Knowledge + Practice

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 526–600

984 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Page 8 of 14

526

Multi-Selecthard

Which THREE of the following are valid methods to secure the control plane on a Cisco Nexus 9000 switch?

Select 3 answers

A.Enable control plane policing (CoPP) to rate-limit control plane traffic.

B.Configure management access lists to restrict SSH/SNMP access.

C.Disable unused services such as HTTP/HTTPS server.

D.Enable Bidirectional Forwarding Detection (BFD) on all interfaces.

E.Implement routing protocol authentication (e.g., OSPF MD5).

AnswersA, B, C

CoPP protects the control plane from DoS attacks.

Why this answer

Control plane policing (CoPP) is a valid method to secure the control plane on a Cisco Nexus 9000 switch. CoPP uses a policy map applied to the control plane to rate-limit or drop traffic destined to the supervisor module, protecting the CPU from excessive or malicious traffic. This is a direct control plane security mechanism defined in Cisco NX-OS.

Exam trap

Cisco often tests the distinction between control plane security (CoPP, management ACLs, disabling services) and other security features like BFD or routing authentication, which protect different planes or functions.

Full explanation →

527

MCQeasy

An engineer needs to design a resilient Fibre Channel SAN that eliminates single points of failure between two MDS switches and a storage array with two controllers. What is the minimum number of FC port channels required to achieve this goal?

A.Three

B.Two

C.One

D.Four

AnswerB

Two port channels allow each controller to connect to both switches.

Why this answer

To eliminate single points of failure between two MDS switches and a dual-controller storage array, you need two Fibre Channel port channels. Each port channel connects one MDS switch to both storage controllers, providing redundancy for both the switch and the controller paths. This design ensures that if one switch or one controller fails, the other port channel maintains connectivity.

Exam trap

Cisco often tests the misconception that you need a port channel per controller or per switch, leading candidates to overcount; the trap here is that two port channels—one from each switch to both controllers—are sufficient to eliminate all single points of failure.

How to eliminate wrong answers

Option A is wrong because three port channels are unnecessary; two suffice to cover both switches and both controllers without introducing extra complexity or cost. Option C is wrong because a single port channel creates a single point of failure at the switch or controller level, failing the requirement. Option D is wrong because four port channels exceed the minimum requirement, as two port channels already provide full redundancy for all components.

Full explanation →

528

MCQeasy

An engineer needs to implement port security on a Cisco Nexus 1000v virtual switch to prevent MAC flooding attacks. The requirement is to allow only the first MAC address learned on the port. Which command sequence accomplishes this?

A.interface ethernet 1/1 switchport port-security switchport port-security maximum 2 switchport port-security violation restrict

B.interface ethernet 1/1 switchport port-security switchport port-security maximum 1 switchport port-security violation shutdown

C.interface ethernet 1/1 switchport port-security switchport port-security maximum 10 switchport port-security violation protect

D.interface ethernet 1/1 switchport port-security manual switchport port-security mac-address 0000.1111.2222

AnswerB

This sets the maximum MAC addresses to 1 and violation action to shutdown.

Why this answer

The command sequence sets the maximum number of MAC addresses to 1, which ensures only the first learned MAC address is allowed on the port. The 'violation shutdown' action disables the port if a violation occurs, effectively preventing MAC flooding attacks by stopping any additional MAC addresses from being learned.

Exam trap

Cisco often tests the distinction between 'violation protect' (silently drops unknown traffic) and 'violation shutdown' (disables the port), and candidates may mistakenly choose 'protect' thinking it is sufficient, but only 'shutdown' fully prevents MAC flooding by stopping all traffic on the port.

How to eliminate wrong answers

Option A is wrong because it sets the maximum to 2, allowing two MAC addresses instead of the required one, and uses 'restrict' which only drops traffic from unknown MACs without disabling the port. Option C is wrong because it sets the maximum to 10, allowing multiple MAC addresses, and uses 'protect' which silently drops unknown traffic but does not prevent the port from learning multiple MACs. Option D is wrong because 'switchport port-security manual' is not a valid command on Cisco Nexus switches; the correct command is 'switchport port-security mac-address sticky' or a static MAC assignment, and it does not enforce the 'first learned' behavior.

Full explanation →

529

MCQmedium

An administrator needs to perform a remote firmware upgrade on a UCS C220 rack server. The server has CIMC configured with an IP address. Which method should the administrator use to upgrade the CIMC firmware?

A.Use the KVM console to boot from a firmware upgrade ISO.

B.Use UCS Manager to upgrade the firmware of the C-series server.

C.Use Cisco IMC Supervisor to upgrade firmware across multiple servers.

D.Use the CIMC web interface to upload and apply the firmware image.

AnswerD

CIMC provides direct firmware upgrade capability.

Why this answer

CIMC supports firmware upgrade via its web interface or CLI using protocols like HTTP, TFTP, or SCP. The recommended method is to use the CIMC GUI or the 'update firmware' command in CIMC.

Full explanation →

530

MCQmedium

When using Cisco NSO (Network Services Orchestrator) to automate service creation across a data center network, what is a key consideration regarding device compatibility?

A.NSO requires NETCONF for all devices.

B.Each device must have a corresponding NED that matches its OS version.

C.Device YANG models must be hand-coded by the team.

D.NSO only supports Cisco devices.

AnswerB

NSO requires a compatible NED for each device model and OS version to translate service models.

Why this answer

B is correct because Cisco NSO uses Network Element Drivers (NEDs) to translate service models into device-specific CLI, SNMP, or NETCONF commands. Each NED is tied to a specific device OS version (e.g., IOS-XE 16.12, NX-OS 9.3), so mismatched NEDs cause configuration failures or incomplete deployments. Without a compatible NED, NSO cannot communicate with or configure the device.

Exam trap

The trap here is that candidates assume NSO relies exclusively on NETCONF or YANG for all devices, overlooking the critical role of OS-version-specific NEDs in enabling multi-protocol, multi-vendor automation.

How to eliminate wrong answers

Option A is wrong because NSO does not require NETCONF for all devices; it supports multiple southbound protocols including CLI, SNMP, and RESTCONF, with NEDs abstracting the protocol details. Option C is wrong because YANG models are not hand-coded by the team for each device; NSO uses pre-built NEDs that contain YANG models, and custom YANG models are only needed for service design, not device compatibility. Option D is wrong because NSO is vendor-agnostic and supports multi-vendor environments through NEDs for devices from Cisco, Juniper, Arista, and others.

Full explanation →

531

MCQeasy

Which protocol is used by NETCONF for transport?

A.SSH

B.Telnet

C.HTTP

D.HTTPS

AnswerA

NETCONF uses SSH for secure transport.

Why this answer

NETCONF (RFC 6241) uses SSH as its transport protocol.

Full explanation →

532

MCQmedium

An administrator wants to create separate FC fabrics on a single Cisco MDS switch for isolation of production and backup traffic. Which technology should they use?

A.PortChannel

B.NPV

C.Zoning

D.VSAN

AnswerD

VSAN creates separate logical fabrics for full isolation.

Why this answer

VSANs (Virtual SANs) provide fabric isolation on the same physical switch, similar to VLANs. Each VSAN has its own fabric services, zoning, and domain ID.

Full explanation →

533

MCQmedium

A company is consolidating its storage network into a single fabric using a Cisco MDS 9509. They want to use VSANs to isolate different departments. The VSANs will be 10, 20, and 30. They have a single ISL between two MDS switches. The engineers want to carry all three VSANs over the ISL. They configure both ends of the ISL as E ports and enable trunking. After configuration, they notice that only VSAN 10 traffic passes over the ISL. The other VSANs appear isolated. The show vsan membership shows all three VSANs are present on both switches. The show interface trunk on the ISL shows that the trunk is up but only VSAN 10 is allowed. What is the most likely cause?

A.The other VSANs are not configured on the trunk interface

B.The allowed VSAN list on the trunk port is limited to only VSAN 10

C.The trunk mode is set to 'on' instead of 'desirable'/'auto'

D.The ISL is in an error-disabled state for VSAN 20 and 30

AnswerB

The allowed VSAN list must be explicitly configured to include VSAN 20 and 30.

Why this answer

The show interface trunk output indicates that only VSAN 10 is in the allowed list. The allowed VSAN list on the trunk port must be configured to include all three VSANs. The trunk mode (on/desirable) does not limit VSANs.

Error-disabled would show in different status. VSAN membership on the interface is not applicable for trunk ports.

Full explanation →

534

MCQmedium

An engineer is configuring a UCS service profile for a blade server that will use FCoE to connect to a Fibre Channel SAN. What must be configured in the service profile to support FCoE traffic?

A.Configure the vNIC with FCoE personality and specify the FCoE VLAN

B.Assign a WWPN to the vNIC

C.Enable the FCoE flag on the vHBA

D.Set the vNIC to use the native VLAN for FCoE

AnswerA

This enables the vNIC to carry FCoE traffic.

Why this answer

To carry FCoE traffic, the vNIC must be configured to use the FCoE VLAN and have the FCoE personality enabled. This allows the adapter to parse FCoE frames.

Full explanation →

535

MCQmedium

A Cisco MDS switch is configured with two VSANs. Hosts in VSAN 1 cannot communicate with hosts in VSAN 2. What is the most likely reason?

A.The IVR is not configured.

B.The VSANs are not connected through an IVR zone.

C.The FC domain ID is conflicting.

D.The switch does not support multi VSAN.

E.The hosts are on different switches.

AnswerB

IVR zones define which devices can communicate across VSANs. Without these zones, traffic is isolated.

Why this answer

By default, VSANs are isolated from each other, meaning traffic cannot cross VSAN boundaries. Inter-VSAN Routing (IVR) must be explicitly configured to allow communication between hosts in different VSANs. Without IVR, hosts in VSAN 1 and VSAN 2 remain in separate fabrics and cannot communicate, even if they are connected to the same switch.

Exam trap

Cisco often tests the misconception that VSANs are like VLANs and can communicate by default, but in Fibre Channel fabrics, VSANs are fully isolated unless IVR is explicitly configured.

How to eliminate wrong answers

Option A is wrong because IVR not being configured is not the most likely reason; the question asks for the most likely reason, and the absence of an IVR zone is a more specific and direct cause. Option C is wrong because conflicting FC domain IDs would cause issues within a single VSAN or between switches in the same VSAN, not between different VSANs. Option D is wrong because the Cisco MDS switch supports multiple VSANs natively; the inability to communicate between VSANs is by design, not a lack of support.

