Cisco CCNP Data Center DCCOR (350-601)

Question 1

In a Cisco ACI fabric, an application team reports that a legacy clustering application relying on gratuitous ARP and silent hosts is failing intermittently after workloads were migrated into a new bridge domain (BD). The BD was created with the default optimized settings. Which BD configuration change should the network engineer make to best support the silent hosts and the application's ARP-based behavior?

Accepted Answer

Enable ARP Flooding and set L2 Unknown Unicast to Flood on the bridge domain

Answer

Disable Unicast Routing and remove the subnet from the bridge domain

Answer

Enable Limit IP Learning to Subnet and set the BD to hardware-proxy

Answer

Change the endpoint retention policy to a lower aging timer on the bridge domain

Question 2

An ACI administrator has an existing contract between the Web-EPG and App-EPG that permits all TCP traffic. A new security requirement mandates that TCP port 23 (Telnet) be explicitly denied between these two EPGs while all other permitted TCP traffic continues to flow. The administrator wants to apply this exception without rewriting the entire allow contract. Which ACI construct should be applied to enforce this specific deny?

Accepted Answer

Configure a taboo contract with a filter matching TCP port 23 and apply it to the EPGs

Answer

Change the VRF policy enforcement to unenforced so the fabric drops Telnet by default

Answer

Add a permit-all vzAny contract at the VRF level to override the port 23 traffic

Answer

Enable intra-EPG isolation on the Web-EPG to block Telnet between the two EPGs

Question 3

A network engineer is deploying a new three-tier application in Cisco ACI. The Web, App, and DB endpoints are each placed in their own EPG within a single bridge domain and VRF. By default, no traffic flows between the EPGs. The engineer wants Web endpoints to reach App endpoints on TCP 8080, but must NOT permit any other inter-EPG traffic. Which configuration correctly achieves this requirement?

Accepted Answer

Create a contract with a subject filtering TCP 8080, provide it from the App EPG and consume it from the Web EPG.

Answer

Enable 'Unenforced' mode on the VRF so the EPGs can communicate freely over TCP 8080.

Answer

Apply a vzAny contract on the VRF permitting TCP 8080 so all EPGs in the VRF can use the service.

Answer

Place all three EPGs into a single ESG and rely on intra-ESG forwarding for TCP 8080.

Question 4

An engineer is configuring an ACI L3Out to connect the fabric to an external OSPF router. Internal EPGs must be able to reach any destination learned via the L3Out, and a contract has already been created between the internal EPG and the external EPG. When configuring the external EPG (L3 External Network), which subnet scope setting must be applied to the 0.0.0.0/0 subnet so that the external routes are properly classified into the external EPG for contract enforcement?

Accepted Answer

External Subnets for the External EPG

Answer

Export Route Control Subnet

Answer

Shared Route Control Subnet

Answer

Aggregate Shared Routes

Question 5

A data center administrator is securing an ACI fabric that hosts a multi-tenant virtualized environment. Several VMs belonging to the same application EPG must be dynamically isolated based on their VM attributes (for example, VM name containing 'DB') without moving them to a different base EPG or requiring VLAN reassignment. The administrator wants endpoints matching the criteria to be classified into a separate policy group so that contracts can control communication between them and the rest of the EPG. Which ACI feature should be implemented to meet this requirement?

Accepted Answer

Configure a uSeg (microsegmented) EPG with a VM-name attribute-based match statement

Answer

Create a static path binding with a unique VLAN encapsulation for each VM

Answer

Apply an intra-EPG isolation flag on the base application EPG

Answer

Configure a separate bridge domain and associate each VM subnet to it

Question 6

A network engineer is designing an ACI application profile for a three-tier application (web, app, database). The security team requires that web servers can only reach app servers on TCP 8080, and app servers can only reach database servers on TCP 1521. All three tiers reside in the same bridge domain and VRF. Which approach correctly enforces this policy in ACI?

Accepted Answer

Create three EPGs (web, app, db) and define contracts where the app EPG provides a contract with TCP 8080 consumed by web, and the db EPG provides a contract with TCP 1521 consumed by app

Answer

Place all three tiers in a single EPG and apply an intra-EPG contract permitting TCP 8080 and TCP 1521

Answer

Create three EPGs and rely on the default ACI behavior, which permits all traffic between EPGs in the same bridge domain

Answer

Create three bridge domains, one per tier, and use subnet-based ACLs on each bridge domain to restrict the ports

Question 7

An ACI administrator is deploying two new EPGs, each mapped to a different physical domain. EPG-Web uses a physical domain tied to VLAN Pool-A (dynamic allocation, blocks 100-200), and EPG-App uses a physical domain tied to VLAN Pool-B (static allocation, blocks 150-250). After the administrator statically binds EPG-App to a leaf port using VLAN 175, EPG-Web endpoints intermittently lose connectivity. What is the most likely root cause?

Accepted Answer

The overlapping encapsulation range between Pool-A and Pool-B allows the same VLAN to be programmed for both EPGs on the same leaf, causing an encapsulation conflict

Answer

Static VLAN pools cannot coexist with dynamic VLAN pools on the same leaf switch, so one pool is administratively disabled

Answer

A dynamic VLAN pool always takes precedence over a static pool, so EPG-App fails to program its VLAN and floods traffic to EPG-Web

Answer

Physical domains do not support static path bindings, so EPG-App must use a VMM domain to allocate VLAN 175 correctly

Question 8

You are deploying a pair of Nexus 9300 leaf switches in a Cisco ACI fabric to provide a vPC to a dual-homed application server. After configuring the vPC interface policy group and applying it to both leaf ports, the server's port-channel remains down and the APIC reports the leaves are not forming a vPC domain. Which configuration step is required to establish the vPC domain between the two leaf switches in ACI?

