Knowledge + Practice

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 376–450

984 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Data quality score: 85/100 — Review before indexing

1 error found across 75 questions. This page is set to noindex until issues are resolved.

Page 6 of 14

376

MCQmedium

A network engineer is troubleshooting inter-VLAN routing on a Cisco Nexus 9000 switch. The switch is configured with VLAN 10 and VLAN 20. Hosts in VLAN 10 cannot ping hosts in VLAN 20. The engineer checks the VLAN ACL (VACL) applied to VLAN 10 and finds the following configuration: ip access-list VACL-FILTER 10 permit ip any any ... vlan access-map VACL-MAP 10 match ip address VACL-FILTER action forward vlan filter VACL-MAP vlan-list 10 What is the most likely reason for the connectivity failure?

A.The access-list permits all, so the VACL should work; perhaps the access-map is missing a default action.

B.The 'vlan filter' command is applied to VLAN 10 only, but the access-map is misconfigured.

C.The VACL is applied only to VLAN 10, so traffic from VLAN 20 to VLAN 10 is not filtered, but this should not cause a failure.

D.The VACL does not apply to traffic routed through the SVI; a Router ACL (RACL) must be used instead.

AnswerD

Correct. VACLs are only for Layer 2 bridging. For inter-VLAN routing, apply a RACL on the SVI interface.

Why this answer

VACLs filter traffic at the ingress of a VLAN, but they only apply to traffic that is bridged within the same VLAN. When traffic is routed between VLANs (inter-VLAN routing), it passes through the SVI (Switch Virtual Interface), and VACLs do not inspect routed traffic. To filter inter-VLAN routed traffic, a Router ACL (RACL) must be applied to the SVI.

Since the hosts in VLAN 10 cannot ping VLAN 20, the VACL on VLAN 10 is not blocking the traffic; rather, the traffic is being routed and is not subject to the VACL, so the failure is likely due to a missing or misconfigured RACL or routing issue.

Exam trap

The trap here is that candidates assume VACLs can filter all traffic within a VLAN, including traffic that is routed to another VLAN, but Cisco specifically tests that VACLs only apply to bridged traffic, not to traffic that is routed through an SVI.

How to eliminate wrong answers

Option A is wrong because the access-map does have a default action (the implicit deny at the end of the access-map sequence), and the permit all entry would forward traffic, so the VACL itself is not misconfigured; the issue is that VACLs do not apply to routed traffic. Option B is wrong because applying the filter to VLAN 10 only is correct for filtering traffic entering VLAN 10, but the problem is that inter-VLAN routed traffic bypasses VACL inspection entirely. Option C is wrong because while it correctly notes that traffic from VLAN 20 to VLAN 10 is not filtered by this VACL, the statement that 'this should not cause a failure' is misleading; the actual failure is due to the VACL not applying to routed traffic in either direction, not a one-way filtering issue.

Full explanation →

377

MCQhard

During a UCS firmware upgrade, the upgrade fails on a few servers in a chassis. The administrators notice that the management plane is still responsive, but the data plane is disrupted. What is the most likely cause?

A.The secondary Fabric Interconnect did not synchronize the firmware image before the upgrade.

B.The boot policy was changed during maintenance.

C.The server memory is exhausted due to high traffic.

D.The service profiles were not updated after the upgrade.

AnswerA

Incomplete sync causes differing firmware versions between FIs, leading to data plane issues.

Why this answer

The most likely cause is that the secondary Fabric Interconnect did not synchronize the firmware image before the upgrade. In a UCS domain, firmware upgrades are typically performed in a hitless manner by first upgrading the secondary Fabric Interconnect, which requires the firmware image to be synchronized from the primary. If synchronization fails, the secondary may boot with an incompatible or missing firmware, causing data plane disruption while the management plane remains responsive because the primary still handles management traffic.

Exam trap

Cisco often tests the misconception that a failed upgrade always results in a complete loss of connectivity, but the trap here is that the management plane can remain operational even when the data plane is disrupted due to a firmware synchronization failure on the secondary Fabric Interconnect.

How to eliminate wrong answers

Option B is wrong because changing the boot policy during maintenance would affect the server's boot order or boot parameters, not cause a partial failure where management is up but data plane is down; boot policy changes do not directly impact firmware upgrade synchronization. Option C is wrong because server memory exhaustion due to high traffic would manifest as performance degradation or crashes, not a specific scenario where management plane is responsive and data plane is disrupted after a firmware upgrade; memory exhaustion is unrelated to firmware image synchronization. Option D is wrong because service profiles not being updated after the upgrade would cause configuration mismatches or policy application failures, but the immediate symptom of management plane up and data plane down points to a firmware image synchronization issue on the Fabric Interconnect, not a service profile update problem.

Full explanation →

378

Multi-Selectmedium

Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)

Select 3 answers

A.Control Plane Policing (CoPP)

B.DHCP snooping

C.Port security

D.IP Source Guard

E.Dynamic ARP Inspection (DAI)

AnswersB, D, E

DHCP snooping filters untrusted DHCP messages.

Why this answer

DHCP snooping is a security feature that acts as a firewall between untrusted hosts and DHCP servers. It filters DHCP messages by validating DHCP packets received on untrusted ports, dropping those that are invalid (e.g., DHCP server messages from a client port), and building a DHCP snooping binding database that maps client MAC addresses, IP addresses, VLAN, and port information. This database is then used by other features like IP Source Guard and Dynamic ARP Inspection to prevent IP spoofing and ARP poisoning attacks.

Exam trap

Cisco often tests the distinction between features that directly prevent DHCP-based attacks (DHCP snooping, IP Source Guard, DAI) versus general security features like CoPP or Port security, which address different attack vectors and do not inspect DHCP protocol messages.

Full explanation →

379

MCQhard

In a BGP EVPN deployment, route type 2 (MAC/IP advertisement) is used to advertise MAC addresses. What additional information is carried in route type 2 for IP routing?

A.IP address and route distinguisher

B.IP address and MAC address

C.IP prefix and next-hop

D.MAC address and VNI

AnswerB

Route type 2 contains the MAC address and optionally the IP address for host routing.

Why this answer

In BGP EVPN, route type 2 (MAC/IP Advertisement Route) is used to advertise both MAC addresses and their associated IP addresses. The additional information carried for IP routing is the IP address and the MAC address, enabling the control plane to support both Layer 2 bridging and Layer 3 routing (e.g., host route advertisement for IP-based forwarding). This is defined in RFC 7432, where the route type 2 NLRI includes a MAC address field and an optional IP address field.

Exam trap

Cisco often tests the distinction between route type 2 (MAC/IP advertisement) and route type 5 (IP prefix route), trapping candidates who confuse the IP address field in type 2 with an IP prefix or next-hop information.

How to eliminate wrong answers

Option A is wrong because the route distinguisher (RD) is part of the EVPN NLRI prefix, not an additional field carried specifically for IP routing; it is used to distinguish overlapping IP prefixes across different VRFs. Option C is wrong because route type 2 carries a single IP address (e.g., a /32 host route), not an IP prefix and next-hop; IP prefix and next-hop are associated with route type 5 (IP prefix route). Option D is wrong because while the MAC address and VNI are present in route type 2, the VNI is part of the EVPN NLRI for identifying the broadcast domain, not an additional element for IP routing; the question specifically asks for the additional information carried for IP routing, which is the IP address.

Full explanation →

380

MCQhard

An engineer is implementing CI/CD for network changes. Which tool is commonly used for version control of network configuration files and infrastructure code?

A.Docker

B.Jenkins

C.Git

D.Ansible

AnswerC

Correct: Git is used for version control.

Why this answer

Git is the industry-standard version control system used for managing infrastructure as code, including network configurations.

Full explanation →

381

MCQhard

A HyperFlex cluster is configured with RF3 and has 6 nodes. If one node fails completely, how many nodes are still required to maintain data availability and cluster quorum?

A.3 nodes

B.4 nodes

C.5 nodes

D.6 nodes

AnswerB

Quorum requires >50% of total nodes; with 6 nodes, quorum is 4. After one failure, 5 remain, so quorum is maintained. But if the question meant minimum nodes to keep cluster operational, it's 4 (since 5 > 4). Actually the question is ambiguous: 'still required' could mean after the failure, how many are needed to continue? After 1 failure, 5 are still up, so 5 nodes are operational. But the answer choices are 3,4,5,6. The correct interpretation: with 6 nodes, quorum is 4, so after 1 failure, 5 nodes remain, which is sufficient. But the question might be asking the minimum number of nodes that must remain to avoid quorum loss. That is 4. So answer B is correct.

Why this answer

With RF3, data is available as long as at least one copy remains. However, cluster quorum requires more than half of the nodes to be operational. For a 6-node cluster, quorum is 4 nodes (majority).

After 1 failure, 5 nodes remain, which is >3, so quorum is maintained. However, the minimum to keep data available with RF3 is 3 nodes (since 3 copies exist, losing one still leaves 2). But cluster quorum is the stricter requirement: with 6 nodes, quorum is 4.

So after 1 failure, 5 nodes are still up, satisfying quorum.

Full explanation →

382

MCQeasy

An engineer wants to prevent unauthorized devices from connecting to access ports. Which port security violation mode will disable the port and generate a syslog message?

A.protect

B.shutdown

C.restrict

D.shutdown vlan

AnswerB

Shutdown disables the port and logs the violation.

Why this answer

The 'shutdown' violation mode is the only port security mode that both disables the port (placing it in an err-disabled state) and generates a syslog message when a violation occurs. This mode immediately shuts down the interface upon detecting an unauthorized MAC address, providing both a clear security alert and a physical disconnection of the offending device.

Exam trap

Cisco often tests the distinction between 'shutdown' and 'shutdown vlan' modes, where candidates mistakenly think 'shutdown vlan' disables the entire port, but it only disables the specific VLAN on that port, leaving other VLANs operational.

How to eliminate wrong answers

Option A is wrong because 'protect' mode drops packets from unauthorized MAC addresses but does not disable the port or generate a syslog message, silently discarding traffic. Option C is wrong because 'restrict' mode drops packets from unauthorized MAC addresses and generates a syslog message, but it does not disable the port; the port remains operational. Option D is wrong because 'shutdown vlan' mode disables only the offending VLAN on the port (placing it in an err-disabled state) and generates a syslog message, but it does not shut down the entire physical port, which is required by the question's condition of disabling the port.

Full explanation →

383

MCQmedium

A storage array uses thin provisioning. A volume is created with a virtual size of 1 TB but only 100 GB of physical storage is allocated initially. What happens when the host writes data beyond the currently allocated physical space?

A.The write fails immediately.

B.The array automatically extends the volume by allocating more physical blocks from the pool.

C.The host must reconfigure the volume size.

D.The volume is expanded to 1 TB physical.

AnswerB

Thin provisioning allocates on demand.

Why this answer

Thin provisioning allocates physical storage on demand. Additional storage is allocated from a shared pool as needed. The array may overcommit, but writes succeed as long as pool has free space.

Full explanation →

384

MCQmedium

Refer to the exhibit. A client connected to Ethernet1/2 cannot obtain an IP address via DHCP. What is the most likely cause?

A.The DHCP snooping information option is disabled

B.The DHCP server is on a different VLAN

C.The DHCP snooping trust configuration is missing on the server port

D.IP source guard is enabled on the client port

AnswerC

Without trust, DHCP server messages are dropped on the untrusted port.

Why this answer

The client cannot obtain an IP address via DHCP because the DHCP server port (Ethernet1/1) is not configured as a DHCP snooping trusted port. By default, all ports are untrusted, and DHCP snooping drops all DHCP server responses (OFFER, ACK) received on untrusted ports. Configuring the port connecting to the DHCP server as trusted is required to allow these messages to reach the client.