Option E is wrong because hosts on different switches can still communicate if they are in the same VSAN or if IVR is configured; the issue here is the VSAN boundary, not the physical switch location.

Full explanation →

536

MCQmedium

A storage administrator needs to isolate Fibre Channel traffic between two departments in a data center using a single MDS switch. The administrator decides to create separate VSANs. Which statement about VSANs is true?

A.VSANs share the same fabric services across all VSANs.

B.VSANs provide isolation similar to VLANs in Ethernet networks.

C.VSANs require separate physical interfaces for each VSAN.

D.VSANs cannot be used with FCoE.

AnswerB

VSANs create separate logical Fibre Channel fabrics on the same physical infrastructure.

Why this answer

VSANs provide isolation similar to VLANs in Ethernet. Each VSAN has its own fabric services and does not share traffic with other VSANs.

Full explanation →

537

MCQhard

An engineer is designing a SAN for a virtualized environment with 20 hosts and 4 storage arrays. Each host requires a separate zone per storage array for security. What is the minimum number of zones required?

A.40

B.20

C.80

D.100

AnswerC

20 hosts * 4 arrays = 80 zones.

Why this answer

In a Fibre Channel SAN with N_Port ID Virtualization (NPIV), each host requires a separate zone per storage array to enforce strict isolation. With 20 hosts and 4 storage arrays, the minimum number of zones is 20 hosts × 4 arrays = 80 zones. This ensures that each host-array pair is isolated, preventing unauthorized access and aligning with security best practices.

Exam trap

Cisco often tests the concept that each host-array pair requires a separate zone, leading candidates to mistakenly multiply hosts by arrays incorrectly or forget that each host needs a zone per array, not just one zone per host.

How to eliminate wrong answers

Option A (40) is wrong because it incorrectly assumes only one zone per host (20 hosts × 2) or a miscalculation of half the required zones. Option B (20) is wrong because it assumes a single zone per host, ignoring the requirement for separate zones per storage array. Option D (100) is wrong because it overcounts, possibly by adding extra zones for redundancy or misapplying a formula like 20 hosts × 5 arrays.

Full explanation →

538

MCQhard

Refer to the exhibit. An engineer is troubleshooting poor FCoE performance. The exhibit shows output from the FCoE interface. Which observation indicates a potential issue?

A.PFC frames received is high compared to PFC frames sent

B.The CRC error count is zero

C.Data frames are 1500 bytes, which is too small for FCoE

D.The admin port mode is F instead of NP

AnswerA

Receiving many pause frames implies the peer is congested or PFC mismatch.

Why this answer

A high count of PFC frames received compared to PFC frames sent indicates that the local interface is receiving many pause frames from the peer, which suggests the peer is experiencing congestion and is forcing the local interface to pause its transmission. This asymmetry is a classic symptom of a buffer congestion or credit starvation issue in the FCoE SAN fabric, leading to poor FCoE performance.

Exam trap

Cisco often tests the misconception that CRC errors or MTU size are the primary causes of FCoE performance issues, when in reality the asymmetry in PFC frame counts is a more subtle and direct indicator of congestion in a lossless fabric.

How to eliminate wrong answers

Option B is wrong because a CRC error count of zero is normal and indicates no physical-layer errors, which is not a performance issue. Option C is wrong because FCoE data frames are typically 1500 bytes (or up to 2500 bytes with jumbo frames), and 1500 bytes is standard for FCoE; it is not too small. Option D is wrong because the admin port mode F (Fabric) is correct for an FCoE forwarder (FCF) facing an ENode; NP mode is used for NPV (N-Port Virtualization) and would be incorrect in this context.

Full explanation →

539

MCQmedium

In an FCoE deployment, a storage administrator needs to ensure that FCoE traffic is carried over a dedicated VLAN. Which configuration is required on a Cisco Nexus switch?

A.Configure the VLAN as a private VLAN.

B.Assign the VLAN as an access VLAN to the interface.

C.Enable FIP snooping and map the FCoE VLAN to a VSAN.

D.Configure the VLAN as a native VLAN on the FCoE interface.

AnswerC

FIP snooping is needed for FCoE; mapping FCoE VLAN to VSAN isolates traffic.

Why this answer

In an FCoE deployment, FIP snooping is required on the Cisco Nexus switch to enforce that only FCoE traffic is carried over a dedicated VLAN. The FCoE VLAN must be mapped to a VSAN to ensure proper isolation and forwarding of storage traffic. This configuration prevents unauthorized devices from injecting FCoE frames and maintains the integrity of the storage network.

Exam trap

Cisco often tests the misconception that a dedicated VLAN alone is sufficient for FCoE traffic, but the trap here is that FIP snooping and VSAN mapping are mandatory to enforce isolation and security, not just VLAN assignment.

How to eliminate wrong answers

Option A is wrong because a private VLAN isolates traffic at Layer 2 within a VLAN, but it does not provide the necessary FCoE-specific control or VSAN mapping; FCoE requires a dedicated standard VLAN with FIP snooping. Option B is wrong because assigning the VLAN as an access VLAN to the interface would strip 802.1Q tags and prevent FCoE frames (which are always tagged) from being properly identified and forwarded. Option D is wrong because configuring the VLAN as a native VLAN on the FCoE interface would cause untagged traffic to be placed in that VLAN, but FCoE frames must be explicitly tagged with the FCoE VLAN ID; native VLAN behavior conflicts with the requirement for a dedicated, tagged FCoE VLAN.

Full explanation →

540

MCQhard

A storage administrator is troubleshooting FCoE performance issues between a Cisco UCS FI and a storage array. The fabric is configured with FIP snooping and DCB. The administrator checks the FCoE interface counters and sees many dropped frames due to 'no buffer space'. What is the most likely root cause?

A.Jumbo frames are disabled on the switch ports

B.The FCoE VLAN is not trunked to the storage array

C.FIP snooping is not enabled on the FCoE VLAN

D.Priority flow control settings are mismatched between the upstream switch and the storage array

AnswerD

PFC mismatch can cause buffer exhaustion and drops.

Why this answer

The 'no buffer space' drops on FCoE interfaces indicate that the receive buffers are being exhausted, which is a classic symptom of Priority Flow Control (PFC) being misconfigured or mismatched between the upstream switch and the storage array. PFC (IEEE 802.1Qbb) is essential for lossless FCoE transport; if one side sends pause frames that the other does not honor, or if the PFC priorities are not aligned, buffers overflow and frames are dropped. This directly explains the observed counter behavior.

Exam trap

Cisco often tests the distinction between 'no buffer space' drops (caused by PFC/flow control mismatches) and other drop types like 'output drops' or 'CRC errors', leading candidates to incorrectly blame jumbo frames or VLAN issues.

How to eliminate wrong answers

Option A is wrong because jumbo frames (typically 9216 bytes) are required for FCoE to encapsulate large SCSI data payloads, but disabling them would cause frame oversize drops, not 'no buffer space' drops. Option B is wrong because the FCoE VLAN not being trunked would result in no connectivity or VLAN mismatch errors, not buffer exhaustion drops. Option C is wrong because FIP snooping is a security feature that prevents unauthorized FCoE devices from joining the fabric; its absence could allow rogue devices but does not cause buffer drops due to PFC mismatches.

Full explanation →

541

Multi-Selecthard

Which three components are part of the ACI Management Information Tree (MIT)? (Choose three.)

Select 3 answers

A.Interface

B.Tenant

C.Application Profile

D.VLAN

E.EPG

AnswersB, C, E

Tenant is a top-level object in MIT.

Why this answer

MIT includes objects like tenants, application profiles, EPGs, and bridge domains.

Full explanation →

542

MCQmedium

For consistent multi-data-center automation, which tool is best suited to orchestrate both NX-OS and ACI across sites?

A.Cisco NSO

B.Puppet

C.Ansible

D.Chef

AnswerA

NSO is built for service orchestration across multiple domains including NX-OS and ACI.

Why this answer

Cisco NSO (Network Services Orchestrator) is the correct tool because it provides multi-domain, multi-vendor orchestration with native support for both NX-OS and ACI through its Network Element Drivers (NEDs). NSO uses a model-driven approach with YANG data models and NETCONF/RESTCONF protocols to manage configuration consistency across distributed data centers, enabling service-level abstraction and closed-loop automation that other tools lack.

Exam trap

Cisco often tests the distinction between configuration management tools (Puppet, Chef, Ansible) and true orchestration platforms (NSO), trapping candidates who assume any automation tool can handle multi-site consistency without understanding NSO's model-driven, stateful orchestration and NED architecture.

How to eliminate wrong answers

Option B (Puppet) is wrong because it is a configuration management tool that relies on a master-agent model with its own DSL, lacking native support for ACI's APIC REST API or NX-OS's NX-API without extensive custom modules, and it does not provide multi-site orchestration capabilities. Option C (Ansible) is wrong because while it can automate NX-OS and ACI via modules, it is a task-based automation tool without a centralized state database or service orchestration layer, making it unsuitable for consistent multi-data-center orchestration across sites. Option D (Chef) is wrong because it is a configuration management tool using Ruby-based recipes and cookbooks, which requires significant custom development to interface with ACI's REST API and NX-OS, and it lacks the built-in multi-site service orchestration and network abstraction that NSO provides.

Full explanation →

543

MCQhard

An engineer is configuring FCoE on a Cisco Nexus 5000 switch. The switch connects to a Fibre Channel storage array. The FCoE Initialization Protocol (FIP) snooping must be enabled. What is the effect of enabling FIP snooping?

A.It enables the switch to terminate FCoE VLANs.

B.It provides FC-BB_6 compliant FCoE traffic forwarding.

C.It enables the switch to act as an FCoE forwarder.

D.It constructs a database of ENode MAC addresses and FC-MAPs.

E.It allows the switch to enforce zone-based policy for FCoE traffic.

AnswerD

FIP snooping monitors FIP frames to build a database of authorized devices.

Why this answer

FIP snooping on a Cisco Nexus 5000 switch constructs a database of ENode MAC addresses and FC-MAPs by inspecting FIP discovery, advertisement, and login frames. This database is used to enforce FCoE traffic only between authorized ENodes and FCFs, preventing rogue devices from injecting FCoE traffic. It does not terminate FCoE VLANs, act as an FCoE forwarder, or enforce zone-based policies directly.

