Troubleshooting practice questions

A network engineer is troubleshooting a slow backup performance between a backup server and a tape library connected via FC. The backup server is connected to a Cisco MDS switch at 8 Gbps, and the tape library is connected at 4 Gbps. The backup job is using hardware compression. Which factor is most likely limiting performance?

Trap 1: Insufficient buffer credits on the MDS switch

Buffer credits affect long-distance links, not speed-limited performance.

Trap 2: Hardware compression on the tape library

Compression reduces data, improving performance, not limiting it.

Trap 3: Half-duplex mode on the FC link

FC always operates in full-duplex mode.

A
Port speed mismatch between the server and tape library
The slower device (4 Gbps) determines the link speed.
B
Insufficient buffer credits on the MDS switch
Why wrong: Buffer credits affect long-distance links, not speed-limited performance.
C
Hardware compression on the tape library
Why wrong: Compression reduces data, improving performance, not limiting it.
D
Half-duplex mode on the FC link
Why wrong: FC always operates in full-duplex mode.

Open the full BGP breakdown →

Question 2mediummultiple choice

A network engineer is troubleshooting a VXLAN EVPN problem where some endpoints are not reachable. The output of 'show bgp l2vpn evpn' shows Type-3 routes but no Type-2 routes for a specific VNI. What should the engineer check?

Trap 1: The route-target import/export is misconfigured.

Route-target misconfiguration would affect all route types, not just Type-2, and would be seen in other VNIs.

Trap 2: BGP session is not established.

If the BGP session were down, no EVPN routes (including Type-3) would be present.

Trap 3: The VNI is not configured under the NVE interface.

If the VNI were not under NVE, Type-3 routes (IMET) would also not be generated for that VNI.

A
The route-target import/export is misconfigured.
Why wrong: Route-target misconfiguration would affect all route types, not just Type-2, and would be seen in other VNIs.
B
BGP session is not established.
Why wrong: If the BGP session were down, no EVPN routes (including Type-3) would be present.
C
The VNI is not configured under the NVE interface.
Why wrong: If the VNI were not under NVE, Type-3 routes (IMET) would also not be generated for that VNI.
D
The VLAN corresponding to the VNI has no active ports.
Type-2 routes carry MAC/IP information. Without active ports in the VLAN, no MACs are learned, so no Type-2 routes are advertised.

Question 3mediummultiple choice

A data center team is troubleshooting an automation script that uses REST API to configure a Cisco Nexus 9000 switch. The script fails with a '401 Unauthorized' error. What is the most likely cause?

Trap 1: API rate limiting has been exceeded

Rate limiting returns 429 Too Many Requests.

Trap 2: Network connectivity issue between the script and the switch

Connectivity issues would result in timeouts or connection refused errors.

Trap 3: The user account does not have admin privileges

Insufficient privileges would return 403 Forbidden.

A
API rate limiting has been exceeded
Why wrong: Rate limiting returns 429 Too Many Requests.
B
Network connectivity issue between the script and the switch
Why wrong: Connectivity issues would result in timeouts or connection refused errors.
C
The user account does not have admin privileges
Why wrong: Insufficient privileges would return 403 Forbidden.
D
Invalid or expired authentication token
401 Unauthorized indicates authentication failure.

Study the full ACL explanation →

Question 4hardmultiple choice

A network engineer is troubleshooting CoPP drops on a Cisco Nexus 9000 switch. The 'show control-plane' output indicates that packets are being dropped due to 'CoPP' on the 'default' control-plane class. Which action is most likely to resolve the issue without affecting routing protocol stability?

Trap 1: Disable CoPP globally to allow all control-plane traffic.

Disabling CoPP removes protection against DoS attacks.

Trap 2: Modify the class-map to reclassify the dropped packets to a higher…

Reclassification may starve other traffic and is not a direct fix.

Trap 3: Increase the ingress buffer size on the control-plane interface.

Buffering only delays drops, does not solve policer drops.