Exam trap

Cisco often tests the default untrusted state of all ports in DHCP snooping, leading candidates to overlook that the server port must be explicitly trusted, even when the server is on the same VLAN or reachable.

How to eliminate wrong answers

Option A is wrong because disabling the DHCP snooping information option (option 82) would only affect the insertion or removal of relay agent information, not the basic forwarding of DHCP messages; DHCP snooping still operates and drops server responses on untrusted ports. Option B is wrong because a DHCP server on a different VLAN is a common and valid deployment; DHCP snooping does not require the server to be on the same VLAN, and the issue is about trust, not VLAN placement. Option D is wrong because IP source guard (IPSG) filters traffic based on IP-to-MAC bindings after a client obtains an IP address, but it does not prevent the initial DHCP exchange; the client cannot even get an IP address due to DHCP snooping dropping server responses.

Full explanation →

385

MCQhard

A Cisco HyperFlex cluster is experiencing performance issues during peak hours. The cluster uses a 4-node all-flash configuration. The engineer notices that the vSphere DRS cluster is heavily imbalanced. Which HyperFlex feature should be used to improve performance by balancing the storage load across nodes?

A.Enable Storage DRS on the HyperFlex datastore

B.Enable the IOPS-based workload rebalancing feature

C.VM vMotion to move VMs to less busy nodes

D.Adjust the deduplication and compression settings to reduce write amplification

AnswerB

This feature automatically rebalances data across nodes based on IOPS, improving performance.

Why this answer

The IOPS-based workload rebalancing feature in Cisco HyperFlex automatically redistributes storage I/O load across cluster nodes based on real-time IOPS metrics. This directly addresses the performance issue during peak hours by ensuring no single node becomes a storage bottleneck, which is the root cause of the vSphere DRS imbalance in a HyperFlex environment.

Exam trap

Cisco often tests the distinction between compute load balancing (vSphere DRS/VM vMotion) and storage I/O load balancing (HyperFlex IOPS rebalancing), leading candidates to mistakenly choose VM vMotion when the issue is storage-side, not compute-side, contention.

How to eliminate wrong answers

Option A is wrong because Storage DRS operates at the vSphere datastore level and manages VM placement across datastores, not the underlying HyperFlex storage node load; HyperFlex presents a single distributed datastore, making Storage DRS irrelevant for node-level I/O balancing. Option C is wrong because VM vMotion moves VMs between ESXi hosts to balance compute load, but it does not affect the storage I/O distribution across HyperFlex nodes, which is the actual performance bottleneck. Option D is wrong because adjusting deduplication and compression settings reduces write amplification and improves storage efficiency, but it does not dynamically rebalance existing I/O load across nodes during peak hours.

Full explanation →

386

MCQmedium

An engineer configures vPC on a pair of Nexus switches. The vPC peer-keepalive link fails, but the vPC peer-link remains operational. What is the expected behavior?

A.Both switches suspend all vPC member ports to avoid loops.

B.The primary switch reloads to prevent a split-brain scenario.

C.The vPC domain remains operational with both switches forwarding traffic.

D.The secondary switch suspends its vPC member ports.

AnswerC

Keepalive is not critical if peer-link is up; domain stays up.

Why this answer

When the vPC peer-keepalive link fails but the peer-link remains up, the vPC domain continues to operate normally because the peer-link is used for control-plane synchronization and data-plane forwarding. The peer-keepalive is only a secondary heartbeat to detect a dual-active scenario when the peer-link is down. Since the peer-link is still functional, both switches can exchange vPC consistency parameters and forward traffic without risk of loops.

Exam trap

Cisco often tests the misconception that the peer-keepalive is the primary mechanism for loop prevention, when in fact the peer-link is critical for control-plane sync and the peer-keepalive only acts as a backup heartbeat for dual-active detection.

How to eliminate wrong answers

Option A is wrong because vPC member ports are only suspended when the peer-link fails, not when only the peer-keepalive fails; the peer-link ensures loop-free operation. Option B is wrong because the primary switch does not reload; a reload only occurs if the peer-link fails and the secondary switch is configured as the 'bridge assurance' or 'auto-recovery' mechanism, but not for a peer-keepalive failure alone. Option D is wrong because the secondary switch suspends its vPC member ports only if the peer-link fails and it cannot detect the primary via peer-keepalive (dual-active scenario); with the peer-link up, the secondary remains active.

Full explanation →

387

Multi-Selectmedium

Which THREE of the following are valid UCS Manager RBAC roles?

Select 5 answers

A.Storage Administrator

B.Network Administrator

C.UCS Administrator

D.Operations Administrator

E.Server Administrator

AnswersA, B, C, D, E

Storage Administrator is a built-in UCS Manager RBAC role responsible for storage-related configurations.

Why this answer

All five options are built-in RBAC roles in UCS Manager. The roles are: Storage Administrator, Network Administrator, UCS Administrator, Operations Administrator, and Server Administrator. Each role provides specific administrative privileges within the UCS environment.

Exam trap

Candidates might think only three roles are valid, but all five are built-in RBAC roles in UCS Manager. The question may mislead by asking for three, but all options are correct.

How to eliminate wrong answers

Option A is wrong because 'Storage Administrator' is not a valid built-in RBAC role in UCS Manager; the correct role for storage management is 'Storage Administrator' is actually a valid role in some contexts, but in UCS Manager the built-in storage-related role is 'Storage Administrator' is not listed as a default role—the default roles include 'Server Administrator', 'Network Administrator', 'UCS Administrator', and 'Operations Administrator' is also a default role, but the question asks for three valid roles, and 'Storage Administrator' is not a default role in UCS Manager; it is a custom role that can be created but is not one of the predefined roles. Option D is wrong because 'Operations Administrator' is a valid UCS Manager RBAC role, but the question requires selecting exactly three correct options, and since 'Operations Administrator' is indeed a default role, the correct set includes B, C, and E, making D incorrect in this context because it is not among the three correct answers—the trap is that 'Operations Administrator' is a valid role but not one of the three listed as correct in the answer key.

Full explanation →

388

MCQhard

An engineer is configuring PXE boot for a UCS B-series blade. The blade's vNIC is associated with a VLAN that has no IP helper address configured. What is required to allow the blade to obtain an IP address from a DHCP server on a different subnet?

A.Configure a static IP address in the service profile

B.Enable DHCP snooping on the Fabric Interconnect

C.Add an IP helper address on the VLAN interface in the upstream switch

D.Use a local DHCP server on the same VLAN

AnswerC

IP helper relays DHCP broadcasts to the DHCP server.

Why this answer

PXE boot requires DHCP. Without IP helper, broadcast DHCP requests cannot cross subnets. A DHCP relay or IP helper is needed.

Full explanation →

389

MCQmedium

In a VXLAN overlay network, what is the primary purpose of ingress replication for BUM traffic?

A.To reduce the need for ARP suppression

B.To forward broadcast, unknown unicast, and multicast traffic without requiring multicast in the underlay

C.To enable multipathing of BUM traffic across multiple paths

D.To assign VXLAN Network Identifiers (VNIs) to tenant traffic

AnswerB

Ingress replication sends BUM traffic as unicast to each remote VTEP.

Why this answer

Ingress replication is a technique used in VXLAN overlay networks to handle BUM (Broadcast, Unknown unicast, Multicast) traffic without requiring a multicast-enabled underlay. The ingress VTEP (VXLAN Tunnel End Point) replicates the BUM packet and sends a separate unicast copy to each remote VTEP in the same VXLAN Network Identifier (VNI) segment, ensuring all relevant endpoints receive the traffic while relying solely on unicast routing in the underlay.

Exam trap

Cisco often tests the distinction between ingress replication and multicast-based replication, and the trap here is that candidates may confuse ingress replication with ARP suppression or assume it provides multipathing, when in fact it is solely a method to forward BUM traffic without multicast in the underlay.

How to eliminate wrong answers

Option A is wrong because ARP suppression is a separate feature that reduces ARP broadcast traffic by caching IP-to-MAC mappings on the VTEP, not a function of ingress replication. Option C is wrong because ingress replication does not inherently enable multipathing; it simply replicates packets to each remote VTEP, and multipathing for BUM traffic is typically achieved through equal-cost multipath (ECMP) load balancing of the encapsulated unicast packets. Option D is wrong because VNI assignment is a fundamental part of VXLAN configuration that maps tenant traffic to specific overlay segments, independent of how BUM traffic is replicated.

Full explanation →

390

MCQeasy

Which security feature on a Nexus switch prevents a rogue DHCP server from assigning invalid IP addresses to clients?

A.Port Security

B.IP Source Guard

C.DHCP Snooping

D.Dynamic ARP Inspection

AnswerC

DHCP snooping prevents rogue DHCP servers by filtering DHCP messages.

Why this answer

DHCP snooping filters DHCP messages and blocks unauthorized DHCP servers.

Full explanation →

391

MCQmedium

A data center administrator reports that traffic from a specific UCS server is not flowing through the expected Fabric Interconnect (FI) A. The pin group is configured, but traffic is still sent to FI B. What should the administrator check?

A.Verify that the server is associated with the correct service profile.

B.Reboot the Fabric Interconnect.

C.Check if the pin group is deleted.

D.Ensure the vNIC's fabric ID is set to match the pin group's preferred fabric.

AnswerD

The vNIC must have the fabric ID set to force traffic to the desired FI.

Why this answer

The pin group configuration determines which Fabric Interconnect a vNIC should use for upstream traffic. If the vNIC's fabric ID is not set to match the pin group's preferred fabric, the server will ignore the pin group and send traffic to the other FI. Option D is correct because the fabric ID mismatch causes the pin group to be ineffective, and verifying this alignment ensures traffic flows through the expected FI A.

Exam trap

Cisco often tests the subtle distinction between a pin group being configured and the vNIC's fabric ID being misaligned, leading candidates to assume the pin group is automatically applied without checking the vNIC-level fabric assignment.

How to eliminate wrong answers

Option A is wrong because the service profile association controls the server's identity and policies, not the specific fabric path selection for traffic; a correctly associated service profile can still have a vNIC fabric ID mismatch. Option B is wrong because rebooting the Fabric Interconnect is a disruptive action that does not address the configuration mismatch between the vNIC fabric ID and the pin group's preferred fabric. Option C is wrong because the pin group is confirmed to be configured; checking if it is deleted is irrelevant when the issue is that the vNIC is not honoring the existing pin group due to fabric ID mismatch.

Full explanation →

392

MCQmedium

A medium-sized enterprise has a Cisco UCS environment with two Fabric Interconnects (FIs) in a cluster. There are 10 blade servers, each with a VIC 1340 adapter. The SAN consists of two MDS 9148S switches in a VSAN for storage. Each server is configured with two vHBAs (primary and secondary) connecting to the SAN via the FIs. Recently, after a firmware upgrade on the MDS switches, several servers are unable to boot from SAN. The storage administrator confirms that the storage array LUNs are accessible from the MDS switches. The UCS administrator reports that the vHBAs show a 'link down' status on the FI. Which action should be taken to resolve the issue?

A.Reconfigure the vHBAs on the UCS Manager with new WWPNs.

B.Check the storage array LUN masking and re-apply LUN access.

C.Verify the active zone set on the MDS switches and re-activate it if necessary.

D.Downgrade the MDS firmware to the previous version.

AnswerC

Firmware upgrade may deactivate the zone set.

Why this answer

The 'link down' status on the vHBAs indicates that the Fibre Channel fabric is not properly delivering the FLOGI (Fabric Login) response to the initiators. Since the storage LUNs are accessible from the MDS switches, the issue is likely that the active zone set was deactivated or not saved after the firmware upgrade, preventing the vHBAs from logging into the fabric. Re-activating the zone set on the MDS switches will re-establish the FC zones and allow the vHBAs to complete FLOGI and resume boot from SAN.

