Scenario practice questions

An administrator needs to reset the CIMC password on a Cisco UCS C-Series server without physical access. Which method can be used?

Trap 1: Use the front panel reset button

Requires physical presence, not remote.

Trap 2: Use UCS Manager

UCS Manager manages UCS blades, not C-Series rack servers.

Trap 3: Connect via serial console during boot

Requires physical serial connection.

A
Use the front panel reset button
Why wrong: Requires physical presence, not remote.
B
Use UCS Manager
Why wrong: UCS Manager manages UCS blades, not C-Series rack servers.
C
Use the CIMC XML API
Allows remote management commands, including password change.
D
Connect via serial console during boot
Why wrong: Requires physical serial connection.

Question 2mediummultiple choice

A server team reports that after connecting a new server to a switchport, the server can receive traffic but cannot send traffic. The port is configured with port security. What is the most likely cause?

Trap 1: The port is in errdisable state

In errdisable, no traffic is received or sent.

Trap 2: The port security maximum is set to 1 and another device is…

That would cause a violation, but the behavior depends on mode.

Trap 3: The server MAC address is not in the allowed list

If the MAC is not allowed, the violation mode determines action; protect mode would drop as described.

A
The port is in errdisable state
Why wrong: In errdisable, no traffic is received or sent.
B
The port security violation mode is set to protect
Protect mode drops offending frames silently, allowing the server to receive but not send traffic from an unknown MAC.
C
The port security maximum is set to 1 and another device is connected
Why wrong: That would cause a violation, but the behavior depends on mode.
D
The server MAC address is not in the allowed list
Why wrong: If the MAC is not allowed, the violation mode determines action; protect mode would drop as described.

Question 3mediummultiple choice

An engineer configures vPC on a pair of Nexus switches. The vPC peer-keepalive link fails, but the vPC peer-link remains operational. What is the expected behavior?

Trap 1: Both switches suspend all vPC member ports to avoid loops.

Suspension occurs only if the peer-link fails and keepalive is lost.

Trap 2: The primary switch reloads to prevent a split-brain scenario.

No reload occurs; keepalive failure alone doesn't trigger split-brain if peer-link is up.

Trap 3: The secondary switch suspends its vPC member ports.

Secondary suspension occurs only when both peer-link and keepalive fail.

A
Both switches suspend all vPC member ports to avoid loops.
Why wrong: Suspension occurs only if the peer-link fails and keepalive is lost.
B
The primary switch reloads to prevent a split-brain scenario.
Why wrong: No reload occurs; keepalive failure alone doesn't trigger split-brain if peer-link is up.
C
The vPC domain remains operational with both switches forwarding traffic.
Keepalive is not critical if peer-link is up; domain stays up.
D
The secondary switch suspends its vPC member ports.
Why wrong: Secondary suspension occurs only when both peer-link and keepalive fail.

Question 4easymultiple choice

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

Trap 1: Use a tenant to separate the EPGs logically.

Tenants are administrative boundaries, not policy enforcement points.

Trap 2: Configure a VRF to isolate traffic between EPGs.

VRF provides routing separation, not granular filtering.

Trap 3: Define a bridge domain with L2 policies.

Bridge domain is for Layer 2 forwarding, not access control.

A
Create a contract between EPGs with appropriate filters.
Contracts in ACI define allowed communication with filters for specific protocols/ports.
B
Use a tenant to separate the EPGs logically.
Why wrong: Tenants are administrative boundaries, not policy enforcement points.
C
Configure a VRF to isolate traffic between EPGs.
Why wrong: VRF provides routing separation, not granular filtering.
D
Define a bridge domain with L2 policies.
Why wrong: Bridge domain is for Layer 2 forwarding, not access control.

Question 5hardmultiple choice

In a HyperFlex cluster, what is the function of the cluster witness VM when replication factor 3 (RF3) is used?

Trap 1: It stores a third replica of all data to reduce storage…

The witness does not store data.

Trap 2: It handles storage replication tasks.

Replication is done by the nodes, not the witness.

Trap 3: It serves as a backup node for failover.

Witness is not a compute node.

A
It stores a third replica of all data to reduce storage requirements.
Why wrong: The witness does not store data.
B
It handles storage replication tasks.
Why wrong: Replication is done by the nodes, not the witness.
C
It serves as a backup node for failover.
Why wrong: Witness is not a compute node.
D
It provides a quorum vote to prevent split-brain scenarios.
Correct. The witness votes for cluster decisions.

Question 6mediummultiple choice

In a Cisco HyperFlex cluster, which component is responsible for ensuring data redundancy and consistency across nodes, and typically requires a separate VM for proper operation?