A
Disable CoPP globally to allow all control-plane traffic.
Why wrong: Disabling CoPP removes protection against DoS attacks.
B
Increase the policer rate for the 'default' class in the CoPP policy.
Raising the policer rate allows more packets to pass, reducing drops.
C
Modify the class-map to reclassify the dropped packets to a higher priority class.
Why wrong: Reclassification may starve other traffic and is not a direct fix.
D
Increase the ingress buffer size on the control-plane interface.
Why wrong: Buffering only delays drops, does not solve policer drops.

Open the full VLAN trunking answer →

Question 5mediummultiple choice

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

Trap 1: MTU mismatch on the underlay network

MTU mismatch would cause packet drops but not the absence of VNI from 'show nve vni'.

Trap 2: Anycast gateway is not configured on the leaf

Anycast gateway is used for first-hop redundancy; its absence does not affect VNI visibility on the NVE.

Trap 3: BGP EVPN peers are not established

BGP EVPN peers not established would affect route exchange, but the VNI would still appear in 'show nve vni' if configured.

A
MTU mismatch on the underlay network
Why wrong: MTU mismatch would cause packet drops but not the absence of VNI from 'show nve vni'.
B
Anycast gateway is not configured on the leaf
Why wrong: Anycast gateway is used for first-hop redundancy; its absence does not affect VNI visibility on the NVE.
C
BGP EVPN peers are not established
Why wrong: BGP EVPN peers not established would affect route exchange, but the VNI would still appear in 'show nve vni' if configured.
D
The VLAN-to-VNI mapping is missing under the VLAN configuration
The VNI must be mapped to a VLAN using 'vn-segment vlan-id' under the VLAN configuration; without it, the VNI does not appear in the NVE interface.

Question 6easymultiple choice

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

Trap 1: show aaa authentication

Shows AAA authentication methods, not per-port status.

Trap 2: show dot1x

Not a valid command; correct is 'show dot1x all'.

Trap 3: show port-security interface ethernet 1/1

Shows port security, not 802.1X.

A
show aaa authentication
Why wrong: Shows AAA authentication methods, not per-port status.
B
show dot1x
Why wrong: Not a valid command; correct is 'show dot1x all'.
C
show authentication interface ethernet 1/1
Displays 802.1X and MAC authentication status.
D
show port-security interface ethernet 1/1
Why wrong: Shows port security, not 802.1X.

Question 7mediummultiple choice

An engineer is troubleshooting connectivity between two Nexus 9000 switches configured with vPC. The vPC peer link is up, but the vPC peer-keepalive link is failing. Which action should be taken to ensure vPC convergence in the event of a peer-link failure?

Trap 1: Disable vPC on both switches and reconfigure the port channels.

Disabling vPC is not necessary; the issue is with keepalive.

Trap 2: Reconfigure the vPC domain with a lower priority on the secondary…

Priority affects role election, not keepalive failure behavior.

Trap 3: Increase the vPC peer-keepalive hold timeout to 5 seconds.

Increasing hold timeout delays failure detection.

A
Ensure the peer-keepalive link uses a dedicated management interface or a separate VRF.
A dedicated keepalive link ensures reliable communication and prevents split-brain.
B
Disable vPC on both switches and reconfigure the port channels.
Why wrong: Disabling vPC is not necessary; the issue is with keepalive.
C
Reconfigure the vPC domain with a lower priority on the secondary switch.
Why wrong: Priority affects role election, not keepalive failure behavior.
D
Increase the vPC peer-keepalive hold timeout to 5 seconds.
Why wrong: Increasing hold timeout delays failure detection.

Question 8easymultiple choice

An engineer is troubleshooting a Cisco UCS B-Series blade that fails to boot. The service profile is associated and the boot policy is set to 'SAN Boot'. The storage administrator confirms the LUN is properly mapped to the WWPN. Which check should the engineer perform first?

Trap 1: Reboot the chassis to reinitialize the IOM

Rebooting chassis is unnecessary and disruptive.

Trap 2: Check that the vHBA has a dynamic WWPN assigned

Dynamic WWPNs are fine; the issue is connectivity.

Trap 3: Ensure the local disk is set as primary boot device

SAN boot bypasses local disk.