Exam trap

Cisco often tests the distinction between storage array LUN masking (target-side) and FC fabric zoning (switch-side); the trap here is that candidates assume a 'link down' on the vHBA must be a physical or HBA configuration issue, when in fact it is a fabric-level problem caused by missing or inactive zone sets after a switch upgrade.

How to eliminate wrong answers

Option A is wrong because changing WWPNs would require re-zoning and re-masking on both the MDS and storage array, and the problem is not related to WWPN exhaustion or duplication. Option B is wrong because the storage administrator confirmed LUNs are accessible from the MDS, so LUN masking is already correct; the issue is at the FC fabric layer, not the storage array. Option D is wrong because downgrading firmware is a disruptive workaround that does not address the root cause (zone set activation state), and the problem is likely a configuration persistence issue after upgrade, not a firmware bug.

Full explanation →

393

MCQeasy

A data center network engineer wants to encrypt all traffic between two top-of-rack (ToR) switches that are connected via a direct link. The encryption should be transparent to upper-layer protocols and operate at Layer 2. Which technology should be used?

A.MACsec (802.1AE)

B.IPsec VPN

C.MKA (MACsec Key Agreement)

D.TLS/SSL

AnswerA

MACsec encrypts at Layer 2, ideal for direct links.

Why this answer

MACsec (802.1AE) is the correct choice because it provides hop-by-hop encryption at Layer 2, encrypting the entire Ethernet frame (excluding the source/destination MAC and VLAN tag) to secure traffic between two directly connected switches. It operates transparently to upper-layer protocols (Layer 3 and above) and requires no IP-level configuration, making it ideal for encrypting a direct link between ToR switches.

Exam trap

Cisco often tests the distinction between the encryption protocol (MACsec/802.1AE) and its key management protocol (MKA), leading candidates to mistakenly select MKA as the encryption technology.

How to eliminate wrong answers

Option B (IPsec VPN) is wrong because it operates at Layer 3 (network layer) and requires IP routing, which adds overhead and is not transparent to upper-layer protocols; it is designed for site-to-site or remote-access VPNs, not for direct Layer 2 link encryption. Option C (MKA - MACsec Key Agreement) is wrong because MKA is the key management protocol used to establish and maintain MACsec keys (as defined in 802.1X-2010), not the encryption technology itself; it is a component of MACsec, not a standalone encryption solution. Option D (TLS/SSL) is wrong because it operates at Layer 4 (transport layer) and is used to encrypt application-layer traffic (e.g., HTTPS), not Layer 2 frames; it requires TCP sessions and is not suitable for transparent link encryption between switches.

Full explanation →

394

MCQhard

A Python script uses NX-API's XML output to extract interface status. Which method is most robust and recommended for parsing the XML?

A.Split the string by tags

B.Use regular expressions to find patterns

C.Use BeautifulSoup

D.Use xml.etree.ElementTree

AnswerD

ElementTree is built-in and efficient for XML parsing.

Why this answer

xml.etree.ElementTree is the recommended method because it is part of Python's standard library, provides robust tree-based parsing that handles XML namespaces and nested structures correctly, and is specifically designed for programmatic XML manipulation. For NX-API XML output, which follows a consistent schema, ElementTree allows reliable extraction of interface status using XPath or tag traversal without fragility.

Exam trap

Cisco often tests the distinction between built-in vs. third-party libraries and between string manipulation vs. proper parsing, leading candidates to choose BeautifulSoup (which is overkill and non-standard for XML) or regex (which seems flexible but is technically incorrect for XML).

How to eliminate wrong answers

Option A is wrong because splitting by tags is brittle and fails if the XML contains whitespace, attributes, or nested elements; it cannot handle the structured hierarchy of NX-API responses. Option B is wrong because regular expressions are not designed for parsing XML's nested tree structure and will break on attribute order changes, CDATA sections, or escaped characters, leading to incorrect or incomplete data extraction. Option C is wrong because BeautifulSoup is a third-party library primarily for HTML parsing and requires additional installation, whereas the exam expects a built-in, lightweight solution for XML parsing in automation scripts.

Full explanation →

395

MCQhard

A UCS C-series server is deployed in a standalone environment. The administrator needs to update the server's firmware remotely. Which CIMC feature should be used?

A.Virtual KVM

B.Firmware Update page in CIMC

C.Virtual Media

D.UCS Manager

AnswerB

CIMC has a dedicated Firmware Update page for remote update.

Why this answer

CIMC provides remote firmware update capability through its web interface or CLI.

Full explanation →

396

MCQeasy

A network engineer is configuring a VPC peer-link on a Nexus switch. Which interface configuration is required for the peer-link port-channel?

A.switchport mode trunk

B.spanning-tree port type edge trunk

C.switchport mode access

D.no switchport

AnswerA

Trunk mode allows multiple VLANs to traverse the peer-link.

Why this answer

A VPC peer-link is a special port-channel that carries control traffic (e.g., Cisco Fabric Services over Ethernet) and data traffic between VPC peer switches. It must be configured as a trunk (switchport mode trunk) to allow multiple VLANs, including the VPC VLAN and the peer-keepalive link VLAN, to traverse the link. Without trunk mode, the peer-link cannot properly forward the necessary VLAN traffic for VPC operation.

Exam trap

Cisco often tests the distinction between a VPC peer-link (which must be a Layer 2 trunk) and a VPC peer-keepalive link (which is a Layer 3 routed link), causing candidates to confuse the two and incorrectly apply 'no switchport' to the peer-link.

How to eliminate wrong answers

Option B is wrong because 'spanning-tree port type edge trunk' is used for access ports connected to end hosts to enable PortFast and BPDU guard, not for a VPC peer-link which is a core infrastructure link that should use a normal spanning-tree port type (e.g., network or normal). Option C is wrong because 'switchport mode access' restricts the interface to a single VLAN, which would prevent the peer-link from carrying the multiple VLANs required for VPC data and control traffic. Option D is wrong because 'no switchport' places the interface into routed (Layer 3) mode, but a VPC peer-link must operate at Layer 2 to forward VLAN-tagged frames between the VPC peers.

Full explanation →

397

MCQmedium

Which statement is true about the VLANs carried on a VPC peer-link?

A.The peer-link carries only the VLANs allowed on the member interfaces.

B.The peer-link carries all VLANs that are allowed on the trunk interface.

C.The peer-link requires spanning-tree port type edge trunk configuration.

D.The peer-link must be configured as a layer 3 interface.

AnswerB

The peer-link is a trunk that can carry any VLAN allowed on it.

Why this answer

In a vPC domain, the peer-link is a special trunk that carries all VLANs allowed on the trunk interface, including those not present on any member port. This ensures that orphaned traffic (traffic arriving on the peer-link destined for a device connected to the other vPC peer) can be forwarded correctly. The peer-link must carry all VLANs to maintain Layer 2 connectivity and loop-free behavior without relying on spanning tree.

Exam trap

Cisco often tests the misconception that the peer-link only carries VLANs present on member ports, when in fact it must carry all VLANs allowed on the trunk to support orphan port traffic and maintain vPC loop-free operation.

How to eliminate wrong answers

Option A is wrong because the peer-link carries all VLANs allowed on the trunk interface, not only those allowed on the member interfaces; restricting VLANs would break traffic for orphan ports. Option C is wrong because the peer-link does not require spanning-tree port type edge trunk; it typically uses a regular trunk with spanning-tree BPDU filtering or guard enabled, but edge trunk is not a requirement. Option D is wrong because the peer-link must be a Layer 2 trunk interface, not a Layer 3 interface, as it carries VLAN traffic between vPC peers.

Full explanation →

398

MCQhard

A data center administrator is implementing FCoE on a Cisco UCS fabric. The converged network adapters (CNAs) must communicate with the Fibre Channel storage array via the FCoE forwarder. Which FCoE port type is used on the CNA to connect to the FCoE forwarder?

A.VE-port

B.VN-port

C.VF-port

D.E-port

AnswerB

VN-port is the virtual N-port on the CNA, connected to a VF-port on the FCoE switch.

Why this answer

VN-port (Virtual N-port) is the FCoE equivalent of an FC N-port, used by the CNA to connect to the FCoE switch's VF-port (Virtual F-port).

Full explanation →

399

MCQmedium

Which UCS C-Series management mode allows the server to be managed as part of a UCS domain using service profiles, while still retaining the ability to use CIMC for direct out-of-band management?

A.Intersight Managed mode

B.UCS Managed mode

C.Direct Connect mode

D.Cisco IMC Supervisor mode

AnswerB

Correct. The server is managed by UCS Manager with CIMC retained.

Why this answer

When a C-series server is adopted into UCS Manager, it can use service profiles but also retains its CIMC for direct management. This is the managed mode, as opposed to standalone (CIMC-only) mode.

Full explanation →

400

MCQeasy

Which command is used to verify the OSPF neighbor state in NX-OS?

A.show ospf neighbors

B.show ip ospf neighbors

C.show running-config ospf

D.show ip route ospf

AnswerB

Correct command.

Why this answer

In NX-OS, the correct command to verify OSPF neighbor state is 'show ip ospf neighbors'. This command displays the OSPF neighbor table, including neighbor ID, priority, state (e.g., FULL, 2WAY), and dead timer. The 'ip' keyword is mandatory in NX-OS to specify the IPv4 address family, distinguishing it from other protocols like OSPFv3 for IPv6.

Exam trap

Cisco often tests the exact syntax difference between IOS and NX-OS, where NX-OS requires the 'ip' keyword in OSPF commands (e.g., 'show ip ospf neighbors' vs. the IOS-compatible 'show ip ospf neighbor'), and candidates mistakenly use the IOS-style command without the 'ip' keyword.

How to eliminate wrong answers

Option A is wrong because 'show ospf neighbors' is not a valid command in NX-OS; it lacks the required 'ip' keyword and will result in an error. Option C is wrong because 'show running-config ospf' displays the OSPF configuration, not neighbor states; it shows parameters like router-id, network types, and area assignments, but not dynamic neighbor adjacency information. Option D is wrong because 'show ip route ospf' displays the OSPF-learned routes in the routing table, not neighbor states; it shows prefixes and next-hop information, not the adjacency status of OSPF neighbors.

Full explanation →

401

MCQmedium

A data center engineer is deploying a new application on Cisco UCS Manager. The application requires consistent low-latency access to storage. The engineer decides to use SAN boot from a Fibre Channel SAN. Which configuration change is necessary on the UCS service profile to enable SAN boot?

A.Enable VIF (Virtual Interface) on the vHBA

B.Configure a QoS policy for the vHBA

C.Set the vNIC to use dynamic MAC address

D.Assign a persistent WWPN to the vHBA

AnswerD

Persistent WWPN ensures the SAN target recognizes the server.

Why this answer

To enable SAN boot from a Fibre Channel SAN, the UCS service profile must assign a persistent WWPN to the vHBA. The WWPN is used by the Fibre Channel fabric to identify the initiator and to zone the storage LUNs; a persistent WWPN ensures that after a server reboot or vHBA reconfiguration, the same WWPN is presented to the SAN, allowing the boot LUN to remain accessible. Without a persistent WWPN, the vHBA would use a dynamically generated WWPN, which would break the SAN zoning and boot path.

Exam trap

Cisco often tests the distinction between vNIC (Ethernet) and vHBA (Fibre Channel) configurations, and the trap here is that candidates confuse MAC address persistence (for vNICs) with WWPN persistence (for vHBAs), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because VIF (Virtual Interface) is a concept related to FCoE (Fibre Channel over Ethernet) and is not required for SAN boot over native Fibre Channel; enabling VIF on the vHBA is not a necessary configuration for SAN boot. Option B is wrong because a QoS policy for the vHBA controls traffic prioritization and bandwidth, but it does not affect the ability to boot from a SAN; QoS is optional and unrelated to SAN boot functionality. Option C is wrong because setting the vNIC to use a dynamic MAC address is relevant for Ethernet networking, not for Fibre Channel SAN boot; the vNIC is used for IP/Ethernet traffic, while SAN boot relies on the vHBA and its WWPN.

