Courseiva

Cisco DCCOR / CCNP Data Center Core 350-601 (350-601) — Questions 601–675

984 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 8

Page 9 of 14

Page 10
601
Multi-Selecthard

Which THREE are characteristics of Cisco TrustSec? (Select exactly 3)

Select 3 answers
A.Uses SGTs to enforce policy
B.Requires Cisco ISE
C.Operates at Layer 2
D.Uses CTS auth-proxy
E.Requires MACsec encryption
AnswersA, B, C

SGTs are central to TrustSec for classifying and enforcing access policies.

Why this answer

Cisco TrustSec uses Security Group Tags (SGTs) to enforce policy based on identity rather than IP addresses. It requires Cisco ISE as the policy server to assign SGTs and enforce access control. TrustSec operates at Layer 2 by embedding SGTs in Ethernet frames.

The CTS auth-proxy is a mechanism for legacy devices but is not a core characteristic; likewise, MACsec encryption is optional and not required.

Exam trap

A common mistake is to think TrustSec can work with any RADIUS server or that CTS auth-proxy is a core requirement. In fact, TrustSec mandates Cisco ISE, operates at Layer 2, and uses SGTs as its fundamental mechanism.

Full explanation →
602
Multi-Selectmedium

A UCS B-series blade server is experiencing boot issues. The service profile is configured to boot from local disk first, then SAN. The blade has local disks but they are not recognized. Which TWO actions should be taken to diagnose the issue?

Select 2 answers
A.Verify the boot policy in the service profile.
B.Re-associate the service profile.
C.Check the Fibre Channel fabric connectivity.
D.Review the local disk configuration policy and RAID settings.
E.Check the blade's CIMC for disk presence.
AnswersD, E

Improper RAID configuration can cause disks to be unrecognized.

Why this answer

Possible causes: local disk not connected, or RAID configuration missing. Checking physical presence in CIMC and verifying RAID configuration are logical first steps.

Full explanation →
603
MCQmedium

An organization has deployed a 4-node HyperFlex cluster with all-flash storage and replication factor 3 (RF3). One node fails. How many nodes are required to remain operational for the cluster to continue serving data without interruption?

A.1
B.2
C.4
D.3
AnswerD

Three nodes still hold all three replicas of data.

Why this answer

For RF3, data is replicated three times. With 4 nodes, if one fails, three remain, which still have all data copies. The cluster remains operational.

Full explanation →
604
Multi-Selecthard

An engineer is troubleshooting a performance issue on a Cisco MDS 9700 switch. The 'show interface fc1/1' output shows CRC errors incrementing slowly. The interface is connected to a storage array. Which two actions should the engineer take to resolve the issue?

Select 2 answers
A.Increase the MTU size on the interface.
B.Replace the fiber optic cable and SFP.
C.Enable BB_credit recovery on the interface.
D.Clear the interface counters.
E.Change the interface speed from auto to a fixed value.
AnswersB, C

Faulty cables or SFPs are common causes of CRC errors.

Why this answer

CRC errors on a Fibre Channel interface typically indicate physical-layer issues such as faulty cabling, damaged SFPs, or dirty optical connectors. Replacing the fiber optic cable and SFP (Option B) directly addresses the most common root cause of CRC errors. Additionally, enabling BB_credit recovery (Option C) helps mitigate performance degradation caused by buffer credit starvation, which can manifest as CRC-like symptoms in some scenarios.

Exam trap

Cisco often tests the distinction between physical-layer errors (CRC) and flow-control issues (BB_credit), tempting candidates to choose a single answer when both a physical fix and a protocol-level tuning are required.

Full explanation →
605
MCQmedium

An engineer notices that a vPC peer link is flapping. Which vPC component must be operational for the vPC to function correctly?

A.vPC member port
B.vPC consistency check
C.vPC peer link
D.vPC peer keepalive link
AnswerC

Peer link must be up for vPC to operate.

Why this answer

The vPC peer link is the critical component that must be operational for the vPC to function correctly. It carries control-plane traffic (e.g., Cisco Fabric Services over Ethernet, or CFSoE) and data-plane traffic between the two vPC peer switches. If the peer link flaps, the vPC domain cannot synchronize the necessary state information, causing the vPC to fail or become unstable.

Exam trap

Cisco often tests the misconception that the peer keepalive link is the most critical component for vPC operation, but in reality, the peer link is essential for data and control-plane synchronization, while the keepalive link is only a secondary heartbeat mechanism.

How to eliminate wrong answers

Option A is wrong because vPC member ports are the individual ports that belong to the vPC, but they are not required to be operational for the vPC itself to function; the vPC can exist even if member ports are down. Option B is wrong because the vPC consistency check is a validation mechanism that ensures configuration parameters match between peers, but it does not directly cause the vPC to function or flap; it only flags mismatches. Option D is wrong because the vPC peer keepalive link is used solely for monitoring the liveness of the peer switch via a Layer 3 path (e.g., using UDP on port 3200), and its failure does not cause the vPC to flap; it only triggers a secondary check if the peer link fails.

Full explanation →
606
MCQhard

Refer to the exhibit. What is the most likely cause of neighbor 10.1.1.3 being stuck in EXSTART?

A.Duplicate router ID.
B.OSPF network type mismatch.
C.MTU mismatch between the interfaces.
D.The interface is configured as passive.
AnswerC

MTU mismatch prevents DBD packets from being sent successfully.

Why this answer

In OSPF, the EXSTART state indicates that neighbors are negotiating the master/slave relationship and exchanging Database Description (DBD) packets. If the MTU of the interface on one side is larger than the MTU on the other, the larger DBD packet will be silently dropped, preventing the neighbor from progressing past EXSTART. This is a classic symptom of an MTU mismatch, as the OSPF adjacency will remain stuck in EXSTART or EXCHANGE.

Exam trap

Cisco often tests the MTU mismatch trap by having candidates confuse it with a network type mismatch, but the key differentiator is that MTU issues cause the adjacency to stall specifically in EXSTART/EXCHANGE, while network type mismatches prevent the adjacency from forming past INIT/2WAY.

How to eliminate wrong answers

Option A is wrong because a duplicate router ID would cause the adjacency to flap or remain in INIT/2WAY, not EXSTART, as OSPF detects the duplicate during the Hello exchange. Option B is wrong because an OSPF network type mismatch (e.g., broadcast vs. point-to-point) typically results in neighbors stuck in INIT or 2WAY, not EXSTART, due to mismatched Hello/dead intervals or DR/BDR election issues. Option D is wrong because a passive interface suppresses OSPF Hellos entirely, preventing any neighbor discovery, so the adjacency would never reach EXSTART.

Full explanation →
607
MCQmedium

A data center engineer is configuring a Cisco UCS C-Series server with a hardware RAID controller. The server will host a critical database. The RAID controller supports RAID 0, 1, 5, 6, and 10. Which RAID level should be chosen to provide the best combination of performance and fault tolerance?

A.RAID 10
B.RAID 6
C.RAID 5
D.RAID 0
AnswerA

RAID 10 combines mirroring and striping, offering both performance and fault tolerance.

Why this answer

RAID 10 (striping of mirrors) provides the best combination of performance and fault tolerance for a critical database workload. It offers high read/write performance through striping and full redundancy via mirroring, allowing up to one disk failure per mirrored pair without data loss. This is ideal for a Cisco UCS C-Series server with a hardware RAID controller where both I/O throughput and availability are paramount.

Exam trap

Cisco often tests the misconception that RAID 5 or RAID 6 offer 'good enough' performance for databases, but the trap is that parity-based RAIDs introduce significant write penalties that degrade transactional throughput, making RAID 10 the correct choice for critical database workloads.

How to eliminate wrong answers

Option B (RAID 6) is wrong because while it offers dual parity and can tolerate two disk failures, its write performance is significantly degraded due to double parity calculations, making it unsuitable for a performance-sensitive database. Option C (RAID 5) is wrong because its single parity provides lower fault tolerance and suffers from a write penalty during parity updates, which can bottleneck database transactions. Option D (RAID 0) is wrong because it offers no fault tolerance; any single disk failure results in complete data loss, which is unacceptable for a critical database.

Full explanation →
608
MCQhard

A UCS administrator needs to ensure that only the fabric interconnect management plane is accessible from the management network. Which feature should be implemented?

A.SED encryption
B.CoPP
C.Management plane isolation
D.RBAC
AnswerC

Management plane isolation restricts management access to dedicated interfaces.

Why this answer

Management plane isolation ensures that management traffic is separate from data traffic, often using dedicated management interfaces or VRFs.

Full explanation →
609
MCQmedium

An engineer is configuring a pair of Nexus 9000 switches as vPC peers. The vPC peer keepalive link is established. Which statement about the vPC peer keepalive is true?

A.It carries data traffic between vPC peers.
B.It is used to synchronize MAC address tables between peers.
C.It is a Layer 3 keepalive using the management or a dedicated interface to ensure peer reachability.
D.It provides a Layer 3 keepalive to detect peer failure and should be on a separate VLAN.
AnswerC

Correct: peer keepalive is a Layer 3 heartbeat, often over mgmt0 or dedicated interface.

Why this answer

The vPC peer keepalive link is a Layer 3 mechanism that uses either the management interface (mgmt0) or a dedicated routed interface to send periodic keepalive messages (UDP port 3200) between vPC peers. Its sole purpose is to verify that the peer switch is still reachable at Layer 3, providing a secondary failure-detection path independent of the vPC peer-link. It does not carry data traffic, nor does it synchronize MAC or routing tables.

Exam trap

Cisco often tests the misconception that the vPC peer keepalive is a Layer 2 VLAN-based mechanism, but it is actually a Layer 3 IP keepalive that uses a management or dedicated routed interface, not a VLAN.

How to eliminate wrong answers

Option A is wrong because the vPC peer keepalive link never carries data traffic; data traffic between vPC peers flows only over the vPC peer-link (Layer 2 trunk). Option B is wrong because MAC address synchronization is performed over the vPC peer-link using Cisco Fabric Services (CFS), not over the keepalive link. Option D is wrong because the keepalive is a Layer 3 (IP) mechanism, not a Layer 2 VLAN-based keepalive; it uses a management or dedicated routed interface and does not require a separate VLAN.