Accepted Answer

Create a vPC Explicit Protection Group that pairs the two leaf node IDs and assigns a vPC domain ID

Answer

Manually configure a vPC peer-link and peer-keepalive link between the two leaf switches under the fabric access policies

Answer

Enable the vPC feature on each leaf using the CLI 'feature vpc' command before applying the interface policy group

Answer

Configure a common HSRP group across both leaves so they share a virtual MAC for the vPC

Question 9

A data center team is building a dedicated back-end fabric to interconnect 256 GPUs across multiple servers for large-model training. The AI workload is dominated by all-reduce collective operations that generate synchronized, bursty east-west traffic where the slowest flow dictates job completion time. Which fabric design characteristic is MOST important to prioritize to minimize tail latency and avoid degrading GPU utilization?

Accepted Answer

A non-blocking, rail-optimized leaf-spine topology that provides full bisection bandwidth so no oversubscription throttles collective flows

Answer

A 4:1 oversubscribed access layer to reduce spine port count and lower the cost of the training cluster

Answer

Enabling deep buffering on leaf switches while relying on TCP retransmission to recover from any congestion drops

Answer

Aggregating all GPU NICs into a single shared management VLAN to simplify addressing across the cluster

Question 10

A data center team is designing an AI training cluster with servers containing 8 GPUs each. Within a single server, GPUs must exchange gradients at maximum bandwidth with the lowest possible latency, bypassing CPU and PCIe bottlenecks. Across servers, GPUs connect through a lossless Ethernet fabric using RoCEv2. Which technology provides the intra-server (scale-up) high-speed GPU-to-GPU interconnect that the design should specify?

Accepted Answer

NVLink/NVSwitch fabric interconnecting GPUs inside the chassis

Answer

RoCEv2 with PFC and ECN across the leaf-spine fabric

Answer

GPUDirect Storage over NVMe-oF for gradient exchange

Answer

InfiniBand HDR uplinks from each server to the spine switches

Question 11

A data center automation engineer maintains Cisco Nexus 9000 switches using Ansible with the cisco.nxos collection. Before applying a large VLAN and interface configuration change to production leaf switches, the engineer wants to preview exactly which tasks would report a change WITHOUT altering any device state, and also wants confidence that re-running the playbook after a successful apply will report no further changes. Which combination of Ansible characteristics satisfies both requirements?

Accepted Answer

Run the playbook with --check mode to preview changes, relying on the modules' idempotency so a re-run against an already-configured device reports 'ok' instead of 'changed'

Answer

Run the playbook with --forks 1 to serialize execution, which guarantees no device changes occur during the first pass

Answer

Use the nxos_command module with a 'when: false' conditional so commands are queued but never sent to the device

Answer

Enable --diff mode alone, since diff output prevents the modules from committing configuration to the running-config

Question 12

A network automation engineer is storing an Ansible playbook and its variable files in a shared Git repository used to configure Cisco Nexus 9000 switches. The variable files contain BGP neighbor authentication keys and device login credentials in plaintext. Security policy requires that these secrets not be readable in the repository while still allowing the playbook to run non-interactively in a CI/CD pipeline. Which approach meets the requirement?

Accepted Answer

Encrypt the sensitive variable files with Ansible Vault and supply the vault password to the pipeline via a vault password file or environment variable at runtime.

Answer

Move the credentials into the playbook's inline tasks and mark those tasks with 'no_log: true' so they are hidden from the repository.

Answer

Base64-encode the variable files before committing them so the secrets are not directly human-readable in Git.

Answer

Store the credentials in the ansible.cfg file, which is automatically excluded from version control by default.

Question 13

A data center runs VXLAN BGP EVPN across two leaf switches (Leaf1 and Leaf2) with ARP suppression enabled on the bridge domain's associated VLAN. Host A on Leaf1 attempts to reach Host B, a silent host connected to Leaf2 that has not yet sent any traffic. Host A sends an ARP request for Host B. Which behavior occurs?

Accepted Answer

Because Host B is silent and unknown to the EVPN control plane, Leaf1 has no cached entry and floods the ARP request across the VXLAN fabric to trigger Host B to respond.

Answer

Leaf1 replies to the ARP request locally using an entry already in its ARP suppression cache, so no flooding occurs and Host B is reached immediately.

Answer

The ARP request is dropped by Leaf1 because ARP suppression prohibits any Layer 2 broadcast from leaving the ingress leaf under all conditions.

Answer

Leaf1 forwards the ARP request as a unicast VXLAN packet directly to Leaf2 based on the underlay multicast group, bypassing the EVPN control plane.

Question 14

A network engineer is deploying a VXLAN BGP EVPN fabric with 2 spine switches and 40 leaf switches. To avoid a full mesh of iBGP sessions in a single AS (65001), the engineer wants a scalable control-plane design for distributing EVPN routes between all VTEPs. What is the recommended approach?

Accepted Answer

Configure the spine switches as EVPN route reflectors and peer each leaf as a route-reflector client

Answer

Configure a full mesh of iBGP EVPN sessions directly between all leaf switches

Answer

Configure each leaf in a unique AS and use eBGP EVPN sessions to the spines with next-hop-self disabled

Answer

Configure the spines as VTEPs and originate all Type-2 and Type-5 routes from the spine layer

Question 15

A network engineer is troubleshooting BUM traffic replication in a VXLAN EVPN fabric that uses ingress replication (no multicast in the underlay). Two VTEPs, Leaf-1 and Leaf-2, both host VNI 10100. Leaf-1 is not flooding broadcast frames for VNI 10100 to Leaf-2, so hosts behind Leaf-2 never receive ARP requests originated on Leaf-1. Which EVPN route type must be exchanged between the two VTEPs to build the ingress replication flood list for VNI 10100?

Accepted Answer

Type-3 Inclusive Multicast Ethernet Tag (IMET) route

Answer

Type-2 MAC/IP advertisement route

Answer

Type-4 Ethernet Segment route

Answer

Type-5 IP Prefix route

Question 16

A data center engineer is troubleshooting an ACI fabric where an endpoint in EPG-Web on Leaf-101 sends an ARP request for an endpoint in the same bridge domain that is currently unlearned by the fabric. The bridge domain is configured with ARP Flooding disabled and L2 Unknown Unicast set to Hardware Proxy. How does the ACI fabric handle this ARP request?