Full explanation →

402

MCQeasy

Which Fibre Channel address component uniquely identifies a port within a fabric and is assigned during fabric login (FLOGI)?

A.WWNN

B.FCID

C.Domain ID

D.WWPN

AnswerB

FCID is dynamically assigned during FLOGI.

Why this answer

The FCID (Fibre Channel ID) is a 24-bit address assigned by the switch upon FLOGI. It consists of Domain, Area, and Port fields. WWPN is a permanent identifier, not assigned dynamically.

Full explanation →

403

MCQeasy

Which statement describes how firmware management works for UCS B-Series blade servers?

A.Firmware must be manually upgraded on each blade individually

B.Firmware is managed through host firmware packages in service profiles

C.Firmware is automatically updated via Cisco TAC

D.Firmware is stored on the fabric interconnect and loaded directly to the server

AnswerB

Host firmware packages define the firmware versions for each server

Why this answer

In Cisco UCS Manager, firmware for B-Series blade servers is managed through host firmware packages that are included in service profiles. These packages define the exact firmware versions for components like the BIOS, adapter, storage controller, and CIMC, and are automatically applied to the blade when the service profile is associated. This ensures consistent firmware levels across blades without manual intervention on each server.

Exam trap

Cisco often tests the misconception that firmware is applied directly from the fabric interconnect, when in fact it is staged locally on the blade and applied during reboot, and that manual per-blade updates are required in UCS Manager, which is incorrect due to the service profile abstraction.

How to eliminate wrong answers

Option A is wrong because firmware is not manually upgraded on each blade individually; UCS Manager automates firmware updates via service profile associations and host firmware packages. Option C is wrong because firmware is not automatically updated via Cisco TAC; TAC provides support but does not push firmware updates, and updates are initiated by the administrator through UCS Manager or Intersight. Option D is wrong because firmware is not stored on the fabric interconnect and loaded directly to the server; firmware images are stored in the UCS Manager repository and are applied to the blade's local storage or adapter memory during the boot process, not streamed directly from the FI.

Full explanation →

404

Multi-Selectmedium

An engineer is configuring FCoE on a Cisco Nexus switch. Which two components are required for FCoE initialization? (Choose two.)

Select 2 answers

A.Fibre Channel Security Protocol (FC-SP)

B.VN-port (Virtual N-port)

C.Enhanced Transmission Selection (ETS)

D.FCoE Initialization Protocol (FIP)

E.VF-port (Virtual F-port)

AnswersB, D

VN-port is the switch side virtual port that connects to the host's VN-port.

Why this answer

FIP is used to discover and initialize FCoE devices, and VN-ports are the virtual FC ports on the switch that connect to VN-ports on the host.

Full explanation →

405

MCQhard

A network administrator is configuring copp (Control Plane Policing) on a Cisco Nexus 9300 to protect the control plane from high-rate traffic. After applying the policy, the switch becomes unresponsive to SSH sessions, but ICMP still works. What is the most likely misconfiguration?

A.The control plane rate limit is set too low because the switch has many interfaces.

B.CoPP is not supported on the Nexus 9300 platform.

C.The default action of the policy-map is to drop traffic not explicitly matched.

D.In the class-map for SSH, the 'match' statement is incorrectly configured, causing SSH traffic to fall under a drop class.

AnswerD

If SSH traffic is not matched or falls into a drop class, SSH would be blocked.

Why this answer

If the class-map for SSH traffic uses an incorrect match statement (e.g., matching on the wrong protocol or port), SSH packets will not be classified into the intended permit class. Instead, they fall through to a default drop class in the policy-map, causing SSH sessions to fail while ICMP (which may be matched by a different class or the default permit action) still works. CoPP relies on precise class-map matching; a misconfiguration here directly explains the selective loss of SSH access.

Exam trap

Cisco often tests the nuance that CoPP policy-maps have an implicit 'permit' default unless a 'class class-default' with a drop action is explicitly configured, leading candidates to incorrectly assume a default drop is the cause when the real issue is a misclassification in the class-map.

How to eliminate wrong answers

Option A is wrong because a low rate limit would affect all control-plane traffic, not just SSH; ICMP would also be impacted, and the symptom is SSH failure with ICMP working. Option B is wrong because CoPP is fully supported on Nexus 9300 switches running NX-OS, and this is a standard feature for control-plane protection. Option C is wrong because the default action in a CoPP policy-map is to permit traffic not explicitly matched (unless a 'class class-default' with a drop action is configured); a default drop would affect all unmatched traffic, including ICMP, which contradicts the symptom that ICMP still works.

Full explanation →

406

MCQmedium

A network engineer wants to automate the configuration of VLANs on a Nexus 9000 switch using REST-based APIs. Which approach should be used to send NX-OS commands via HTTP/HTTPS in JSON format?

A.Guest Shell

B.NX-API REST

C.NETCONF

D.NX-API CLI

AnswerB

NX-API REST uses XML/JSON over HTTP/HTTPS for configuration.

Why this answer

NX-API REST supports XML or JSON over HTTP/HTTPS and allows configuration via RESTful operations. NX-API CLI sends CLI commands over HTTP, not REST. Guest Shell runs bash scripts.

NETCONF uses XML over SSH.

Full explanation →

407

MCQeasy

Which HyperFlex replication factor ensures that data is stored on at least three nodes, providing higher data protection?

A.RF1

B.RF2

C.RF3

D.RF4

AnswerC

RF3 stores three copies, protecting against two node failures.

Why this answer

Replication Factor 3 (RF3) stores three copies of data across the cluster, offering protection against two concurrent node failures.

Full explanation →

408

MCQmedium

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

A.Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.

B.Disable vPC on both switches and reconfigure the port channels.

C.Reconfigure the vPC domain with a lower priority on the secondary switch.

D.Increase the vPC peer-keepalive hold timeout to 5 seconds.

AnswerA

A dedicated keepalive link ensures reliable communication and prevents split-brain.

Why this answer

When the vPC peer link fails, the peer-keepalive link is used by the secondary switch to detect that the primary is still alive and to avoid becoming the primary (which would cause a split-brain scenario). Using a dedicated management interface or a separate VRF ensures the keepalive messages are isolated from the data plane and remain reachable even if the peer link goes down, allowing the secondary to correctly keep its vPC member ports in a suspended state and maintain convergence.

Exam trap

Cisco often tests the misconception that the peer-keepalive link is only for role negotiation during normal operation, when in fact it is critical for preventing split-brain during peer-link failures, and candidates may overlook the need for its isolation from the data plane.

How to eliminate wrong answers

Option B is wrong because disabling vPC and reconfiguring port channels is a disruptive, manual process that does not address the keepalive failure and would cause unnecessary downtime; vPC convergence relies on the keepalive link to prevent split-brain, not on reconfiguration. Option C is wrong because changing the vPC domain priority on the secondary switch does not affect the keepalive link's functionality; priority determines the role (primary/secondary) but does not fix a failing keepalive path. Option D is wrong because increasing the hold timeout to 5 seconds only delays the detection of a keepalive failure, potentially prolonging a split-brain scenario; it does not ensure the keepalive link is reliable or isolated.

Full explanation →

409

MCQhard

An engineer is designing a SAN to connect hosts to two storage arrays for redundancy. The hosts are dual-attached to two MDS switches. Each storage array has two controllers, each with a single FC port. The engineer wants to avoid a single point of failure and ensure that each host can reach both storage controllers. Which design should be used?

A.Connect both HBAs of each host to the same switch, and create zones that include both HBAs and both storage ports.

B.Connect each host HBA to a separate switch, and zone each HBA to one storage controller port.

C.Use NPV mode to simplify connectivity.

D.Connect each host HBA to a different switch, and zone each HBA to a specific storage controller, using zones that cross VSANs.

E.Connect each host HBA to a different switch, and zone each HBA to both storage controller ports.

AnswerE

This provides redundant paths at every layer: HBA, switch, and controller.

Why this answer

It provides full redundancy: each host HBA connects to a different MDS switch, and each HBA is zoned to both storage controller ports. This ensures that if a switch, HBA, or storage controller fails, the host can still reach at least one storage controller via the remaining path. The dual-zoning per HBA allows each host to access both controllers without a single point of failure, meeting the requirement for host-to-controller reachability.

Exam trap

Cisco often tests the misconception that connecting both HBAs to the same switch is acceptable for redundancy, but the trap here is that a single switch failure would cause complete loss of connectivity, so each HBA must be on a different switch to eliminate that single point of failure.

How to eliminate wrong answers

Option A is wrong because connecting both HBAs of each host to the same switch creates a single point of failure at the switch level; if that switch fails, the host loses all connectivity. Option B is wrong because zoning each HBA to only one storage controller port means that if that specific controller port fails, the host cannot reach the other controller, violating the requirement for full redundancy. Option C is wrong because NPV (N_Port Virtualization) mode is used to simplify Fibre Channel fabric connectivity by reducing domain IDs, but it does not address the zoning or redundancy requirements for host-to-controller access.

Option D is wrong because zoning across VSANs is unnecessary and adds complexity; VSANs are used for isolation, not for providing redundant paths, and this design does not ensure each host can reach both storage controllers.

Full explanation →

410

Multi-Selectmedium

An engineer is tuning performance for a storage network. Which two practices improve FC SAN performance?

Select 2 answers

A.Disabling flow control.

B.Using single-initiator zoning.

C.Ensuring adequate buffer credits.

D.Enabling broadcast zoning.

E.Setting fabric login timeout to the maximum.

AnswersB, C

Reduces inter-initiator traffic.

Why this answer

Single-initiator zoning (Option B) reduces inter-switch link (ISL) traffic and prevents fabric-wide disruptions by ensuring that only one initiator can communicate with a specific set of target ports. This minimizes the number of Registered State Change Notifications (RSCNs) and simplifies troubleshooting, directly improving FC SAN performance by reducing control-plane overhead.

Exam trap

Cisco often tests the misconception that disabling flow control improves performance by reducing overhead, but in FC SANs, flow control (BB_Credit) is mandatory for lossless operation, and disabling it causes frame drops and retransmissions.

Full explanation →

411

MCQmedium

In VXLAN overlay networks, which mechanism is used to forward broadcast, unknown unicast, and multicast (BUM) traffic when multicast is not enabled in the underlay?

A.Head-end replication

B.Egress replication

C.Ingress replication

D.Multicast replication

AnswerC

Ingress replication sends a copy of the BUM frame to each remote VTEP as unicast VXLAN packets.

Why this answer

In VXLAN overlay networks, when multicast is not enabled in the underlay, ingress replication is used to forward BUM traffic. With ingress replication, the source VTEP (ingress node) replicates the BUM packet and sends a separate unicast-encapsulated copy to each remote VTEP in the VXLAN segment. This avoids reliance on underlay multicast trees, making it suitable for networks that do not support multicast routing.

Exam trap

Cisco often tests the distinction between 'ingress replication' and 'head-end replication'—the trap is that candidates confuse the generic concept of head-end replication with the specific VXLAN term 'ingress replication', leading them to select the less precise option.

How to eliminate wrong answers

Option A is wrong because head-end replication is a generic term that can describe any replication performed at the source, but in VXLAN the specific standardized term for this mechanism when multicast is disabled is 'ingress replication', not 'head-end replication'. Option B is wrong because egress replication would imply the destination VTEP performs replication, which is not how VXLAN BUM handling works; replication is always performed at the ingress VTEP. Option D is wrong because multicast replication relies on underlay multicast (e.g., PIM) to distribute BUM traffic, which is explicitly not enabled in this scenario.

Full explanation →

412

MCQeasy

A data center administrator needs to deploy a new blade server in a Cisco UCS chassis. The server must automatically inherit the correct service profile based on its slot location. Which feature should be configured?

