiator must have multiple network interfaces and the storage array must present the same LUNs via multiple target portal groups, each accessible via different IP addresses.

Full explanation →
363
Multi-Selectmedium

A data center is implementing iSCSI with MPIO. Which three components are required for MPIO to function? (Choose three.)

Select 3 answers
A.Multiple network interfaces on the initiator
B.CHAP authentication
C.Jumbo frames enabled
D.Multiple iSCSI sessions
E.Multiple target IP addresses (portals)
AnswersA, D, E

Needed to create multiple paths.

Why this answer

MPIO requires multiple network paths between initiator and target, multiple network interfaces (or HBAs) on the initiator, and multiple target portals (IP addresses) on the storage array. A single session cannot leverage MPIO.

Full explanation →
364
Matchingmedium

Match each Cisco NX-OS feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Virtual device context for partitioning a switch

Virtual routing and forwarding for network segmentation

Virtual PortChannel for multi-homing with loop prevention

Fabric Extender for remote linecard connectivity

Power-On Auto Provisioning for zero-touch deployment

Why these pairings

The correct matches are VDC with logical partitioning, VRF with multiple routing tables, FEX with remote line card, and Port Channel with link bundling. Common confusion is between VDC and VRF.

Full explanation →
365
MCQhard

A Nexus 7000 switch is experiencing high CPU utilization due to control plane traffic. The engineer notices that many packets are being punted to the CPU from the data plane, particularly ARP packets. After examining the CoPP configuration, the engineer sees that the 'arp' class-map is matched in a policy-map with a police rate of 1000 pps and a conform-action of 'transmit'. The current ARP rate is 2000 pps. What is the immediate impact?

A.All ARP packets are transmitted normally because the conform-action is 'transmit'.
B.Approximately half of the ARP packets are dropped, reducing CPU load but potentially causing reachability issues.
C.The switch applies an ACL to drop all ARP packets.
D.Packets are marked down and transmitted.
AnswerB

With 2000 pps against 1000 pps limit, half are dropped.

Why this answer

The CoPP policy is configured with a police rate of 1000 pps for ARP packets, but the current ARP rate is 2000 pps. Since the rate exceeds the policer, the conform-action 'transmit' only applies to packets within the rate; excess packets are dropped by default (drop action is implicit when no exceed-action is specified). This results in approximately half of the ARP packets being dropped, which reduces CPU load but can cause ARP resolution failures and reachability issues.

Exam trap

Cisco often tests the implicit default action for excess traffic in CoPP policers—candidates mistakenly assume that only the conform-action matters and that all traffic is transmitted, overlooking that the exceed-action defaults to 'drop' when not explicitly configured.

How to eliminate wrong answers

Option A is wrong because the conform-action 'transmit' only applies to packets that conform to the police rate (1000 pps); packets exceeding the rate are dropped, not transmitted normally. Option C is wrong because CoPP does not apply ACLs to drop packets; it uses a policer within a policy-map to rate-limit traffic, and no ACL is automatically applied to drop all ARP packets. Option D is wrong because the policy-map does not specify a 'markdown' action (such as 'set-dscp' or 'set-cos') or a 'transmit' action for exceed traffic; the default behavior for excess packets is to drop them, not mark and transmit.

Full explanation →
366
MCQmedium

A company uses hard zoning based on World Wide Names (WWNs) to control access between servers and storage arrays. An administrator needs to add a new server with WWPN 50:00:00:00:00:00:01:23 to the zone. What is an advantage of hard zoning over soft zoning?

A.Hard zoning requires less configuration effort.
B.Hard zoning allows devices to communicate across VSANs.
C.Hard zoning is enforced by the switch hardware and provides better security.
D.Hard zoning prevents unauthorized devices from accessing the fabric even if they spoof a WWN.
AnswerC

Hard zoning uses hardware enforcement, preventing traffic from devices not in the zone.