Exam trap

Cisco often tests the distinction between FIP snooping (a security feature that builds a database of MAC-to-FC-MAP bindings) and FCoE forwarding (which requires an FCF), leading candidates to mistakenly think snooping enables forwarding or termination.

How to eliminate wrong answers

Option A is wrong because FIP snooping does not terminate FCoE VLANs; VLAN termination is a function of an FCoE forwarder (FCF) or a bridge, not a snooping feature. Option B is wrong because FC-BB_6 compliance is a standard for FCoE operation, but FIP snooping itself does not provide compliant forwarding; it only monitors and filters FIP frames to secure the fabric. Option C is wrong because FIP snooping does not enable the switch to act as an FCoE forwarder; an FCoE forwarder is a separate entity that performs encapsulation and forwarding, while snooping is a passive security mechanism.

Option E is wrong because zone-based policy enforcement for FCoE traffic is handled by the Fibre Channel zoning configuration on the FCF or SAN fabric, not by FIP snooping on the switch.

Full explanation →

544

MCQmedium

Which command is used on a Cisco Nexus switch to display the VXLAN network identifier (VNI) associated with a specific VLAN?

A.show vxlan vni

B.show vlan id 100

C.show interface nve 1

D.show running-config vxlan

AnswerA

This command lists VNIs and their associated VLANs.

Why this answer

The 'show vxlan vni' command on Cisco Nexus switches displays the VXLAN network identifier (VNI) and its mapping to VLANs, including the associated VLAN ID and segment state. This command directly answers the question by showing the VNI-to-VLAN binding, which is essential for verifying VXLAN overlay configurations.

Exam trap

Cisco often tests the distinction between commands that show VXLAN configuration versus operational state, and the trap here is that candidates confuse 'show interface nve 1' (which shows VNI membership on the NVE) with the command that specifically maps a VLAN to its VNI, leading them to select option C instead of the correct 'show vxlan vni'.

How to eliminate wrong answers

Option B is wrong because 'show vlan id 100' displays traditional VLAN information (like ports and name) but does not show any VXLAN VNI mappings, as VXLAN operates at a different encapsulation layer. Option C is wrong because 'show interface nve 1' shows the NVE interface configuration and state (source IP, VNI membership, etc.) but does not directly display the VNI associated with a specific VLAN; it lists VNIs configured on the NVE but not their VLAN bindings. Option D is wrong because 'show running-config vxlan' displays the VXLAN configuration commands (like 'vni' and 'member vni') but does not show the operational mapping of VNI to VLAN in a concise, per-VLAN lookup format.

Full explanation →

545

MCQhard

An administrator needs to replace a faulty blade server in a UCS chassis. The blade is associated with a service profile that has a persistent WWPN pool. What is the correct procedure to maintain stateless computing?

A.Remove the faulty blade, insert the new blade, and auto-associate the service profile

B.Replace the blade and delete the old service profile to create a new one

C.Replace the blade and update the WWPN pool to match the new hardware

D.Replace the blade and manually reconfigure the service profile with new WWPNs

AnswerA

The service profile will be automatically associated if the blade is discovered, or the administrator can manually associate it. The WWPNs remain the same.

Why this answer

UCS stateless computing allows a blade replacement without reconfiguration by simply disassociating the service profile from the faulty blade, removing the blade, inserting the new blade, and re-associating the same service profile. The WWPNs from the pool are retained.

Full explanation →

546

Multi-Selectmedium

Which three components are required for a basic Cisco UCS B-Series deployment? (Choose three.)

Select 3 answers

A.UCS C-Series Rack Server

B.Blade Servers (B-Series)

C.Fabric Interconnects

D.HyperFlex Cluster

E.UCS 5108 Blade Chassis

AnswersB, C, E

Correct. Blades provide compute.

Why this answer

A basic UCS B-Series deployment includes Fabric Interconnects for network connectivity, a UCS 5108 chassis to house blades, and blade servers. UCS Manager is software that typically runs on the FIs.

Full explanation →

547

Multi-Selectmedium

Which TWO security features are used to prevent MAC address flooding attacks on a Cisco Nexus switch? (Choose two.)

Select 2 answers

A.Port Security

B.IP Source Guard

C.Control Plane Policing

D.DHCP Snooping

E.BPDU Guard

AnswersA, D

Port Security limits the number of MAC addresses per port.

Why this answer

Port Security (A) is correct because it limits the number of MAC addresses allowed on a switch port, preventing MAC flooding attacks by dropping frames from unknown source MACs once the limit is exceeded. DHCP Snooping (D) is correct because it builds a trusted database of IP-to-MAC bindings from DHCP messages, which can be used to validate traffic and prevent MAC spoofing that often accompanies flooding attacks.

Exam trap

Cisco often tests the distinction between features that directly prevent MAC flooding (Port Security, DHCP Snooping) versus features that mitigate related spoofing attacks (IP Source Guard, Dynamic ARP Inspection), leading candidates to mistakenly select IP Source Guard.

Full explanation →

548

Multi-Selecteasy

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Select 3 answers

A.DHCP Snooping

B.RBAC

C.IP Source Guard

D.Dynamic ARP Inspection

E.CoPP

AnswersA, C, D

Prevents rogue DHCP servers.

Why this answer

DHCP snooping, DAI, and IP Source Guard work together to prevent various Layer 2 attacks.

Full explanation →

549

MCQmedium

An engineer notices that after a reboot of one UCS fabric interconnect (FI-A), the server traffic fails over to FI-B but never fails back to FI-A even after FI-A is fully operational. Which configuration change would ensure automatic failback?

A.Change the 'Backup Link' policy to 'Active/Active'

B.Change the 'Backup Link' policy to 'Primary/Secondary'

C.Change the 'Backup Link' policy to 'Active/Standby'

D.Change the 'Backup Link' policy to 'Failover Only'

AnswerA

Active/Active mode allows automatic failback

Why this answer

The 'Backup Link' policy in UCS determines how uplink ports behave during failover and failback. Setting it to 'Active/Active' allows both FIs to actively forward traffic, and when the failed FI recovers, the server traffic automatically fails back because the policy does not designate a permanent primary or standby role. This ensures symmetric traffic flow without manual intervention.

Exam trap

Cisco often tests the misconception that 'Active/Standby' is a valid Backup Link policy, when in fact the only two options are 'Active/Active' and 'Primary/Secondary', and candidates confuse the failover behavior of the server vNIC policy with the uplink Backup Link policy.

How to eliminate wrong answers

Option B is wrong because 'Primary/Secondary' designates one FI as primary and the other as secondary, which prevents automatic failback after the primary recovers; traffic remains on the secondary until manual action is taken. Option C is wrong because 'Active/Standby' is not a valid UCS Backup Link policy; the correct term is 'Active/Active' or 'Primary/Secondary', and 'Active/Standby' would imply a standby role that blocks automatic failback. Option D is wrong because 'Failover Only' is not a valid UCS Backup Link policy; the actual options are 'Active/Active' and 'Primary/Secondary', and a 'Failover Only' concept would not allow failback at all.

Full explanation →

550

MCQeasy

A network engineer is configuring DHCP snooping on a Cisco Nexus 9000 switch to prevent rogue DHCP server attacks. The switch connects to the legitimate DHCP server on Ethernet 1/1. Clients are connected to ports Ethernet 1/2 through 1/24. The engineer enables DHCP snooping globally and on VLAN 10, but clients are unable to obtain IP addresses from the DHCP server. Other connectivity between clients and the server works (e.g., static IPs). What is the most likely cause and solution?

A.Disable DHCP snooping as it is not needed in this topology.

B.Configure a static DHCP binding for each client on the switch.

C.Ethernet 1/1 is untrusted by default. Configure it as trusted with 'ip dhcp snooping trust' and verify DHCP snooping is enabled on VLAN 10.

D.Add 'ip dhcp snooping information option' on Ethernet 1/1 to allow DHCP option 82.

AnswerC

Correct. DHCP snooping requires the port towards the trusted server to be set as trusted to allow server messages.

Why this answer

By default, all interfaces on a Cisco Nexus 9000 switch are untrusted for DHCP snooping. The legitimate DHCP server is connected to Ethernet 1/1, which must be explicitly configured as trusted using the 'ip dhcp snooping trust' interface command. Without this, the switch discards DHCP server messages (OFFER, ACK) received on that port, preventing clients from obtaining IP addresses even though DHCP snooping is enabled globally and on VLAN 10.

Exam trap

Cisco often tests the default untrusted state of all interfaces in DHCP snooping, leading candidates to assume that enabling snooping globally and on a VLAN is sufficient without configuring trust on the server-facing port.

How to eliminate wrong answers

Option A is wrong because DHCP snooping is a necessary security feature to block rogue DHCP servers; disabling it would leave the network vulnerable and does not address the misconfiguration. Option B is wrong because static DHCP bindings are used for IP Source Guard or to map client MAC addresses to IP addresses, not to allow DHCP server messages through an untrusted port. Option D is wrong because the 'ip dhcp snooping information option' (DHCP option 82) is used to insert relay agent information and is not required for basic DHCP snooping trust; it is typically used in DHCP relay scenarios, not for directly connected servers.

Full explanation →

551

MCQmedium

A company is deploying a new storage network using Cisco MDS 9700 switches. They have multiple host servers and storage arrays. The security policy requires that each host can only access its own LUNs. The solution must be efficient and not require reconfiguration when new hosts are added. Which approach best meets these requirements?

A.Traditional zone-based zoning with pWWNs

B.VSAN zoning

C.FSPF metric tuning

D.Smart Zoning

AnswerD

Smart Zoning reduces zone objects and simplifies management by automatically handling LUN masking.

Why this answer

Smart Zoning is correct because it automatically creates LUN-specific access controls based on the host initiator and target storage port, ensuring each host can only see its own LUNs without manual reconfiguration when new hosts are added. This approach reduces the number of zone objects and simplifies management by using LUN-level granularity within a single zone, unlike traditional zoning which requires per-LUN zones.

Exam trap

Cisco often tests the misconception that VSAN zoning or traditional pWWN zoning can provide LUN-level isolation, but they only operate at the port level, failing to meet the per-host LUN access requirement without excessive administrative overhead.

How to eliminate wrong answers

Option A is wrong because traditional zone-based zoning with pWWNs only controls which initiators can talk to which targets at the port level, not at the LUN level, so it cannot enforce per-host LUN isolation without creating many separate zones that require reconfiguration when new hosts are added. Option B is wrong because VSAN zoning segments the fabric into separate virtual SANs but still operates at the port level, not LUN level, and adding new hosts would require VSAN membership changes or additional zones. Option C is wrong because FSPF metric tuning is used for routing path selection in Fibre Channel fabrics and has no role in access control or LUN masking.