A.Static service profile association

B.Qualifier-based service profile association

C.Service profile template with pool

D.Default service profile

AnswerB

Uses server attributes like slot ID to automatically map a profile, enabling zero-touch deployment.

Why this answer

Qualifier-based service profile association allows a service profile to be automatically applied to a blade server based on its slot location within the UCS chassis. This is achieved by configuring a qualifier that matches the chassis ID and slot number, enabling automatic inheritance without manual intervention.

Exam trap

The trap here is that candidates often confuse qualifier-based association with static association or service profile templates, mistakenly thinking that a template alone can automatically assign profiles based on location without a qualifier.

How to eliminate wrong answers

Option A is wrong because static service profile association requires manual assignment of a service profile to a specific server and does not support automatic inheritance based on slot location. Option C is wrong because a service profile template with pool is used for creating service profiles from a template with a pool of names or UUIDs, but it does not automatically associate profiles based on slot location. Option D is wrong because a default service profile is a fallback profile applied when no other profile is associated, but it is not designed to match specific slot locations for automatic inheritance.

Full explanation →

413

MCQhard

A large enterprise is using Cisco UCS Manager to manage a chassis with 8 B-Series blades. The environment uses a combination of Ethernet and Fibre Channel traffic. The UCS fabric interconnect (FI) is configured in end-host mode with two uplinks to the core network. Recently, the engineering team deployed a new service profile for a high-performance computing workload that requires 40Gbps Ethernet per vNIC and 16Gbps Fibre Channel per vHBA. The server has two vNICs and two vHBAs. After deployment, the server's OS shows only 10Gbps connectivity on each vNIC. The engineer checks UCS Manager and sees that the vNIC templates are set to '10 Gbps' and the vHBA templates are set to '16 Gbps' but the actual link speed for vNICs is only 10Gbps. The fabric interconnect ports are configured as 40Gbps uplinks. The engineer has verified that the server adapter supports 40Gbps. What is the most likely cause of the speed mismatch?

A.The fabric interconnect uplinks are configured as 40Gbps, but the port channel is not configured correctly, causing speed negotiation to fail.

B.The vNIC template used in the service profile specifies a requested speed of '10 Gbps' instead of '40 Gbps'.

C.The server's adapter policy is set to 'Windows' mode, which limits Ethernet speeds to 10Gbps.

D.The QoS policy applied to the vNIC limits the bandwidth to 10Gbps.

AnswerB

The vNIC template's speed setting determines the allocated speed; it must be set to 40Gbps.

Why this answer

The vNIC template in the service profile defines the requested speed for the virtual NIC. If the template is set to '10 Gbps', the UCS Manager will allocate only 10 Gbps of bandwidth per vNIC, regardless of the physical adapter's capability or the uplink speed. Since the engineer verified the adapter supports 40 Gbps and the uplinks are 40 Gbps, the mismatch is directly caused by the template configuration.

Exam trap

Cisco often tests the misconception that the physical adapter or uplink speed automatically determines the vNIC speed, when in fact the vNIC template's requested speed is the controlling parameter in UCS Manager.

How to eliminate wrong answers

Option A is wrong because the fabric interconnect uplinks are configured as 40 Gbps and the issue is not related to port channel misconfiguration; speed negotiation for vNICs is independent of uplink port channels. Option C is wrong because the server adapter policy (e.g., 'Windows' mode) does not limit Ethernet speeds to 10 Gbps; it affects driver behavior and failover settings, not link speed. Option D is wrong because a QoS policy applied to a vNIC can shape or limit bandwidth, but the question states the vNIC templates are set to '10 Gbps', and the OS shows 10 Gbps connectivity; QoS policies typically enforce maximum bandwidth after the link is established, not the negotiated link speed.

Full explanation →

414

Multi-Selecteasy

Which TWO characteristics are true about Cisco VPC? (Choose two)

Select 2 answers

A.VPC allows dual-homing of a server to two different switches.

B.VPC keepalive uses Layer 2 connectivity.

C.VPC requires a dedicated management VLAN.

D.VPC peer-link can be a single link or EtherChannel.

E.VPC member ports can be on different VLANs on each peer.

AnswersA, D

VPC enables a server to connect to two switches simultaneously, treating them as a single logical node.

Why this answer

Cisco Virtual PortChannel (vPC) allows a server to be dual-homed to two different switches, enabling active-active load balancing and link redundancy. This is achieved by making the two switches appear as a single logical switch to the downstream device using the vPC protocol, which synchronizes state and forwarding information across the peer link.

Exam trap

Cisco often tests the misconception that vPC keepalive uses Layer 2 connectivity, when in fact it requires Layer 3 reachability, and that vPC member ports can have mismatched VLANs, which is not allowed because the VLAN configuration must be consistent across both peers for the vPC to operate correctly.

Full explanation →

415

Multi-Selecthard

An organization uses synchronous replication between two storage arrays for disaster recovery. Which three characteristics apply to synchronous replication? (Choose three.)

Select 3 answers

A.It requires less bandwidth than asynchronous replication.

B.Write acknowledgment is sent only after data is written to both arrays.

C.It increases write latency compared to asynchronous replication.

D.It is suitable for long-distance links with high latency.

E.It provides zero Recovery Point Objective (RPO).

AnswersB, C, E

This ensures data consistency.

Why this answer

Synchronous replication writes data to both primary and secondary arrays before acknowledging the write. This ensures zero RPO and minimal data loss, but increases write latency due to the round trip. It is typically used over short distances.

Full explanation →

416

MCQhard

A HyperFlex cluster uses RF2 and consists of 5 nodes. One node fails. Data is re-replicated to the remaining nodes. After re-replication, what is the largest number of additional node failures that can occur without data loss?

A.0

B.2

C.1

D.3

AnswerC

RF2 allows one failure; after re-replication, still one.

Why this answer

With RF2 (two copies), the cluster can tolerate one failure. After a failure and re-replication, the cluster has 4 nodes. If one more node fails, data might still be available if the surviving node holds a copy.

However, with RF2, a second failure could lead to data loss if both copies are lost. The maximum tolerable is one additional failure, because with two failures, some data may have only one copy left (if the second failure affects the only remaining copy). Actually, with RF2, you can tolerate one failure.

After re-replication, same tolerance: one more failure. So answer is 1.

Full explanation →

417

MCQmedium

An engineer is deploying a UCS B-Series blade server and needs to configure connectivity to the SAN. Which component is responsible for the physical connection between the blade and the Fabric Interconnect?

A.Mezzanine adapter on the blade

B.I/O Module (IOM) in the chassis

C.Fabric Extender (FEX) on the Fabric Interconnect

D.Cisco Integrated Management Controller (CIMC)

AnswerB

The IOM provides the physical uplink to the Fabric Interconnect.

Why this answer

The I/O Module (IOM) in the UCS chassis connects blade servers to the Fabric Interconnects via server ports.

Full explanation →

418

MCQhard

A network engineer is troubleshooting CoPP drops on a Cisco Nexus 9000 switch. The 'show control-plane' output indicates that packets are being dropped due to 'CoPP' on the 'default' control-plane class. Which action is most likely to resolve the issue without affecting routing protocol stability?

A.Disable CoPP globally to allow all control-plane traffic.

B.Increase the policer rate for the 'default' class in the CoPP policy.

C.Modify the class-map to reclassify the dropped packets to a higher priority class.

D.Increase the ingress buffer size on the control-plane interface.

AnswerB

Raising the policer rate allows more packets to pass, reducing drops.

Why this answer

The 'default' class in a CoPP policy catches all control-plane traffic not explicitly matched by higher-priority classes. Drops in this class indicate that the aggregate policer rate for unmatched traffic is too low. Increasing the policer rate for the 'default' class allows more legitimate control-plane packets (e.g., ARP, BFD, or management traffic) to pass without impacting the dedicated policers for critical protocols like OSPF or BGP, thus preserving routing stability.

Exam trap

Cisco often tests the misconception that all CoPP drops indicate a need to reclassify traffic to a higher priority class, when in fact the 'default' class drop is a classic sign of an undersized catch-all policer that simply needs a rate adjustment.

How to eliminate wrong answers

Option A is wrong because disabling CoPP globally removes all control-plane protection, exposing the CPU to DoS attacks and potentially causing routing instability from excessive traffic. Option C is wrong because reclassifying dropped packets to a higher priority class would bypass the intended CoPP hierarchy, potentially starving critical protocol traffic and violating the principle of least privilege. Option D is wrong because the control-plane interface does not have a configurable ingress buffer; buffer tuning applies to data-plane interfaces, not to the control-plane policing mechanism.

Full explanation →

419

Multi-Selectmedium

A network engineer is planning a VXLAN EVPN fabric. Which two statements about VXLAN Network Identifiers (VNIs) are correct? (Choose two.)

Select 2 answers

A.VXLAN encapsulates Layer 2 frames in UDP packets

B.VNI values range from 1 to 4096

C.VNI is a 24-bit field in the VXLAN header

D.VXLAN uses TCP for encapsulation

E.VNI is used only for Layer 3 routing

AnswersA, C

VXLAN uses MAC-in-UDP encapsulation.

Why this answer

VXLAN encapsulates Layer 2 Ethernet frames inside UDP packets (typically UDP destination port 4789). This allows Layer 2 segments to be extended over a Layer 3 IP network, which is the fundamental purpose of VXLAN in a data center fabric.

Exam trap

Cisco often tests the VNI range (24-bit vs. 12-bit VLAN ID) to catch candidates who confuse VXLAN VNIs with traditional VLAN IDs.

Full explanation →

420

MCQhard

An engineer is designing an NPV deployment to scale the number of hosts connected to a Fibre Channel fabric. In NPV mode, which port type is used on the NPV switch to connect to the core switch?

A.VN_port

B.E_port

C.F_port

D.NP_port

AnswerD

NP_port is the upstream port on an NPV switch that connects to a core switch's F_port.

Why this answer

In NPV mode, the edge switch uses NP_ports to connect to the core switch's F_ports. NP_ports behave like N_ports and log in to the core fabric.

Full explanation →

421

MCQeasy

A new storage administrator is configuring LUN masking on a Cisco MDS switch. The storage array presents two LUNs to the fabric with the same LUN ID (0) but to different target ports. The administrator wants to ensure that a specific host can access both LUNs. The host is connected to a single HBA port. The host will see both target ports in the same zone. After zoning, the host discovers both target ports but only sees the first LUN. The show flogi database shows the host's pWWN with two FC IDs assigned. What is the most likely issue?

A.The zone is misconfigured

B.The host is not configured for multipathing

C.There is a LUN ID conflict

D.The target LUNs are not masked to the host's pWWN

AnswerD

The storage array likely has LUN masking that only allows the first LUN for this host.

Why this answer

The host discovers both target ports via FLOGI but only sees the first LUN because the storage array has not been configured to mask the LUNs to the host's pWWN. LUN masking is an array-side access control that determines which initiator WWNs can see which LUNs; without it, the array defaults to presenting only the first LUN (LUN 0) to any initiator. The zone is correctly configured (both target ports are in the same zone and the host sees them), and the LUN ID conflict is irrelevant because the LUNs are on different target ports, so they can share the same LUN ID without conflict.

Exam trap

Cisco often tests the distinction between zoning (fabric-level connectivity) and LUN masking (array-level access control), trapping candidates who assume zoning alone grants LUN visibility.

How to eliminate wrong answers

Option A is wrong because the zone is correctly configured: the host discovers both target ports, proving the zone includes both target ports and the host's pWWN. Option B is wrong because multipathing is a host-side driver configuration that affects path failover and load balancing, not the visibility of LUNs; the host already sees both target ports, so multipathing would not cause one LUN to be hidden. Option C is wrong because a LUN ID conflict occurs when two LUNs with the same ID are presented to the same initiator from the same target port, but here the LUNs are on different target ports, so sharing LUN ID 0 is allowed and does not cause one LUN to disappear.