Full explanation →
610
MCQmedium

A storage administrator is configuring a new Fibre Channel fabric using Cisco MDS switches. The edge switches must connect to the core without participating in the full routing domain to conserve domain IDs. Which Fibre Channel feature should be configured on the edge switches?

A.PortChannels
B.VSANs
C.NPV mode
D.EISL trunking
AnswerC

NPV mode allows edge switches to proxy login through the core switch, eliminating the need for a domain ID.

Why this answer

N-Port Virtualization (NPV) mode allows an edge switch to connect to a core switch without consuming a Fibre Channel domain ID, scaling the fabric while reducing administrative overhead.

Full explanation →
611
MCQmedium

A network administrator wants to prevent IP spoofing attacks on a data center access switch. The switch has IP Source Guard enabled on the client-facing ports. Which condition must be met for IP Source Guard to work properly?

A.DHCP snooping must be disabled on the VLAN.
B.DHCP snooping must be enabled on the VLAN and the port must be untrusted.
C.All clients must use DHCP; static IPs are not supported.
D.Dynamic ARP Inspection must be enabled first.
AnswerB

IP Source Guard uses the DHCP snooping binding table on untrusted ports.

Why this answer

IP Source Guard uses a binding table created by DHCP snooping to validate the source IP address of packets received on a port. For IP Source Guard to work, DHCP snooping must be enabled on the VLAN, and the client-facing port must be configured as an untrusted port so that DHCP snooping can populate the binding table with valid DHCP lease information. Without this binding table, IP Source Guard has no source IP-to-MAC mapping to enforce.

Exam trap

Cisco often tests the dependency between IP Source Guard and DHCP snooping, specifically that DHCP snooping must be enabled on the VLAN and the port must be untrusted, leading candidates to incorrectly assume DHCP snooping must be disabled or that static IPs are unsupported.

How to eliminate wrong answers

Option A is wrong because DHCP snooping must be enabled on the VLAN to build the IP-to-MAC binding table that IP Source Guard relies on; disabling DHCP snooping would leave the binding table empty, causing IP Source Guard to drop all traffic. Option C is wrong because IP Source Guard supports static IP assignments if a static binding is manually configured using the 'ip source binding' command; it does not require all clients to use DHCP. Option D is wrong because Dynamic ARP Inspection (DAI) is a separate security feature that also depends on DHCP snooping, but IP Source Guard does not require DAI to be enabled first; both features can operate independently as long as DHCP snooping is active.

Full explanation →
612
MCQeasy

A network engineer is configuring VLAN ACLs on a Cisco Nexus 9000 switch to enforce traffic filtering between VLANs. Which configuration step is required to apply a VACL to a VLAN?

A.Apply the VACL to a Layer 3 interface using 'ip access-group'.
B.Apply the VACL to a physical port using 'mac access-group'.
C.Define a VLAN access-map and then apply it under the VLAN configuration.
D.Use the 'vlan filter' command in global configuration mode.
AnswerD

'vlan filter' applies the VACL to a specific VLAN.

Why this answer

VACLs on Cisco Nexus 9000 switches are applied using the 'vlan filter' command in global configuration mode, which references a VLAN access-map. This command binds the access-map to a specific VLAN, enabling Layer 2 traffic filtering between VLANs without requiring a Layer 3 interface.

Exam trap

Cisco often tests the distinction between applying an ACL to an interface versus applying a VACL to a VLAN, and the trap here is that candidates mistakenly think a VLAN access-map is applied directly under the VLAN configuration (like 'vlan 10' mode) rather than using the global 'vlan filter' command.

How to eliminate wrong answers

Option A is wrong because 'ip access-group' applies an IP ACL to a Layer 3 interface (SVI or routed port), not a VACL, and VACLs are not applied to Layer 3 interfaces. Option B is wrong because 'mac access-group' applies a MAC ACL to a physical port for Layer 2 traffic filtering on that port, not to a VLAN for inter-VLAN filtering. Option C is wrong because while defining a VLAN access-map is a necessary step, it must be applied using the 'vlan filter' command in global configuration mode, not under the VLAN configuration (the 'vlan' config mode does not support applying access-maps directly).

Full explanation →
613
MCQmedium

An engineer is configuring a VXLAN EVPN fabric. Which address family must be enabled under BGP to exchange MAC/VTEP reachability information?

A.address-family ipv4 unicast
B.address-family l2vpn vpls
C.address-family vpnv4
D.address-family l2vpn evpn
AnswerD

This is the correct address family for EVPN.

Why this answer

In a VXLAN EVPN fabric, BGP is used as the control plane to exchange MAC and VTEP reachability information. The correct address family for this is 'l2vpn evpn' (address-family l2vpn evpn), which carries EVPN NLRI (Network Layer Reachability Information) as defined in RFC 7432. This enables the distribution of MAC addresses, IP-to-MAC bindings, and VTEP endpoints across the overlay network.

Exam trap

Cisco often tests the distinction between 'l2vpn vpls' and 'l2vpn evpn' — candidates mistakenly choose VPLS because it also deals with Layer 2 overlays, but VXLAN EVPN specifically requires the EVPN address family, not VPLS.

How to eliminate wrong answers

Option A is wrong because 'address-family ipv4 unicast' is used for exchanging traditional IPv4 unicast routes, not for MAC/VTEP reachability in an EVPN overlay. Option B is wrong because 'address-family l2vpn vpls' is used for VPLS (Virtual Private LAN Service) control plane signaling, which is a different technology and not compatible with VXLAN EVPN. Option C is wrong because 'address-family vpnv4' is used for MPLS Layer 3 VPNs (RFC 4364) to carry VPN-IPv4 routes, not for Layer 2 MAC/VTEP information in a VXLAN fabric.

Full explanation →
614
Drag & Dropmedium

Sequence the steps to configure a VXLAN with BGP EVPN on a Cisco Nexus switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

VXLAN EVPN requires overlay feature, VNI mapping, VTEP loopback, BGP peering, and verification.

Full explanation →
615
Multi-Selectmedium

Which TWO of the following are components of the Cisco ACI Management Information Tree (MIT)? (Choose two.)

Select 2 answers
A.l3extOut
B.fvAp
C.fvTenant
D.vlan
E.interface
AnswersB, C

Correct. Application Profile is a MIT object under tenant.

Why this answer

The MIT includes objects like tenants, application profiles (AP), EPGs, and bridge domains (BD). VRF is also part of MIT. 'fvTenant', 'fvAp', 'fvAEPg', 'fvBD' are object classes. 'l3extOut' is for L3 out, not part of the core MIT hierarchy for tenant networking.

Full explanation →
616
MCQhard

A large enterprise data center has a disaster recovery site 100 km away. The SAN uses two MDS 9700 series switches at each site, connected via a dedicated dark fiber. Each link operates at 16 Gbps with a round-trip time of 2 ms. Recently, backup jobs to the remote storage array have been failing with timeout errors. The backup server is local to Site A, but the backup target is in Site B. The link utilization never exceeds 40%, and no errors are reported on the interfaces. The engineer suspects the issue is related to buffer credits. The current buffer credit count on the ISL is 16. The engineer calculates that for 16 Gbps over 100 km (2 ms RTT), they need at least 200 credits to maintain full throughput. Which action is most appropriate to resolve the issue?

A.Enable NPIV on the ISL ports to allow multiple logins.
B.Increase the buffer-to-buffer credit count to 300 on the ISL interfaces.
C.Configure the ISL to operate at 8 Gbps to reduce the buffer credit requirement.
D.Implement FCIP over the existing dark fiber to offload buffer credit management.
AnswerB

Increasing buffer-to-buffer credits to 300 provides enough credits to keep the link fully utilized over the 100 km distance, preventing timeout errors.

Why this answer

The timeout errors during backup are caused by buffer credit starvation, as the current credit count of 16 is insufficient for the 100 km distance (2 ms RTT) at 16 Gbps. Increasing the buffer-to-buffer credit count to 300 ensures enough credits to maintain full throughput, preventing credit starvation and associated timeouts. Option B is correct because it directly addresses the insufficient credit count.

Option A (NPIV) is unrelated to buffer credits; NPIV allows multiple N-port logins, not credit management. Option C (reducing speed to 8 Gbps) would lower throughput and is not optimal. Option D (FCIP) is unnecessary because the existing dark fiber provides a direct Fibre Channel link; FCIP is for IP-based transport and does not help with buffer credit issues.

Full explanation →
617
Multi-Selecteasy

Which TWO features are used to validate ARP packets and prevent ARP spoofing attacks? (Select exactly 2)

Select 2 answers
A.IP Source Guard
B.Private VLANs
C.Dynamic ARP Inspection
D.Port Security
E.DHCP Snooping
AnswersC, E

DAI intercepts and validates ARP packets.

Why this answer

Dynamic ARP Inspection (DAI) is correct because it validates ARP packets by checking them against the DHCP snooping binding database, ensuring that only legitimate ARP replies and requests are forwarded. This prevents ARP spoofing attacks where an attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate device.

Exam trap

Cisco often tests the distinction between features that validate ARP packets (DAI) versus features that validate IP packets (IP Source Guard) or limit MAC addresses (Port Security), causing candidates to confuse the scope of each security mechanism.

Full explanation →
618
MCQhard

In an ACI fabric, an EPG is configured with a contract that allows HTTP traffic to an external network. The external network is reachable via a Layer 3 Outside. However, HTTP traffic from the EPG fails. What is the most likely cause?

A.The subject action is set to deny
B.The L3Out and the EPG are in different VRFs
C.The filter uses the wrong direction
D.The contract is applied to the consumer EPG instead of the provider
AnswerB

ACI contracts only work within the same VRF. If the L3Out is in a different VRF, route leaking is required.

Why this answer

In Cisco ACI, communication between an EPG and an external network via a Layer 3 Outside requires both to be in the same VRF. If the EPG and the L3Out are in different VRFs, the contract cannot be enforced, and traffic will fail even if the contract allows HTTP. The VRF provides the routing and policy enforcement boundary for the contract.

Exam trap

Cisco often tests the misconception that a contract alone is sufficient for inter-VRF communication, but in ACI, contracts are VRF-scoped and cannot bridge different VRFs without additional configuration like a VRF route leak or a shared service contract.

