- A
Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Use vzAny for both EPGs.
Why wrong: vzAny is used for contracts applied to all EPGs; not required here and could overly permit traffic.
- B
Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Assign web_EPG as provider and app_EPG as consumer.
Why wrong: This would allow traffic from app to web, not web to app, unless filter is bidirectional.
- C
Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer.
Correct: provider sends traffic to consumer; filter permits TCP 8080; direction both allows response.
- D
Create a contract with subject 'web_to_app' and apply filter 'ip'. Assign web_EPG as provider and app_EPG as consumer.
Why wrong: IP filter would permit all IP traffic, not just TCP 8080.
350-601 Security Practice Question
This 350-601 practice question tests your understanding of security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An engineer is configuring a new data center leaf switch to enforce micro-segmentation using Cisco ACI. The requirement is to permit traffic from web servers to application servers on TCP port 8080, but deny all other traffic. The web servers are in EPG 'web_EPG' and application servers in EPG 'app_EPG'. Which contract configuration should be applied?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer.
Option C is correct because in Cisco ACI, contracts define the rules for communication between EPGs. The provider EPG offers a service, and the consumer EPG accesses it. By setting the filter direction to 'both', the contract enforces bidirectional traffic on TCP port 8080, which is necessary for web-to-application communication (e.g., HTTP responses). This configuration ensures that only traffic matching the filter is permitted, while all other traffic is implicitly denied by ACI's default deny behavior.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Use vzAny for both EPGs.
Why it's wrong here
vzAny is used for contracts applied to all EPGs; not required here and could overly permit traffic.
- ✗
Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Assign web_EPG as provider and app_EPG as consumer.
Why it's wrong here
This would allow traffic from app to web, not web to app, unless filter is bidirectional.
- ✓
Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer.
Why this is correct
Correct: provider sends traffic to consumer; filter permits TCP 8080; direction both allows response.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Create a contract with subject 'web_to_app' and apply filter 'ip'. Assign web_EPG as provider and app_EPG as consumer.
Why it's wrong here
IP filter would permit all IP traffic, not just TCP 8080.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume the default filter direction (consumer to provider) is sufficient for bidirectional TCP communication, but Cisco tests the understanding that the 'both' direction is required for return traffic in ACI contracts.
Detailed technical explanation
How to think about this question
In ACI, contracts use filters with configurable direction (uni-directional or both). When a filter is set to 'both', the hardware policy CAM entries are programmed to allow traffic in both directions for the specified protocol and port, which is essential for stateful services like TCP. A common real-world scenario is migrating from a traditional firewall to ACI, where engineers forget to set direction to 'both' for TCP-based services, causing asymmetric traffic drops and application timeouts.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Security — study guide chapter
Learn the concepts, then practise the questions
- →
Security practice questions
Targeted practice on this topic area only
- →
All 350-601 questions
500 questions across all exam domains
- →
Cisco DCCOR / CCNP Data Center Core 350-601 study guide
Full concept coverage aligned to exam objectives
- →
350-601 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related 350-601 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Network practice questions
Practise 350-601 questions linked to Network.
Compute practice questions
Practise 350-601 questions linked to Compute.
Storage Network practice questions
Practise 350-601 questions linked to Storage Network.
Automation practice questions
Practise 350-601 questions linked to Automation.
Security practice questions
Practise 350-601 questions linked to Security.
350-601 fundamentals practice questions
Practise 350-601 questions linked to 350-601 fundamentals.
350-601 scenario practice questions
Practise 350-601 questions linked to 350-601 scenario.
350-601 troubleshooting practice questions
Practise 350-601 questions linked to 350-601 troubleshooting.
Practice this exam
Start a free 350-601 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this 350-601 question test?
Security — This question tests Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer. — Option C is correct because in Cisco ACI, contracts define the rules for communication between EPGs. The provider EPG offers a service, and the consumer EPG accesses it. By setting the filter direction to 'both', the contract enforces bidirectional traffic on TCP port 8080, which is necessary for web-to-application communication (e.g., HTTP responses). This configuration ensures that only traffic matching the filter is permitted, while all other traffic is implicitly denied by ACI's default deny behavior.
What should I do if I get this 350-601 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More 350-601 practice questions
- Refer to the exhibit. The interface fc1/1 is configured as an E_port. The connected switch also has an E_port configured…
- Refer to the exhibit. After applying this configuration, the engineer activates the zoneset with 'zoneset activate name…
- A network engineer is troubleshooting a slow backup performance between a backup server and a tape library connected via…
- A data center engineer is deploying a new application on Cisco UCS Manager. The application requires consistent low-late…
- Which TWO are valid methods to configure a Cisco UCS service profile for stateless computing? (Choose two.)
- A data center engineer notices that a UCS B-Series blade server is failing to boot from a SAN LUN that is correctly mapp…
Last reviewed: Jun 11, 2026
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.