Accepted Answer

The spine proxy (COOP database) is consulted to resolve the target, and the ARP is unicasted to the destination leaf if the endpoint is known; otherwise it is dropped.

Answer

The ARP request is flooded to all leaf switches in the bridge domain using the BD GIPo multicast group.

Answer

The ingress leaf broadcasts the ARP to all ports in the EPG only, without involving the spine.

Answer

The ARP request is silently dropped because ARP Flooding is disabled, preventing any resolution.

Question 17

A data center engineer is planning software maintenance on a Cisco Nexus switch. In addition to the NX-OS image upgrade, Cisco has released a new EPLD (Electronic Programmable Logic Device) image to address a hardware programming issue on the I/O modules. The engineer wants to understand the operational impact before scheduling the change window. Which statement correctly describes the EPLD upgrade behavior?

Accepted Answer

EPLD upgrades can be disruptive; upgrading the EPLDs on a module typically powers down and reloads that module, interrupting traffic on its interfaces.

Answer

EPLD upgrades are always nondisruptive because they run in parallel with the active NX-OS control plane and never affect data forwarding.

Answer

EPLD images can only be applied through a full ISSU and cannot be upgraded independently of the NX-OS system image.

Answer

EPLD upgrades replace the NX-OS kickstart and system images, so no separate EPLD file is required.

Question 18

A storage administrator is extending a Fibre Channel ISL between two data centers 80 km apart over dark fiber at 8 Gbps. After bringing up the link, throughput is far below line rate even though no errors are logged and the link stays up. Which action is most likely to resolve the performance problem?

Accepted Answer

Increase the number of buffer-to-buffer credits configured on the extended ISL ports

Answer

Enable FCoE on the ISL to allow lossless Ethernet PFC behavior

Answer

Change the port type from E_Port to F_Port on both switches

Answer

Lower the port speed to 4 Gbps to reduce frame transmission jitter

Question 19

A storage administrator is editing the zoning configuration on a Cisco MDS 9000 fabric that uses enhanced zoning across VSAN 20. A colleague on another switch in the same fabric attempts to make zoning changes at the same time and reports an error that the operation cannot proceed. When the first administrator finishes, they modify a zone and then run 'zoneset activate name PROD-ZS vsan 20'. What behavior of enhanced zoning explains the colleague's error and ensures configuration consistency?

Accepted Answer

Enhanced zoning acquires a fabric-wide lock so only one administrator can modify the zoning database at a time, and changes are distributed and committed atomically to all switches.

Answer

Enhanced zoning uses soft zoning, which prevents two switches from advertising the same FCNS entries simultaneously.

Answer

Basic zoning was still in effect, so the full zoneset had to be manually copied to each switch, blocking the second administrator.

Answer

The colleague's error occurred because enhanced zoning distributes only the active zoneset, requiring the full zoneset to be re-merged on every activation.

Question 20

A storage administrator is hardening a MDS/Nexus Fibre Channel fabric that spans two data centers. Management requires that only explicitly approved switches be allowed to join VSAN 20, and any unauthorized switch attempting to merge into the fabric must be prevented from doing so and have its E_Port isolated. Which security feature meets this requirement?

Accepted Answer

Fabric binding, which authorizes ISL formation based on a configured list of switch WWNs (sWWNs)

Answer

Port security, which binds device pWWNs to specific F_Ports on the switch

Answer

Hard zoning enforced by the switch ASICs using WWPN-based zones

Answer

FC-SP DHCHAP configured only on host-facing F_Ports

Question 21

A storage administrator connects a new server HBA to a Cisco MDS switch port configured in F mode. The port comes up, but the server cannot access its LUNs on the target array. On the MDS, the 'show flogi database' output lists the HBA's pWWN with an assigned FCID, but 'show fcns database' does not display the target array's pWWN as accessible to the initiator. What is the most likely cause?

Accepted Answer

The initiator and target are not in the same active zone within the active zoneset

Answer

The HBA failed FLOGI and never registered with the fabric

Answer

The VSAN has not been assigned a domain ID by the principal switch

Answer

The F port must be reconfigured as an E port to allow target visibility

Question 22

A storage administrator is extending a Fibre Channel SAN between two data centers over a shared IP WAN link with 200 ms round-trip latency and limited bandwidth. The primary requirement is to reduce the amount of replication data traversing the WAN to fit within the available bandwidth. Which FCIP feature should be enabled on the MDS switches to meet this goal?

Accepted Answer

IP compression on the FCIP tunnel interface

Answer

FCIP write acceleration

Answer

TCP selective acknowledgment (SACK) on the FCIP profile

Answer

Increasing the maximum bandwidth setting on the FCIP profile

Question 23

A storage administrator is configuring an iSCSI deployment on a Cisco Nexus/MDS environment and wants to reduce the frequency of full LUN rescans on hosts. A new storage array with additional targets has just been added to the same portal IP. Which iSCSI mechanism allows an already-logged-in initiator to learn about the newly added targets without manually reconfiguring each host?

Accepted Answer

The initiator issues a SendTargets discovery session to the portal, which returns the full list of available targets including the newly added ones

Answer

The initiator relies on iSNS to push a broadcast to all hosts forcing an immediate LUN-level rescan

Answer

The target array sends an unsolicited FLOGI to the initiator advertising the new LUNs

Answer

The initiator uses CHAP renegotiation to trigger automatic discovery of new targets

Question 24

A storage administrator is extending a Fibre Channel SAN between two data centers 600 km apart using an FCIP tunnel over an existing IP WAN link. Users report that remote tape backup jobs are extremely slow, and analysis shows that each SCSI write command must wait for a status response before the next command is sent, causing the round-trip WAN latency to dominate throughput. Which FCIP feature should the administrator enable to improve backup performance across the tunnel?