Why this answer

Hard zoning uses the FC address (or WWN) and is enforced by the switch ASIC, providing security even if a device spoofs its WWN? Actually, hard zoning by WWN uses the WWN to assign FC addresses and enforces zoning at the hardware level, while soft zoning relies on name server queries and can be bypassed. Hard zoning provides better security.

Full explanation →
367
MCQmedium

A network engineer is configuring a Cisco UCS service profile for a blade server that must boot from a LUN on a SAN. Which boot policy type should be selected in the service profile?

A.SAN Boot Policy
B.iSCSI Boot Policy
C.LAN Boot Policy
D.Local Disk Boot Policy
AnswerA

SAN boot policy configures boot from Fibre Channel or FCoE storage.

Why this answer

Boot from SAN requires a SAN boot policy that specifies the WWPN of the target storage and the LUN to boot from, typically using a vHBA.

Full explanation →
368
MCQhard

Refer to the exhibit. A server with WWPN 10:00:00:00:c9:2b:1a:5f is zoned to two storage ports in zone Server1_Storage1 and to one storage port in zone Server1_Storage2. The server can access the LUNs through the first zone but not through the second. What is the most likely cause?

A.The second zone does not include the second storage controller's port
B.The storage port 20:00:00:00:c9:2b:1a:6c is in a different VSAN
C.The zone set has not been activated
D.The server is not allowed to be in multiple zones
AnswerA

The server may need both storage paths to access LUNs; missing port causes no path.

Why this answer

The server can access LUNs through zone Server1_Storage1 because both storage ports in that zone are from the same storage controller or are properly configured for multipathing. However, zone Server1_Storage2 contains only one storage port (20:00:00:00:c9:2b:1a:6c), and if that port belongs to a different storage controller that is not zoned with the server's WWPN correctly, or if the second storage controller's port is missing from the zone, the server cannot discover or access LUNs through that path. In Fibre Channel zoning, each zone must include the initiator and at least one target port from the storage controller that owns the LUNs; if the second zone omits the required storage controller port, access fails.

Exam trap

Cisco often tests the misconception that an initiator cannot be in multiple zones, but the real trap is that each zone must include the correct storage controller port that owns the LUNs, not just any storage port.

How to eliminate wrong answers

Option B is wrong because if the storage port 20:00:00:00:c9:2b:1a:6c were in a different VSAN, the server would not be able to see it at all from either zone, yet the server can access LUNs through the first zone, indicating the port is in the same VSAN. Option C is wrong because if the zone set had not been activated, neither zone would work, but the server successfully accesses LUNs through the first zone, proving the zone set is active. Option D is wrong because Cisco MDS/Nexus Fibre Channel switches allow an initiator to be a member of multiple zones simultaneously; this is standard practice for multipathing and is not a restriction.

Full explanation →
369
Multi-Selectmedium

A storage administrator is troubleshooting a Fibre Channel SAN where initiators cannot log in to a target. The administrator verifies that the VSAN is configured correctly and that zoning is in place. Which two additional checks should be performed to resolve the issue?

Select 2 answers
A.Ensure NPIV is enabled on the F-port.
B.Confirm that FCID persistence is not enabled with invalid static FCIDs.
C.Verify that port security is not blocking the initiator WWPN.
D.Verify the FCoE VLAN ID matches on both ends.
E.Check that LUN masking has been applied on the target.
AnswersB, C

Invalid static FCID persistence can cause login failures if the FCID is already in use or conflicting.

Why this answer

In a Fibre Channel SAN, FCID persistence assigns a specific FCID to a device each time it logs in. If an invalid static FCID is configured (e.g., an FCID that conflicts with another device or is outside the allowed range), the initiator may fail to log in because the switch cannot assign the requested address. This is a common cause of login failures even when VSAN and zoning are correctly configured.

Exam trap

Cisco often tests the distinction between fabric-level login issues (like FCID persistence or port security) and storage-level issues (like LUN masking), leading candidates to incorrectly select LUN masking as a cause of login failure.