How to eliminate wrong answers

Option A is wrong because if the subject action were set to deny, the contract would explicitly block HTTP traffic, but the question states the contract allows HTTP, so the action is not deny. Option C is wrong because the filter direction (e.g., from consumer to provider) is correctly configured in the contract; the issue is not about direction but about VRF mismatch preventing any policy application. Option D is wrong because applying the contract to the consumer EPG instead of the provider is a valid configuration; the consumer EPG typically consumes the contract, and the provider EPG provides the service, so this would not cause a failure if the contract is correctly applied to the consumer.

Full explanation →
619
MCQeasy

A network engineer is configuring a new Fibre Channel switch to connect to an existing storage fabric. The switch will be used to aggregate multiple edge switches and must appear as a single Fibre Channel device to the core. Which port type should be used on the edge switch facing the core switch to achieve this?

A.F-port
B.N-port
C.NP-port
D.E-port
AnswerC

Correct. NP-port is used in NPV mode to connect an edge switch to the core fabric.

Why this answer

NP-port (N-Port Virtualization) is used on an edge switch in NPV mode to connect to the core fabric; it behaves like an N-port but allows multiple N-port IDs behind it.

Full explanation →
620
MCQeasy

A data center architect is designing a SAN with two MDS switches using VSANs. Which method ensures traffic isolation between departments while allowing sharing of a tape library?

A.Use FCIP tunnels for each department.
B.Create separate VSANs and merge them for the tape library.
C.Create separate VSANs for each department and a shared VSAN for the tape library with inter-VSAN routing (IVR).
D.Use one VSAN for all departments and one zone for each department.
AnswerC

IVR allows selective sharing between VSANs.

Why this answer

It uses separate VSANs to isolate each department's traffic at Layer 2, while inter-VSAN routing (IVR) selectively allows the tape library to be shared across VSANs without merging them. IVR enables controlled communication between specific initiators and targets in different VSANs, preserving isolation for all other traffic.

Exam trap

The trap here is that candidates often confuse VSANs with zones, thinking that zoning alone provides the same level of isolation as separate VSANs, but VSANs create independent fabrics while zones only restrict access within a single fabric.

How to eliminate wrong answers

Option A is wrong because FCIP tunnels are used for extending Fibre Channel over IP networks, not for traffic isolation within a local SAN; they do not address department-level isolation or tape library sharing. Option B is wrong because merging VSANs would combine all traffic into a single fabric, breaking the required isolation between departments. Option D is wrong because using a single VSAN with zones only provides access control within that VSAN, but does not isolate traffic at the fabric level; all departments would share the same control plane and broadcast domain, violating strict isolation requirements.

Full explanation →
621
MCQhard

A Cisco UCS upgrade from release 3.1(1) to 4.0(4) is planned. The current release has a known issue that affects NVRAM backup. What is the best practice to avoid an outage during this upgrade?

A.Perform a cold reboot of all Fabric Interconnects before starting.
B.Upgrade all components simultaneously to reduce transition time.
C.Upgrade the firmware on the chassis first, then the Fabric Interconnects.
D.Upgrade to an intermediate release that is recommended for the upgrade path.
AnswerD

Most major upgrades require stepping through an intermediate release.

Why this answer

Cisco UCS firmware upgrades must follow a supported upgrade path to avoid incompatibilities and known issues. Skipping directly from 3.1(1) to 4.0(4) is not supported; an intermediate release (e.g., 3.2(x) or 4.0(1)) is required to resolve the NVRAM backup issue and ensure a seamless upgrade without service disruption.

Exam trap

Cisco often tests the concept of supported upgrade paths and intermediate releases, trapping candidates who assume direct upgrades are always possible or that component order can be rearranged arbitrarily.

How to eliminate wrong answers

Option A is wrong because a cold reboot of all Fabric Interconnects before starting would cause an immediate outage, defeating the purpose of avoiding downtime; the upgrade process itself handles reboots gracefully. Option B is wrong because upgrading all components simultaneously violates Cisco's recommended sequential upgrade order (Fabric Interconnects first, then chassis IOMs, then servers) and increases the risk of configuration mismatches and extended downtime. Option C is wrong because the chassis firmware should be upgraded after the Fabric Interconnects, not before, as the Fabric Interconnects control the management plane and must be at a compatible version first.

Full explanation →
622
MCQeasy

In a Cisco UCS B-Series deployment, which component provides the physical connectivity between blade server mezzanine cards and the Fabric Interconnects?

A.UCS Manager
B.Fabric Extender (FEX)
C.I/O Module (IOM)
D.Cisco Integrated Management Controller (CIMC)
AnswerC

Correct. The IOM connects blade mezzanine cards to Fabric Interconnects.

Why this answer

The I/O Module (IOM) in the UCS 5108 chassis provides the connectivity between blade server mezzanine cards and the Fabric Interconnects via server ports.

Full explanation →
623
MCQmedium

An engineer is connecting a Cisco UCS C-Series rack server to the network. The server must be managed by UCS Manager alongside existing B-Series blades. Which mode should the C-Series server be configured in?

A.Direct Connect mode
B.UCS Manager mode
C.Standalone mode
D.Cisco IMC Supervisor mode
AnswerB

UCS Manager mode allows unified management of C-Series in UCS Manager.

Why this answer

C-Series rack servers can be integrated into UCS Manager using UCS Manager mode (sometimes called C-Series Integrated mode), where they are managed through the Fabric Interconnects.

Full explanation →
624
MCQmedium

A UCS administrator notices that a service profile associated with a vNIC template that uses 'fabric failover' is not failing over to the secondary Fabric Interconnect when the primary link goes down. The vNIC template is set to 'fabric failover' enabled, and both Fabric Interconnects are in the same VLAN. What is the most likely cause?

A.The 'Primary Fabric' setting is not defined in the vNIC template.
B.The server is pinned to the primary Fabric Interconnect via a pin group.
C.The MTU size on the secondary Fabric Interconnect is set to 1500 instead of 9000.
D.The 'MAC Address' policy is set to 'pool-based' instead of 'static'.
AnswerA

The primary fabric must be selected in the vNIC template for failover to function correctly.

Why this answer

When 'fabric failover' is enabled on a vNIC template, the UCS Manager requires the 'Primary Fabric' setting to be explicitly defined to determine which Fabric Interconnect (FI-A or FI-B) should be the active path. Without this setting, the system cannot properly orchestrate the failover behavior, causing the vNIC to remain pinned to the primary FI even when its link goes down. This is a common misconfiguration because the 'fabric failover' checkbox alone does not imply a primary fabric assignment.

Exam trap

Cisco often tests the misconception that enabling 'fabric failover' alone is sufficient for automatic failover, when in fact the 'Primary Fabric' field must also be explicitly configured to define the active path.

How to eliminate wrong answers

Option B is wrong because a pin group explicitly pins a server to a specific Fabric Interconnect, which would prevent failover by design; however, the question states the vNIC template uses 'fabric failover' enabled, and a pin group would override that setting, but the most likely cause is the missing 'Primary Fabric' definition, not the presence of a pin group. Option C is wrong because MTU size mismatch (1500 vs 9000) affects jumbo frame support and packet fragmentation, not the failover mechanism between Fabric Interconnects. Option D is wrong because the MAC Address policy (pool-based vs static) determines how MAC addresses are assigned to vNICs, but it has no impact on fabric failover behavior.

Full explanation →
625
MCQmedium

In the context of Ansible automation for Cisco Nexus switches, which module can be used to manage VLAN configurations?

A.nxos_interface
B.nxos_vlan
C.nxos_bgp
D.nxos_config
AnswerB

Correct: nxos_vlan is designed for VLAN management.

Why this answer

The cisco.nxos collection includes the nxos_vlan module specifically for managing VLANs on NX-OS devices.

Full explanation →
626
MCQhard

An organization wants to encrypt Fibre Channel traffic in-flight between storage and servers. Which standard should be used?

A.IPsec
B.MACsec
C.FC-SP-2
D.SED
AnswerC

FC-SP-2 encrypts FC frames.

Why this answer

FC-SP-2 provides encryption for Fibre Channel data in transit.

Full explanation →
627
MCQeasy

Which control plane protection mechanism should be configured to limit the rate of BGP updates destined to the CPU of a Nexus 9000 switch to prevent CPU overload?

A.VLAN Access Control Lists (VACLs)
B.Control Plane Policing (CoPP)
C.EtherChannel load balancing
D.Switched Port Analyzer (SPAN)
AnswerB

CoPP rate-limits control plane packets.

Why this answer

Control Plane Policing (CoPP) is the correct mechanism because it directly filters and rate-limits control plane traffic, such as BGP updates, before it reaches the CPU of a Nexus 9000 switch. By applying a CoPP policy, you can protect the CPU from being overwhelmed by excessive BGP updates, ensuring stability and preventing denial-of-service conditions.

Exam trap

Cisco often tests the distinction between data plane and control plane mechanisms, and the trap here is that candidates may confuse VACLs (data plane filtering) with CoPP (control plane policing), assuming any ACL can protect the CPU.

How to eliminate wrong answers

Option A is wrong because VLAN Access Control Lists (VACLs) filter traffic within the data plane at the VLAN level, not the control plane, and cannot rate-limit BGP updates destined to the CPU. Option C is wrong because EtherChannel load balancing distributes data traffic across aggregated links to improve bandwidth and redundancy, but it has no mechanism to police or limit control plane traffic like BGP updates. Option D is wrong because Switched Port Analyzer (SPAN) is used for port mirroring traffic to a monitoring device for analysis, not for filtering or rate-limiting control plane packets to the CPU.

Full explanation →
628
MCQeasy

Which NX-OS command displays the vPC consistency parameters and status on a Cisco Nexus switch?

A.show vpc peerlink
B.show vpc brief
C.show vpc consistency-parameters
D.show running-config vpc
AnswerC

Correct: displays type-1 and type-2 consistency.

Why this answer

The 'show vpc consistency-parameters' command is the correct choice because it directly displays the vPC consistency parameters and their status, which are critical for ensuring that both vPC peer switches have identical configurations for type-1 parameters (e.g., STP, VLANs, MTU). If these parameters mismatch, the vPC will be suspended to prevent traffic loops or forwarding issues. This command is the dedicated tool for verifying consistency before and after vPC configuration changes.

Exam trap

Cisco often tests the distinction between commands that show configuration versus runtime status, and the trap here is that candidates confuse 'show running-config vpc' (which shows configuration) with the dedicated consistency check command, or assume 'show vpc brief' includes consistency details when it only shows a high-level summary.