Accepted Answer

FCIP Write Acceleration (tape acceleration)

Answer

FCIP compression on the tunnel interface

Answer

Increase the TCP maximum bandwidth on the FCIP profile

Answer

Enable IPsec encryption on the FCIP tunnel

Question 25

A storage administrator is troubleshooting an ESXi host connected to a Cisco MDS fabric. The host's initiator successfully completes FLOGI and its zone with the target array is active, but the host cannot discover any LUNs presented by the target. On the MDS switch, the 'show fcns database' output lists both the initiator and target FC4 features, and 'show zone status' confirms the zone is fully activated in the correct VSAN. Which action should the administrator take NEXT to resolve the missing LUN visibility?

Accepted Answer

Verify LUN masking and host mapping configuration on the storage array

Answer

Increase the buffer-to-buffer credits on the initiator's F port

Answer

Reconfigure the zone to use interface-based zoning instead of pWWN

Answer

Change the VSAN interop mode to mode 1 on the fabric

Question 26

A storage administrator is hardening an MDS Fibre Channel fabric. A junior engineer accidentally cabled an unauthorized HBA into interface fc1/12, and it successfully performed FLOGI and began accessing the fabric. The administrator wants to ensure that only pre-approved pWWNs can log in on specific physical ports, and that any unauthorized device attempting FLOGI is automatically rejected without requiring manual zoning changes. Which feature should be implemented to enforce this?

Accepted Answer

Fibre Channel port security binding pWWNs to specific interfaces per VSAN

Answer

Hard zoning enforcement using fWWN-based zone members

Answer

Fabric binding to control which switches can join the fabric

Answer

Port-channel VSAN trunking to restrict allowed VSANs on the ISL

Question 27

A storage administrator is troubleshooting suboptimal path selection in a Fibre Channel fabric. Traffic between two MDS switches is traversing a 8 Gbps ISL instead of a parallel 32 Gbps ISL. Both ISLs are in the same VSAN and are up. What is the most likely cause, and what mechanism determines the preferred FC route?

Accepted Answer

FSPF computes least-cost paths where cost is inversely proportional to link speed, but a manually configured higher interface cost on the 32 Gbps ISL is overriding the default

Answer

FSPF is selecting the higher-bandwidth link automatically; the issue must be a physical fault on the 32 Gbps ISL

Answer

FC uses STP to select the lowest-cost path, and the 8 Gbps link has the lower bridge priority

Answer

FSPF load-balances equally across all ISLs regardless of speed, so both links should carry identical traffic

Question 28

A storage administrator has correctly configured single-initiator zoning on a Cisco MDS 9000 fabric so that a specific server HBA can reach a storage array's target port. However, the security team is concerned that the server can still see and potentially access LUNs belonging to other servers presented by that same array target port. Which additional control most directly restricts which specific LUNs behind the target port that particular server is permitted to access?

Accepted Answer

LUN masking configured on the storage array

Answer

A more restrictive hard zoning enforcement mode on the MDS switch

Answer

Port security auto-learning locked down on the fabric

Answer

VSAN isolation separating the initiator and target

Question 29

A data center engineer is deploying a new Cisco MDS 9148 fabric switch at the edge of an existing storage fabric. The core directors are already at their maximum supported domain ID count, and adding another domain ID would exceed the fabric's scalability limits. The engineer needs the edge switch to connect servers to the fabric without consuming an additional domain ID, while the core switches must be able to allow multiple logins over a single uplink. Which combination of features must be enabled to meet these requirements?

Accepted Answer

Enable NPV mode on the edge MDS switch and enable NPIV on the core switch

Answer

Enable NPIV on the edge MDS switch and enable NPV mode on the core switch

Answer

Enable FSPF load balancing on the edge switch and trunking on the core switch

Answer

Enable VSAN trunking on both the edge and core switches

Question 30

A storage engineer is connecting two Cisco MDS/Nexus FC switches with two 32G Fibre Channel links bundled into a port channel. The port channel must carry traffic for VSAN 10 and VSAN 20 across the ISL. After configuration, VSAN 20 traffic is not passing, though VSAN 10 works. The engineer confirms both member ports are up and the port channel is operational. What is the MOST likely cause?

Accepted Answer

The trunk allowed VSAN list on the port channel does not include VSAN 20

Answer

The port channel is configured in mode active rather than mode on

Answer

The two member ports operate at different speeds, preventing VSAN 20 forwarding

Answer

Zoning for VSAN 20 has not been distributed via CFS to the peer switch

Question 31

A storage administrator is enabling Fibre Channel port security on VSAN 20 of a Cisco MDS switch to prevent unauthorized devices from logging into fabric ports. To speed initial configuration, they enable auto-learning, let all current devices perform FLOGI, and then plan to make the learned bindings permanent. Which action must they take so that the learned entries are retained and no NEW devices can be learned automatically afterward?

Accepted Answer

Disable auto-learning after the database is populated, then activate/commit the port security database so the learned bindings become enforced permanent entries

Answer

Leave auto-learning enabled permanently so the switch continuously validates every device that logs in against the fabric

Answer

Copy the running configuration to startup configuration, which automatically converts the auto-learned entries into static bindings

Answer

Deactivate the port security database and re-enable it, forcing the switch to freeze the current learned bindings

Question 32

A storage administrator wants to ensure that only authenticated switches and end devices can join a Cisco MDS Fibre Channel fabric. The requirement is a challenge-response protocol that mutually authenticates devices using a shared secret before allowing fabric access, without relying solely on WWN-based lists. Which security mechanism should be configured?