Trap 1: Cisco IMC

CIMC is for out-of-band management, not cluster redundancy.

Trap 2: HyperFlex Data Platform (HXDP) controller

HXDP runs on each node, but the witness is a separate entity.

Trap 3: vCenter Server

vCenter manages VMware but is not the arbiter.

A
Cisco IMC
Why wrong: CIMC is for out-of-band management, not cluster redundancy.
B
HyperFlex Data Platform (HXDP) controller
Why wrong: HXDP runs on each node, but the witness is a separate entity.
C
Cluster Witness VM
The witness VM provides arbitration for cluster membership.
D
vCenter Server
Why wrong: vCenter manages VMware but is not the arbiter.

Question 7mediummultiple choice

An engineer needs to connect a Cisco MDS switch to a core Fibre Channel fabric using NPV mode. What port type will the edge switch's uplink ports assume in this scenario?

Trap 1: N-port

N-port is for end devices, not uplinks.

Trap 2: E-port

E-port is for ISL connections between switches.

Trap 3: F-port

F-port is used on core switches to connect N-ports.

A
NP-port
NP-port is the uplink port type in NPV mode.
B
N-port
Why wrong: N-port is for end devices, not uplinks.
C
E-port
Why wrong: E-port is for ISL connections between switches.
D
F-port
Why wrong: F-port is used on core switches to connect N-ports.

Question 8mediummultiple choice

Refer to the exhibit. An administrator connects a new server to Ethernet1/1 and the port immediately goes into errdisable state. The previous device was connected to that port. What is the most likely cause?

Exhibit

```
switch# show port-security interface ethernet 1/1
Port Security              : Enabled
Port status                : Secured
Violation mode             : Shutdown
Maximum MAC Addresses      : 1
Sticky MAC Addresses       : 1
Last violation time        : 00:00:15
Last violation MAC address : 000c.291a.2b3c
```

Trap 1: The port security violation mode is set to protect

Protect mode drops frames but does not errdisable the port.

Trap 2: The port security maximum MAC addresses is set too high

A high maximum would allow more MACs; this violation is due to mismatch.

Trap 3: The port is configured as a trunk

Trunk configuration is not shown and would not cause this violation.

A
The new server has a different MAC address than the sticky MAC
Sticky MAC learned the previous server's MAC; new server's MAC is different, causing a violation and port shutdown.
B
The port security violation mode is set to protect
Why wrong: Protect mode drops frames but does not errdisable the port.
C
The port security maximum MAC addresses is set too high
Why wrong: A high maximum would allow more MACs; this violation is due to mismatch.
D
The port is configured as a trunk
Why wrong: Trunk configuration is not shown and would not cause this violation.

Question 9mediummultiple choice

A Nexus 9000 switch is configured with VPC. The VPC keepalive link fails. What is the effect on the VPC domain?

Trap 1: Both switches suspend the VPC VLANs.

Only the secondary suspends its VPC member ports; the primary continues forwarding.

Trap 2: Both switches continue to forward traffic normally.

Without keepalive, the secondary will suspend its VPC ports to prevent dual-active.

Trap 3: The primary switch becomes orphan.

The primary does not become orphan; it continues to operate normally.

A
Both switches suspend the VPC VLANs.
Why wrong: Only the secondary suspends its VPC member ports; the primary continues forwarding.
B
Both switches continue to forward traffic normally.
Why wrong: Without keepalive, the secondary will suspend its VPC ports to prevent dual-active.
C
The secondary switch suspends its VPC member ports.
To avoid split-brain, the secondary switch suspends its VPC member ports while keepalive is down.
D
The primary switch becomes orphan.
Why wrong: The primary does not become orphan; it continues to operate normally.

Question 10mediummultiple choice

A data center administrator is implementing Cisco TrustSec on a Nexus 7000 switch to enforce role-based access control. After configuring a security group tag (SGT) classification policy, users report that traffic between two servers is not being tagged. What is the most likely cause?

Trap 1: DHCP snooping is not enabled on the VLAN.

DHCP snooping is unrelated to SGT classification.

Trap 2: The switch ASIC does not support TrustSec in hardware.

Nexus 7000 generally supports TrustSec in hardware.

Trap 3: The SGT is assigned on the egress interface instead of ingress.

SGT classification happens on ingress.

A
DHCP snooping is not enabled on the VLAN.
Why wrong: DHCP snooping is unrelated to SGT classification.
B
The ingress interface is missing the 'sgt' or 'ip policy' command to classify traffic.
Ingress interface must have 'sgt' or 'ip policy' to assign SGTs.
C
The switch ASIC does not support TrustSec in hardware.
Why wrong: Nexus 7000 generally supports TrustSec in hardware.
D
The SGT is assigned on the egress interface instead of ingress.
Why wrong: SGT classification happens on ingress.