Full explanation →

422

Multi-Selectmedium

A storage administrator is configuring Fibre Channel zoning on a Cisco MDS switch to restrict access between initiators and targets. Which two statements about hard zoning vs. soft zoning are true? (Choose two.)

Select 2 answers

A.Hard zoning uses the Fibre Channel name server to restrict access.

B.Both hard and soft zoning require the active zone set to be configured.

C.Hard zoning provides security against WWPN spoofing.

D.Soft zoning enforces access at the hardware level.

E.Soft zoning can be bypassed by a device that directly addresses another device.

AnswersC, E

Hard zoning uses hardware-based ACLs that filter by port or WWN, making it harder to spoof.

Why this answer

Hard zoning uses hardware ACLs to enforce access at the port level, providing security against WWPN spoofing. Soft zoning relies on the name server to filter responses, but a device can still attempt to communicate; it is less secure.

Full explanation →

423

MCQhard

Which VXLAN EVPN route type is used for discovering VTEPs and building the BUM forwarding tree?

A.Type 1

B.Type 3

C.Type 2

D.Type 5

AnswerB

Inclusive Multicast Ethernet Tag.

Why this answer

B is correct because VXLAN EVPN Route Type 3 (Inclusive Multicast Ethernet Tag Route) is specifically used to advertise the VXLAN tunnel endpoint (VTEP) IP addresses and the VNI (VXLAN Network Identifier) for BUM (Broadcast, Unknown unicast, Multicast) traffic. This route type enables the discovery of remote VTEPs and builds the multicast forwarding tree (either via ingress replication or PIM-based multicast) necessary for BUM traffic delivery in a VXLAN EVPN fabric.

Exam trap

Cisco often tests the distinction between Route Type 2 (MAC/IP advertisement) and Route Type 3 (BUM tree), so the trap here is that candidates mistakenly associate MAC address learning (Type 2) with VTEP discovery, when in fact Type 3 is the dedicated route for building the BUM forwarding tree and discovering remote VTEPs for broadcast and unknown traffic.

How to eliminate wrong answers

Option A is wrong because Route Type 1 (Ethernet Auto-Discovery Route) is used for redundancy and fast convergence (e.g., advertising ESI labels for multihoming), not for VTEP discovery or BUM tree building. Option C is wrong because Route Type 2 (MAC/IP Advertisement Route) advertises MAC addresses and host IPs along with their VTEP and VNI mappings, but it does not handle BUM forwarding tree construction. Option D is wrong because Route Type 5 (IP Prefix Route) is used for advertising external IP prefixes (e.g., from a WAN or data center interconnect) and is not involved in VTEP discovery or BUM traffic handling.

Full explanation →

424

MCQmedium

Refer to the exhibit. An administrator connects a new server to Ethernet1/1 and the port immediately goes into errdisable state. The previous device was connected to that port. What is the most likely cause?

A.The new server has a different MAC address than the sticky MAC

B.The port security violation mode is set to protect

C.The port security maximum MAC addresses is set too high

D.The port is configured as a trunk

AnswerA

Sticky MAC learned the previous server's MAC; new server's MAC is different, causing a violation and port shutdown.

Why this answer

The port immediately entering errdisable state upon connecting a new server indicates a port security violation. When port security is enabled with sticky MAC addresses, the switch dynamically learns and 'sticks' the MAC address of the first connected device to the running configuration. Connecting a device with a different MAC address triggers a security violation, and if the violation mode is 'shutdown' (the default), the port is placed into errdisable state.

This matches the scenario where the previous device's MAC was learned as sticky, and the new server's MAC differs.

Exam trap

Cisco often tests the misconception that any port security violation immediately causes errdisable, but the trap here is that only the 'shutdown' and 'restrict' modes can lead to errdisable (restrict does not errdisable but logs and drops), while 'protect' silently drops traffic without disabling the port.

How to eliminate wrong answers

Option B is wrong because the 'protect' violation mode drops packets from unknown MAC addresses but does not place the port into errdisable state; it simply discards traffic without disabling the port. Option C is wrong because setting the maximum MAC addresses too high would allow more MAC addresses than intended, but it would not cause an immediate errdisable state upon connecting a new device; a violation occurs only when the limit is exceeded, not when a single new MAC appears. Option D is wrong because configuring the port as a trunk does not inherently cause errdisable; trunk ports can carry multiple VLANs and are not directly related to port security violations unless combined with other features like DTP misconfiguration.

Full explanation →

425

Multi-Selectmedium

Which TWO benefits does NPIV (N_Port ID Virtualization) provide in a Fibre Channel SAN? (Choose two.)

Select 2 answers

A.Enhances security by isolating traffic at the port level

B.Enables Fibre Channel connectivity for virtual machines

C.Increases throughput by aggregating bandwidth

D.Allows multiple VSANs on a single link

E.Reduces the number of physical ports needed for virtualized servers

AnswersB, E

Correct: VMs can have dedicated WWPNs.

Why this answer

NPIV allows a single physical N_Port to register multiple N_Port IDs (FCIDs) with the Fibre Channel fabric. This enables each virtual machine on a virtualized server to have its own unique WWN and FCID, providing direct Fibre Channel connectivity to storage without requiring a dedicated physical HBA per VM. By sharing a single physical port among multiple VMs, NPIV reduces the number of physical ports and HBAs needed in virtualized environments.

Exam trap

Cisco often tests NPIV alongside VSAN trunking and port channels, so the trap here is confusing NPIV's ability to assign multiple FCIDs per port with VSAN trunking or bandwidth aggregation, leading candidates to incorrectly select options about multiple VSANs or increased throughput.

Full explanation →

426

Multi-Selectmedium

Which two statements about the Cisco NX-API REST interface are true? (Choose two.)

Select 2 answers

A.It only supports GET operations.

B.It can be used to send CLI commands.

C.It requires the use of YANG models.

D.It supports both XML and JSON message formats.

E.It uses SSH for transport.

AnswersB, D

NX-API CLI allows sending CLI commands.

Why this answer

NX-API REST supports JSON and XML over HTTP/HTTPS, and can be used to send CLI commands (via NX-API CLI) as well as structured data.

Full explanation →

427

MCQmedium

A developer wants to run a Python script directly on a Nexus switch to automate local operations. Which feature allows executing a Python script in a Linux environment on the switch?

A.NX-API

B.EEM with Python applet

C.OnEX

D.Guest Shell

AnswerD

Guest Shell provides a bash shell environment for running Python scripts.

Why this answer

Guest Shell provides a secure Linux environment on Nexus switches where Python scripts can run. EEM with Python applets runs scripts triggered by events. OnEX is not a standard feature.

NX-API is for remote API access.

Full explanation →

428

MCQeasy

In a VXLAN environment, what is the function of a VTEP?

A.It manages the VXLAN multicast groups

B.It encapsulates and decapsulates VXLAN packets

C.It acts as a DHCP server for tenant VMs

D.It provides Layer 3 routing between VXLAN segments

AnswerB

VTEP is responsible for VXLAN encapsulation/decapsulation.

Why this answer

A VTEP (VXLAN Tunnel Endpoint) is the device that performs VXLAN encapsulation and decapsulation. It takes an original Layer 2 frame, adds a VXLAN header (with a VNI to identify the tenant segment), a UDP header (port 4789), and an outer IP/Ethernet header, then sends the packet over the underlay network. On the receiving side, the VTEP strips these headers and forwards the original frame to the destination host.

This encapsulation/decapsulation function is the core purpose of a VTEP in a VXLAN environment.

Exam trap

Cisco often tests the distinction between the VTEP's core encapsulation/decapsulation role and the separate functions of multicast group management, DHCP services, or Layer 3 routing, leading candidates to confuse the VTEP with a VXLAN gateway or a multicast router.

How to eliminate wrong answers

Option A is wrong because VXLAN multicast groups are used for BUM traffic (broadcast, unknown unicast, multicast) in multicast-mode VXLAN, but managing those groups is a function of the underlay network (e.g., PIM) or the control plane, not a specific function of the VTEP itself. Option C is wrong because a VTEP is a networking device (switch or router) that handles tunnel encapsulation; DHCP services for tenant VMs are provided by dedicated DHCP servers or the hypervisor, not by the VTEP. Option D is wrong because Layer 3 routing between VXLAN segments is performed by a VXLAN gateway (which may be a VTEP with routing capabilities, such as a VXLAN routing gateway or a VRF-aware device), but the fundamental function of a VTEP is encapsulation/decapsulation, not routing.

Full explanation →

429

MCQmedium

A Cisco MDS switch is configured with a VSAN and the administrator needs to assign a Fibre Channel port to this VSAN. Which command should be used in interface configuration mode to assign the port to VSAN 10?

A.vsan database vsan 10

B.switchport vsan 10

C.switchport mode vsan 10

D.vsan 10

AnswerB

This is the correct command to assign the interface to VSAN 10.

Why this answer

The 'switchport vsan' command is used to assign a Fibre Channel interface to a specific VSAN.

Full explanation →

430

MCQeasy

Which feature allows a Fibre Channel switch to use multiple links between two switches as a single logical link?

A.NPIV

B.NPV

C.SAN port channel

D.SPAN

E.FCIP

AnswerC

SAN port channels bundle multiple ISL links into a single logical link.

Why this answer

SAN port channel (C) is correct because it allows multiple physical Fibre Channel links between two switches to be aggregated into a single logical link, providing load balancing and redundancy. This is achieved by bundling up to 16 physical ISLs into one logical interface, using a proprietary hashing algorithm to distribute frames across the member links while maintaining in-order delivery.

Exam trap

Cisco often tests the distinction between SAN port channel (link aggregation) and NPV/NPIV (virtualization features), so the trap here is confusing link aggregation with virtualization or tunneling protocols like FCIP.

How to eliminate wrong answers

Option A is wrong because NPIV (N_Port ID Virtualization) allows a single Fibre Channel N_Port to register multiple FC IDs, enabling virtualization, but it does not aggregate links. Option B is wrong because NPV (N_Port Virtualization) allows a switch to behave as a host to upstream switches, reducing domain IDs, but it does not bundle links. Option D is wrong because SPAN (Switched Port Analyzer) is a Cisco feature for mirroring traffic to a monitor port, not for link aggregation.

Option E is wrong because FCIP (Fibre Channel over IP) tunnels FC frames over IP networks for long-distance connectivity, but it does not combine multiple physical links into a single logical link between two FC switches.

Full explanation →

431

MCQhard

Refer to the exhibit. What is the most likely cause of the NVE interface being down?

A.The VXLAN destination UDP port is incorrect.

B.The overlay VLAN is not configured.

C.The source interface is not configured.

D.The VNI list is empty.

AnswerC

The output shows 'Source Interface: not configured', which prevents NVE from coming up.

Why this answer

The NVE (Network Virtualization Edge) interface requires a valid source interface (typically a loopback) to establish VXLAN tunnels. If the source interface is not configured under the NVE interface, the interface remains in a down state because it cannot form VXLAN overlay adjacencies. This is the most common cause of an NVE interface being down in Cisco NX-OS.

Exam trap

Cisco often tests the specific requirement that the NVE interface must have a source interface configured to come up, and candidates mistakenly think an empty VNI list or incorrect UDP port would cause the interface to be down, but those affect traffic forwarding, not the interface state.

How to eliminate wrong answers

Option A is wrong because the VXLAN destination UDP port (default 4789) is a static value used for encapsulation and does not affect the operational state of the NVE interface itself; an incorrect port would cause packet drops but not bring the interface down. Option B is wrong because the overlay VLAN is configured under the bridge domain or VNI mapping, not directly on the NVE interface, and its absence would prevent traffic forwarding but not cause the NVE interface to be down. Option D is wrong because an empty VNI list means no VNIs are mapped to the NVE, which would prevent VXLAN traffic but the NVE interface can still be up/up if the source interface is properly configured.