A
Verify that the UCS Fabric Interconnect is connected to the SAN switches
Without fabric connectivity, the server cannot reach the storage.
B
Reboot the chassis to reinitialize the IOM
Why wrong: Rebooting chassis is unnecessary and disruptive.
C
Check that the vHBA has a dynamic WWPN assigned
Why wrong: Dynamic WWPNs are fine; the issue is connectivity.
D
Ensure the local disk is set as primary boot device
Why wrong: SAN boot bypasses local disk.

Question 9mediumdrag order

Order the steps for troubleshooting a Fibre Channel link that is not coming up.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10hardmulti select

An engineer is troubleshooting a performance issue on a Cisco MDS 9700 switch. The 'show interface fc1/1' output shows CRC errors incrementing slowly. The interface is connected to a storage array. Which two actions should the engineer take to resolve the issue?

Trap 1: Increase the MTU size on the interface.

MTU affects frame size but not CRC errors.

Trap 2: Clear the interface counters.

Clearing counters hides the problem without resolving it.

Trap 3: Change the interface speed from auto to a fixed value.

Speed mismatch is less likely; fixing speed may cause other issues.

A
Increase the MTU size on the interface.
Why wrong: MTU affects frame size but not CRC errors.
B
Replace the fiber optic cable and SFP.
Faulty cables or SFPs are common causes of CRC errors.
C
Enable BB_credit recovery on the interface.
BB_credit recovery helps manage buffer credit issues that can cause CRC errors.
D
Clear the interface counters.
Why wrong: Clearing counters hides the problem without resolving it.
E
Change the interface speed from auto to a fixed value.
Why wrong: Speed mismatch is less likely; fixing speed may cause other issues.

Question 11mediummultiple choice

A SAN administrator notices intermittent connectivity issues between an initiator and target. The Fibre Channel link shows CRC errors. What is the most likely cause?

Trap 1: Incorrect domain ID.

Domain ID issues cause fabric login problems.

Trap 2: Buffer credit starvation.

Buffer credit issues cause frame drops, not CRC.

Trap 3: Incorrect zone configuration.

Zoning issues cause login failures, not CRC.

A
Incorrect domain ID.
Why wrong: Domain ID issues cause fabric login problems.
B
Faulty SFP or fiber optic cable.
Physical layer issues cause CRC errors.
C
Buffer credit starvation.
Why wrong: Buffer credit issues cause frame drops, not CRC.
D
Incorrect zone configuration.
Why wrong: Zoning issues cause login failures, not CRC.

Question 12mediummulti select

An engineer is tuning performance for a storage network. Which two practices improve FC SAN performance?

Trap 1: Disabling flow control.

Flow control is essential.

Trap 2: Enabling broadcast zoning.

Broadcast increases overhead.

Trap 3: Setting fabric login timeout to the maximum.

Does not improve performance.

A
Disabling flow control.
Why wrong: Flow control is essential.
B
Using single-initiator zoning.
Reduces inter-initiator traffic.
C
Ensuring adequate buffer credits.
Prevents frame loss.
D
Enabling broadcast zoning.
Why wrong: Broadcast increases overhead.
E
Setting fabric login timeout to the maximum.
Why wrong: Does not improve performance.

Study the full virtualization explanation →

Question 13mediummulti select

An engineer is designing a SAN for a virtualized environment. Which two best practices should be followed for Fibre Channel zoning?

Trap 1: Use multiple initiators in a single zone.

Increases risk of misconfiguration.

Trap 2: Use soft zoning exclusively.

Soft zoning is less secure.

Trap 3: Disable zoning for performance.

Zoning is required for security.

A
Use single-initiator zoning.
Simplifies troubleshooting and security.
B
Use multiple initiators in a single zone.
Why wrong: Increases risk of misconfiguration.
C
Use soft zoning exclusively.
Why wrong: Soft zoning is less secure.
D
Disable zoning for performance.
Why wrong: Zoning is required for security.
E
Zone by WWPN rather than WWNN.
More granular control.