How to eliminate wrong answers

Option A is wrong because 'show vpc peerlink' displays the status and details of the vPC peer-link (e.g., port channel, keepalive), not the consistency parameters. Option B is wrong because 'show vpc brief' provides a summary of vPC status, role, and peer-link health, but does not list the individual consistency parameters or their compliance. Option D is wrong because 'show running-config vpc' shows the configured vPC commands in the running configuration, not the runtime consistency check results or parameter status.

Full explanation →
629
Drag & Dropmedium

Arrange the steps to recover a lost admin password on a Cisco Nexus switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Password recovery involves boot interruption, register change, boot, password reset, and save.

Full explanation →
630
MCQeasy

A network engineer is troubleshooting high CPU utilization on a Nexus 9000 switch. Which command is most useful to identify the process consuming the most CPU?

A.show processes cpu history
B.show process cpu sort
C.show system resources
D.show cpu usage
AnswerB

This command sorts processes by CPU usage, allowing identification of the most intensive process.

Why this answer

The 'show process cpu sort' command on Nexus 9000 switches displays the current CPU utilization sorted by the process consuming the most CPU, allowing the engineer to quickly identify the top CPU consumer. This command provides a real-time, sorted list of processes with their CPU usage percentages, which is directly useful for troubleshooting high CPU utilization.

Exam trap

Cisco often tests the distinction between 'show processes cpu' (which lists all processes unsorted) and 'show process cpu sort' (which sorts by CPU usage), and the trap here is that candidates may confuse 'show cpu usage' with a valid command or assume 'show system resources' provides process-level detail.

How to eliminate wrong answers

Option A is wrong because 'show processes cpu history' shows historical CPU utilization data in a graphical format over time, not the current processes consuming CPU, so it cannot identify the specific process causing the spike. Option C is wrong because 'show system resources' displays overall system resource usage (memory, CPU, buffers) but does not break down CPU usage by individual process, making it insufficient for pinpointing the culprit process. Option D is wrong because 'show cpu usage' is not a valid command on Nexus 9000 switches; the correct command for a summary of CPU usage is 'show processes cpu', which lists all processes but not sorted by CPU consumption.

Full explanation →
631
MCQeasy

What is the primary benefit of using UCS service profiles for server deployment?

A.Hardware abstraction and stateless computing
B.Increased network bandwidth
C.Reduced power consumption
D.Simplified storage zoning
AnswerA

Service profiles decouple the logical server identity from physical hardware.

Why this answer

Service profiles abstract hardware configuration, allowing rapid provisioning and stateless computing. A server can be replaced without reconfiguration by simply associating the same service profile.

Full explanation →
632
MCQmedium

Which Cisco UCS component is responsible for aggregating traffic from multiple blade servers in a 5108 chassis to the Fabric Interconnect?

A.Cisco UCS 2200 Series Fabric Extender
B.Cisco UCS 5108 Chassis I/O Module (IOM)
C.Cisco UCS 6300 Series Fabric Interconnect
D.Cisco UCS 2100 Series Fabric Extender
AnswerB

The I/O Module (IOM) in the 5108 chassis aggregates traffic from blade servers and uplinks to the Fabric Interconnect. This is the correct component as per Cisco's naming convention.

Why this answer

The I/O Module (IOM) in the 5108 chassis connects to the midplane and uplinks to the Fabric Interconnect via server ports.

Exam trap

The Cisco UCS 2200 Series Fabric Extender is actually the I/O Module (IOM) used in the 5108 chassis. Candidates often confuse the naming and think Fabric Extenders are separate from IOMs, but they are the same component. The correct answer is the IOM (B), while the Fabric Extender (A) describes the same hardware, which is why it's a trap.

Full explanation →
633
MCQmedium

In UCS service profile templates, when you update the template, how do the changes propagate to the service profiles derived from it?

A.Changes are applied only if the service profile is not associated with a server.
B.Changes are automatically applied to all derived service profiles immediately.
C.Changes are applied only during server reboot.
D.Changes must be manually applied to each derived service profile.
AnswerB

By default, templates update derived profiles automatically, though this can be overridden.

Why this answer

When a service profile is created from a template, it can be set to update automatically when the template changes, or manually. The default behavior is that changes are propagated automatically unless the profile is set to manual update.

Full explanation →
634
MCQmedium

An organization wants to integrate their UCS C-series rack servers into an existing UCS Manager domain. Which mode should be used to achieve centralized management of the C-series servers through UCS Manager?

A.Direct Connect mode
B.UCS Managed mode
C.Standalone mode
D.Cisco IMC Supervisor mode
AnswerB

In UCS Managed mode, the C-series server appears as a compute resource in UCS Manager and can be assigned service profiles.

Why this answer

C-series servers can be managed by UCS Manager when they are in UCS Managed mode, which requires the server to be connected via a Fabric Interconnect and have the appropriate license.

Full explanation →
635
MCQeasy

An NFS client is unable to write to a mounted export. The client can read files. What is the most likely cause?

A.Export permissions are read-only for the client
B.Network latency causing timeouts
C.Incorrect mount options (e.g., ro instead of rw)
D.NFS version mismatch
AnswerA

Correct: Read-only export allows reads but denies writes.

Why this answer

The NFS export permissions are configured on the NFS server using the /etc/exports file. If the export is set to 'ro' (read-only) for the client's IP or subnet, the client can read files but any write attempt will be denied at the server level, regardless of the client's mount options. This is the most direct cause of a client being able to read but not write.

Exam trap

Cisco often tests the distinction between server-side export permissions and client-side mount options, trapping candidates who assume that a 'rw' mount option guarantees write capability without considering the server's export configuration.

How to eliminate wrong answers

Option B is wrong because network latency or timeouts would typically cause intermittent failures or slow performance, not a consistent inability to write while reads succeed. Option C is wrong because if the client mounts with 'ro' (read-only), the mount would succeed but writes would fail at the client kernel level with a 'Read-only file system' error; however, the question states the client can read files, which is consistent with a read-only mount, but the most likely cause given the server-side control is export permissions. Option D is wrong because an NFS version mismatch would usually prevent the mount entirely or cause protocol negotiation failures, not allow reads while blocking writes.

Full explanation →
636
Multi-Selectmedium

Which TWO statements correctly describe active zone sets in a Cisco MDS Fibre Channel fabric?

Select 2 answers
A.The active zone set is propagated to all switches in the fabric
B.Only one zone set can be active per VSAN
C.Zones within the active zone set can be selectively deactivated
D.The active zone set is stored in the running configuration only
E.Multiple zone sets can be active simultaneously
AnswersA, B

When a zone set is activated, it is distributed to all switches in the VSAN.

Why this answer

An active zone set is the set of zones that are enforced in the fabric. Only one zone set can be active at a time, and it is propagated to all switches in the fabric.

Full explanation →
637
MCQmedium

A Cisco ACI fabric has contracts configured to allow traffic between two EPGs. After deployment, traffic between endpoints in these EPGs is being dropped, but contract statistics show no packets have been permitted. The administrator checks the contract configuration and it looks correct. What is the most likely cause?

A.The contract is configured only on the provider EPG, but the consumer EPG is not consuming the contract.
B.The contract is applied to the wrong VRF.
C.The filter direction is set to both, but the contract is using an incorrect filter.
D.The endpoints are in different VMM domains.
AnswerA

The consumer EPG must also consume the contract; otherwise, traffic is denied.

Why this answer

The most likely cause is that the contract is configured on the provider EPG but the consumer EPG is not configured to consume it. In Cisco ACI, a contract must be explicitly provided by one EPG and consumed by another for traffic to be permitted. If the consumer EPG does not have the contract applied, the contract will not be enforced, and traffic will be dropped even if the contract configuration appears correct.

The contract statistics showing no permitted packets confirm that the contract is not being applied to the traffic flow.

Exam trap

Cisco often tests the misconception that configuring a contract on the provider EPG alone is enough to permit traffic, when in fact the consumer EPG must also explicitly consume the contract for the policy to take effect.

How to eliminate wrong answers

Option B is wrong because applying a contract to the wrong VRF would prevent any communication between EPGs in different VRFs, but the contract statistics would show no packets at all, and the administrator would likely notice the VRF mismatch during configuration review. Option C is wrong because an incorrect filter direction or filter would still result in some packets being counted in contract statistics (e.g., denied packets), but the question states no packets have been permitted, indicating the contract itself is not being consumed. Option D is wrong because endpoints in different VMM domains can still communicate if the EPGs are in the same VRF and a contract is properly configured; VMM domain mismatch affects endpoint discovery and policy enforcement but does not directly cause contract statistics to show zero permitted packets.

Full explanation →
638
MCQmedium

In a data center running MST, which region configuration parameter must match on all switches for them to be part of the same region?

A.Spanning-tree mode
B.Bridge priority
C.Max-age and hello time
D.Region name, revision number, and VLAN-to-instance mapping
AnswerD

All three must match for consistent region membership.

Why this answer

In Multiple Spanning Tree (MST), switches must agree on three parameters to belong to the same MST region: the region name, the revision number, and the VLAN-to-instance mapping. These parameters are exchanged in MST BPDUs, and if any differ, the switches treat each other as being in different regions, which can lead to suboptimal or incorrect spanning-tree behavior.

Exam trap

Cisco often tests the specific three required MST region parameters (name, revision, mapping) to trap candidates who confuse global spanning-tree settings or timer values with region membership criteria.

How to eliminate wrong answers

Option A is wrong because spanning-tree mode (e.g., PVST+, Rapid PVST+, or MST) is a global protocol setting, not a region-specific parameter; switches can run MST but still be in different regions if their region configuration differs. Option B is wrong because bridge priority is a per-switch or per-instance value used for root bridge election, not a region-matching parameter. Option C is wrong because max-age and hello time are timer values used in spanning-tree operation across all regions, not parameters that define region membership.

Full explanation →
639
MCQmedium

A Cisco MDS switch is configured with fabric binding to restrict which switches can join the fabric. A new switch is added, but it fails to establish an E-port connection. What is the most likely cause?

A.Incompatible SFP modules between the switches
B.Incorrect zoning configuration on the existing switch
C.The new switch has a higher priority than the principal switch
D.The new switch's WWN is not included in the fabric binding configuration
AnswerD

Fabric binding rejects unauthorized switches.