Full explanation →

432

MCQmedium

An engineer is configuring OSPF on a Nexus 9000 switch in a data center spine-leaf topology. Which OSPF network type is most appropriate on the point-to-point links between leaf and spine switches to ensure fast convergence?

A.broadcast

B.point-to-multipoint

C.point-to-point

D.non-broadcast

AnswerC

Point-to-point is optimal for direct links, avoids DR/BDR.

Why this answer

In a spine-leaf topology, the links between leaf and spine switches are typically point-to-point, even if they are Ethernet interfaces. Configuring the OSPF network type as point-to-point on these links eliminates the need for a Designated Router (DR) and Backup Designated Router (BDR) election, which reduces OSPF adjacency formation time and ensures faster convergence. This network type also allows OSPF to use multicast hello packets (224.0.0.5) without the overhead of a DR/BDR election, making it the most appropriate choice for fast convergence.

Exam trap

Cisco often tests the misconception that 'broadcast' is the default and therefore acceptable for all Ethernet links, but the trap here is that candidates overlook the DR/BDR election overhead on point-to-point links, which directly impacts convergence time in a spine-leaf design.

How to eliminate wrong answers

Option A is wrong because the broadcast network type requires a DR/BDR election, which adds delay in adjacency formation and convergence, and is unnecessary for point-to-point links. Option B is wrong because point-to-multipoint is designed for non-broadcast multi-access (NBMA) networks where a single interface connects to multiple neighbors, not for dedicated point-to-point links, and it does not leverage the fast adjacency benefits of point-to-point. Option D is wrong because non-broadcast is used for NBMA environments (e.g., Frame Relay) where neighbors must be statically configured and DR/BDR election is still required, which is inefficient and slower for point-to-point links.

Full explanation →

433

MCQmedium

A Cisco ACI fabric administrator wants to implement microsegmentation using Cisco Group-Based Policy (GBP) in a network that hosts virtual machines and bare-metal servers. Which component must be used to enforce microsegmentation policies for bare-metal servers?

A.Application Policy Infrastructure Controller (APIC)

B.Virtual Switch (e.g., Cisco AVS)

C.External firewall appliance

D.Leaf switch

AnswerD

Leaf switches enforce microsegmentation for bare-metal servers via PCAM.

Why this answer

In Cisco ACI, microsegmentation for bare-metal servers is enforced at the leaf switch using Cisco Group-Based Policy (GBP). Unlike virtual machines that rely on a virtual switch (e.g., Cisco AVS) to apply policies, bare-metal servers connect directly to the leaf switch via physical interfaces. The leaf switch uses the opflex protocol to receive policy definitions from the APIC and applies them at the port level, enabling microsegmentation without requiring a hypervisor or virtual switch.

Exam trap

Cisco often tests the misconception that microsegmentation policies are enforced by the APIC or a virtual switch, but the trap here is that for bare-metal servers, the leaf switch is the enforcement point because there is no hypervisor to host a virtual switch.

How to eliminate wrong answers

Option A is wrong because the APIC is the centralized controller that defines and manages policies, but it does not enforce them at the data plane; enforcement occurs on the leaf switches. Option B is wrong because a virtual switch (e.g., Cisco AVS) is used for microsegmentation of virtual machines, not for bare-metal servers, which lack a hypervisor and thus cannot leverage a virtual switch. Option C is wrong because an external firewall appliance is not a native component of ACI microsegmentation; ACI uses its own policy enforcement at the leaf switch, and relying on an external firewall would introduce latency and complexity, defeating the purpose of GBP.

Full explanation →

434

Multi-Selectmedium

A storage administrator is configuring iSCSI security. Which two methods can be used to authenticate iSCSI initiators to a target? (Choose two.)

Select 2 answers

A.CHAP

B.WWN zoning

C.IP-based access control lists

D.FCoE VLANs

E.VSAN membership

AnswersA, C

CHAP authenticates the initiator to the target.

Why this answer

CHAP is the standard authentication for iSCSI, and IP-based ACLs are a common access control method. Mutual CHAP is an option, but CHAP is the base.

Full explanation →

435

MCQhard

Refer to the exhibit. A Python script using the Cisco ACI Cobra SDK fails with 'AuthenticationError'. Which of the following is the most likely cause?

A.The APIC URL is incorrect

B.The user does not have API access

C.The username or password is incorrect

D.The script is missing required imports

AnswerC

AuthenticationError directly indicates failed login due to credentials.

Why this answer

The 'AuthenticationError' in the Cisco ACI Cobra SDK indicates that the APIC rejected the login credentials. This error is raised specifically when the username or password provided in the script's login method (e.g., 'Login('apic_url', 'username', 'password')') does not match a valid APIC local or AAA-authenticated user. The SDK performs an HTTP POST to the APIC's '/api/aaaLogin.json' endpoint, and a non-200 response with an authentication failure triggers this exception.

Exam trap

Cisco often tests the distinction between authentication failures (wrong credentials) and authorization failures (no API access), so candidates mistakenly choose 'user does not have API access' when the error message clearly points to the login phase.

How to eliminate wrong answers

Option A is wrong because an incorrect APIC URL would typically result in a connection timeout or HTTP 404 error, not an 'AuthenticationError' — the SDK would fail to reach the APIC before authentication is attempted. Option B is wrong because if the user lacks API access, the APIC would still authenticate the user (returning a token) but then deny subsequent API operations with a 403 Forbidden error; the 'AuthenticationError' occurs at login, not during API calls. Option D is wrong because missing imports would cause a Python ImportError or NameError at script startup, not an 'AuthenticationError' at runtime — the SDK would not even execute the login call.

Full explanation →

436

MCQmedium

A Python script using the pyATS framework to parse 'show interface' output on a Nexus 9000 switch fails with a parsing error, even though the CLI command runs successfully. What is the most likely missing component?

A.The script does not include the correct authentication method.

B.The Genie parser for the specific NX-OS version is not installed or imported.

C.The script uses the wrong device type (e.g., iosxe instead of nxos).

D.The switch is not configured with NETCONF.

AnswerB

pyATS uses Genie parsers that are version-specific; missing parser leads to parse error.

Why this answer

The pyATS framework relies on Genie parsers to convert raw CLI output into structured data. If the Genie parser for the specific NX-OS version is missing or not imported, the script cannot parse the 'show interface' output, resulting in a parsing error even though the CLI command itself runs successfully. This is the most likely missing component because pyATS/Genie parsers are version-specific and must be installed for the exact platform and OS version.

Exam trap

Cisco often tests the distinction between command execution success and parsing success, trapping candidates who assume a working CLI command guarantees pyATS/Genie parsing will work without the correct version-specific parser installed.

How to eliminate wrong answers

Option A is wrong because authentication methods (e.g., SSH credentials, API tokens) are used for device connection, not for parsing CLI output; a parsing error occurs after successful connection and command execution. Option C is wrong because using the wrong device type (e.g., iosxe instead of nxos) would cause a different error—either a connection failure or a mismatch in command syntax—not a parsing error on a command that runs successfully. Option D is wrong because NETCONF is not required for pyATS/Genie parsing; pyATS can parse CLI output over SSH or Telnet without any NETCONF configuration.

Full explanation →

437

MCQmedium

An administrator wants to use the APIC REST API to create a new Tenant in ACI. Which object in the Management Information Tree (MIT) should be the target of the POST request?

A.fvEp

B.fvAp

C.fvTenant

D.fvBD

AnswerC

fvTenant is the correct object class for a tenant.

Why this answer

The Tenant object is at the top of the MIT hierarchy under root. The API endpoint for tenants is typically /api/mo/uni/tn-[name].json. EPG, BD, and AP are child objects.

Full explanation →

438

MCQeasy

A network engineer wants to automate the deployment of VLANs across 50 Nexus switches in a data center. Which approach provides the most consistent and repeatable results with minimal manual effort?

A.Python script using netmiko

B.Manual CLI on each switch

C.Bash script with SSH

D.Ansible playbook with nxos_vlan module

AnswerD

Declarative and idempotent, ensures consistent configuration.

Why this answer

Ansible playbook with the nxos_vlan module is the correct choice because it provides idempotent, declarative automation that ensures consistent VLAN configuration across all 50 Nexus switches with minimal manual effort. Ansible handles SSH connectivity and state management natively, eliminating the need for custom scripting and reducing the risk of human error.

Exam trap

Cisco often tests the distinction between ad-hoc scripting (like netmiko or Bash) and declarative automation tools (like Ansible) that provide idempotency and state management, leading candidates to choose a technically functional but less robust scripting approach.

How to eliminate wrong answers

Option A is wrong because a Python script using netmiko, while programmatic, requires custom error handling, idempotency logic, and manual loop management for 50 switches, making it less consistent and more effort than Ansible's built-in modules. Option B is wrong because manual CLI on each switch is error-prone, time-consuming, and does not scale to 50 switches, offering no repeatability or automation. Option C is wrong because a Bash script with SSH relies on fragile expect-like constructs or raw SSH commands, lacks idempotency, and requires extensive custom logic to handle device differences and failures, leading to inconsistent results.

Full explanation →

439

MCQmedium

Refer to the exhibit. A UCS administrator applies a service profile with this boot policy to a blade. The blade boots from the SAN LUN successfully. However, after a reboot due to a firmware update, the blade boots from the local disk instead of the SAN. What is the most likely reason?

A.The WWPN of the SAN target is incorrect.

B.The SAN target LUN ID changed after the firmware update.

C.The boot order has local disk before the SAN target.

D.The local disk was not present at initial association.

AnswerC

Exhibit shows local-disk listed first.

Why this answer

The most likely reason is that the boot order in the service profile's boot policy lists the local disk before the SAN target. After a firmware update, the UCS Manager re-evaluates the boot policy, and if the local disk is present and has a higher priority, the blade will boot from it instead of the SAN LUN. The initial successful boot from SAN occurred because the local disk was not present at that time, but after the reboot, the local disk became available and took precedence.

Exam trap

The trap here is that candidates often assume a firmware update changes SAN parameters (like WWPN or LUN ID), but Cisco tests the concept that the boot order policy itself, not the SAN configuration, determines which device boots first when multiple bootable devices are present.

How to eliminate wrong answers

Option A is wrong because an incorrect WWPN of the SAN target would prevent any successful boot from the SAN LUN, not just after a reboot. Option B is wrong because a change in the SAN target LUN ID after a firmware update is unlikely and would cause a persistent boot failure, not a switch to local disk. Option D is wrong because the local disk not being present at initial association explains why the SAN boot worked initially, but it does not explain why the boot order policy itself would change; the boot order is static unless modified.

Full explanation →

440

Multi-Selectmedium

Which TWO statements about Fibre Channel zoning are correct? (Choose two.)

Select 2 answers

A.Zoning can be used to prevent unauthorized access to storage targets.

B.Zoning is required to increase the distance between a host and storage.

C.Zoning can only be applied within a single VSAN.

D.Zoning is used to load balance traffic across multiple paths.

E.Hard zoning uses ACLs to enforce membership at the frame level.

AnswersA, E

Zoning restricts communication between specific ports.

Why this answer

Fibre Channel zoning restricts which initiators can communicate with which targets, effectively preventing unauthorized access to storage LUNs. By defining zone members (via WWN or port ID), the fabric enforces these access controls at the switch level, ensuring that only devices within the same zone can exchange Fibre Channel frames.

Exam trap

Cisco often tests the distinction between hard zoning (frame-level ACL enforcement) and soft zoning (name server filtering), and candidates mistakenly think zoning can increase distance or balance traffic, which are unrelated functions.

Full explanation →

441

MCQmedium

In a centralized anycast gateway VXLAN EVPN design, which is a requirement?