Full explanation →

552

Multi-Selectmedium

A data center team is implementing configuration automation for a fleet of Nexus 9000 switches. They need a solution that supports idempotent configuration, works well with version control, and does not require an agent on the switches. Which two tools should they consider?

Select 2 answers

A.Puppet

B.Chef

C.Ansible

D.Python with Paramiko

E.Cisco NSO

AnswersC, E

Ansible is agentless, uses SSH/NX-API, and its playbooks are idempotent and version-controllable.

Why this answer

C is correct because Ansible is an agentless automation tool that uses SSH to push declarative configurations to Nexus 9000 switches. It supports idempotent playbooks, meaning the same playbook can be run multiple times without changing the state if the desired configuration is already in place, and its YAML-based playbooks integrate seamlessly with version control systems like Git.

Exam trap

Cisco often tests the distinction between agent-based (Puppet, Chef) and agentless (Ansible, NSO) automation tools, and the trap here is that candidates may overlook the 'no agent' requirement and select Puppet or Chef because they are familiar configuration management tools, or they may dismiss NSO because it is less commonly used in smaller environments.

Full explanation →

553

MCQeasy

Which protocol is used to carry VXLAN encapsulation and facilitates the exchange of MAC reachability information between VTEPs in a VXLAN EVPN fabric?

A.eBGP

B.OSPF

C.MP-BGP

D.PIM

AnswerC

MP-BGP with EVPN address family carries MAC/VNI routes between VTEPs.

Why this answer

In a VXLAN EVPN fabric, MP-BGP (Multiprotocol BGP) is the control plane protocol used to advertise MAC reachability information between VTEPs. It carries VXLAN encapsulation information via the BGP EVPN address family (AFI L2VPN / SAFI EVPN), enabling VTEPs to learn remote MAC addresses and VNI mappings without relying on data-plane flooding.

Exam trap

Cisco often tests the distinction between the control plane (MP-BGP) and the data plane (VXLAN) or underlay protocols (OSPF, PIM), leading candidates to mistakenly choose OSPF or PIM for MAC reachability exchange.

How to eliminate wrong answers

Option A is wrong because eBGP alone does not support the EVPN address family or carry MAC/VXLAN information; MP-BGP with the L2VPN EVPN address family is required. Option B is wrong because OSPF is a link-state IGP that distributes IP routes, not MAC reachability or VXLAN encapsulation attributes. Option D is wrong because PIM is a multicast routing protocol used for underlay multicast replication in VXLAN, not for exchanging MAC reachability information in the control plane.

Full explanation →

554

MCQhard

An iSCSI SAN is experiencing performance issues. The storage array and initiators are connected via a dedicated VLAN. The network team notices high jitter. What is the most effective mitigation?

A.Use multiple iSCSI sessions per initiator

B.Configure link aggregation between switches

C.Enable jumbo frames on all switches

D.Implement QoS to give iSCSI traffic higher priority

AnswerD

Correct: QoS reduces jitter by prioritizing iSCSI traffic.

Why this answer

High jitter indicates variable latency in the network, which is detrimental to iSCSI performance because iSCSI relies on TCP and is sensitive to delay variation. Implementing QoS to prioritize iSCSI traffic ensures consistent low-latency delivery by marking iSCSI frames (e.g., with DSCP CS4 or AF41) and queuing them ahead of other traffic, directly mitigating jitter. This is the most effective mitigation because it addresses the root cause—uncontrolled network congestion—rather than increasing parallelism or frame size.

Exam trap

Cisco often tests the misconception that jumbo frames or link aggregation solve latency and jitter issues, when in fact they address throughput and bandwidth, not delay variation; the trap is confusing throughput optimization with latency/jitter mitigation.

How to eliminate wrong answers

Option A is wrong because using multiple iSCSI sessions per initiator increases parallelism but does not reduce jitter; it can actually exacerbate congestion and jitter by adding more TCP streams. Option B is wrong because link aggregation (LACP) increases aggregate bandwidth and provides redundancy but does not prioritize traffic or reduce jitter; it may even spread iSCSI flows across multiple links, causing out-of-order delivery and retransmissions. Option C is wrong because enabling jumbo frames reduces CPU overhead and improves throughput for large transfers but does not address jitter; jumbo frames can even increase latency variation if not supported end-to-end or if fragmentation occurs.

Full explanation →

555

MCQhard

An engineer receives an error 'XML namespace mismatch' when using NETCONF to configure a Nexus switch. The YANG model used is from the Cisco NX-OS openconfig model. What is the most likely cause?

A.The namespace in the XML payload does not match the YANG model

B.The switch is running in VM mode

C.The YANG model is not supported on this switch version

D.The NETCONF session is not authenticated

AnswerA

Directly causes the namespace mismatch error.

Why this answer

The 'XML namespace mismatch' error occurs when the namespace URI declared in the XML payload does not match the namespace defined in the YANG module. NETCONF uses the namespace to identify the correct YANG model for parsing the configuration data. If the namespace in the XML does not exactly match the one in the Cisco NX-OS openconfig YANG model, the switch rejects the operation with this specific error.

Exam trap

Cisco often tests the distinction between namespace mismatch errors and other NETCONF failures (like unsupported model or authentication), so candidates mistakenly choose 'unsupported model' when the error message explicitly points to a namespace issue.

How to eliminate wrong answers

Option B is wrong because VM mode (virtual machine mode) does not affect XML namespace validation; it is a licensing or operational mode that does not change NETCONF protocol behavior. Option C is wrong because if the YANG model were unsupported, the error would typically be 'data model not supported' or 'capability not advertised', not a namespace mismatch. Option D is wrong because an unauthenticated NETCONF session would fail at the session establishment phase (e.g., 'authentication failed' or 'session rejected'), not during payload processing with a namespace-specific error.

Full explanation →

556

Multi-Selecteasy

Which two statements about the NX-API REST interface on Nexus switches are true? (Choose two.)

Select 2 answers

A.It supports JSON and XML encoding.

B.It uses YANG models exclusively.

C.It only supports read-only operations.

D.It requires enabling 'feature nxapi' on the switch.

E.It uses SSH for transport.

AnswersA, D

Both formats are supported.

Why this answer

NX-API REST supports JSON and XML and uses HTTPS for secure communication.

Full explanation →

557

MCQmedium

A UCS administrator is creating a boot policy for a service profile that will be used for B-series blades. The requirement is to boot from a LUN on a SAN-attached storage array. Which boot order should be configured in the service profile boot policy?

A.Local disk and SAN with equal priority

B.PXE first, then SAN

C.Local disk first, then SAN

D.SAN only with vHBA

AnswerD

Correct. Boot from SAN requires the vHBA as the primary (and only) boot device in the policy.

Why this answer

Boot from SAN uses a vHBA to connect to a storage LUN. The boot policy should list the SAN target first.

Full explanation →

558

MCQhard

An organization deploys compute resources using both UCS B-Series blades and C-Series rack servers. The network uses Cisco ACI. Which approach ensures consistent connectivity policies across both compute types?

A.Use a single EPG with appropriate encapsulation for both

B.Create separate EPGs for blade and rack servers

C.It is not possible to have consistent policies between blade and rack

D.Use a physical domain for blades and a VMM domain for rack servers

AnswerA

Single EPG ensures consistent policy application

Why this answer

Cisco ACI allows a single Endpoint Group (EPG) to span both UCS B-Series blades and C-Series rack servers by using the appropriate encapsulation (e.g., VLAN or VXLAN) and associating the EPG with both a physical domain (for blades connected via Fabric Interconnects) and a VMM domain (for rack servers managed by VMware vCenter). This ensures consistent connectivity policies, such as contracts and QoS, are applied uniformly across all compute types without requiring separate EPGs.

Exam trap

Cisco often tests the misconception that different compute types (blade vs. rack) require separate EPGs, when in fact a single EPG can span multiple domains to enforce consistent policies, and the trap here is assuming that physical and VMM domains are mutually exclusive rather than complementary.

How to eliminate wrong answers

Option B is wrong because creating separate EPGs for blade and rack servers would fragment policy enforcement, requiring duplicate contracts and filters, which contradicts the goal of consistent connectivity policies. Option C is wrong because it is entirely possible to have consistent policies between blade and rack servers using a single EPG with appropriate domain associations, as supported by Cisco ACI's unified policy model. Option D is wrong because using a physical domain for blades and a VMM domain for rack servers is a valid approach to associate the EPG with both compute types, but the statement incorrectly implies they must be used separately; in fact, both domains can be attached to the same EPG to achieve consistency.

Full explanation →

559

MCQeasy

A storage administrator connects a host to an MDS switch via Fibre Channel. The host has an HBA with WWPN 21:00:00:1b:32:12:34:56. Which port type does the MDS switch automatically configure on the interface connecting to the host?

A.F-port

B.Trunk port

C.NP-port

D.E-port

AnswerA

F-port connects to an N-port (host or target) and provides fabric services.

Why this answer

When a host (N-port) connects to a switch, the switch operates as an F-port (fabric port) to provide fabric services. Cisco MDS switches auto-detect and configure the port as F-port unless specifically set otherwise.

Full explanation →

560

MCQeasy

Which best practice should be followed when creating a UCS service profile template for stateless computing?

A.Assign MAC and WWN addresses from pools

B.Use local storage on each server for boot images

C.Configure Windows Server NIC teaming for all vNICs

D.Define MAC addresses directly in the service profile

AnswerA

Pools enable auto-assignment and stateless operation

Why this answer

Stateless computing in UCS requires that all server identity information, such as MAC addresses and WWNs, be abstracted away from the hardware and assigned dynamically from pools. This allows the service profile to be applied to any compatible blade or rack server without manual reconfiguration, enabling rapid provisioning and seamless hardware replacement. Defining these addresses directly in the profile or using static assignments would break the stateless model by tying the profile to specific hardware.

Exam trap

Cisco often tests the misconception that stateless computing means you can hardcode identities like MAC addresses for consistency, when in fact the opposite is true—pools are essential to maintain the stateless abstraction.

