Scenario practice questions

A company has two Cisco MDS 9700 switches in a dual-fabric SAN. Each fabric has its own set of storage arrays and hosts. The company wants to enable selective communication between specific devices in Fabric A and Fabric B without merging the fabrics. Which Cisco technology should be used?

Trap 1: FCIP

FCIP is used to connect remote Fibre Channel fabrics over IP networks.

Trap 2: NPV

NPV is used to simplify edge switch configuration, not for inter-fabric communication.

Trap 3: Port channels

Port channels provide increased bandwidth and redundancy on a single link, not inter-fabric routing.

A
FCIP
Why wrong: FCIP is used to connect remote Fibre Channel fabrics over IP networks.
B
NPV
Why wrong: NPV is used to simplify edge switch configuration, not for inter-fabric communication.
C
IVR
IVR enables selective communication between devices in different VSANs while keeping fabrics separate.
D
Port channels
Why wrong: Port channels provide increased bandwidth and redundancy on a single link, not inter-fabric routing.

Question 2easymultiple choice

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

Trap 1: Use a tenant to separate the EPGs logically.

Tenants are administrative boundaries, not policy enforcement points.

Trap 2: Configure a VRF to isolate traffic between EPGs.

VRF provides routing separation, not granular filtering.

Trap 3: Define a bridge domain with L2 policies.

Bridge domain is for Layer 2 forwarding, not access control.

A
Create a contract between EPGs with appropriate filters.
Contracts in ACI define allowed communication with filters for specific protocols/ports.
B
Use a tenant to separate the EPGs logically.
Why wrong: Tenants are administrative boundaries, not policy enforcement points.
C
Configure a VRF to isolate traffic between EPGs.
Why wrong: VRF provides routing separation, not granular filtering.
D
Define a bridge domain with L2 policies.
Why wrong: Bridge domain is for Layer 2 forwarding, not access control.

Question 3mediummultiple choice

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

Trap 1: Disable vPC on both switches and reconfigure the port channels.

Disabling vPC is not necessary; the issue is with keepalive.

Trap 2: Reconfigure the vPC domain with a lower priority on the secondary…

Priority affects role election, not keepalive failure behavior.

Trap 3: Increase the vPC peer-keepalive hold timeout to 5 seconds.

Increasing hold timeout delays failure detection.

A
Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.
A dedicated keepalive link ensures reliable communication and prevents split-brain.
B
Disable vPC on both switches and reconfigure the port channels.
Why wrong: Disabling vPC is not necessary; the issue is with keepalive.
C
Reconfigure the vPC domain with a lower priority on the secondary switch.
Why wrong: Priority affects role election, not keepalive failure behavior.
D
Increase the vPC peer-keepalive hold timeout to 5 seconds.
Why wrong: Increasing hold timeout delays failure detection.

Question 4hardmulti select

An engineer is troubleshooting a performance issue on a Cisco MDS 9700 switch. The 'show interface fc1/1' output shows CRC errors incrementing slowly. The interface is connected to a storage array. Which two actions should the engineer take to resolve the issue?

Trap 1: Increase the MTU size on the interface.

MTU affects frame size but not CRC errors.

Trap 2: Clear the interface counters.

Clearing counters hides the problem without resolving it.

Trap 3: Change the interface speed from auto to a fixed value.

Speed mismatch is less likely; fixing speed may cause other issues.

A
Increase the MTU size on the interface.
Why wrong: MTU affects frame size but not CRC errors.
B
Replace the fiber optic cable and SFP.
Faulty cables or SFPs are common causes of CRC errors.
C
Enable BB_credit recovery on the interface.
BB_credit recovery helps manage buffer credit issues that can cause CRC errors.
D
Clear the interface counters.
Why wrong: Clearing counters hides the problem without resolving it.
E
Change the interface speed from auto to a fixed value.
Why wrong: Speed mismatch is less likely; fixing speed may cause other issues.

Read the full NAT/PAT explanation →

Question 5hardmultiple choice

You manage a UCS domain with two fabric interconnects (FI-A and FI-B) in an cluster. The domain contains 8 blade servers. After a power failure, both FIs come back online, but the cluster experiences a split-brain situation where both FIs claim to be primary. The subordinate FI (FI-B) shows all blades as 'Discovery' state. You suspect configuration mismatch. You have console access to both FIs. Which recovery procedure should be performed to restore a stable cluster?

