Medium — 350-601 Practice Quiz

Question 1

An ACI administrator has an existing contract between the Web-EPG and App-EPG that permits all TCP traffic. A new security requirement mandates that TCP port 23 (Telnet) be explicitly denied between these two EPGs while all other permitted TCP traffic continues to flow. The administrator wants to apply this exception without rewriting the entire allow contract. Which ACI construct should be applied to enforce this specific deny?

Accepted Answer

Configure a taboo contract with a filter matching TCP port 23 and apply it to the EPGs

Answer

Change the VRF policy enforcement to unenforced so the fabric drops Telnet by default

Answer

Add a permit-all vzAny contract at the VRF level to override the port 23 traffic

Answer

Enable intra-EPG isolation on the Web-EPG to block Telnet between the two EPGs

Question 2

A network engineer is deploying a new three-tier application in Cisco ACI. The Web, App, and DB endpoints are each placed in their own EPG within a single bridge domain and VRF. By default, no traffic flows between the EPGs. The engineer wants Web endpoints to reach App endpoints on TCP 8080, but must NOT permit any other inter-EPG traffic. Which configuration correctly achieves this requirement?

Accepted Answer

Create a contract with a subject filtering TCP 8080, provide it from the App EPG and consume it from the Web EPG.

Answer

Enable 'Unenforced' mode on the VRF so the EPGs can communicate freely over TCP 8080.

Answer

Apply a vzAny contract on the VRF permitting TCP 8080 so all EPGs in the VRF can use the service.

Answer

Place all three EPGs into a single ESG and rely on intra-ESG forwarding for TCP 8080.

Question 3

An engineer is configuring an ACI L3Out to connect the fabric to an external OSPF router. Internal EPGs must be able to reach any destination learned via the L3Out, and a contract has already been created between the internal EPG and the external EPG. When configuring the external EPG (L3 External Network), which subnet scope setting must be applied to the 0.0.0.0/0 subnet so that the external routes are properly classified into the external EPG for contract enforcement?

Accepted Answer

External Subnets for the External EPG

Answer

Export Route Control Subnet

Answer

Shared Route Control Subnet

Answer

Aggregate Shared Routes

Question 4

A data center administrator is securing an ACI fabric that hosts a multi-tenant virtualized environment. Several VMs belonging to the same application EPG must be dynamically isolated based on their VM attributes (for example, VM name containing 'DB') without moving them to a different base EPG or requiring VLAN reassignment. The administrator wants endpoints matching the criteria to be classified into a separate policy group so that contracts can control communication between them and the rest of the EPG. Which ACI feature should be implemented to meet this requirement?

Accepted Answer

Configure a uSeg (microsegmented) EPG with a VM-name attribute-based match statement

Answer

Create a static path binding with a unique VLAN encapsulation for each VM

Answer

Apply an intra-EPG isolation flag on the base application EPG

Answer

Configure a separate bridge domain and associate each VM subnet to it

Question 5

A network engineer is designing an ACI application profile for a three-tier application (web, app, database). The security team requires that web servers can only reach app servers on TCP 8080, and app servers can only reach database servers on TCP 1521. All three tiers reside in the same bridge domain and VRF. Which approach correctly enforces this policy in ACI?

Accepted Answer

Create three EPGs (web, app, db) and define contracts where the app EPG provides a contract with TCP 8080 consumed by web, and the db EPG provides a contract with TCP 1521 consumed by app

Answer

Place all three tiers in a single EPG and apply an intra-EPG contract permitting TCP 8080 and TCP 1521

Answer

Create three EPGs and rely on the default ACI behavior, which permits all traffic between EPGs in the same bridge domain

Answer

Create three bridge domains, one per tier, and use subnet-based ACLs on each bridge domain to restrict the ports

Question 6

You are deploying a pair of Nexus 9300 leaf switches in a Cisco ACI fabric to provide a vPC to a dual-homed application server. After configuring the vPC interface policy group and applying it to both leaf ports, the server's port-channel remains down and the APIC reports the leaves are not forming a vPC domain. Which configuration step is required to establish the vPC domain between the two leaf switches in ACI?