How to eliminate wrong answers

Option B is wrong because stateless computing relies on centralized boot from SAN or network storage, not local storage, to ensure that server identity and data are independent of the physical hardware; using local storage would reintroduce statefulness. Option C is wrong because Windows Server NIC teaming is a guest OS-level configuration that should be handled separately from the UCS service profile, which manages vNIC failover via fabric failover or pinning at the infrastructure layer. Option D is wrong because defining MAC addresses directly in the service profile defeats the purpose of stateless computing by creating a hard dependency on specific addresses, preventing the profile from being reused across different servers without conflict.

Full explanation →

561

MCQmedium

In a Cisco ACI fabric, a new EPG is created and associated with a bridge domain that has 'Unicast Routing' enabled. However, endpoints in that EPG cannot communicate with endpoints in other EPGs in the same VRF. What is missing?

A.The EPG must be attached to a Layer 3 outside

B.The bridge domain must have 'L3 Unknown Multicast Flooding' set

C.A contract between the EPGs

D.A route leak between bridge domains

AnswerC

Inter-EPG communication requires a contract; without it, packets are dropped.

Why this answer

In Cisco ACI, communication between EPGs within the same VRF is not allowed by default; it requires a contract. A contract defines the policies (allow/deny) and filters for traffic between EPGs. Without a contract, all traffic is dropped, even if the bridge domain has unicast routing enabled.

Option C is correct because the missing element is the contract that explicitly permits inter-EPG communication.

Exam trap

Cisco often tests the misconception that enabling unicast routing on a bridge domain is sufficient for inter-EPG communication, when in fact contracts are mandatory in ACI to allow any traffic between EPGs.

How to eliminate wrong answers

Option A is wrong because attaching a Layer 3 outside is used for external connectivity (e.g., to a router or WAN), not for enabling communication between EPGs within the same VRF. Option B is wrong because 'L3 Unknown Multicast Flooding' controls how unknown multicast traffic is handled (flood or forward to a multicast router), not unicast routing between EPGs. Option D is wrong because route leaking between bridge domains is not a native ACI concept; inter-EPG routing within the same VRF is handled by the ACI fabric automatically via the contract policy, not by explicit route leaks.

Full explanation →

562

MCQmedium

Refer to the exhibit. The server in slot 2 is associated and working. A new server is inserted into slot 1, but after 30 minutes it remains in 'Unassigned' state. What is the most likely reason?

A.The service profile is already associated with another server.

B.The server is not powered on.

C.The server's CIMC firmware is not compatible with the Fabric Interconnect firmware.

D.The Fabric Interconnect ports are not configured as server ports.

AnswerC

Incompatibility can cause discovery to fail, leaving the slot unassigned.

Why this answer

The server in slot 1 remains in 'Unassigned' state because its CIMC firmware is incompatible with the Fabric Interconnect firmware. In Cisco UCS, the CIMC on each blade must match a supported firmware version for the Fabric Interconnect to discover and manage the server. When firmware versions are mismatched, the server cannot transition to the 'Associated' state and stays 'Unassigned'.

Exam trap

Cisco often tests the distinction between 'Unassigned' (server not discovered/manageable) and 'Unassociated' (server discovered but not bound to a service profile), leading candidates to incorrectly attribute the issue to service profile association or power state.

How to eliminate wrong answers

Option A is wrong because if the service profile were already associated with another server, the new server would show as 'Unassociated' (available for association) or would fail association, not remain 'Unassigned' — the 'Unassigned' state indicates the server is not yet discovered or manageable. Option B is wrong because a server not powered on would still be discovered by the Fabric Interconnect and appear in a 'Discovered' or 'Unassociated' state; power state does not prevent the server from being assigned a service profile. Option D is wrong because Fabric Interconnect ports configured as server ports are required for server connectivity, but if they were misconfigured, the existing server in slot 2 would also be affected and not working — the exhibit shows slot 2 is associated and working, so port configuration is correct.

Full explanation →

563

MCQmedium

In ACI automation, the APIC REST API interacts with the Management Information Tree (MIT). Which of the following represents a typical hierarchical object path in the MIT?

A./api/node/class/topSystem.json

B./api/mo/sys/intf.json

C./api/mo/uni/fabric/protpol.json

D./api/mo/uni/tn-{tenant}/ap-{app}/epg-{epg}.json

AnswerD

Correct: This represents the MIT path for an EPG under an application profile under a tenant.

Why this answer

The MIT follows a hierarchy: Tenant > Application Profile (AP) > Endpoint Group (EPG).

Full explanation →

564

MCQmedium

A UCS service profile includes a vHBA that is bound to a WWPN. The blade server fails and is replaced with a new blade of the same model. What happens to the WWPN configuration after the replacement?

A.The WWPN must be re-imported from the SAN fabric

B.The WWPN is automatically applied from the service profile to the new blade

C.The WWPN is generated by the CIMC of the new blade

D.The WWPN is lost and must be reconfigured manually on the new blade

AnswerB

Correct. The service profile abstracts the WWPN, so the new blade inherits it.

Why this answer

Stateless computing ensures that the WWPN is inherited from the service profile, so the replacement blade uses the same WWPN.

Full explanation →

565

MCQmedium

What is the purpose of FIP (FCoE Initialization Protocol) in an FCoE network?

A.To discover FCoE-capable devices and establish virtual links

B.To provide flow control for FCoE traffic

C.To negotiate DCB parameters

D.To encapsulate FC frames into Ethernet frames

AnswerA

FIP handles discovery and initialization.

Why this answer

FIP is used to discover and initialize FCoE devices and establish virtual links before FCoE data frames can be sent.

Full explanation →

566

Multi-Selectmedium

Which THREE are correct about using Ansible with Cisco NX-OS? (Choose three.)

Select 3 answers

A.Ansible requires an agent installed on the Nexus switch.

B.The cisco.nxos collection includes the nxos_vlan module.

C.Playbooks are written in YAML format.

D.Ansible uses a proprietary protocol to communicate with Nexus switches.

E.The nxos_config module is used to manage configuration on NX-OS.

AnswersB, C, E

Correct. nxos_vlan is part of cisco.nxos.

Why this answer

The cisco.nxos collection includes modules like nxos_vlan, nxos_interface, nxos_bgp, and nxos_config. Playbooks are written in YAML. Ansible uses SSH (or NX-API) to connect, not a dedicated agent. 'nxos_facts' is a module for gathering facts.

Full explanation →

567

MCQeasy

Refer to the exhibit. What is the current state of the VPC domain?

A.VPC domain not configured

B.Peer-link down

C.Consistency check failed

D.Operational

AnswerD

All fields indicate normal operation.

Why this answer

The exhibit shows the output of 'show vpc' with the vPC domain ID set to 100, the peer-keepalive link status as 'Active', and the peer-link status as 'up'. The vPC role is 'primary' and the operational status is listed as 'operational', which indicates that the vPC domain is fully functional and all consistency checks have passed. Therefore, the current state is operational.

Exam trap

Cisco often tests the distinction between the peer-link being 'up' and the vPC domain being 'operational', where candidates may incorrectly assume a peer-link failure when the domain is actually operational, or confuse a consistency check failure with a peer-link issue.

How to eliminate wrong answers

Option A is wrong because the output clearly shows a vPC domain ID of 100, peer-keepalive link status as 'Active', and peer-link status as 'up', indicating the domain is configured. Option B is wrong because the peer-link status is explicitly shown as 'up' in the output, not down. Option C is wrong because the operational status is 'operational' and there is no indication of a consistency check failure; a failed consistency check would show a 'failed' or 'suspended' status for the vPC.

Full explanation →

568

MCQhard

Refer to the exhibit. The configuration is intended to provide Layer 2 isolation within VLAN 100 while allowing the promiscuous port (Ethernet 1/1) to communicate with all ports in the community VLAN. However, hosts in VLAN 100 cannot communicate with each other. What is the most likely misconfiguration?

A.The SVI interface needs 'ip address' to be removed.

B.The SVI interface should have 'private-vlan mapping' to the primary VLAN, not the community VLAN.

C.The 'switchport private-vlan association trunk' command on Ethernet 1/1 is incorrect; it should be 'switchport private-vlan association mapping' or similar.

D.The command 'no ip redirects' should not be applied to the SVI.

AnswerC

The association command syntax is likely wrong; it should map the secondary VLAN to the promiscuous port.

Why this answer

The command 'switchport private-vlan association trunk' is invalid for configuring a promiscuous port in a private VLAN. The correct command is 'switchport private-vlan mapping primary-vlan-id secondary-vlan-id' to map the promiscuous port to the primary VLAN and the secondary community VLAN. Without this correct mapping, the promiscuous port cannot forward traffic to hosts in the community VLAN, causing Layer 2 isolation to fail.

Exam trap

Cisco often tests the distinction between 'private-vlan association' (used on trunk ports) and 'private-vlan mapping' (used on promiscuous or host ports), leading candidates to confuse the two commands and misapply them.

How to eliminate wrong answers

Option A is wrong because removing the IP address from the SVI would break Layer 3 routing for VLAN 100, which is not required for Layer 2 isolation; the SVI IP is needed for management or routing, and its presence does not affect private VLAN behavior. Option B is wrong because the 'private-vlan mapping' on the SVI should map the primary VLAN to the secondary community VLAN (e.g., 'private-vlan mapping 100 200'), not the community VLAN to the primary; the given syntax is correct in intent, but the issue is on the promiscuous port, not the SVI. Option D is wrong because 'no ip redirects' is a security feature that disables ICMP redirects and does not impact private VLAN isolation or host-to-host communication within a community VLAN.

Full explanation →

569

Matchingmedium

Match each Cisco ACI component to its role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Central controller for policy management

Leaf-to-leaf connectivity and fabric backplane

Top-of-rack switch connecting servers to fabric

Endpoint group for policy application

Bridge domain for Layer 2 forwarding context

Why these pairings

Correct matches: APIC is the central policy controller; Spine switches connect leaves; Leaf switches connect endpoints. Common confusions include mistaking APIC as a forwarding switch and associating EPG with spine switches.

Full explanation →

570

MCQhard

In an FCoE environment, which protocol is responsible for discovering and initializing FCoE-capable endpoints, including the exchange of MAC addresses and establishing virtual links?

A.ARP

B.DCBX

C.FCoE

D.FIP

AnswerD

FIP handles discovery and initialization for FCoE.

Why this answer

The FCoE Initialization Protocol (FIP) is used to discover FCoE devices and establish virtual links before FCoE data frames are sent.

Full explanation →

571

MCQmedium

Which feature on a Nexus switch uses DHCP snooping binding information to filter IP traffic on a per-port basis?