Why this answer

Fabric binding on a Cisco MDS switch uses the fabric-binding database to enforce a whitelist of allowed switch WWNs. When a new switch attempts to bring up an E-port, the principal switch checks the new switch's WWN against this database. If the WWN is not present, the E-port is automatically isolated, preventing the switch from joining the fabric.

This is the most direct cause of the failure described.

Exam trap

Cisco often tests the distinction between fabric binding (switch-level admission control) and zoning (device-level access control), leading candidates to incorrectly attribute E-port failures to zoning issues.

How to eliminate wrong answers

Option A is wrong because incompatible SFP modules would typically cause a link-down or operational failure at the physical layer, not a specific E-port isolation due to fabric binding. Option B is wrong because zoning controls which initiators and targets can communicate within a fabric, not which switches are allowed to join the fabric; incorrect zoning would not prevent an E-port from coming up. Option C is wrong because switch priority affects principal switch election and load balancing, but a higher priority does not cause E-port isolation; fabric binding enforces WWN-based admission regardless of priority.

Full explanation →
640
MCQmedium

In a spine-leaf architecture, what is the primary advantage of using a full mesh between spines and leaves?

A.It provides uniform low-latency paths between any two leaves
B.It reduces the total number of ports required
C.It removes the requirement for Spanning Tree Protocol
D.It eliminates the need for VLANs in the data center
AnswerA

Each leaf is one hop from any spine, ensuring low latency.

Why this answer

In a spine-leaf architecture, a full mesh between spines and leaves ensures that every leaf switch is connected to every spine switch. This design provides multiple equal-cost paths between any two leaf switches, allowing for uniform low-latency forwarding because traffic can traverse a single spine hop without congestion or path asymmetry. The full mesh eliminates the need for complex path selection and guarantees predictable, consistent latency across the fabric.

Exam trap

Cisco often tests the misconception that a full mesh reduces port count or eliminates VLANs, but the real advantage is uniform low-latency paths due to the equal-cost multipath design.

How to eliminate wrong answers

Option B is wrong because a full mesh between spines and leaves actually increases the total number of ports required (each leaf needs a port per spine, and each spine needs a port per leaf), not reduces them. Option C is wrong because while spine-leaf architectures inherently avoid loops due to the Layer 3 design (using routing protocols like OSPF or BGP), the full mesh itself does not remove the requirement for Spanning Tree Protocol; rather, the use of Layer 3 routing at the spine eliminates the need for STP. Option D is wrong because VLANs are still used in data center fabrics for segmentation and tenant isolation, even in a spine-leaf topology; the full mesh does not eliminate VLANs.

Full explanation →
641
MCQhard

A data center deployment uses NPV mode on a Cisco MDS switch to connect to a core Fibre Channel switch. After configuration, the NPV switch does not register with the core. What is the most likely cause?

A.Fibre Channel ports are in trunk mode.
B.The core switch has NPV mode enabled.
C.NPIV is not enabled on the core switch.
D.The NPV switch has an incorrect domain ID.
AnswerC

Core must have NPIV enabled for NPV.

Why this answer

NPV (N_Port Virtualization) mode requires NPIV (N_Port ID Virtualization) to be enabled on the core Fibre Channel switch. NPIV allows a single physical N_Port to register multiple FCIDs (Fibre Channel IDs) for multiple virtual initiators behind the NPV switch. Without NPIV on the core, the NPV switch cannot complete the FLOGI (Fabric Login) process and will not register with the fabric.

Exam trap

Cisco often tests the distinction between NPV and NPIV, trapping candidates who confuse the two or assume that enabling NPV on both sides is required.

How to eliminate wrong answers

Option A is wrong because trunk mode on Fibre Channel ports (E_Port or TE_Port) is used for ISL (Inter-Switch Link) connections between core switches, not for NPV uplinks, which use NP_Ports. Option B is wrong because enabling NPV mode on the core switch would break the NPV architecture; NPV is only enabled on the edge switch (the NPV switch), while the core must operate in standard Fibre Channel switch mode (with NPIV enabled). Option D is wrong because domain IDs are assigned by the principal switch in the fabric and are not configured manually on NPV switches; NPV switches do not participate in domain ID distribution as they are not full switches in the fabric.

Full explanation →
642
MCQeasy

A DevOps team is implementing CI/CD for network configuration changes on Nexus switches. Which tool is most suitable for version control of network configuration files?

A.Git
B.Jenkins
C.Ansible
D.Docker
AnswerA

Git provides version control for configuration files.

Why this answer

Git is a distributed version control system widely used for managing infrastructure as code, including network configurations. Ansible is for automation, Jenkins for CI/CD pipelines, and Docker for containers.

Full explanation →
643
Multi-Selecteasy

Which two statements are true about Cisco TrustSec? (Choose two.)

Select 2 answers
A.It requires a Cisco ISE policy server
B.It requires 802.1X authentication
C.It provides encryption at Layer 2
D.It uses VLANs for segmentation
E.It uses SGTs for access control
AnswersA, E

ISE is the policy server that defines and distributes SGT-based policies.

Why this answer

Cisco TrustSec relies on a Cisco ISE policy server to define and enforce security policies based on Security Group Tags (SGTs). ISE acts as the centralized policy decision point, dynamically assigning SGTs to authenticated endpoints and distributing the SGT-to-IP bindings to network devices via SXP or inline tagging.

Exam trap

Cisco often tests the misconception that TrustSec requires 802.1X or provides mandatory encryption, when in fact 802.1X is just one of several authentication methods and encryption (MACsec) is an optional enhancement.

Full explanation →
644
MCQeasy

Which FCoE component is responsible for encapsulating Fibre Channel frames into Ethernet frames?

A.FCoE module on the switch or adapter
B.FCoE Forwarder (FCF)
C.Virtual Fibre Channel interface (VFC)
D.VN interface
AnswerA

The FCoE module performs encapsulation/decapsulation.

Why this answer

The FCoE module on the switch or adapter is the component that performs the encapsulation of native Fibre Channel frames into Ethernet frames. This module handles the conversion by adding an Ethernet header, including the EtherType 0x8906 for FCoE, and managing the mapping of Fibre Channel constructs (e.g., VSANs) to VLANs. Without this module, Fibre Channel traffic cannot traverse an Ethernet network.

Exam trap

Cisco often tests the distinction between the component that performs encapsulation (FCoE module) and the logical interfaces or forwarding entities (VFC, VN, FCF) that rely on that encapsulation, leading candidates to confuse the control-plane role of the FCF or the logical nature of VFC/VN interfaces with the actual encapsulation function.

How to eliminate wrong answers

Option B (FCoE Forwarder or FCF) is wrong because the FCF is a control-plane device that provides Fibre Channel forwarding services (e.g., fabric login, name server) and connects FCoE VLANs to Fibre Channel SANs, but it does not perform the actual encapsulation of frames; that is done by the FCoE module. Option C (Virtual Fibre Channel interface or VFC) is wrong because a VFC is a logical interface that binds to an Ethernet interface and represents a Fibre Channel port in software, but it does not encapsulate frames; it relies on the underlying FCoE module for encapsulation. Option D (VN interface) is wrong because a VN interface is a virtual N_port (node port) that appears to the Fibre Channel stack as a standard N_port, but it is a logical construct that uses the FCoE module for encapsulation; it does not perform the encapsulation itself.

Full explanation →
645
Multi-Selecteasy

Which TWO methods are supported for authenticating to the APIC REST API?

Select 2 answers
A.SAML authentication
B.Certificate-based authentication
C.Local AAA user (username/password)
D.RADIUS/TACACS+ authentication
E.LDAP authentication
AnswersB, C

X.509 certificates can be used for API authentication.

Why this answer

The APIC REST API supports certificate-based authentication (option B) and local AAA user authentication with a username and password (option C). Certificate-based authentication uses X.509 certificates for secure, non-interactive API access, while local AAA authentication relies on credentials stored directly on the APIC. Both methods are explicitly documented as valid for REST API calls.

Exam trap

Cisco often tests the distinction between authentication methods supported for the REST API versus those supported for management access (SSH, web GUI), leading candidates to incorrectly select RADIUS/TACACS+ or LDAP as valid REST API options.

Full explanation →
646
MCQmedium

Which component in a UCS domain is responsible for aggregating and forwarding all management traffic between the chassis and the fabric interconnects?

A.CIMC
B.Blade BMC
C.IOM (FEX)
D.System controller (CMC)
AnswerD

The CMC manages the chassis and communicates with the FIs over the management network.

Why this answer

The system controller (also known as the chassis management controller) in the UCS chassis handles management traffic for the blades, including communication with UCS Manager via the FIs.

Full explanation →
647
Drag & Dropmedium

Arrange the steps to configure a vPC domain on a pair of Cisco Nexus switches.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

vPC requires feature vPC, then domain creation, keepalive link, peer-link, and member ports.

Full explanation →
648
MCQhard

A company is deploying a multi-tenant environment with several virtualized hosts using NPIV. Each virtual machine requires its own WWPN. During testing, some VMs cannot log into the SAN. The MDS switch logs show 'FLOGI rejected: no available resources'. What is the most likely cause?

A.The maximum FC frame size is set incorrectly on the switch
B.The VSAN maximum number of devices has been reached
C.The zone set is full and cannot accept more members
D.The NPIV limit or the number of allowed logins has been exceeded on the upstream switch
AnswerD

By default, NPIV max logins may be hit with many VMs.

Why this answer

The error 'FLOGI rejected: no available resources' on an MDS switch in an NPIV environment indicates that the switch has exhausted its allocated resources for handling fabric logins (FLOGIs) from N_Port ID Virtualization (NPIV) initiators. NPIV allows multiple virtual WWPNs to share a single physical FC port, but each virtual login consumes a login resource on the upstream switch. When the NPIV limit or the maximum number of allowed logins per interface or per VSAN is exceeded, the switch rejects new FLOGIs, preventing VMs from logging into the SAN.

Exam trap

Cisco often tests the distinction between resource exhaustion (NPIV login limits) and configuration errors (zoning or VSAN device limits) by using the specific error message 'FLOGI rejected: no available resources', which candidates mistakenly attribute to zoning or VSAN device limits instead of NPIV login resource depletion.