Question 14mediummultiple choice

In a Cisco HyperFlex cluster, a new ESXi host is being added. The host is discovered, but the cluster health status shows 'Degraded'. What should be the first troubleshooting step?

Trap 1: Reboot the new ESXi host.

Rebooting without diagnosis may not resolve the issue.

Trap 2: Check if the vCenter Server is in maintenance mode.

vCenter maintenance is not directly related to host addition.

Trap 3: Delete and re-create the cluster.

Too drastic and will cause downtime.

A
Reboot the new ESXi host.
Why wrong: Rebooting without diagnosis may not resolve the issue.
B
Verify that the new host's controller VM has the same firmware version as the cluster.
Firmware consistency is critical for cluster stability.
C
Check if the vCenter Server is in maintenance mode.
Why wrong: vCenter maintenance is not directly related to host addition.
D
Delete and re-create the cluster.
Why wrong: Too drastic and will cause downtime.

Question 15hardmulti select

Which TWO troubleshooting steps should be taken when a UCS blade server fails to discover during the initial discovery process?

Trap 1: Immediately replace the blade server

Should verify connections first

Trap 2: Power cycle the chassis

Power cycling is not a first troubleshooting step

Trap 3: Reset the fabric interconnect to factory defaults

Drastic and unnecessary

A
Verify the physical cabling between the IOM and fabric interconnect
Physical connectivity is essential
B
Immediately replace the blade server
Why wrong: Should verify connections first
C
Power cycle the chassis
Why wrong: Power cycling is not a first troubleshooting step
D
Reset the fabric interconnect to factory defaults
Why wrong: Drastic and unnecessary
E
Check firmware compatibility between FI and chassis
Firmware mismatch can prevent discovery

Review the full OSPF breakdown →

Question 16mediummultiple choice

A network engineer is troubleshooting an OSPF adjacency issue between two Nexus switches. The neighbors are stuck in the EXSTART state. What is the most likely cause?

Trap 1: Hold timer mismatch

Hold timer mismatch causes adjacency to go down, not stuck in EXSTART.

Trap 2: Incorrect area ID

Area ID mismatch prevents neighbor discovery, not EXSTART.

Trap 3: Duplicate router ID

Duplicate router IDs prevent adjacency formation entirely, not just EXSTART.

A
Hold timer mismatch
Why wrong: Hold timer mismatch causes adjacency to go down, not stuck in EXSTART.
B
Incorrect area ID
Why wrong: Area ID mismatch prevents neighbor discovery, not EXSTART.
C
MTU mismatch
MTU mismatch leads to DBD packet rejection, keeping the neighbor in EXSTART.
D
Duplicate router ID
Why wrong: Duplicate router IDs prevent adjacency formation entirely, not just EXSTART.

Question 17easymultiple choice

A network engineer is troubleshooting VXLAN connectivity between two VTEPs. The source VTEP is configured with `nve1` and member VNI 10000. The `show nve peers` command shows the remote VTEP IP but the status is 'Init'. What is a likely cause?

Trap 1: The remote VTEP is not configured with the same VNI.

VNI mismatch would cause traffic drops but not necessarily keep the peer in 'Init' state; the peer could still be 'Up' with no VNI mapping.

Trap 2: The MTU is too low.

MTU issues cause fragmentation or drops, not peer state 'Init'.

Trap 3: The VRF is mismatched between the VTEPs.

VRF mismatch affects Layer 3 routing but does not prevent NVE peer establishment.

A
The multicast group is not reachable.
VXLAN relies on multicast for BUM traffic; if the multicast group is unreachable, the peer remains in 'Init'.
B
The remote VTEP is not configured with the same VNI.
Why wrong: VNI mismatch would cause traffic drops but not necessarily keep the peer in 'Init' state; the peer could still be 'Up' with no VNI mapping.
C
The MTU is too low.
Why wrong: MTU issues cause fragmentation or drops, not peer state 'Init'.
D
The VRF is mismatched between the VTEPs.
Why wrong: VRF mismatch affects Layer 3 routing but does not prevent NVE peer establishment.