Question 11hardmultiple choice

A data center engineer is configuring vPC on a pair of Cisco Nexus switches. The vPC peer-link is established but the vPC member ports remain suspended. After checking the configuration, the engineer notices that the vPC peer-keepalive link is not functioning. What is the most likely cause of the suspended member ports?

Trap 1: MTU mismatch on the peer-link

MTU mismatch may cause packet drops but not typically member port suspension.

Trap 2: Mismatched vPC domain ID

Mismatched domain ID prevents vPC formation entirely.

Trap 3: Incorrect VLAN configuration on member ports

VLAN mismatch can cause issues but not directly related to peer-keepalive failure.

A
MTU mismatch on the peer-link
Why wrong: MTU mismatch may cause packet drops but not typically member port suspension.
B
Peer-keepalive link failure causing dual-active detection issues
Peer-keepalive failure can trigger a dual-active situation, leading to member port suspension.
C
Mismatched vPC domain ID
Why wrong: Mismatched domain ID prevents vPC formation entirely.
D
Incorrect VLAN configuration on member ports
Why wrong: VLAN mismatch can cause issues but not directly related to peer-keepalive failure.

Question 12easymultiple choice

In a HyperFlex cluster, what is the function of the witness VM?

Trap 1: To store backup copies of all cluster data

The witness does not store data; it only maintains quorum state.

Trap 2: To offload data replication processing

Data replication is handled by the HXDP across storage nodes.

Trap 3: To provide a centralized management interface

Management is done via HX Connect or vCenter plugin, not the witness.

A
To store backup copies of all cluster data
Why wrong: The witness does not store data; it only maintains quorum state.
B
To offload data replication processing
Why wrong: Data replication is handled by the HXDP across storage nodes.
C
To provide a centralized management interface
Why wrong: Management is done via HX Connect or vCenter plugin, not the witness.
D
To act as a tie-breaker for cluster quorum
The witness ensures cluster availability by voting in the event of a failure.

Question 13hardmultiple choice

An organization's storage network uses RAID-10 for critical databases. The storage array has 12 disks. How many disks can fail simultaneously without data loss, assuming the worst-case scenario?

Trap 1: 11

That would be all but one, not possible in RAID-10.

Trap 2: 2

Only 2 if they are in different mirrors, but up to 6 is the maximum.

Trap 3: 1

In the worst case, if two disks in the same mirror fail, data is lost. But overall, up to 6 can fail if they are in different mirrors.

A
6
RAID-10 can tolerate up to 6 disk failures as long as no mirror loses both disks.
B
11
Why wrong: That would be all but one, not possible in RAID-10.
C
2
Why wrong: Only 2 if they are in different mirrors, but up to 6 is the maximum.
D
1
Why wrong: In the worst case, if two disks in the same mirror fail, data is lost. But overall, up to 6 can fail if they are in different mirrors.

Question 14easymultiple choice

A storage administrator has been tasked with integrating a new Cisco MDS 9706 switch into an existing Fibre Channel SAN. The existing SAN consists of two Cisco MDS 9148S switches configured in a VSAN 100 with a single zone set that contains all initiator and target WWPNs. The administrator connects the new switch to one of the existing switches using an ISL and configures the new switch with VSAN 100 and the same zone configuration. The administrator activates the zone set on the new switch and verifies that the ISL is up and both switches see each other's Fibre Channel IDs. However, servers attached to the existing switches still cannot discover the storage targets that are connected to the new switch. The administrator has confirmed that the ISL is operational and that the zone set on the new switch is activated with the correct WWPNs. What should the administrator check next?

Trap 1: Confirm that the zone set on the new switch is activated and…

Already confirmed, so this is not the issue.

Trap 2: Ensure that the trunk protocol is enabled on the ISL and that…

ISL works without trunk if both sides are in the same VSAN; not required.

Trap 3: Check that the new switch's domain ID is unique and not conflicting.

Domain IDs are already resolved since the ISL is up and FC IDs are seen.

A
Confirm that the zone set on the new switch is activated and contains correct WWPNs.
Why wrong: Already confirmed, so this is not the issue.
B
Ensure that the trunk protocol is enabled on the ISL and that allowed VSANs include VSAN 100.
Why wrong: ISL works without trunk if both sides are in the same VSAN; not required.
C
Check that the new switch's domain ID is unique and not conflicting.
Why wrong: Domain IDs are already resolved since the ISL is up and FC IDs are seen.
D
Verify that the new switch's target-facing interfaces are not in shutdown state.
Interfaces must be administratively enabled to allow login.