How to eliminate wrong answers

Option A is wrong because the maximum FC frame size (e.g., 2112 bytes vs. 1024 bytes) affects data transmission efficiency and fragmentation, not the ability to perform a fabric login (FLOGI), which is a control-plane operation. Option B is wrong because the VSAN maximum number of devices (configurable via 'fabric-limit device-login-limit') would cause a different error, such as 'device not allowed' or 'login denied', not a resource exhaustion error for FLOGI. Option C is wrong because a full zone set prevents new zone members from being added or activated, but it does not block an existing zone member's FLOGI; the error 'FLOGI rejected: no available resources' is a login resource issue, not a zoning configuration issue.

Full explanation →
649
MCQmedium

A storage array supports both synchronous and asynchronous replication. The application requires zero data loss in case of a site failure. Which replication type should be chosen?

A.Synchronous replication
B.Asynchronous replication
C.Thin provisioning
D.Snapshot-based replication
AnswerA

Synchronous replication guarantees zero data loss as data must be written to both sites.

Why this answer

Synchronous replication writes data to the primary and secondary storage before acknowledging the write, ensuring zero data loss (RPO=0). Asynchronous replication may have some lag.

Full explanation →
650
MCQhard

In a UCS environment, which method provides management plane isolation for the fabric interconnects?

A.Enabling CoPP on the fabric interconnect
B.Configuring the management IP on a dedicated management port
C.Using RBAC roles in UCS Manager
D.Using a separate VRF for management traffic
AnswerB

The management port is physically separate from data ports.

Why this answer

UCS fabric interconnects have a dedicated management interface that can be placed in a separate management VLAN for isolation.

Full explanation →
651
MCQmedium

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

A.Dynamic ARP Inspection
B.DHCP Snooping
C.IP Source Guard
D.Port Security
AnswerB

DHCP snooping blocks rogue DHCP servers.

Why this answer

DHCP snooping filters DHCP server messages on untrusted ports.

Full explanation →
652
MCQhard

An organization wants to adopt Infrastructure as Code (IaC) principles for their data center network. Which practice best aligns with IaC for network configuration?

A.Using spreadsheets to track changes
B.Manually configuring devices via CLI
C.Using a web GUI for each device
D.Storing configuration files in Git and applying them with automation tools
AnswerD

This is a core IaC practice.

Why this answer

IaC involves managing and provisioning network infrastructure through machine-readable definition files, rather than manual processes. Storing configurations in version control (like Git) and using automated tools is key.

Full explanation →
653
MCQmedium

A network engineer is troubleshooting an OSPF adjacency issue between two Nexus switches. The neighbors are stuck in the EXSTART state. What is the most likely cause?

A.Hold timer mismatch
B.Incorrect area ID
C.MTU mismatch
D.Duplicate router ID
AnswerC

MTU mismatch leads to DBD packet rejection, keeping the neighbor in EXSTART.

Why this answer

When OSPF neighbors are stuck in the EXSTART state, the most common cause is an MTU mismatch. In EXSTART, the routers exchange Database Description (DBD) packets, which must be no larger than the interface MTU. If one interface has a smaller MTU, the DBD packet is dropped, preventing the adjacency from progressing to the Exchange state.

Cisco Nexus switches default to an MTU of 1500 bytes, but any mismatch will cause this issue.

Exam trap

Cisco often tests the MTU mismatch trap by making candidates confuse it with other OSPF adjacency issues, such as area ID or timer mismatches, which cause different stuck states (e.g., INIT or 2-WAY) rather than EXSTART.

How to eliminate wrong answers

Option A is wrong because a hold timer mismatch causes neighbors to be stuck in the INIT or 2-WAY state, not EXSTART; OSPF uses the Hello/Dead interval for neighbor discovery, not DBD exchange. Option B is wrong because an incorrect area ID prevents the adjacency from forming at all, typically leaving neighbors in the DOWN or ATTEMPT state, as OSPF requires matching area IDs in Hello packets. Option D is wrong because a duplicate router ID causes OSPF to reject the neighbor entirely, resulting in a state of DOWN or ATTEMPT, not EXSTART, as the router ID is verified during the Hello exchange.

Full explanation →
654
Multi-Selectmedium

Which TWO of the following are characteristics of the NETCONF protocol? (Choose two.)

Select 2 answers
A.Operates over SSH or TLS.
B.Supports JSON encoding as well as XML.
C.Uses XML for data representation.
D.Uws a single RPC for all operations.
E.Uses RESTful HTTP methods.
AnswersA, C

Correct: NETCONF typically uses SSH (RFC 6242) or TLS.

Why this answer

NETCONF uses XML for data encoding and provides operations like get, edit-config, etc., based on YANG models.

Full explanation →
655
Multi-Selecthard

Which THREE components are part of a HyperFlex HX Data Platform (HXDP) cluster? (Choose three.)

Select 3 answers
A.Fabric Interconnect
B.Witness VM
C.IOM module
D.Storage node
E.Controller VM (CVM)
AnswersB, D, E

Witness provides quorum.

Why this answer

HXDP cluster includes controller VMs, storage nodes, and a witness VM for quorum.

Full explanation →
656
MCQeasy

Which Cisco Data Center Network Manager component is used for centralized fabric management and automation of Nexus switches?

A.DCNM
B.Cisco ISE
C.Prime Infrastructure
D.APIC
AnswerA

Correct: DCNM manages Nexus switches.

Why this answer

Cisco Data Center Network Manager (DCNM) is the centralized management platform specifically designed for fabric management, provisioning, and automation of Nexus switches in data center environments. It provides a single pane of glass for configuring, monitoring, and troubleshooting Nexus-based fabrics, including VXLAN EVPN, Cisco ACI, and traditional SAN/Nexus environments.

Exam trap

Cisco often tests the distinction between DCNM (for traditional Nexus fabric management) and APIC (for ACI fabric management), so candidates mistakenly choose APIC when the question mentions 'automation of Nexus switches' without specifying ACI.

How to eliminate wrong answers

Option B (Cisco ISE) is wrong because Cisco Identity Services Engine is a policy-based access control and authentication platform (RADIUS/802.1X), not a fabric management or automation tool for Nexus switches. Option C (Prime Infrastructure) is wrong because Cisco Prime Infrastructure is a lifecycle management tool for campus and branch networks (routers, switches, wireless), not designed for data center fabric automation of Nexus switches. Option D (APIC) is wrong because the Application Policy Infrastructure Controller is the centralized controller for Cisco ACI (Application Centric Infrastructure) fabrics, not for standalone Nexus switch management or traditional NX-OS automation.

Full explanation →
657
MCQeasy

A small business has a Cisco MDS 9148S switch with a single fabric. Two hosts are connected to ports fc1/1 and fc1/2, and a storage array is connected to ports fc1/3 and fc1/4. The administrator wants to ensure that each host can only see its own assigned LUNs on the array. They have configured a zone for each host containing the host pWWN and the target pWWN for the respective LUNs. However, Host A is able to see Host B's LUNs. What is the most likely cause?

A.The zone is not active
B.The zones are not in the same VSAN
C.The target ports are using soft zoning
D.The zoning configuration is using a zone alias that includes both hosts
AnswerD

A zone alias containing both hosts would place them in the same zone, allowing cross-access.

Why this answer

The administrator likely used a zone alias that inadvertently includes both hosts' pWWNs. In Cisco MDS zoning, a zone alias is a named set of pWWNs; if the alias contains both Host A and Host B, then any zone using that alias will include both hosts, allowing Host A to see Host B's LUNs. This violates the intended hard-zoning isolation, as zones must contain only the specific host-target pairs to enforce LUN masking.

Exam trap

The trap here is that candidates often assume 'zone alias' is just a naming convenience that doesn't affect zone membership, but Cisco tests that an alias expands to include all its members, so using a shared alias in multiple zones breaks isolation.

How to eliminate wrong answers

Option A is wrong because if the zone were not active, no host would see any LUNs, not just cross-host visibility; zones must be activated via the 'zone activate' command to take effect. Option B is wrong because zones in different VSANs are isolated by default and cannot communicate, so this would prevent any visibility, not cause unintended access. Option C is wrong because soft zoning (name server filtering) only hides devices from queries but does not prevent frame-level access; the issue described is actual LUN visibility, which requires hard zoning (hardware-enforced access control) to be misconfigured.

Full explanation →
658
MCQmedium

A service profile is configured to boot from local disk, but the blade server has no local storage. What will happen when the blade is associated with this service profile?

A.The service profile will automatically change the boot policy to SAN.
B.The association will fail with an error message.
C.The blade will boot from SAN automatically as a fallback.
D.The blade will fail to boot and the operating system will not load.
AnswerD

Without a boot device, the blade will not boot.

Why this answer

UCS Manager does not validate hardware capabilities at association time. The blade will boot and fail to find a boot device, resulting in a boot failure. The service profile can still be associated.

Full explanation →
659
MCQeasy

In a spine-leaf data center architecture, what is the primary purpose of using equal-cost multipath (ECMP) routing?

A.To enable VXLAN encapsulation between VTEPs
B.To ensure loop-free Layer 2 topology
C.To provide load balancing across multiple paths between leaf and spine switches
D.To reduce the number of VLANs required in the fabric
AnswerC

ECMP distributes traffic across multiple equal-cost paths, increasing throughput and redundancy.

Why this answer

In a spine-leaf architecture, ECMP is used to distribute traffic across multiple equal-cost paths between leaf and spine switches. This provides load balancing by hashing flows across available uplinks, maximizing bandwidth utilization and ensuring no single link is overwhelmed. ECMP is a Layer 3 routing feature that operates with protocols like OSPF or BGP, not a Layer 2 or encapsulation mechanism.

Exam trap

Cisco often tests ECMP in the context of VXLAN/EVPN fabrics, and the trap here is confusing ECMP's role in load-balancing underlay traffic with VXLAN's role in overlay encapsulation, leading candidates to mistakenly associate ECMP with VXLAN tunnel establishment.