Read the full VPN explanation →

Question 18mediummulti select

When troubleshooting a VXLAN EVPN fabric with Cisco Nexus 9000 switches, which three commands provide information about the EVPN operation? (Choose three.)

Trap 1: show running-config interface nve1.

Shows configuration, not operational status.

Trap 2: show ip interface brief.

Shows IP interfaces, not EVPN-specific.

A
show bgp l2vpn evpn summary.
Shows BGP EVPN session status.
B
show l2route mac all.
Shows MAC routes learned via EVPN.
C
show running-config interface nve1.
Why wrong: Shows configuration, not operational status.
D
show nve peers.
Shows NVE peer status.
E
show ip interface brief.
Why wrong: Shows IP interfaces, not EVPN-specific.

Open the full VLAN trunking answer →

Question 19mediummultiple choice

A network engineer is troubleshooting inter-VLAN routing on a Cisco Nexus 9000 switch. The switch is configured with VLAN 10 and VLAN 20. Hosts in VLAN 10 cannot ping hosts in VLAN 20. The engineer checks the VLAN ACL (VACL) applied to VLAN 10 and finds the following configuration:

ip access-list VACL-FILTER
  10 permit ip any any

...

vlan access-map VACL-MAP 10

match ip address VACL-FILTER action forward

vlan filter VACL-MAP vlan-list 10

What is the most likely reason for the connectivity failure?

Trap 1: The access-list permits all, so the VACL should work; perhaps the…

The access-map has action forward, so it permits when matched. Default action is drop, but the ACL matches all, so it should forward. Not the likely cause.

Trap 2: The 'vlan filter' command is applied to VLAN 10 only, but the…

The configuration appears correct; the issue is not the VACL configuration itself but its applicability.

Trap 3: The VACL is applied only to VLAN 10, so traffic from VLAN 20 to…

While true that the VACL is only on VLAN 10, the issue is that VACLs do not filter routed traffic, so this is not the root cause.

A
The access-list permits all, so the VACL should work; perhaps the access-map is missing a default action.
Why wrong: The access-map has action forward, so it permits when matched. Default action is drop, but the ACL matches all, so it should forward. Not the likely cause.
B
The 'vlan filter' command is applied to VLAN 10 only, but the access-map is misconfigured.
Why wrong: The configuration appears correct; the issue is not the VACL configuration itself but its applicability.
C
The VACL is applied only to VLAN 10, so traffic from VLAN 20 to VLAN 10 is not filtered, but this should not cause a failure.
Why wrong: While true that the VACL is only on VLAN 10, the issue is that VACLs do not filter routed traffic, so this is not the root cause.
D
The VACL does not apply to traffic routed through the SVI; a Router ACL (RACL) must be used instead.
Correct. VACLs are only for Layer 2 bridging. For inter-VLAN routing, apply a RACL on the SVI interface.

Question 20hardmultiple choice

An engineer is troubleshooting a SAN performance issue. The MDS switch shows high CRC errors on an F port. The host is connected via a 16 Gbps FC link. The errors increase when the host sends large I/O. What is the most likely cause?

Trap 1: The host's HBA firmware is outdated.

Firmware issues can cause problems but typically not exclusively CRC errors on the switch side.

Trap 2: The zone configuration is incorrect.

Incorrect zoning prevents communication but does not cause CRC errors.

Trap 3: The host is experiencing buffer credit starvation.

Buffer credit starvation results in discards (credit loss), not CRC errors.

A
The host's HBA firmware is outdated.
Why wrong: Firmware issues can cause problems but typically not exclusively CRC errors on the switch side.
B
The zone configuration is incorrect.
Why wrong: Incorrect zoning prevents communication but does not cause CRC errors.
C
The host is experiencing buffer credit starvation.
Why wrong: Buffer credit starvation results in discards (credit loss), not CRC errors.
D
The switch port is configured for 8 Gbps.
Why wrong: Speed mismatch would cause link issues but not necessarily CRC errors.
E
The cable length exceeds the supported distance for 16 Gbps.
16 Gbps FC has shorter reach; long cables cause CRC errors, especially under heavy load.