Accepted Answer

Create a vPC Explicit Protection Group that pairs the two leaf node IDs and assigns a vPC domain ID

Answer

Manually configure a vPC peer-link and peer-keepalive link between the two leaf switches under the fabric access policies

Answer

Enable the vPC feature on each leaf using the CLI 'feature vpc' command before applying the interface policy group

Answer

Configure a common HSRP group across both leaves so they share a virtual MAC for the vPC

Question 7

A data center team is designing an AI training cluster with servers containing 8 GPUs each. Within a single server, GPUs must exchange gradients at maximum bandwidth with the lowest possible latency, bypassing CPU and PCIe bottlenecks. Across servers, GPUs connect through a lossless Ethernet fabric using RoCEv2. Which technology provides the intra-server (scale-up) high-speed GPU-to-GPU interconnect that the design should specify?

Accepted Answer

NVLink/NVSwitch fabric interconnecting GPUs inside the chassis

Answer

RoCEv2 with PFC and ECN across the leaf-spine fabric

Answer

GPUDirect Storage over NVMe-oF for gradient exchange

Answer

InfiniBand HDR uplinks from each server to the spine switches

Question 8

A data center automation engineer maintains Cisco Nexus 9000 switches using Ansible with the cisco.nxos collection. Before applying a large VLAN and interface configuration change to production leaf switches, the engineer wants to preview exactly which tasks would report a change WITHOUT altering any device state, and also wants confidence that re-running the playbook after a successful apply will report no further changes. Which combination of Ansible characteristics satisfies both requirements?

Accepted Answer

Run the playbook with --check mode to preview changes, relying on the modules' idempotency so a re-run against an already-configured device reports 'ok' instead of 'changed'

Answer

Run the playbook with --forks 1 to serialize execution, which guarantees no device changes occur during the first pass

Answer

Use the nxos_command module with a 'when: false' conditional so commands are queued but never sent to the device

Answer

Enable --diff mode alone, since diff output prevents the modules from committing configuration to the running-config

Question 9

A network automation engineer is storing an Ansible playbook and its variable files in a shared Git repository used to configure Cisco Nexus 9000 switches. The variable files contain BGP neighbor authentication keys and device login credentials in plaintext. Security policy requires that these secrets not be readable in the repository while still allowing the playbook to run non-interactively in a CI/CD pipeline. Which approach meets the requirement?

Accepted Answer

Encrypt the sensitive variable files with Ansible Vault and supply the vault password to the pipeline via a vault password file or environment variable at runtime.

Answer

Move the credentials into the playbook's inline tasks and mark those tasks with 'no_log: true' so they are hidden from the repository.

Answer

Base64-encode the variable files before committing them so the secrets are not directly human-readable in Git.

Answer

Store the credentials in the ansible.cfg file, which is automatically excluded from version control by default.

Question 10

A network engineer is deploying a VXLAN BGP EVPN fabric with 2 spine switches and 40 leaf switches. To avoid a full mesh of iBGP sessions in a single AS (65001), the engineer wants a scalable control-plane design for distributing EVPN routes between all VTEPs. What is the recommended approach?

Accepted Answer

Configure the spine switches as EVPN route reflectors and peer each leaf as a route-reflector client

Answer

Configure a full mesh of iBGP EVPN sessions directly between all leaf switches

Answer

Configure each leaf in a unique AS and use eBGP EVPN sessions to the spines with next-hop-self disabled

Answer

Configure the spines as VTEPs and originate all Type-2 and Type-5 routes from the spine layer

Question 11

A network engineer is troubleshooting BUM traffic replication in a VXLAN EVPN fabric that uses ingress replication (no multicast in the underlay). Two VTEPs, Leaf-1 and Leaf-2, both host VNI 10100. Leaf-1 is not flooding broadcast frames for VNI 10100 to Leaf-2, so hosts behind Leaf-2 never receive ARP requests originated on Leaf-1. Which EVPN route type must be exchanged between the two VTEPs to build the ingress replication flood list for VNI 10100?

Accepted Answer

Type-3 Inclusive Multicast Ethernet Tag (IMET) route

Answer

Type-2 MAC/IP advertisement route

Answer

Type-4 Ethernet Segment route

Answer

Type-5 IP Prefix route

Question 12

A data center engineer is planning software maintenance on a Cisco Nexus switch. In addition to the NX-OS image upgrade, Cisco has released a new EPLD (Electronic Programmable Logic Device) image to address a hardware programming issue on the I/O modules. The engineer wants to understand the operational impact before scheduling the change window. Which statement correctly describes the EPLD upgrade behavior?

Accepted Answer

EPLD upgrades can be disruptive; upgrading the EPLDs on a module typically powers down and reloads that module, interrupting traffic on its interfaces.