How to eliminate wrong answers

Option A is wrong because VXLAN encapsulation between VTEPs is enabled by configuring a VXLAN tunnel and a Network Virtualization Edge (NVE) interface, not by ECMP; ECMP can be used to load-balance VXLAN-encapsulated traffic but is not its primary purpose. Option B is wrong because ensuring a loop-free Layer 2 topology is the function of Spanning Tree Protocol (STP) or its alternatives like TRILL/SPB, while ECMP operates at Layer 3 and does not prevent Layer 2 loops. Option D is wrong because reducing the number of VLANs is achieved through VXLAN segmentation and VLAN-to-VNI mapping, not through ECMP routing.

Full explanation →
660
Multi-Selecthard

Which TWO statements about Cisco TrustSec in a data center environment are true? (Choose two.)

Select 2 answers
A.TrustSec requires MACsec encryption on all links to function.
B.Cisco ISE can dynamically assign SGTs to endpoints during authentication.
C.TrustSec uses Security Group Tags (SGTs) to enforce access control policies.
D.SGTs are assigned based on the source IP address of the traffic.
E.TrustSec policies are enforced at Layer 3 only.
AnswersB, C

ISE assigns SGTs as part of policy after authentication.

Why this answer

Cisco ISE can dynamically assign Security Group Tags (SGTs) to endpoints during authentication via 802.1X or MAB, enabling role-based access control. This is a core TrustSec feature where the SGT is propagated to the network infrastructure to enforce policies.

Exam trap

Cisco often tests the misconception that TrustSec requires MACsec or IP-based tagging, when in fact SGTs are identity-based and MACsec is optional; candidates may also incorrectly assume TrustSec is Layer 3 only, ignoring its Layer 2 enforcement capabilities.

Full explanation →
661
MCQmedium

A data center engineer is using Cisco Intersight to manage a hybrid infrastructure that includes UCS servers and HyperFlex clusters. The engineer needs to deploy a new server profile to a UCS domain that is claimed in Intersight. The profile includes a firmware policy that specifies version 4.1(3c) for the motherboard and 5.0(3a) for the storage controller. The target server is a C-Series rack mount server currently running firmware version 4.0(2a) on the motherboard. After deploying the profile, the server goes into a 'Pending' state and does not become 'Selectable'. The engineer checks the UCS Manager and sees that the server is in 'Discovery Failed' state. The engineer has verified that network connectivity is fine and the CIMC is accessible. What should the engineer do to resolve this?

A.Ensure that the firmware policy in Intersight is consistent with the current firmware on the server.
B.Remove the server from Intersight inventory and re-claim it.
C.Reset the server's CIMC to factory defaults and re-discover it.
D.Update the firmware manually on the server using UCS Manager before deploying the profile.
AnswerD

Manually updating the firmware to a version compatible with the UCS domain will allow the server to be discovered, after which the profile can be applied.

Why this answer

When a firmware policy in Intersight specifies a version that is not compatible with the current firmware on the server, the server may enter a 'Discovery Failed' state. In this scenario, the motherboard firmware must be updated to a version that supports the storage controller firmware 5.0(3a) before the profile can be applied. Manually updating the firmware via UCS Manager ensures the server meets the prerequisite firmware baseline, allowing Intersight to complete the deployment.

Exam trap

Cisco often tests the concept that firmware policies have dependency chains, and candidates mistakenly think that a simple re-claim or reset will fix a 'Discovery Failed' state, when in fact the root cause is an incompatible firmware version that must be manually updated first.

How to eliminate wrong answers

Option A is wrong because ensuring consistency between the firmware policy and the current firmware would defeat the purpose of the policy, which is to enforce a target version; the issue is not consistency but compatibility. Option B is wrong because removing and re-claiming the server would not resolve the underlying firmware incompatibility; it would only reset the inventory state without addressing the firmware version mismatch. Option C is wrong because resetting the CIMC to factory defaults would erase configuration but not change the firmware version; the server would still fail discovery due to the incompatible firmware.

Full explanation →
662
MCQeasy

A UCS C-series rack server is to be integrated into UCS Manager. The server will be managed by CIMC and must participate in compute pools. Which operating mode should be configured on the C-series server to allow UCS Manager to discover and manage it?

A.Cisco IMC Supervisor mode
B.UCS-managed mode
C.Direct connect mode
D.Standalone mode
AnswerB

This mode allows UCS Manager to discover and manage the server.

Why this answer

C-series servers can operate in standalone mode (IMC only) or UCS-managed mode. To be managed by UCS Manager, the server must be in UCS-managed mode, which requires enabling UCSM (Cisco UCS Manager) mode in CIMC.

Full explanation →
663
Multi-Selecthard

A company is deploying a multi-site UCS environment with UCS Central. Which three capabilities does UCS Central provide over individual UCS Manager instances? (Choose three.)

Select 3 answers
A.Unified reporting and inventory across domains.
B.Direct management of individual blade server power states.
C.Global service profile templates that can be applied across multiple UCS domains.
D.Real-time performance monitoring of each server's CPU utilization.
E.Centralized firmware management for all domains.
AnswersA, C, E

UCS Central provides a single view of all resources.

Why this answer

UCS Central offers global service profile templates, cross-domain policies, and centralized firmware management across multiple UCS domains.

Full explanation →
664
MCQeasy

An engineer is configuring a Fibre Channel over Ethernet (FCoE) SAN. Which statement about FCoE Initialization Protocol (FIP) is true?

A.FIP operates only over lossless Ethernet.
B.FIP uses Ethernet MAC addresses for communication.
C.FIP is used only for FCoE initialization, not for maintenance.
D.FIP requires IP addresses to establish FCoE sessions.
AnswerB

FIP uses MAC addresses for discovery and login.

Why this answer

FCoE Initialization Protocol (FIP) uses Ethernet MAC addresses for communication during the discovery, initialization, and maintenance phases of an FCoE session. FIP frames are encapsulated in standard Ethernet frames with a specific EtherType (0x8914), allowing FCoE-capable endpoints to discover each other and establish virtual links without relying on IP addresses.

Exam trap

Cisco often tests the misconception that FIP requires IP addresses or that it is only used during initialization, when in fact FIP uses MAC addresses and also handles ongoing session maintenance like keep-alives.

How to eliminate wrong answers

Option A is wrong because FIP operates over lossless Ethernet (using priority flow control, PFC), but it is not limited to lossless Ethernet; FIP can also run over lossy Ethernet for discovery and initialization, though data traffic requires lossless Ethernet. Option C is wrong because FIP is used not only for initialization but also for ongoing maintenance, such as keep-alive messages (FIP VLAN request, FIP keep-alive) to monitor and maintain the FCoE session. Option D is wrong because FIP does not require IP addresses; it uses Ethernet MAC addresses and FCoE-specific EtherTypes to establish and manage FCoE sessions, avoiding the IP layer entirely.

Full explanation →
665
MCQeasy

Refer to the exhibit. The Fabric Interconnect cannot ping its default gateway. The management interface is configured and up. What is the most likely cause?

A.The default route is missing from the routing table.
B.The management VLAN is not allowed on the upstream switch.
C.The management interface is configured as DHCP instead of static.
D.The IP address is a duplicate on the network.
AnswerA

Without a default route, the FI cannot reach subnets beyond its own.

Why this answer

The Fabric Interconnect cannot ping its default gateway despite the management interface being up and configured, which indicates that the device lacks a route to reach the gateway subnet. A default route is required to forward traffic destined for networks not directly connected; without it, the Fabric Interconnect will drop packets to the gateway even if the interface is operational. This is the most likely cause because the exhibit shows no default route in the routing table, and the interface status confirms Layer 1 and Layer 2 connectivity.

Exam trap

Cisco often tests the distinction between interface-level connectivity (Layer 1/Layer 2) and routing (Layer 3), leading candidates to incorrectly blame VLAN pruning or IP conflicts when the real issue is a missing default route in the management VRF.

How to eliminate wrong answers

Option B is wrong because if the management VLAN were not allowed on the upstream switch, the interface would likely be in a down/down or err-disabled state, but the exhibit states the management interface is configured and up, indicating VLAN pruning is not the issue. Option C is wrong because the exhibit explicitly shows a static IP address configuration (e.g., IP address and subnet mask), so DHCP misconfiguration is not applicable. Option D is wrong because a duplicate IP address would cause intermittent connectivity or address conflict messages, but the interface would still be up and able to send ARP requests; the inability to ping the gateway points to a routing problem, not an IP conflict.

Full explanation →
666
Multi-Selectmedium

An engineer is deploying a new VXLAN fabric and must ensure that the control plane can handle MAC advertisement without flooding. Which TWO protocols can be used for control plane learning in VXLAN? (Select two.)

Select 2 answers
A.IGMP Snooping
B.OpenFlow
C.VXLAN data plane learning
D.MP-BGP EVPN
E.OSPF
AnswersB, D

OpenFlow is a protocol for SDN controllers that can manage forwarding tables. In some VXLAN implementations, an SDN controller using OpenFlow can act as the control plane for MAC advertisement, eliminating flooding. Therefore, this is correct.

Why this answer

MP-BGP EVPN (Option D) is the primary control plane protocol for VXLAN, defined in RFC 7432, enabling MAC address advertisement without flooding. OpenFlow (Option B) is used in SDN controllers to manage forwarding tables, and in some VXLAN implementations (e.g., VMware NSX), it can serve as the control plane for MAC learning. IGMP Snooping (A) handles multicast group management, not MAC advertisement.

VXLAN data plane learning (C) is the flood-and-learn method, which the question explicitly wants to avoid. OSPF (E) is a routing protocol, not a VXLAN control plane.

Exam trap

Candidates often select only MP-BGP EVPN because it is the most well-known, but fail to recognize that OpenFlow can also serve as a control plane protocol in SDN-based VXLAN solutions. They might also mistakenly choose IGMP Snooping or OSPF due to familiarity with multicast or routing, ignoring the specific requirement for control plane learning.

Full explanation →
667
MCQhard

In an ACI environment, an automation script uses the acitoolkit Python library to create a new EPG. The script connects to the APIC using login credentials. After creating the EPG, what must be called to commit the changes?

A.session.save()
B.session.push_to_apic()
C.session.commit()
D.session.apply()
AnswerB

Correct method to push changes.

Why this answer

acitoolkit uses a Session object; after making changes, the session's push_to_apic method must be called to commit.

Full explanation →
668
MCQhard

During FCoE initialization, which protocol is used by a CNA to discover FCoE-capable switches and establish a virtual link?

A.LLDP
B.DCBX
C.FIP
D.ARP
AnswerC

FIP is the standard protocol for FCoE initialization and discovery.