A.Each VTEP has a unique anycast IP address.

B.All VTEPs share a common anycast IP address for the default gateway.

C.The anycast gateway is configured on the spine switches.

D.The route reflector is an external BGP speaker.

AnswerB

This is the definition of centralized anycast gateway.

Why this answer

In a centralized anycast gateway VXLAN EVPN design, all VTEPs share a common anycast IP address and MAC address for the default gateway. This allows any VTEP to serve as the first-hop router for hosts, enabling optimal east-west traffic forwarding without requiring a separate gateway device. The anycast IP is configured on each VTEP's VLAN interface, and the same IP/MAC is advertised via EVPN Type-2 routes.

Exam trap

Cisco often tests the misconception that the anycast gateway is configured on spine switches or that each VTEP uses a unique anycast IP, when in fact the shared anycast IP/MAC on leaf VTEPs is the defining requirement.

How to eliminate wrong answers

Option A is wrong because each VTEP does not have a unique anycast IP address; instead, all VTEPs share the same anycast IP and MAC for the default gateway. Option C is wrong because the anycast gateway is configured on the leaf switches (VTEPs), not on the spine switches, which act as route reflectors or underlay forwarders. Option D is wrong because the route reflector can be an internal BGP speaker (e.g., a spine switch) and does not have to be an external BGP speaker; in fact, iBGP is commonly used within the fabric.

Full explanation →

442

MCQmedium

A UCS B-series blade is configured to boot from SAN using a vHBA that connects to a Fibre Channel SAN. The storage administrator reports that the LUN is not being presented to the blade. Which component in the UCS domain is responsible for mapping the vHBA WWPN to the physical Fibre Channel interface?

A.IOM (FEX)

B.CIMC

C.Fabric Interconnect

D.UCS Manager

AnswerC

The FI maps the vHBA WWPN to the physical Fibre Channel interface.

Why this answer

In UCS, the Fabric Interconnect (FI) acts as a Fibre Channel forwarder (FCF) or NPV switch. The vHBA's WWPN is assigned by UCS Manager and the FI maps it to the appropriate uplink Fibre Channel interface. The UCS Manager itself configures this mapping, but the actual mapping occurs on the FI.

Full explanation →

443

MCQmedium

A UCS administrator needs to replace a failed blade server in a chassis with a new blade. The new blade must automatically receive the same configuration as the failed one. Which feature enables this?

A.Chassis management controller failover

B.Automatic firmware synchronization

C.UCS Manager auto-discovery

D.Stateless computing using service profiles

AnswerD

Service profiles abstract hardware identity, enabling seamless replacement.

Why this answer

Stateless computing via service profiles allows a new blade to be assigned the same profile, automatically applying the configuration.

Full explanation →

444

MCQeasy

Which VXLAN component is responsible for encapsulating and decapsulating Ethernet frames into UDP packets?

A.VNI

B.VXLAN tunnel

C.VXLAN gateway

D.VTEP

AnswerD

VTEP performs VXLAN encapsulation/decapsulation.

Why this answer

The VTEP (VXLAN Tunnel Endpoint) is the device that performs encapsulation and decapsulation of Ethernet frames into UDP packets. It is the edge component in a VXLAN network that maps tenant traffic to VXLAN segments and handles the actual tunneling by adding the VXLAN header (including VNI) and outer UDP/IP headers.

Exam trap

Cisco often tests the distinction between the VTEP (the device that does encapsulation) and the VXLAN tunnel (the logical path), so candidates mistakenly pick 'VXLAN tunnel' because they associate 'tunnel' with encapsulation, but the tunnel is the path, not the endpoint.

How to eliminate wrong answers

Option A is wrong because VNI (VXLAN Network Identifier) is a 24-bit segment identifier in the VXLAN header that distinguishes tenant traffic, but it does not perform encapsulation or decapsulation. Option B is wrong because a VXLAN tunnel is the logical path between VTEPs over the underlay network, not the component that encapsulates or decapsulates frames. Option C is wrong because a VXLAN gateway connects VXLAN and non-VXLAN networks (e.g., VLAN-to-VXLAN bridging) and may perform translation, but the fundamental encapsulation/decapsulation function is always done by the VTEP.

Full explanation →

445

MCQhard

Refer to the exhibit. An automation script queries the Cisco Nexus 9000 using the NX-API JSON format and receives the above output. The script is designed to validate that interface Eth1/1 is in access mode with VLAN 100. However, the script reports a failure. What is the most likely reason?

A.The script uses strict type checking, and the values are returned as strings instead of integers.

B.The JSON output is malformed and cannot be parsed.

C.The interface is administratively down.

D.The JSON output is missing the 'switchportMode' field.

AnswerA

JSON returns numbers as strings in this context; a type mismatch causes failure.

Why this answer

The NX-API returns all values as strings in JSON output, including numeric fields like VLAN IDs. If the script uses strict type checking (e.g., `===` in Python or JavaScript), comparing the string '100' to the integer 100 will fail, even though the interface is correctly configured in access mode with VLAN 100. This is a common pitfall when parsing NX-API responses without explicit type conversion.

Exam trap

Cisco often tests the nuance that NX-API returns all values as strings, tricking candidates who assume numeric fields are returned as integers and overlook the need for type conversion in validation logic.

How to eliminate wrong answers

Option B is wrong because the JSON output shown is well-formed (valid key-value pairs, proper brackets), so parsing would succeed. Option C is wrong because the output includes 'adminState: up', indicating the interface is administratively up, not down. Option D is wrong because the output clearly contains the 'switchportMode' field with value 'access', so the field is not missing.

Full explanation →

446

MCQmedium

An engineer is troubleshooting high CPU utilization on a Nexus 7700 switch. The output of 'show process cpu' shows high usage from the 'netstack' process. Which action should the engineer take to identify the cause?

A.Enable 'feature netstack' to get more details.

B.Reboot the switch to clear the process.

C.Check for broadcast storms using 'show interface'.

D.Use 'show system internal netstack stats'.

AnswerD

This command shows internal netstack counters and helps isolate the issue.

Why this answer

The 'netstack' process handles network stack operations, including packet processing and forwarding. The 'show system internal netstack stats' command provides detailed internal statistics about the netstack process, such as packet drops, buffer usage, and error counters, which help pinpoint the root cause of high CPU utilization.

Exam trap

Cisco often tests the distinction between generic interface troubleshooting and process-specific internal diagnostics, leading candidates to choose a broad command like 'show interface' instead of the targeted internal command for the identified process.

How to eliminate wrong answers

Option A is wrong because 'feature netstack' is not a valid command; netstack is an internal process, not a feature that can be enabled. Option B is wrong because rebooting the switch is a disruptive, temporary fix that does not identify the underlying cause and may mask the issue. Option C is wrong while broadcast storms can cause high CPU, the question specifically identifies the 'netstack' process, and 'show interface' does not provide netstack-specific statistics; the correct diagnostic command targets the process directly.

Full explanation →

447

MCQhard

A data center engineer is designing a UCS Manager solution that requires VLAN segmentation across multiple fabric interconnects. The network team requires that each VLAN is assigned a unique native VLAN ID per fabric. Which pool configuration supports this requirement?

A.Use derived VLAN pools based on chassis location

B.Create separate VLAN pools for each fabric with non-overlapping ranges

C.Create a single VLAN pool that includes all required VLANs

D.Configure VLANs directly in the service profile using inline pools

AnswerB

Separate pools enable unique native VLAN IDs per fabric

Why this answer

UCS Manager allows separate VLAN pools to be assigned per fabric interconnect, enabling unique native VLAN IDs per fabric. By creating non-overlapping VLAN pools for each fabric, the engineer ensures that each fabric has its own native VLAN ID without conflict, meeting the requirement for VLAN segmentation across multiple fabric interconnects.

Exam trap

Cisco often tests the misconception that a single VLAN pool can be used for both fabrics, but the requirement for unique native VLAN IDs per fabric demands separate pools with non-overlapping ranges to avoid conflict.

How to eliminate wrong answers

Option A is wrong because derived VLAN pools based on chassis location do not provide per-fabric native VLAN differentiation; they are used for chassis-specific VLAN assignment, not for separating VLANs across fabrics. Option C is wrong because a single VLAN pool that includes all required VLANs would assign the same native VLAN ID to both fabrics, violating the requirement for unique native VLAN IDs per fabric. Option D is wrong because configuring VLANs directly in the service profile using inline pools does not allow per-fabric native VLAN assignment; inline pools are used for individual service profiles and cannot enforce separate native VLAN IDs across fabrics.

Full explanation →

448

MCQmedium

An administrator is troubleshooting a performance issue in an FC SAN. The initiator and target are in the same VSAN. The link is 16 Gbps but throughput is only 4 Gbps. The engineer checks the BB_Credit utilization and sees a high count of BB_Credit zero. What is the most likely cause?

A.Congestion on the target port

B.High link error rates

C.Incorrect zoning configuration

D.Buffer-to-buffer credit exhaustion

AnswerD

BB_Credit zero means the port has run out of credits, causing pauses and low throughput.

Why this answer

BB_Credit zero indicates buffer-to-buffer credit exhaustion, which pauses transmission and reduces throughput. This is typically due to distance or small credit pool. Link errors would show CRC errors, congestion would cause other symptoms, and zoning is unrelated.

Full explanation →

449

MCQmedium

Refer to the exhibit. A UCS administrator has configured vNIC templates as shown. Both Fabric Interconnects have identical uplink configurations. The vNIC templates have 'Failover: Enabled'. However, when Fabric Interconnect A fails, servers using vNIC-A do not fail over to Fabric Interconnect B. What is the most likely cause?

A.A pin group is configured that forces traffic to Fabric Interconnect A.

B.The native VLAN (10) is not allowed on Fabric Interconnect B's trunk.

C.The uplink interfaces are configured with 'spanning-tree port type edge trunk', which blocks failover traffic.

D.The server's service profile does not include a secondary vNIC for Fabric B.

AnswerD

Failover requires a secondary vNIC on the other fabric in the same service profile.

Why this answer

The server's service profile must include both a primary vNIC (for Fabric Interconnect A) and a secondary vNIC (for Fabric Interconnect B) to enable failover. The 'Failover: Enabled' setting on the vNIC template only allows the vNIC to use the other fabric's uplink if a secondary vNIC is explicitly defined in the service profile; without it, the vNIC is pinned to its original fabric and cannot fail over.

Exam trap

Cisco often tests the misconception that enabling 'Failover' on a vNIC template alone is sufficient for failover, when in reality a secondary vNIC must be explicitly added to the service profile to provide the alternate fabric path.

How to eliminate wrong answers

Option A is wrong because a pin group that forces traffic to Fabric Interconnect A would prevent failover, but the question states that vNIC templates have 'Failover: Enabled', and a pin group would override that setting only if explicitly configured; the scenario does not mention any pin group, so this is an unlikely cause. Option B is wrong because the native VLAN (10) not being allowed on Fabric Interconnect B's trunk would cause connectivity issues for VLAN 10 traffic, but it would not prevent the vNIC from failing over to Fabric B's uplinks; failover is a fabric-level path selection, not a VLAN-specific behavior. Option C is wrong because 'spanning-tree port type edge trunk' (PortFast trunk) does not block failover traffic; it enables faster convergence by skipping STP on the uplink ports, and failover traffic is not blocked by this configuration.

Full explanation →

450

MCQeasy

Which AAA protocol is recommended by Cisco for network device administration, as it separates authentication, authorization, and accounting?

A.TACACS+

B.RADIUS

C.LDAP

D.802.1X

AnswerA

TACACS+ separates AAA and encrypts all traffic.

Why this answer

TACACS+ encrypts the entire packet and separates AAA functions, making it preferred over RADIUS for admin access.

Full explanation →

Page 6 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

Network Storage Network Automation Compute Security

See all domains with question counts →