A.Port Security

B.IP Source Guard

C.Dynamic ARP Inspection

D.CoPP

AnswerB

IP Source Guard filters IP traffic based on DHCP snooping bindings.

Why this answer

IP Source Guard uses DHCP snooping bindings to filter IP traffic, allowing only traffic from valid IP-MAC pairs.

Full explanation →

572

Drag & Dropmedium

Arrange the steps to create a service profile template in Cisco UCS Manager.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Service profile template requires UUID pool, vNIC template, profile creation, server pool association, and assignment.

Full explanation →

573

MCQhard

During a UCS service profile configuration, an engineer needs to specify that the server should boot from a SAN LUN. Which boot policy type should be configured?

A.SAN boot policy

B.Local disk boot policy

C.PXE boot policy

D.Virtual media boot policy

AnswerA

SAN boot policy enables booting from a Fibre Channel or FCoE LUN.

Why this answer

A SAN boot policy specifies the WWPN of the target and LUN ID to boot from a SAN LUN.

Full explanation →

574

MCQeasy

In a Cisco NX-OS environment, which command is used to verify the operational state of a virtual Port Channel (vPC) peer link?

A.show vpc brief

B.show port-channel summary

C.show running-config vpc

D.show vpc consistency-parameters

AnswerA

Displays vPC peer status, peer-link status, and consistency.

Why this answer

The 'show vpc brief' command displays the operational state of the vPC peer link, including whether the peer link is up, the role of the switch (primary/secondary), and the status of the vPC domain. This command is specifically designed to verify the health and operational status of the vPC peer link and member ports in a Cisco NX-OS environment.

Exam trap

Cisco often tests the distinction between commands that show configuration versus operational state, leading candidates to mistakenly choose 'show running-config vpc' (which only shows static configuration) instead of 'show vpc brief' (which shows live operational status).

How to eliminate wrong answers

Option B is wrong because 'show port-channel summary' displays the status of all port-channel interfaces, but it does not provide vPC-specific operational details such as peer link status, vPC role, or consistency checks. Option C is wrong because 'show running-config vpc' shows the configured vPC parameters (e.g., domain ID, peer keepalive settings) but not the real-time operational state of the peer link. Option D is wrong because 'show vpc consistency-parameters' is used to verify that vPC member ports have consistent configuration parameters across both peers, not to check the operational state of the peer link itself.

Full explanation →

575

Multi-Selectmedium

Which THREE are benefits of using Cisco UCS Manager to manage compute resources? (Choose three.)

Select 3 answers

A.Centralized management of multiple chassis

B.Direct management of virtual machines

C.Policy-based provisioning to automate server deployment

D.Improved performance by disabling hardware features

E.Unified fabric for LAN and SAN traffic

AnswersA, C, E

UCS Manager manages up to 160 chassis.

Why this answer

Cisco UCS Manager provides a single-pane-of-glass management interface that can centrally manage up to 160 chassis (including UCS 5108 and UCS 9508) in a single domain. This eliminates the need to configure each chassis individually, reducing operational overhead and ensuring consistent configuration across the entire compute infrastructure.

Exam trap

Cisco often tests the distinction between what UCS Manager directly manages (physical compute and fabric) versus what it integrates with (hypervisors for VMs), so candidates mistakenly think UCS Manager can manage VMs because of its integration with VMware vCenter.

Full explanation →

576

MCQmedium

An engineer is configuring OSPF on a Cisco Nexus switch in a data center. The network consists of multiple point-to-point links. To improve convergence, the engineer wants to reduce the dead interval to 10 seconds. Which command sets the dead interval correctly?

A.ip ospf dead-interval 30

B.ip ospf hello-interval 10

C.ip ospf dead-interval 10

D.ip ospf dead-interval 40

AnswerC

Sets dead interval to 10 seconds.

Why this answer

The 'ip ospf dead-interval 10' command directly sets the OSPF dead interval to 10 seconds on a Cisco Nexus switch. The dead interval is the time a router waits without receiving a hello packet before declaring the neighbor down, and reducing it to 10 seconds speeds up convergence on point-to-point links.

Exam trap

Cisco often tests the distinction between the 'ip ospf dead-interval' and 'ip ospf hello-interval' commands, trapping candidates who confuse the two or assume that changing the hello interval automatically adjusts the dead interval.

How to eliminate wrong answers

Option A is wrong because 'ip ospf dead-interval 30' sets the dead interval to 30 seconds, not 10, which does not meet the requirement. Option B is wrong because 'ip ospf hello-interval 10' sets the hello interval to 10 seconds, not the dead interval; while related, this command does not directly configure the dead interval. Option D is wrong because 'ip ospf dead-interval 40' sets the dead interval to 40 seconds, which is longer than the desired 10 seconds and would actually slow convergence.

Full explanation →

577

MCQmedium

In a Cisco ACI fabric, which object represents a collection of endpoints that share the same forwarding behavior and security policies?

A.VRF

B.Tenant

C.Endpoint Group (EPG)

D.Bridge Domain (BD)

AnswerC

EPG is a collection of endpoints with shared policies.

Why this answer

In Cisco ACI, an Endpoint Group (EPG) is a logical object that groups endpoints (e.g., servers, VMs) with identical forwarding behavior and security policies. EPGs are the fundamental unit for applying contracts (security policies) and defining communication rules within the fabric, ensuring consistent traffic handling across all members.

Exam trap

Cisco often tests the distinction between an EPG and a Bridge Domain, where candidates mistakenly think the BD (Layer 2 domain) defines security policies, but in ACI, security is applied at the EPG level via contracts.

How to eliminate wrong answers

Option A is wrong because a VRF (Virtual Routing and Forwarding) is a Layer 3 routing domain that provides path isolation and route separation, not a collection of endpoints with shared forwarding and security policies. Option B is wrong because a Tenant is a top-level administrative container for policies and objects (like EPGs, VRFs, BDs) but does not itself represent a group of endpoints. Option D is wrong because a Bridge Domain (BD) defines a Layer 2 forwarding domain and subnet, but it is the EPG that maps endpoints to the BD and applies security policies via contracts.

Full explanation →

578

MCQeasy

An engineer is configuring iSCSI multipath I/O (MPIO) for a storage array. The initiator has two NICs connected to two different switches, and the target has two iSCSI ports on different subnets. Which condition must be met for MPIO to function correctly?

A.CHAP authentication must be disabled.

B.Each path must be on a separate subnet.

C.Both paths must be on the same subnet.

D.Jumbo frames must be enabled on all interfaces.

AnswerB

Separate subnets ensure distinct paths for MPIO.

Why this answer

MPIO requires that the initiator and target have multiple paths that are not on the same subnet to avoid routing issues. Typically, each path should be on a separate subnet.

Full explanation →

579

MCQmedium

An organization is deploying a new leaf-spine fabric with Cisco ACI. The requirement is to allow inter-tenant communication between two EPGs in different tenants. Which configuration object is necessary to enable this communication?

A.A common VRF that spans both tenants.

B.A filter that permits the required traffic.

C.A bridge domain that connects both EPGs.

D.A shared contract between the two EPGs.

AnswerD

Contracts define allowed communication; shared contracts work across tenants.

Why this answer

In Cisco ACI, inter-tenant communication between EPGs in different tenants requires a shared contract. A contract defines the rules (filters) that permit traffic between EPGs, and when it is marked as 'shared,' it can be consumed by EPGs across tenant boundaries. This allows the provider EPG in one tenant to expose services to a consumer EPG in another tenant without merging the tenants' VRFs or bridge domains.

Exam trap

Cisco often tests the misconception that a shared VRF or bridge domain is required for inter-tenant communication, but the correct mechanism is a shared contract that applies policy across tenant boundaries without merging the underlying network constructs.

How to eliminate wrong answers

Option A is wrong because a common VRF spanning both tenants is not a configuration object for inter-tenant communication; VRFs are tenant-scoped and cannot be shared across tenants—each tenant has its own private VRF namespace. Option B is wrong because a filter alone only defines the traffic type (e.g., TCP port 80) but does not provide the policy framework (contract) needed to permit traffic between EPGs; a filter must be part of a contract. Option C is wrong because a bridge domain connects EPGs within the same tenant and VRF, not across tenants; inter-tenant communication requires a contract, not a shared bridge domain.

Full explanation →

580

Multi-Selecthard

An organization is deploying a new Fibre Channel SAN with Cisco MDS switches. The design requires high availability and load sharing over multiple ISLs. Which three features should be implemented? (Choose three.)

Select 3 answers

A.NPIV

B.Fibre Channel PortChannels

C.Multiple equal-cost paths via FSPF

D.Hard zoning by WWPN

E.VSAN trunking (EISL)

AnswersB, C, E

PortChannels combine multiple ISLs for increased bandwidth and redundancy.

Why this answer

VSAN trunking (EISL) allows multiple VSANs over a single ISL; PortChannels aggregate multiple physical ISLs into a logical link with load balancing; multiple active equal-cost paths (FSPF) provide load sharing and redundancy.

Full explanation →

581

Drag & Dropmedium

Order the steps to upgrade the software on a Cisco Nexus switch using ISSU.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

ISSU requires image copy, boot variable, compatibility check, upgrade command, and reload.

Full explanation →

582

MCQhard

A data center uses HyperFlex HX Data Platform with a 3-node cluster configured with replication factor 2 (RF2). One node fails permanently. What is the impact on data availability and cluster operation?

A.Data is unavailable until the failed node is replaced

B.The witness VM takes over the failed node's storage role

C.The cluster automatically changes to RF3 to maintain protection

D.All data remains accessible but the cluster is degraded and requires a new node to restore RF2

AnswerD

Correct. Data is available, but redundancy is lost until a new node is added.

Why this answer

With RF2, each data block is stored on two nodes. If one node fails, the remaining two nodes have all data, but the cluster becomes degraded. A new node must be added to restore redundancy.

Full explanation →

583

Multi-Selectmedium

A network administrator is planning a UCS C-Series rack server deployment. Which two statements correctly describe the integration modes with UCS Manager? (Choose two.)

Select 2 answers

A.In Cisco IMC Supervisor mode, the server is managed by the IMC Supervisor but can also be integrated into UCS Manager.

B.In Cisco IMC Supervisor mode, the server's CIMC is managed directly by UCS Manager.

C.In Direct Connect mode, the server must be connected to a Fabric Interconnect via a supported adapter.

D.In Direct Connect mode, the server is managed directly by UCS Manager via the Fabric Interconnect.

E.Standalone mode allows the server to be managed by UCS Manager without any additional configuration.