Full explanation →
370
MCQmedium

A Fibre Channel fabric has multiple initiators and targets. The engineer wants to ensure that only specific hosts can access specific storage volumes. Which zoning practice is most secure?

A.Zoning by storage array aliases
B.Single-initiator zoning with WWPNs
C.Using VSANs instead of zones
D.Soft zoning with domain/port IDs
AnswerB

Correct: Single-initiator zoning is the most secure practice.

Why this answer

Single-initiator zoning with WWPNs is the most secure practice because it creates a one-to-one mapping between a single initiator and its target(s) using the globally unique World Wide Port Name. This eliminates any possibility of unauthorized access or interference from other initiators, as each zone contains exactly one initiator, preventing any form of 'spoofing' or 'zoning overlap' that could allow a rogue host to access storage volumes it should not see.

Exam trap

Cisco often tests the misconception that VSANs alone provide sufficient security, but the trap is that VSANs isolate traffic at the fabric level, not at the device level, so zoning is still required within each VSAN to control which initiators can access which targets.

How to eliminate wrong answers

Option A is wrong because zoning by storage array aliases relies on administrator-defined names that can be duplicated or misconfigured, and it does not enforce the strict isolation of single-initiator zoning; it often groups multiple initiators together, reducing security. Option C is wrong because VSANs provide isolation at the fabric level (Layer 2) but do not replace the need for zones within a VSAN; they separate traffic between different VSANs but within a VSAN, zoning is still required to control access between specific initiators and targets. Option D is wrong because soft zoning with domain/port IDs uses the switch port number (domain,port) which can change if a cable is moved or a device is reconnected to a different port, making it less secure and less stable than WWPN-based hard zoning.

Full explanation →
371
Multi-Selectmedium

A company is planning to deploy Cisco Intersight to manage a hybrid environment including on-premises UCS domains and AWS EC2 instances. Which THREE of the following are required components for integrating AWS with Intersight?

Select 3 answers
A.An Intersight account with appropriate licenses
B.An Intersight Virtual Appliance deployed in AWS
C.A VPN tunnel between the on-premises network and AWS
D.An AWS IAM role with read-write access to EC2 and CloudFormation
E.Network connectivity from Intersight to the AWS public endpoints
AnswersA, D, E

An Intersight account is required to manage devices and use features.

Why this answer

A valid Intersight account with the appropriate licenses (e.g., Intersight Essentials or Premier) is required to enable the AWS integration feature. Without the proper license tier, the Intersight account cannot access the cloud orchestration or management capabilities needed to connect and manage external cloud providers like AWS.

Exam trap

Cisco often tests the misconception that a virtual appliance or VPN tunnel is required for cloud provider integration, but Intersight uses direct API calls over the internet, making network connectivity to AWS public endpoints the only network requirement.

Full explanation →
372
MCQmedium

A server administrator reports that a newly provisioned application server cannot access its LUN on the storage array. The SAN zoning uses WWPNs. The administrator verifies that the server's HBA WWPN is correctly zoned with the storage port's WWPN. Which additional check should the engineer perform to isolate the issue?

A.Confirm that VSAN interop is enabled on the MDS switch
B.Verify that the zone set is activated and that the zones are in the active zone set
C.Ensure that the switch port is configured in F mode and local switching is enabled
D.Check whether FCIP is configured on the storage array
AnswerB

Zone set must be active for zoning to take effect.

Why this answer

Even if the WWPNs are correctly configured in the zone, the zone set must be activated for the zoning to take effect. Without activation, the zone configuration remains in the pending or offline zone set, and the Fibre Channel fabric will not enforce the access controls. The engineer should verify that the zone set is activated and that the zones appear in the active zone set using commands like 'show zoneset active' on the MDS switch.

Exam trap

Cisco often tests the distinction between configuring a zone and activating the zone set, because candidates assume that creating a zone automatically applies it to the fabric.