Accepted Answer

DHCHAP (Diffie-Hellman Challenge Handshake Authentication Protocol)

Answer

Port security with auto-learning of pWWNs

Answer

Enhanced zoning with fabric-wide lock

Answer

Fabric binding using an authorized sWWN list

Question 33

A storage administrator is configuring zoning on a Cisco MDS fabric that connects 40 servers to a dual-controller storage array. To follow Cisco and industry best practices while minimizing RSCN disruption and simplifying troubleshooting, how should the administrator structure the zones?

Accepted Answer

Create single-initiator zones, each containing one server HBA and only the target ports it needs to access

Answer

Create one large zone containing all 40 server HBAs and both storage array target ports

Answer

Create single-target zones, each containing one storage port and all 40 server HBAs

Answer

Disable zoning entirely and rely on VSAN separation to isolate the servers from each other

Question 34

A storage engineer is integrating a Cisco MDS 9000 fabric with a legacy third-party FC switch fabric that requires standards-based interoperability. The engineer must place the connecting VSAN into interop mode to allow the fabrics to merge without proprietary features breaking the ISL. What is a primary consequence the engineer must plan for when enabling interop mode 1 on the VSAN?

Accepted Answer

The Domain ID range is restricted to 97-127, so switch Domain IDs outside that range must be reassigned, requiring the VSAN to be temporarily suspended

Answer

All zoning is automatically converted from WWPN-based to port-based enforcement across both fabrics

Answer

FSPF is disabled on the VSAN and static routing must be manually configured on each ISL

Answer

Buffer-to-buffer credits are globally reset to 16 and cannot be modified while interop mode is active

Question 35

A storage engineer is troubleshooting FCoE connectivity on a Nexus switch acting as an FCF. During FIP fabric login, an ENode successfully completes FLOGI. The engineer inspects the source MAC address used by the ENode for subsequent FCoE data frames and notices it is different from the CNA's burned-in MAC address. What determines the MAC address the ENode now uses for FCoE traffic?

Accepted Answer

The FCF assigns a Fabric-Provided MAC Address (FPMA) built from the FC-MAP prefix and the FCID assigned during FLOGI

Answer

The ENode retains its Server-Provided MAC Address (SPMA) and the FCF simply learns it via FIP discovery

Answer

The FCF assigns a MAC address derived from the CNA's WWPN concatenated with the VSAN ID

Answer

The ENode uses a randomly generated locally administered MAC address advertised in the FIP discovery advertisement

Question 36

A data center engineer is deploying FCoE on a Nexus switch to consolidate Ethernet and Fibre Channel traffic on the same 10G links. During validation, FCoE frames are occasionally being dropped under heavy LAN load, causing SCSI timeouts on the storage array. The engineer confirms PFC is enabled on the no-drop class for FCoE. Which additional configuration ensures FCoE traffic receives a guaranteed minimum share of link bandwidth so it is not starved by LAN traffic during congestion?

Accepted Answer

Configure Enhanced Transmission Selection (ETS) to allocate a bandwidth percentage to the FCoE traffic class

Answer

Increase the MTU on the FCoE VLAN to 9216 to accommodate baby jumbo frames

Answer

Enable DCBX on the interface so the CoS value for FCoE is renegotiated to 5

Answer

Configure a lower FSPF cost on the virtual Fibre Channel interface to prioritize FCoE paths

Question 37

A storage administrator is provisioning block storage on a new Nexus-connected server that must reach an iSCSI target array. The server's software iSCSI initiator is configured, but no LUNs appear after saving the target's portal IP address. The array requires the initiator to authenticate and dynamically learn the list of available targets from a single management portal address before mapping LUNs. Which iSCSI mechanism must the administrator ensure is functioning to allow the initiator to obtain the list of exported targets from that portal?

Accepted Answer

SendTargets discovery, which returns the available target IQNs and their portal addresses from the specified portal

Answer

iSNS zoning enforcement, which statically binds each LUN to a single initiator MAC address

Answer

CHAP mutual authentication, which by itself enumerates and mounts all exported LUNs

Answer

iSCSI header digest, which validates the target IQN list using a CRC before login

Question 38

A storage administrator is deploying an iSCSI SAN where each server has two NICs connecting to two separate physical switches, and the storage array presents its targets on two subnets. The goal is to achieve both redundancy AND active/active load distribution across both paths to the same LUN. Which host-side configuration should be implemented to meet this requirement correctly?

Accepted Answer

Configure host multipathing (MPIO) with each NIC bound to a separate VMkernel/iSCSI port on a different subnet

Answer

Configure NIC teaming (LACP) across both NICs and present a single iSCSI initiator interface to the array

Answer

Bridge both NICs into a single Layer 2 domain and rely on Spanning Tree for path failover

Answer

Use a single NIC with jumbo frames enabled and configure the array for target-side failover only

Question 39

A data center architect is designing storage connectivity for a new virtualization cluster. The application team requires a datastore that presents raw block-level LUNs to the hypervisor hosts over the existing IP network, allowing the hypervisor to format the volumes with its own clustered file system. No dedicated Fibre Channel infrastructure is available, and the solution must run over standard Ethernet with TCP/IP. Which storage access method best meets these requirements?

Accepted Answer

iSCSI, because it encapsulates SCSI block commands in TCP/IP to present LUNs to hosts

Answer

NFS, because it exports file systems that hypervisors mount directly over IP

Answer

FCoE, because it delivers native Fibre Channel block access over the Ethernet fabric

Answer

CIFS/SMB, because it provides shared file access suitable for hypervisor datastores

Question 40

A data center engineer bundles four interfaces into a port-channel between a Nexus 9000 and a downstream server using LACP. The requirement is that if fewer than three member links are operational, the entire port-channel must go down rather than forward traffic on the remaining links. Additionally, if the server sends no LACP PDUs on a member interface, that interface must NOT independently forward traffic as a standalone access port. Which combination of configuration achieves both requirements?