AnswersC, D

Direct Connect requires a VIC adapter that connects to the FI.

Why this answer

Direct Connect mode connects servers directly to FI for management; IMC Supervisor mode manages via IMC Supervisor; standalone mode is independent.

Full explanation →

584

MCQeasy

An organization has deployed a Cisco UCS B-Series blade server with a Fabric Interconnect pair. The administrator is tasked with deploying a new server for a critical application. The administrator creates a service profile from an existing template that includes vNIC, vHBA, and storage policies. The blade is located in chassis 2, slot 1. The administrator attempts to associate the profile with this blade but fails with the error: 'No suitable compute resource available.' The administrator verifies that the blade's firmware is updated, that the blade is not already associated with another profile, and that it has sufficient memory and CPU. What is the most likely cause?

A.The blade's firmware version is incompatible with the service profile.

B.The blade is in the wrong chassis slot.

C.The server pool policy is not assigned to the service profile template.

D.The vNIC/vHBA policies in the service profile have invalid MAC/WWN assignments.

AnswerC

Without a server pool, UCS Manager cannot determine which blade to use for the association, leading to the 'No suitable compute resource available' error.

Why this answer

The error 'No suitable compute resource available' typically occurs when the service profile is configured to use a server pool, but no server pool policy is assigned to the service profile template. Without a server pool, the Fabric Interconnect cannot identify which blades are eligible for association, even if the blade itself is available and meets hardware requirements. Assigning a server pool policy to the template ensures that blades in the specified pool (e.g., chassis 2, slot 1) are considered as valid compute resources.

Exam trap

Cisco often tests the concept that 'No suitable compute resource available' is not about hardware faults or firmware mismatches but about the absence of a server pool policy in the service profile template, which candidates may overlook because they focus on verifying blade hardware readiness.

How to eliminate wrong answers

Option A is wrong because the administrator already verified that the blade's firmware is updated, and firmware incompatibility would typically generate a different error (e.g., 'Firmware version mismatch') rather than 'No suitable compute resource available.' Option B is wrong because the blade's location (chassis 2, slot 1) is explicitly specified in the service profile association attempt, and the error is not about physical slot constraints but about logical resource selection. Option D is wrong because invalid MAC/WWN assignments would cause a policy validation failure or association error related to network/storage configuration, not a 'no suitable compute resource' error, which is specifically about the blade not being found in the available resource pool.

Full explanation →

585

MCQmedium

An engineer is configuring a Cisco MDS switch to connect to a core switch in NPV mode. The edge switch will be connected to the core via an ISL. What port mode should be configured on the edge switch's interface connecting to the core?

A.F-port

B.E-port

C.NP-port

D.auto

AnswerC

NP-port is the correct mode for an edge switch interface connecting to the core fabric in NPV mode.

Why this answer

In NPV mode, the edge switch uses NP-ports to connect to the core switch's F-ports. This allows the edge switch to appear as a host to the core fabric.

Full explanation →

586

Multi-Selecteasy

Which two VXLAN control plane options are supported on Cisco Nexus 9000 switches? (Choose two.)

Select 2 answers

A.Multicast

B.OTV

C.Static VXLAN tunnel

D.OpenFlow

E.MP-BGP EVPN

AnswersA, E

Traditional VXLAN uses multicast for BUM traffic and MAC learning.

Why this answer

VXLAN on Cisco Nexus 9000 switches supports both multicast-based control plane (using IGMP/PIM to flood BUM traffic) and MP-BGP EVPN (RFC 7432) as the control plane for distributing MAC/VTEP reachability. Multicast is the traditional method for handling BUM traffic in VXLAN fabrics, while MP-BGP EVPN provides a more scalable, standards-based control plane with host route advertisement and multi-tenancy.

Exam trap

Cisco often tests the distinction between VXLAN control plane options and other overlay technologies (like OTV) or configuration methods (like static tunnels), leading candidates to confuse supported control planes with unrelated features.

Full explanation →

587

Multi-Selecthard

Which three checks are part of the vPC type-1 consistency check? (Choose three.)

Select 3 answers

A.Port-channel load-balancing method

B.STP mode

C.VLAN interface state

D.MTU on the peer-link

E.MST region name

AnswersB, C, E

STP mode (e.g., RSTP, MST) must match.

Why this answer

Type-1 consistency parameters are critical and must match on both vPC peers; they include STP mode, MST region, VLAN configuration, and vPC-related parameters like role priority. STP mode, MST region name, and VLAN interface configuration are type-1.

Full explanation →

588

MCQhard

In Cisco TrustSec, which technology is used to enforce east-west traffic policies based on identity without relying on IP addresses?

A.SGT

B.SGACL

C.ACLs

D.VLAN ACLs

AnswerB

SGACLs use SGTs for policy.

Why this answer

SGACLs enforce policies based on SGTs, not IP addresses.

Full explanation →

589

MCQmedium

A DevOps team wants to version control network device configurations. Which tool is best suited for tracking changes and collaborating on configuration files?

A.Python virtual environment

B.Ansible Tower

C.Cisco Prime Infrastructure

D.Git

AnswerD

Git provides distributed version control.

Why this answer

Git is the industry standard for version control, enabling history, branching, and collaboration.

Full explanation →

590

MCQhard

Refer to the exhibit. The CoPP policy above is applied. Which traffic is most likely to be dropped?

A.Both ICMP and class-default traffic that exceed their rates

B.ICMP traffic that exceeds 1000 bps

C.class-default traffic that exceeds 20000 bps

D.OSPF traffic that exceeds 5000 bps

AnswerB

The ICMP class drops packets that exceed the police rate.

Why this answer

The CoPP policy explicitly defines a class-map for ICMP traffic with a police rate of 1000 bps. Any ICMP traffic exceeding this rate is dropped due to the 'drop' action in the police command. The other classes (OSPF and class-default) have higher rates and are not as constrained, making ICMP the most likely to be dropped when exceeded.

Exam trap

Cisco often tests the misconception that all traffic exceeding its policed rate is equally likely to be dropped, but the trap here is that the lowest policed rate (ICMP at 1000 bps) is the most restrictive and thus the most likely to be exceeded and dropped, not the higher-rate classes.

How to eliminate wrong answers

Option A is wrong because the class-default traffic is policed at 20000 bps, which is a much higher rate than ICMP's 1000 bps, so class-default is less likely to be dropped unless it significantly exceeds its rate; ICMP is the primary concern. Option C is wrong because class-default traffic has a police rate of 20000 bps, which is 20 times higher than ICMP's rate, making it less likely to be dropped under typical traffic loads. Option D is wrong because OSPF traffic is policed at 5000 bps, which is 5 times higher than ICMP's rate, and OSPF control traffic is typically low-volume, so it is not the most likely to be dropped.

Full explanation →

591

MCQhard

A UCS administrator notices that a server in a UCS domain is not booting from SAN after a firmware upgrade. The service profile shows the correct WWPN and boot policy. The SAN switch sees the initiator login. However, the storage array does not see any initiator attempts. What is the most likely issue?

A.The boot policy is missing the primary SAN target

B.The WWPN is duplicated on another initiator

C.The zone alias on the SAN switch does not match the initiator WWPN

D.The VSAN membership is incorrect on the fabric interconnect

AnswerC

The zone alias mismatch would allow login (since zoning is based on WWPN) but the storage may not see the initiator if zones are misconfigured.

Why this answer

The SAN switch sees the initiator login, but the storage array does not see any initiator attempts. This indicates that the Fibre Channel fabric is blocking the initiator's WWPN from reaching the storage target, typically because the zone configuration on the SAN switch does not include the initiator's WWPN or the zone alias does not match the actual WWPN. Since the service profile and boot policy are correct, and the VSAN membership is functional (the switch sees the login), the most likely issue is a zoning mismatch on the SAN switch.

Exam trap

Cisco often tests the distinction between fabric-level visibility (FLOGI success) and zone-level communication (PLOGI/PRLI failure) to trick candidates into assuming the issue is with the boot policy or VSAN membership rather than zoning.

How to eliminate wrong answers

Option A is wrong because the boot policy is confirmed correct in the question, and a missing primary SAN target would cause the server to fail to find the boot LUN, but the storage array would still see initiator attempts if zoning were correct. Option B is wrong because a duplicate WWPN would cause login conflicts or fabric segmentation, but the SAN switch sees the initiator login successfully, ruling out duplication. Option D is wrong because incorrect VSAN membership would prevent the fabric interconnect from seeing the initiator login at all, but the SAN switch does see the login, indicating VSAN membership is functional.

Full explanation →

592

MCQmedium

A network administrator is troubleshooting a vPC pair and needs to verify the operational status of the vPC peer-link. Which NX-OS command displays vPC status including peer-link and member port states?

A.show vpc brief

B.show vpc consistency-parameters

C.show vpc peer-keepalive

D.show vpc

AnswerD

Shows vPC status, peer-link status, and member ports.

Why this answer

The 'show vpc' command (without any keyword) is the correct choice because it displays comprehensive vPC operational status, including the peer-link state (up/down), member port states, and vPC consistency status. This single command provides a high-level summary of all vPC components, making it the go-to command for initial troubleshooting of vPC peer-link and member port health.

Exam trap

The trap is that 'show vpc brief' does display the peer-link status (up/down), so candidates may think it provides sufficient information. However, it omits detailed member port states (e.g., individual port channel members and their status), which are essential for verifying operational health. The correct command 'show vpc' includes both peer-link status and per-member port details.

How to eliminate wrong answers

Option A is wrong because 'show vpc brief' displays a condensed output showing only vPC IDs, port channels, and their status, but it does not include detailed peer-link state or member port status. Option B is wrong because 'show vpc consistency-parameters' is used to verify that vPC configuration parameters (e.g., STP, VLANs) are consistent between the two vPC peers, not to show operational status of the peer-link or member ports. Option C is wrong because 'show vpc peer-keepalive' only displays the status of the Layer 3 keepalive link between vPC peers, which is separate from the peer-link (the Layer 2 port-channel used for data traffic and control-plane synchronization).

Full explanation →

593

MCQhard

In a Cisco ACI fabric, an external L3Out is configured to advertise a subnet to the outside. Which object must be created in the tenant to define the Layer 3 outside network connection?

A.L3Out

B.External EPG

C.Contract

D.Bridge Domain

AnswerA

L3Out is the object that defines the external connection.