Trap 1: Reset both FIs to factory defaults and reconfigure from backup

Unnecessarily destructive, backup may not be available

Trap 2: Boot the FIs into the EFI shell and clear the flash

EFI is for firmware issues, not cluster state

Trap 3: Perform a stateful switchover (SSO) on both FIs

SSO is for fault tolerance, not split-brain recovery

A
Reset both FIs to factory defaults and reconfigure from backup
Why wrong: Unnecessarily destructive, backup may not be available
B
Boot the FIs into the EFI shell and clear the flash
Why wrong: EFI is for firmware issues, not cluster state
C
Perform a stateful switchover (SSO) on both FIs
Why wrong: SSO is for fault tolerance, not split-brain recovery
D
On the subordinate FI (FI-B), enter the recovery mode and force a re-initialization, then reset the cluster
Standard UCS split-brain recovery procedure

Question 6mediummultiple choice

A server team reports that after connecting a new server to a switchport, the server can receive traffic but cannot send traffic. The port is configured with port security. What is the most likely cause?

Trap 1: The port is in errdisable state

In errdisable, no traffic is received or sent.

Trap 2: The port security maximum is set to 1 and another device is…

That would cause a violation, but the behavior depends on mode.

Trap 3: The server MAC address is not in the allowed list

If the MAC is not allowed, the violation mode determines action; protect mode would drop as described.

A
The port is in errdisable state
Why wrong: In errdisable, no traffic is received or sent.
B
The port security violation mode is set to protect
Protect mode drops offending frames silently, allowing the server to receive but not send traffic from an unknown MAC.
C
The port security maximum is set to 1 and another device is connected
Why wrong: That would cause a violation, but the behavior depends on mode.
D
The server MAC address is not in the allowed list
Why wrong: If the MAC is not allowed, the violation mode determines action; protect mode would drop as described.

Question 7mediummultiple choice

Refer to the exhibit. An administrator connects a new server to Ethernet1/1 and the port immediately goes into errdisable state. The previous device was connected to that port. What is the most likely cause?

Exhibit

```
switch# show port-security interface ethernet 1/1
Port Security              : Enabled
Port status                : Secured
Violation mode             : Shutdown
Maximum MAC Addresses      : 1
Sticky MAC Addresses       : 1
Last violation time        : 00:00:15
Last violation MAC address : 000c.291a.2b3c
```

Trap 1: The port security violation mode is set to protect

Protect mode drops frames but does not errdisable the port.

Trap 2: The port security maximum MAC addresses is set too high

A high maximum would allow more MACs; this violation is due to mismatch.

Trap 3: The port is configured as a trunk

Trunk configuration is not shown and would not cause this violation.

A
The new server has a different MAC address than the sticky MAC
Sticky MAC learned the previous server's MAC; new server's MAC is different, causing a violation and port shutdown.
B
The port security violation mode is set to protect
Why wrong: Protect mode drops frames but does not errdisable the port.
C
The port security maximum MAC addresses is set too high
Why wrong: A high maximum would allow more MACs; this violation is due to mismatch.
D
The port is configured as a trunk
Why wrong: Trunk configuration is not shown and would not cause this violation.

Question 8mediummultiple choice

A Nexus 9000 switch is configured with VPC. The VPC keepalive link fails. What is the effect on the VPC domain?

Trap 1: Both switches suspend the VPC VLANs.

Only the secondary suspends its VPC member ports; the primary continues forwarding.

Trap 2: Both switches continue to forward traffic normally.

Without keepalive, the secondary will suspend its VPC ports to prevent dual-active.

Trap 3: The primary switch becomes orphan.

The primary does not become orphan; it continues to operate normally.

A
Both switches suspend the VPC VLANs.
Why wrong: Only the secondary suspends its VPC member ports; the primary continues forwarding.
B
Both switches continue to forward traffic normally.
Why wrong: Without keepalive, the secondary will suspend its VPC ports to prevent dual-active.
C
The secondary switch suspends its VPC member ports.
To avoid split-brain, the secondary switch suspends its VPC member ports while keepalive is down.
D
The primary switch becomes orphan.
Why wrong: The primary does not become orphan; it continues to operate normally.

Question 9easymultiple choice

An administrator needs to reset the CIMC password on a Cisco UCS C-Series server without physical access. Which method can be used?

Trap 1: Use the front panel reset button

Requires physical presence, not remote.

Trap 2: Use UCS Manager

UCS Manager manages UCS blades, not C-Series rack servers.

Trap 3: Connect via serial console during boot

Requires physical serial connection.