How to eliminate wrong answers

Option A is wrong because VSAN interop is not a standard feature on MDS switches; VSANs are isolated by default and inter-VSAN routing (IVR) would be needed for communication between VSANs, but this is unrelated to a LUN access issue within the same VSAN. Option C is wrong because switch ports in F mode (fabric port) are used to connect to N-port devices like HBAs, and local switching is enabled by default on MDS switches; neither setting would prevent a correctly zoned HBA from accessing its LUN. Option D is wrong because FCIP is used for extending Fibre Channel over IP networks, not for local SAN connectivity; it is irrelevant to a server accessing its LUN on a directly connected storage array.

Full explanation →
373
MCQhard

A data center uses self-encrypting drives (SEDs) in UCS servers. Which type of protection does SED provide?

A.In-flight encryption for Fibre Channel
B.At-rest encryption on the drive
C.Encryption of SAN traffic
D.Network-level encryption
AnswerB

SEDs encrypt data stored on the drive, protecting it at rest.

Why this answer

SEDs provide at-rest encryption, protecting data when the drive is powered off or removed.

Full explanation →
374
MCQmedium

What does the oversubscription ratio in a spine-leaf fabric represent?

A.Ratio of spine to leaf bandwidth
B.Ratio of server bandwidth to leaf uplink bandwidth
C.Ratio of total fabric bandwidth to total server bandwidth
D.Number of spine switches per leaf
AnswerB

Commonly 3:1 or 4:1.

Why this answer

In a spine-leaf fabric, the oversubscription ratio specifically compares the total bandwidth available from the servers (leaf southbound ports) to the total uplink bandwidth from the leaf to the spine (leaf northbound ports). This ratio determines how much potential congestion exists when multiple servers contend for uplink capacity, directly impacting performance in a non-blocking or oversubscribed design.

Exam trap

Cisco often tests the distinction between oversubscription ratio (server-to-uplink on a leaf) and overall fabric capacity, leading candidates to mistakenly choose the total fabric bandwidth ratio (Option C) instead of the leaf-level server-to-uplink ratio.

How to eliminate wrong answers

Option A is wrong because the ratio of spine to leaf bandwidth is not a defined metric in fabric design; oversubscription focuses on server-to-uplink contention, not spine-to-leaf bandwidth comparison. Option C is wrong because total fabric bandwidth to total server bandwidth is a broader capacity metric, not the oversubscription ratio, which specifically measures leaf-level server vs. uplink bandwidth. Option D is wrong because the number of spine switches per leaf relates to redundancy and path diversity, not bandwidth oversubscription.

Full explanation →
375
MCQmedium

A network engineer is designing a spine-leaf fabric with oversubscription ratio 3:1. Each leaf switch has 48x10G host-facing ports and 4x40G uplinks to spines. What is the oversubscription ratio per leaf?

A.2:1
B.4:1
C.3:1
D.1.2:1
AnswerC

Correct: 480/160 = 3.

Why this answer

The oversubscription ratio per leaf is calculated by dividing the total host-facing bandwidth by the total uplink bandwidth. Each leaf has 48x10G host ports (480G total) and 4x40G uplinks (160G total). 480G / 160G = 3:1, matching the design target.

Exam trap

Cisco often tests the oversubscription calculation by providing port counts and speeds, and the trap here is that candidates may incorrectly sum the uplink bandwidth (e.g., 4x40G = 160G) but then divide host bandwidth by the number of uplinks instead of total uplink bandwidth, or confuse oversubscription with the ratio of host ports to uplink ports.

How to eliminate wrong answers

Option A is wrong because 2:1 would require 240G of uplink bandwidth (e.g., 6x40G), not the 160G provided. Option B is wrong because 4:1 would require only 120G of uplink bandwidth (e.g., 3x40G), which underestimates the actual uplink capacity. Option D is wrong because 1.2:1 would require 400G of uplink bandwidth (e.g., 10x40G), far exceeding the 160G available.

Full explanation →
Page 4

Page 5 of 14

Page 6

All pages

1234567891011121314

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

NetworkStorage NetworkAutomationComputeSecurity
See all domains with question counts →