Accepted Answer

Configure 'lacp min-links 3' on the port-channel and 'lacp suspend-individual' (default) so non-negotiating members are suspended

Answer

Configure 'lacp max-bundle 3' on the port-channel and 'no lacp suspend-individual' to allow standalone forwarding

Answer

Configure 'lacp min-links 3' and 'no lacp suspend-individual' so members fall back to individual mode when no PDUs are received

Answer

Configure 'port-channel min-links 3' with LACP mode 'on' so links stay bundled without negotiation

Question 41

A network engineer configures NetFlow on a Cisco Nexus 9000 switch to analyze traffic patterns for capacity planning. After applying a custom flow record, the collector receives flow entries, but flows that share the same source IP, destination IP, and protocol but differ only by TCP port are being aggregated into a single flow entry instead of being tracked separately. Which change to the flow record configuration resolves this issue?

Accepted Answer

Add the Layer 4 source and destination ports as match (key) fields in the flow record

Answer

Add the Layer 4 source and destination ports as collect (non-key) fields in the flow record

Answer

Increase the active flow timeout so ports are exported before aggregation occurs

Answer

Change the exporter version from NetFlow v9 to IPFIX to enable per-port granularity

Question 42

A network engineer on a Cisco Nexus 9000 switch made several configuration changes to routing and interface parameters during a maintenance window. After the changes, an application team reports connectivity failures. The engineer had created a checkpoint named 'pre-change' before starting. Which action restores the exact running configuration to the state captured in that checkpoint with the least disruption, applying only the differences?

Accepted Answer

Run 'rollback running-config checkpoint pre-change'

Answer

Copy the startup-config back to the running-config using 'copy start run'

Answer

Reload the switch so it boots from the last saved startup-config

Answer

Run 'write erase' and paste the checkpoint file into the console

Question 43

A data center operations team wants proactive detection of configuration drift, forwarding inconsistencies, and pre-change impact validation across their ACI and NX-OS fabrics. They deploy Cisco Nexus Dashboard with an AI/ML-powered assurance service that continuously ingests telemetry and models the network's intended state versus actual state. Which capability of this service specifically allows the team to simulate a proposed policy change and predict whether it will introduce connectivity or contract violations BEFORE the change is committed to the fabric?

Accepted Answer

Pre-Change Analysis (change simulation) in Nexus Dashboard Insights

Answer

Flow Telemetry export via NetFlow v9 records

Answer

ERSPAN session mirroring to an external analyzer

Answer

SNMP trap correlation using an external NMS

Question 44

A network engineer is hardening access-layer Nexus switches in a data center. Users report intermittent connectivity, and investigation reveals a rogue device on an access port replying to DHCP requests with false gateway addresses, plus ARP spoofing attempts. The engineer enables DHCP snooping and Dynamic ARP Inspection (DAI) on the user VLAN. After enablement, legitimate clients on that VLAN can no longer obtain IP addresses, and the uplink toward the aggregation switch drops all DHCP replies. What is the MOST likely cause and correct remediation?

Accepted Answer

The uplink port toward the aggregation switch (and DHCP server path) must be configured as a DHCP snooping trusted port; by default all ports are untrusted and DHCP server-to-client messages are dropped on untrusted ports.

Answer

DAI must be disabled because it is incompatible with DHCP snooping on the same VLAN; the two features cannot coexist without a separate ARP ACL.

Answer

The access ports facing clients must be configured as trusted so that DHCP DISCOVER messages are forwarded upstream.

Answer

DHCP snooping rate limiting must be raised on the uplink because the default limit of 15 packets per second blocks all server replies.

Question 45

A data center engineer is hardening a Nexus 9000 access layer that supports a dual-stack IPv6 tenant network. Rogue IPv6 router advertisements from a compromised host in the VLAN have caused clients to install a malicious default gateway, redirecting traffic. Which First-Hop Security feature should the engineer deploy on the untrusted access ports to prevent unauthorized devices from sending Router Advertisement messages?

Accepted Answer

IPv6 RA Guard

Answer

IPv6 DHCP Guard

Answer

IPv6 Source Guard

Answer

IPv6 Neighbor Discovery Inspection (ND Inspection)

Question 46

A storage administrator completes a nondisruptive ISSU on a Nexus 9000 switch to upgrade the NX-OS software. After the upgrade, a new NX-OS feature that depends on updated hardware programmable logic still fails to function correctly. The 'show install all impact epld' output indicates certain EPLD images differ from those currently running on the line cards. What is the correct conclusion the administrator should draw?

Accepted Answer

EPLD upgrades are a separate process from the NX-OS ISSU and may be required to enable new hardware-dependent functionality

Answer

EPLD images are bundled automatically with every ISSU, so the failure must be a software bug unrelated to hardware logic

Answer

The switch must be downgraded because EPLD mismatches always prevent NX-OS from booting the new image

Answer

EPLD images can only be updated by physically replacing the affected line cards

Question 47

A data center administrator is hardening the management plane of a Nexus 9000 switch after a security audit. The auditors require that administrative CLI access use public-key authentication (no passwords over the wire) and that only the dedicated management subnet 10.20.30.0/24 be permitted to reach the VTY lines. Which combination of configuration actions satisfies BOTH requirements?

Accepted Answer

Generate an RSA key pair, bind the user's SSH public key with 'username admin sshkey ...', and apply an inbound IP ACL permitting 10.20.30.0/24 to the VTY lines using 'line vty' with 'ip access-class ... in'

Answer

Enable the SNMPv3 user with authPriv, then apply a CoPP policy that rate-limits SSH from all subnets except 10.20.30.0/24

Answer

Disable the 'feature ssh', enable 'feature telnet' with an MD5-hashed password, and apply a port ACL (PACL) on the mgmt0 interface

Answer

Configure MACsec (CTS) on mgmt0 and set 'aaa authentication login default group tacacs+' so only the management subnet can authenticate

Question 48

A data center engineer must upgrade the NX-OS software on a pair of Nexus 9000 switches that forward critical production traffic. Management requires that data-plane forwarding continues uninterrupted during the upgrade of a single switch. Which upgrade method and condition must be satisfied to meet this requirement?