A
Use the front panel reset button
Why wrong: Requires physical presence, not remote.
B
Use UCS Manager
Why wrong: UCS Manager manages UCS blades, not C-Series rack servers.
C
Use the CIMC XML API
Allows remote management commands, including password change.
D
Connect via serial console during boot
Why wrong: Requires physical serial connection.

Question 10hardmultiple choice

In a vPC domain, a consistency check failure is observed for the vPC keepalive link. What is the impact on the vPC domain operation?

Trap 1: The vPC peer link will be suspended.

Peer link suspension occurs only if the peer link itself fails or if the keepalive fails and the peer link also fails.

Trap 2: The secondary switch will shutdown its vPC member ports.

This occurs if the keepalive fails AND the peer link fails, but not automatically.

Trap 3: Both switches will independently forward traffic via the vPC peer…

Without keepalive, the secondary may think primary is down and take over, causing split-brain.

A
The vPC peer link will be suspended.
Why wrong: Peer link suspension occurs only if the peer link itself fails or if the keepalive fails and the peer link also fails.
B
The secondary switch will shutdown its vPC member ports.
Why wrong: This occurs if the keepalive fails AND the peer link fails, but not automatically.
C
The vPC domain will continue to operate but with reduced reliability.
The keepalive is a secondary monitoring mechanism; its loss increases risk of split-brain if the peer link fails.
D
Both switches will independently forward traffic via the vPC peer link.
Why wrong: Without keepalive, the secondary may think primary is down and take over, causing split-brain.

Question 11mediummultiple choice

A data center administrator is implementing Cisco TrustSec on a Nexus 7000 switch to enforce role-based access control. After configuring a security group tag (SGT) classification policy, users report that traffic between two servers is not being tagged. What is the most likely cause?

Trap 1: DHCP snooping is not enabled on the VLAN.

DHCP snooping is unrelated to SGT classification.

Trap 2: The switch ASIC does not support TrustSec in hardware.

Nexus 7000 generally supports TrustSec in hardware.

Trap 3: The SGT is assigned on the egress interface instead of ingress.

SGT classification happens on ingress.

A
DHCP snooping is not enabled on the VLAN.
Why wrong: DHCP snooping is unrelated to SGT classification.
B
The ingress interface is missing the 'sgt' or 'ip policy' command to classify traffic.
Ingress interface must have 'sgt' or 'ip policy' to assign SGTs.
C
The switch ASIC does not support TrustSec in hardware.
Why wrong: Nexus 7000 generally supports TrustSec in hardware.
D
The SGT is assigned on the egress interface instead of ingress.
Why wrong: SGT classification happens on ingress.

Question 12mediummultiple choice

A data center engineer is using Cisco Intersight to manage a hybrid infrastructure that includes UCS servers and HyperFlex clusters. The engineer needs to deploy a new server profile to a UCS domain that is claimed in Intersight. The profile includes a firmware policy that specifies version 4.1(3c) for the motherboard and 5.0(3a) for the storage controller. The target server is a C-Series rack mount server currently running firmware version 4.0(2a) on the motherboard. After deploying the profile, the server goes into a 'Pending' state and does not become 'Selectable'. The engineer checks the UCS Manager and sees that the server is in 'Discovery Failed' state. The engineer has verified that network connectivity is fine and the CIMC is accessible. What should the engineer do to resolve this?

Trap 1: Ensure that the firmware policy in Intersight is consistent with…

The firmware policy should define the desired version; making it consistent with the current version would not resolve the firmware incompatibility that causes discovery failure.

Trap 2: Remove the server from Intersight inventory and re-claim it.

Re-claiming the server would not address the underlying firmware issue and would likely result in the same discovery failure.

Trap 3: Reset the server's CIMC to factory defaults and re-discover it.

Resetting CIMC may clear configuration issues but will not resolve the firmware incompatibility that prevents discovery.

A
Ensure that the firmware policy in Intersight is consistent with the current firmware on the server.
Why wrong: The firmware policy should define the desired version; making it consistent with the current version would not resolve the firmware incompatibility that causes discovery failure.
B
Remove the server from Intersight inventory and re-claim it.
Why wrong: Re-claiming the server would not address the underlying firmware issue and would likely result in the same discovery failure.
C
Reset the server's CIMC to factory defaults and re-discover it.
Why wrong: Resetting CIMC may clear configuration issues but will not resolve the firmware incompatibility that prevents discovery.
D
Update the firmware manually on the server using UCS Manager before deploying the profile.
Manually updating the firmware to a version compatible with the UCS domain will allow the server to be discovered, after which the profile can be applied.