Why this answer

FIP (FCoE Initialization Protocol) is used by CNAs to discover FCoE switches (FCFs) and perform login to create VN-ports.

Full explanation →
669
MCQhard

A data center architect is designing an ACI fabric with VMM integration to VMware vSphere. The goal is to allow dynamic policy assignment to virtual machines. What is the correct configuration hierarchy to enable this?

A.Create a VMM domain under the infra tenant and associate it with the physical domain.
B.Create a VMM domain under the tenant, integrate with vCenter, and map EPGs to port groups.
C.Use a Layer 4-Layer 7 service graph to connect VMs directly.
D.Configure VXLAN directly on the vSphere distributed switch.
AnswerB

This is the correct method for VMM integration.

Why this answer

VMM integration in ACI requires creating a VMM domain under a tenant (or common tenant), integrating it with vCenter, and then mapping EPGs to vSphere port groups. This allows dynamic policy assignment to VMs based on their port group membership, enabling micro-segmentation and automated policy enforcement as VMs move across hosts.

Exam trap

Cisco often tests the misconception that VMM domains belong to the infra tenant or that VXLAN must be manually configured on the vSphere switch, when in fact the VMM domain is tenant-scoped and the ACI fabric handles VXLAN encapsulation transparently.

How to eliminate wrong answers

Option A is wrong because VMM domains are not created under the infra tenant; they are created under a regular tenant (or common tenant) and associated with a physical domain only if needed for VLAN/VXLAN encapsulation, but the primary integration is with vCenter, not the physical domain. Option C is wrong because Layer 4-Layer 7 service graphs are used for inserting service appliances (like firewalls or load balancers) into traffic flows, not for directly connecting VMs or enabling dynamic policy assignment via VMM integration. Option D is wrong because VXLAN is configured on the ACI leaf switches (via the VMM domain and EPG mappings), not directly on the vSphere distributed switch; the vSphere switch uses port groups that are mapped to EPGs, but VXLAN encapsulation is handled by the ACI fabric.

Full explanation →
670
MCQmedium

Which API uses RESTful principles and supports both XML and JSON encoding for network configuration, as defined in RFC 8040?

A.OpenConfig
B.RESTCONF
C.NETCONF
D.NX-API CLI
AnswerB

RESTCONF is RESTful and supports both XML and JSON.

Why this answer

RESTCONF (RFC 8040) is a REST-based protocol using HTTP methods and supports XML/JSON.

Full explanation →
671
Multi-Selecteasy

A data center architect is designing a spine-leaf fabric with OSPF as the underlay routing protocol. Which two statements about OSPF in this design are correct? (Choose two.)

Select 2 answers
A.OSPF neighbors are formed between leaf and spine switches over the fabric links.
B.OSPF supports ECMP by default, which is essential for load balancing in the fabric.
C.Passive interfaces are configured on the server-facing ports of leaf switches.
D.OSPF must be replaced by BGP in a VXLAN EVPN fabric.
E.OSPF areas must be different for leaf and spine switches to prevent routing loops.
AnswersA, B

Correct. OSPF neighbors are formed between leaf and spine switches over the fabric links, establishing Layer 3 adjacency for the underlay.

Why this answer

In a spine-leaf fabric using OSPF as the underlay, OSPF neighbors are formed directly between leaf and spine switches over the physical fabric links. Option B is correct because OSPF supports ECMP by default, enabling load balancing across multiple equal-cost paths in the fabric. Option C is incorrect: while passive interfaces are often configured on server-facing ports to prevent OSPF neighbor formation with servers, the question asks for two correct statements about OSPF in the design, and the other two options (A and B) are more fundamental to OSPF operation in the underlay.

Options D and E are clearly incorrect; OSPF can coexist with BGP in VXLAN EVPN, and OSPF areas can be the same across leaf and spine switches.

Exam trap

Cisco often tests the misconception that OSPF must be replaced by BGP in VXLAN EVPN fabrics, but the correct understanding is that OSPF serves as the underlay and BGP as the overlay, and they can operate together. Also, candidates may think that all three statements (A, B, C) are correct, but only two are correct per the question's requirement.

Full explanation →
672
MCQhard

An engineer is deploying a new UCS chassis with two Fabric Interconnects. The design requires that server traffic can fail over to the secondary FI if the primary FI fails, without requiring any changes to the server's network configuration. Which technology must be enabled on the uplink ports of the Fabric Interconnects to the upstream switches to ensure transparent failover of server traffic?

A.Configure a virtual PortChannel (vPC) between the Fabric Interconnects and upstream switches.
B.Apply QoS policies to prioritize failover traffic.
C.Enable pin groups with 'failover' mode on the server ports.
D.Implement Private VLANs on the uplink ports to isolate traffic.
AnswerC

Pin groups with failover mode allow the secondary FI to assume the primary's MAC and IP, enabling transparent failover.

Why this answer

Pin groups with 'failover' mode enable transparent server traffic failover by pinning server vNICs to a specific Fabric Interconnect (FI) and automatically repinning them to the secondary FI upon primary FI failure, without requiring any changes to the server's network configuration. This ensures that the server's MAC and IP addresses remain active on the secondary FI, maintaining connectivity without manual intervention.

Exam trap

Cisco often tests the distinction between upstream redundancy technologies (like vPC) and server-side failover mechanisms (like pin group failover mode), leading candidates to incorrectly choose vPC for transparent server failover when it only addresses link redundancy to the upstream network.

How to eliminate wrong answers

Option A is wrong because a virtual PortChannel (vPC) between Fabric Interconnects and upstream switches provides link-level redundancy and load balancing, but it does not handle server-side failover; vPC is an upstream switch technology, not a mechanism for transparent server failover between FIs. Option B is wrong because QoS policies prioritize traffic types but do not provide any failover mechanism; they are unrelated to transparent server failover. Option D is wrong because Private VLANs isolate traffic within a VLAN for security purposes and have no role in failover or repinning server traffic between Fabric Interconnects.

Full explanation →
673
MCQmedium

Refer to the exhibit. A server connected to interface fc1/3 on the MDS switch cannot log in to the fabric. The server's HBA WWPN is 10:00:00:00:c9:2b:1a:62. What is the most likely reason for the login failure?

A.NPIV is disabled on the port
B.The server's WWPN is not in the active zone set
C.Interface fc1/3 is not assigned to VSAN 100
D.The link speed is mismatched between switch and HBA
AnswerC

Without correct VSAN, the port cannot participate.

Why this answer

Interface fc1/3 is not assigned to VSAN 100, as shown in the exhibit (the interface is in VSAN 1 by default or another VSAN). Without being in the correct VSAN, the server's FLOGI (Fabric Login) request is processed in the wrong VSAN context, preventing it from logging into the fabric and accessing the intended storage targets. Assigning the interface to the correct VSAN is mandatory for successful fabric login.

Exam trap

Cisco often tests the distinction between pre-login requirements (VSAN assignment, port mode) and post-login requirements (zoning, NPIV), so the trap here is assuming zone membership is checked before the server can log in, when in fact FLOGI must succeed first.

How to eliminate wrong answers

Option A is wrong because NPIV (N_Port ID Virtualization) is only required when multiple virtual HBAs share a single physical port; it is not a prerequisite for a single HBA to log in. Option B is wrong because zone membership is checked after successful fabric login (FLOGI) and name server registration; the server cannot even attempt zone-based access if it fails to log in. Option D is wrong because a link speed mismatch would cause the interface to be in a non-operational state (e.g., err-disabled or not up), but the exhibit shows the interface is up; the issue is VSAN misassignment, not physical layer negotiation.

Full explanation →
674
MCQhard

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

A.Enable dynamic ARP inspection on all VLANs.
B.Enable IP source guard on all access ports.
C.Enable DHCP snooping globally and configure uplink ports as trusted.
D.Enable MAC port security on all access ports.
AnswerC

DHCP snooping filters DHCP offers from untrusted ports.

Why this answer

DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.

Exam trap

Cisco often tests the distinction between DHCP snooping (which blocks rogue DHCP servers) and DAI or IPSG (which rely on DHCP snooping but address different threats), leading candidates to confuse the security feature with its prerequisite.

How to eliminate wrong answers

Option A is wrong because dynamic ARP inspection (DAI) validates ARP packets based on DHCP snooping bindings, but it does not directly prevent a rogue DHCP server from sending DHCP offers. Option B is wrong because IP source guard (IPSG) filters IP traffic based on the DHCP snooping binding table, but it does not block DHCP server messages; it only prevents IP spoofing on data traffic. Option D is wrong because MAC port security limits the number of MAC addresses per port and prevents MAC flooding, but it has no mechanism to detect or block unauthorized DHCP servers.

Full explanation →
675
MCQmedium

An engineer is configuring OSPF in a data center fabric with multiple Nexus 9000 switches. To ensure fast convergence after a link failure, which OSPF feature should be enabled?

A.OSPF authentication
B.OSPF Fast Hello
C.OSPF LSA throttling
D.OSPF stub area
AnswerB

Fast Hello sends hellos at sub-second intervals for fast failure detection.

Why this answer

OSPF Fast Hello reduces the dead interval to less than 1 second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF to detect a link failure in milliseconds rather than the default 40 seconds, significantly improving convergence time in a data center fabric where rapid failover is critical.

Exam trap

Cisco often tests the distinction between features that improve failure detection speed (like Fast Hello or BFD) versus features that optimize LSA propagation or reduce database size (like LSA throttling or stub areas), leading candidates to confuse convergence optimization with detection acceleration.

How to eliminate wrong answers

Option A is wrong because OSPF authentication (MD5 or SHA) provides security against routing attacks but does not affect convergence speed after a link failure. Option C is wrong because OSPF LSA throttling controls the rate at which LSAs are generated and flooded, which helps prevent network instability during flapping but does not directly speed up failure detection. Option D is wrong because configuring an OSPF stub area reduces the size of the LSDB by blocking Type 5 LSAs, which can improve CPU and memory usage but has no impact on the speed of detecting a link failure.

Full explanation →
Page 8

Page 9 of 14

Page 10

All pages

1234567891011121314

Practice 350-601 by domain

Target a specific domain to shore up weak areas.

NetworkStorage NetworkAutomationComputeSecurity
See all domains with question counts →