Why this answer

In Cisco ACI, an L3Out is the object that defines the Layer 3 outside network connection for a tenant. It is created within the tenant to specify the routing protocol (e.g., OSPF, BGP, EIGRP) and the external subnet that will be advertised to the outside world. Without an L3Out, the fabric cannot establish external connectivity or advertise routes.

Exam trap

The trap here is that candidates often confuse the External EPG (which groups external endpoints) with the L3Out itself, but the L3Out is the actual configuration object that defines the Layer 3 outside network connection and routing policies.

How to eliminate wrong answers

Option B is wrong because an External EPG (External Endpoint Group) is a logical grouping of external endpoints that consume or provide services, but it is not the object that defines the Layer 3 outside network connection; it is associated with an L3Out. Option C is wrong because a Contract defines the policy for communication between EPGs (e.g., allow/deny traffic), not the Layer 3 outside network connection itself. Option D is wrong because a Bridge Domain is a Layer 2 forwarding context within a tenant that handles internal subnet traffic, not external Layer 3 routing.

Full explanation →

594

Matchingmedium

Match each Cisco MDS FC switch feature to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Virtual SAN for isolating Fibre Channel traffic

Access control between initiators and targets

Routing protocol for Fibre Channel fabric

Fibre Channel over IP for remote connectivity

Inter-VSAN routing for selective communication

Why these pairings

VSAN, Zoning, and NPV are correctly matched. FCoE encapsulates Fibre Channel over Ethernet, and DCNM provides centralized management. Common confusions include mixing VSAN with FCoE or DCNM with FCoE.

Full explanation →

595

MCQhard

An engineer is troubleshooting a SAN performance issue. The MDS switch shows high CRC errors on an F port. The host is connected via a 16 Gbps FC link. The errors increase when the host sends large I/O. What is the most likely cause?

A.The host's HBA firmware is outdated.

B.The zone configuration is incorrect.

C.The host is experiencing buffer credit starvation.

D.The switch port is configured for 8 Gbps.

E.The cable length exceeds the supported distance for 16 Gbps.

AnswerE

16 Gbps FC has shorter reach; long cables cause CRC errors, especially under heavy load.

Why this answer

At 16 Gbps Fibre Channel, signal integrity degrades over long cable distances, causing bit errors that manifest as CRC errors on the F port. The error increase with large I/O is characteristic of marginal signal quality, as larger frames are more likely to encounter corrupted bits. Option E correctly identifies that the cable length exceeds the supported distance for 16 Gbps, typically 10 meters for OM3 multimode fiber or 100 meters for OM4, depending on the transceiver type.

Exam trap

Cisco often tests the distinction between physical-layer errors (CRC, running disparity) and higher-layer issues (buffer credits, zoning), so the trap here is that candidates confuse buffer credit starvation (a flow-control problem) with CRC errors (a signal-integrity problem).

How to eliminate wrong answers

Option A is wrong because outdated HBA firmware typically causes link instability or negotiation failures, not CRC errors that scale with I/O size. Option B is wrong because zone configuration errors cause connectivity or login issues, not CRC errors on an established link. Option C is wrong because buffer credit starvation causes performance degradation (e.g., reduced throughput) due to lack of credits, not CRC errors; CRC errors indicate physical-layer issues.

Option D is wrong because if the switch port were configured for 8 Gbps, the link would negotiate to 8 Gbps and CRC errors would not increase with large I/O at 16 Gbps; the symptom would be a speed mismatch, not CRC errors.

Full explanation →

596

MCQeasy

Which VPC component is used to send Layer 2 control plane traffic between peer switches?

A.VPC consistency check

B.VPC peer keepalive

C.VPC member port

D.VPC peer-link

AnswerD

The peer-link is a Layer 2 port-channel that carries control and data traffic between peers.

Why this answer

The VPC peer-link is the special port channel that carries Layer 2 control plane traffic (such as BPDUs, HSRP hellos, and IGMP queries) between the two VPC peer switches. It ensures that both peers have a consistent view of the Layer 2 topology and can synchronize state for protocols like STP and vPC. Without the peer-link, control plane traffic would not be exchanged, breaking the VPC domain's ability to operate as a single logical switch.

Exam trap

Cisco often tests the distinction between the peer-link (which carries Layer 2 control plane traffic) and the peer-keepalive link (which only carries Layer 3 heartbeats), leading candidates to mistakenly select the peer-keepalive option.

How to eliminate wrong answers

Option A is wrong because VPC consistency check is a validation mechanism that verifies configuration parameters (e.g., STP mode, MTU) are identical on both peers, but it does not carry any traffic. Option B is wrong because VPC peer keepalive uses a separate Layer 3 link (typically a management or routed interface) to exchange periodic keepalive messages to detect peer failures; it does not carry Layer 2 control plane traffic. Option C is wrong because VPC member port is an individual port that belongs to a VPC and forwards data traffic, but it does not carry control plane traffic between the peers.

Full explanation →

597

Multi-Selecthard

Which THREE statements accurately describe FCIP (Fibre Channel over IP) configurations on Cisco MDS switches?

Select 3 answers

A.FCIP uses VE_port (Virtual E_port) interfaces to connect to the FC fabric

B.FCIP requires IPsec for security over public networks

C.FCIP can be used in conjunction with Fibre Channel port channels

D.FCIP compression reduces the latency of the IP transport

E.FCIP can be configured on a GigabitEthernet interface

AnswersA, C, E

VE_ports terminate FCIP tunnels.

Why this answer

FCIP encapsulates Fibre Channel frames into IP packets and uses VE_ports (Virtual E_ports) to connect separate FC fabrics over an IP network. VE_ports behave like standard E_ports but operate over an FCIP tunnel, allowing Fibre Channel fabric services to extend across the IP link.

Exam trap

Cisco often tests the misconception that FCIP compression reduces latency, when in fact it only reduces bandwidth usage and can actually increase latency due to the processing overhead of compression algorithms.

Full explanation →

598

MCQmedium

Two Cisco Nexus 9000 switches are connected via Ethernet interface 1/1. The engineer wishes to secure the link using MACsec (IEEE 802.1ae) with a pre-shared key for connectivity association key (CAK) protection. Both switches have the same hardware and software version supporting MACsec. The engineer configures the following on both switches: feature macsec macsec policy MACSEC_POLICY cipher-suite gcm-aes-128 security-mode no-encrypt mka sak-rekey-time 30 interface ethernet 1/1 macsec policy MACSEC_POLICY However, the link comes up without MACsec encryption (the port counter shows MACsec frames dropped). The engineer checks that the pre-shared key is configured correctly via 'macsec key-chain' but notices it was not explicitly applied. What is the most likely reason for MACsec failing to establish?

A.Both switches must have the same MACsec profile name.

B.The interface must be put in a 'macsec' mode with 'switchport macsec'.

C.The MACsec key chain must be created and referenced in the macsec policy, and the MKA policy must be applied to the interface with 'macsec mka policy'.

D.The 'feature macsec' command is not enabled, so MACsec is not operational.

AnswerC

Correct. A key chain must be defined and linked to the policy, and the MKA policy must be explicitly applied under the interface.

Why this answer

MACsec on Cisco Nexus 9000 switches requires a key chain to be defined and explicitly referenced within the MACsec policy. Without the 'key-chain' command under the 'macsec policy', the pre-shared key (CAK) is not available for MKA (MACsec Key Agreement) to derive session keys. Additionally, the MKA policy must be applied to the interface using 'macsec mka policy' to enable the key agreement protocol; simply enabling MACsec on the interface without these steps leaves the link unsecured, causing MACsec frames to be dropped.

Exam trap

Cisco often tests the requirement that a key chain must be explicitly referenced in the MACsec policy and that an MKA policy must be applied to the interface, tricking candidates into thinking that simply enabling MACsec on the interface with a policy is sufficient.

How to eliminate wrong answers

Option A is wrong because the MACsec profile name does not need to match on both switches; only the key chain parameters (e.g., key string) must match for MKA to succeed. Option B is wrong because 'switchport macsec' is not a valid command on Nexus 9000; the interface is placed into MACsec mode by applying the MACsec policy directly with 'macsec policy' under the interface. Option D is wrong because 'feature macsec' is correctly enabled in the configuration, so MACsec is operational at the feature level; the failure is due to missing key chain and MKA policy application, not the feature being disabled.

Full explanation →

599

MCQhard

In a VXLAN EVPN multi-tier design, which feature ensures traffic between leaf switches takes the optimal path without hair-pinning through a spine?

A.Anycast gateway

B.Type-2 routes

C.ECMP

D.ARP suppression

AnswerC

ECMP enables load distribution across multiple spines, avoiding hair-pinning.

Why this answer

C is correct because Equal-Cost Multipath (ECMP) in a VXLAN EVPN multi-tier design allows leaf switches to load-balance traffic across multiple equal-cost spine paths, ensuring that traffic between leaf switches takes the most direct route without being forced to hair-pin through a spine. ECMP leverages the underlying IP fabric's routing to forward VXLAN-encapsulated packets over any available spine, avoiding suboptimal forwarding that would occur if a single spine were used as a relay.

Exam trap

Cisco often tests the misconception that Anycast Gateway or ARP suppression directly influences inter-leaf forwarding paths, when in fact ECMP is the mechanism that enables optimal multi-path routing in the underlay to avoid hair-pinning.

How to eliminate wrong answers

Option A is wrong because Anycast Gateway (e.g., using the same IP and MAC on multiple VTEPs) is designed to provide first-hop redundancy and optimal host-to-gateway forwarding, not to prevent hair-pinning of leaf-to-leaf traffic through a spine. Option B is wrong because Type-2 routes (MAC/IP advertisement routes) are used in EVPN to advertise host reachability and MAC-to-IP bindings, not to influence the path selection between leaf switches. Option D is wrong because ARP suppression is a feature that reduces broadcast traffic by caching ARP replies on the VTEP, but it does not affect the forwarding path or prevent hair-pinning through a spine.

Full explanation →

600

MCQeasy

What is the purpose of the Cisco Integrated Management Controller (CIMC) for UCS C-Series rack servers?

A.To provide high-speed data switching between servers

B.To enable out-of-band management for remote server control

C.To manage storage arrays

D.To replace the need for a Fabric Interconnect

AnswerB

Correct. CIMC allows remote management.

Why this answer

CIMC provides out-of-band management for rack servers, including remote KVM, virtual media, and firmware updates, independent of the host OS.

Full explanation →

Page 8 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

Network Storage Network Automation Compute Security

See all domains with question counts →