Accepted Answer

Perform an In-Service Software Upgrade (ISSU), ensuring the target release is a supported non-disruptive upgrade path and that features/topology support control-plane restart

Answer

Perform a disruptive 'install all' upgrade during a maintenance window because all NX-OS upgrades reload the data plane

Answer

Copy the new image to bootflash and change the boot variables, then power-cycle the switch to activate the software

Answer

Use a cold reload upgrade but pre-stage the configuration on the peer so vPC failover masks the reload

Question 49

A data center administrator secures access ports on a Nexus 9000 switch connecting to a rack of physical servers. The requirement is that each port dynamically learns the connected server's MAC address, retains it across reboots by saving it to the running configuration, and — if an unauthorized MAC appears — the port must drop the offending traffic and increment a violation counter WITHOUT shutting the interface down or affecting the legitimate server. Which port security configuration meets all of these requirements?

Accepted Answer

Enable port security with sticky MAC learning and set the violation mode to restrict

Answer

Enable port security with sticky MAC learning and set the violation mode to protect

Answer

Enable port security with dynamic MAC learning and set the violation mode to shutdown

Answer

Enable port security with static MAC entries and set the violation mode to shutdown

Question 50

A data center engineer is developing a RESTCONF client to manage interface descriptions on a Nexus 9000 switch running NX-OS. The client currently sends an HTTP PUT to the resource URI for a specific interface containing only the 'description' leaf. After the call, the engineer notices that other previously configured attributes on that same interface node (such as MTU and speed settings within the same YANG container) have been reset to their defaults. What is the most likely cause, and how should the request be changed to update only the description without affecting other attributes?

Accepted Answer

PUT replaces the entire target resource with the supplied content; use HTTP PATCH to merge only the specified leaf into the existing configuration.

Answer

PUT is read-only in RESTCONF; use HTTP POST to the interface URI to create a new merge operation for the description leaf.

Answer

The Accept header is set to XML instead of JSON; switching to application/yang-data+json will preserve the untouched leaves.

Answer

The candidate datastore was not locked before the write; issuing a GET with the lock parameter before PUT will prevent attribute loss.

Question 51

A network engineer must capture traffic from server-facing interfaces on a Nexus 9000 leaf switch and deliver it to a packet analyzer located in a different data center pod across a routed Layer 3 boundary. The analyzer cannot be relocated, and no Layer 2 adjacency exists between the leaf and the analyzer subnet. Which monitoring method should the engineer implement to meet this requirement?

Accepted Answer

Configure an ERSPAN session that encapsulates the mirrored traffic in GRE and routes it to the remote analyzer's IP address

Answer

Configure a local SPAN session with the source interfaces and the destination pointing to a local physical port

Answer

Enable NetFlow export on the server-facing interfaces and send flow records to the analyzer via UDP

Answer

Configure an RSPAN session using a dedicated RSPAN VLAN trunked toward the remote pod

Question 52

A storage administrator wants to troubleshoot latency on a Nexus 9000 switch by mirroring traffic. They configure a local SPAN session with interface Ethernet1/10 as the source and Ethernet1/48 (connected to an analyzer) as the destination. The requirement is to capture ONLY the frames that Ethernet1/10 transmits toward the connected server, without capturing frames the server sends into the switch. Which source configuration meets this requirement?

Accepted Answer

source interface Ethernet1/10 tx

Answer

source interface Ethernet1/10 rx

Answer

source interface Ethernet1/10 both

Answer

source vlan 10 rx

Question 53

A data center operations team is monitoring a fleet of Nexus 9000 switches. They complain that their SNMP-based polling of interface counters every 60 seconds misses short-lived microbursts and adds CPU load during collection cycles. They want near-real-time visibility into interface statistics with minimal device overhead and the ability to push data directly to a collector. Which approach best addresses these requirements?

Accepted Answer

Configure model-driven streaming telemetry to push interface stats via gRPC/gNMI to the collector

Answer

Increase SNMP polling frequency to every 5 seconds across all switches

Answer

Enable SPAN sessions on all interfaces and send mirrored traffic to an analyzer

Answer

Deploy syslog with debug-level logging for interface state changes

Question 54

A data center engineer notices that after a vPC domain reload on the secondary Nexus 9000 switch, all vPC member ports briefly went down and traffic was disrupted even though the type-1 consistency parameters matched on both peers. The engineer wants to prevent vPC member ports from being suspended on the recovering peer before it has fully synchronized state with the primary peer following a reload. Which vPC feature should be enabled to address this?

Accepted Answer

delay restore

Answer

vpc peer-gateway

Answer

graceful consistency-check

Answer

auto-recovery reload-delay

Question 55

A storage administrator is mounting an NFSv3 datastore from a NetApp filer to a group of Linux database servers. The database vendor requires that any temporary loss of connectivity to the NFS server must NOT cause I/O operations to return errors to the application; instead, the client should retry indefinitely until the server responds. Which NFS mount behavior meets this requirement?

Accepted Answer

Mount with the 'hard' option so that RPC calls are retried indefinitely until the server recovers

Answer

Mount with the 'soft' option so that failed RPC calls time out and return an error after retrans attempts

Answer

Mount with the 'intr' option so that I/O is silently discarded during outages

Answer

Mount with the 'nolock' option so that file locking is disabled and I/O never blocks

Question 56

A storage administrator has mounted an NFS v3 datastore on multiple ESXi hosts connected to a Cisco Nexus 9000 leaf pair. During month-end batch jobs, a low-priority reporting VM consumes most of the NFS array's throughput, causing a business-critical database VM on the same datastore to experience high read latency. The admin wants to ensure the database VM receives proportional access to storage resources during contention without changing the physical storage or network fabric. Which mechanism should be used?

Accepted Answer

Enable Storage I/O Control (SIOC) with a congestion latency threshold and assign higher shares to the database VM

Answer

Configure Priority Flow Control (PFC) on the Nexus leaf switchports facing the ESXi hosts

Answer

Migrate the NFS datastore from NFS v3 to NFS v4.1 to enable session trunking

Answer

Increase the NFS mount to use the 'hard' option with a larger rsize/wsize value

Question 57

A data center engineer is deploying NFS datastores for a VMware cluster on a Nexus-based storage network. The storage team requires that file locking and session state survive brief network interruptions so that clients can reclaim locks after a server or path failure, and they also want to consolidate access under a single well-known TCP port to simplify firewall rules on the Nexus edge. Which NFS version and characteristic should the engineer select to meet these requirements?

Accepted Answer

NFSv4, because it is a stateful protocol with integrated locking and lease-based state recovery, using TCP port 2049 without separate portmapper/lockd services

Answer

NFSv3, because it uses a stateless protocol that automatically re-establishes locks over UDP after any interruption

Answer

NFSv3, because its Network Lock Manager (NLM) sideband protocol runs on the same fixed port 2049 as the data traffic

Answer

NFSv4, because it remains fully stateless while adding mandatory Kerberos, eliminating the need for lock recovery

Question 58

A consortium of regional hospitals wants to share a common cloud infrastructure that supports their shared compliance requirements (HIPAA), security policies, and mission. The infrastructure will be jointly owned and managed by several of the participating organizations and a third-party provider, and access is restricted exclusively to the member hospitals. According to NIST SP 800-145, which cloud deployment model best describes this arrangement?

Accepted Answer

Community cloud

Answer

Public cloud

Answer

Private cloud

Answer

Hybrid cloud

Question 59

A cloud architect is documenting a public cloud offering to justify it aligns with NIST SP 800-145. The finance team notices that during month-end processing, compute capacity automatically scales out within minutes to handle the load and then scales back in afterward, appearing to consumers as effectively unlimited and available at any time. Which of the five essential characteristics defined in NIST SP 800-145 does this behavior specifically describe?

Accepted Answer

Rapid elasticity

Answer

Resource pooling

Answer

Measured service

Answer

On-demand self-service

Question 60

A network engineer wants to automate configuration of a Cisco Nexus 9000 switch from a Python script running on an external server. The requirement is to send existing CLI commands (e.g., 'show version', 'configure interface') and receive structured JSON responses over an HTTPS session, without having to rewrite the logic around a YANG data model. Which on-switch interface best meets this requirement?

Accepted Answer

NX-API CLI (via the /ins endpoint)

Answer

RESTCONF using the OpenConfig YANG models

Answer

gRPC dial-out streaming telemetry

Answer

NETCONF over SSH port 830

Question 61

A network automation engineer is writing an Ansible playbook to configure a fleet of Nexus 9000 switches. The team wants the playbook to interact with the switches over an HTTPS-based programmatic interface rather than opening interactive SSH CLI sessions, and they have already enabled the 'nxapi' feature on all devices. In the playbook's connection settings, which value must be assigned to the 'ansible_connection' variable so tasks are delivered through the NX-API back end?

Accepted Answer

ansible_connection: httpapi

Answer

ansible_connection: network_cli

Answer

ansible_connection: netconf

Answer

ansible_connection: local

Question 62

A network engineer must build an automated inventory audit that collects the running software version, serial number, and installed module list from 40 Nexus 9000 switches, then generates a report. The engineer wants to use Ansible without writing custom parsing logic or issuing raw show commands that require regex screen-scraping. Which approach best meets these requirements?

Accepted Answer

Use the cisco.nxos.nxos_facts module with the gather_subset parameter and reference the returned structured ansible_net_ facts in a template

Answer

Use the cisco.nxos.nxos_command module to run 'show version' and 'show module', then parse the stdout with regex_search filters

Answer

Enable NX-API and call each switch with the uri module, then hand-write JSON parsers for every CLI response

Answer

Configure model-driven telemetry dial-out to a gRPC collector and export the data to a spreadsheet manually

Question 63

A data center engineer needs to install a custom third-party monitoring agent (packaged as an RPM) directly on the Nexus 9000 switch's underlying Linux host so it runs in the native NX-OS environment rather than in an isolated container. Which on-box automation capability should the engineer enable and use to accomplish this?

Accepted Answer

The Bash shell (feature bash-shell), which provides access to the native Linux environment and dnf/yum for RPM package installation

Answer

The Guest Shell, a secure Linux container (LXC) decoupled from the host that isolates installed software

Answer

An EEM applet configured with a CLI action to trigger the RPM installer

Answer

NX-API REST with a JSON-RPC payload that pushes the RPM binary to bootflash

Question 64

A network automation engineer wants to programmatically retrieve the full operational and configuration state from a Nexus 9000 switch and integrate it into a Python-based orchestration workflow. The workflow must parse structured data, validate it against a YANG data model, and support model-driven configuration changes over a single standardized transport. Which approach best satisfies these requirements?

Accepted Answer

Use NETCONF over SSH with YANG-modeled data to retrieve and edit configuration via the running datastore

Answer

Use SNMPv3 GET/SET operations against standard and vendor MIBs

Answer

Screen-scrape 'show' command output over SSH and parse it with regular expressions

Answer

Use EEM applets with CLI actions triggered by syslog events to export configuration

Exam domain	Exam weight	Practice
Network	25%	Practice this topic
Compute	25%	Practice this topic
Storage Network	20%	Practice this topic
Automation and Artificial Intelligence	15%	Practice this topic
Security	15%	Practice this topic

Cisco CCNP Data Center DCCOR (350-601) (350-601) practice exam & study guide

Start studying 350-601

All 350-601 study resources

350-601 exam domains

Sample 350-601 questions

Key 350-601 terms

350-601 frequently asked questions

Network (25%)

Compute (25%)

Storage Network (20%)

Automation and Artificial Intelligence (15%)

Security (15%)