Answer

EPLD upgrades are always nondisruptive because they run in parallel with the active NX-OS control plane and never affect data forwarding.

Answer

EPLD images can only be applied through a full ISSU and cannot be upgraded independently of the NX-OS system image.

Answer

EPLD upgrades replace the NX-OS kickstart and system images, so no separate EPLD file is required.

Question 13

A storage administrator is editing the zoning configuration on a Cisco MDS 9000 fabric that uses enhanced zoning across VSAN 20. A colleague on another switch in the same fabric attempts to make zoning changes at the same time and reports an error that the operation cannot proceed. When the first administrator finishes, they modify a zone and then run 'zoneset activate name PROD-ZS vsan 20'. What behavior of enhanced zoning explains the colleague's error and ensures configuration consistency?

Accepted Answer

Enhanced zoning acquires a fabric-wide lock so only one administrator can modify the zoning database at a time, and changes are distributed and committed atomically to all switches.

Answer

Enhanced zoning uses soft zoning, which prevents two switches from advertising the same FCNS entries simultaneously.

Answer

Basic zoning was still in effect, so the full zoneset had to be manually copied to each switch, blocking the second administrator.

Answer

The colleague's error occurred because enhanced zoning distributes only the active zoneset, requiring the full zoneset to be re-merged on every activation.

Question 14

A storage administrator is hardening a MDS/Nexus Fibre Channel fabric that spans two data centers. Management requires that only explicitly approved switches be allowed to join VSAN 20, and any unauthorized switch attempting to merge into the fabric must be prevented from doing so and have its E_Port isolated. Which security feature meets this requirement?

Accepted Answer

Fabric binding, which authorizes ISL formation based on a configured list of switch WWNs (sWWNs)

Answer

Port security, which binds device pWWNs to specific F_Ports on the switch

Answer

Hard zoning enforced by the switch ASICs using WWPN-based zones

Answer

FC-SP DHCHAP configured only on host-facing F_Ports

Question 15

A storage administrator connects a new server HBA to a Cisco MDS switch port configured in F mode. The port comes up, but the server cannot access its LUNs on the target array. On the MDS, the 'show flogi database' output lists the HBA's pWWN with an assigned FCID, but 'show fcns database' does not display the target array's pWWN as accessible to the initiator. What is the most likely cause?

Accepted Answer

The initiator and target are not in the same active zone within the active zoneset

Answer

The HBA failed FLOGI and never registered with the fabric

Answer

The VSAN has not been assigned a domain ID by the principal switch

Answer

The F port must be reconfigured as an E port to allow target visibility

Question 16

A storage administrator is extending a Fibre Channel SAN between two data centers over a shared IP WAN link with 200 ms round-trip latency and limited bandwidth. The primary requirement is to reduce the amount of replication data traversing the WAN to fit within the available bandwidth. Which FCIP feature should be enabled on the MDS switches to meet this goal?

Accepted Answer

IP compression on the FCIP tunnel interface

Answer

FCIP write acceleration

Answer

TCP selective acknowledgment (SACK) on the FCIP profile

Answer

Increasing the maximum bandwidth setting on the FCIP profile

Question 17

A storage administrator is configuring an iSCSI deployment on a Cisco Nexus/MDS environment and wants to reduce the frequency of full LUN rescans on hosts. A new storage array with additional targets has just been added to the same portal IP. Which iSCSI mechanism allows an already-logged-in initiator to learn about the newly added targets without manually reconfiguring each host?

Accepted Answer

The initiator issues a SendTargets discovery session to the portal, which returns the full list of available targets including the newly added ones

Answer

The initiator relies on iSNS to push a broadcast to all hosts forcing an immediate LUN-level rescan

Answer

The target array sends an unsolicited FLOGI to the initiator advertising the new LUNs

Answer

The initiator uses CHAP renegotiation to trigger automatic discovery of new targets

Question 18

A storage administrator is troubleshooting an ESXi host connected to a Cisco MDS fabric. The host's initiator successfully completes FLOGI and its zone with the target array is active, but the host cannot discover any LUNs presented by the target. On the MDS switch, the 'show fcns database' output lists both the initiator and target FC4 features, and 'show zone status' confirms the zone is fully activated in the correct VSAN. Which action should the administrator take NEXT to resolve the missing LUN visibility?

Accepted Answer

Verify LUN masking and host mapping configuration on the storage array

Answer

Increase the buffer-to-buffer credits on the initiator's F port

Answer

Reconfigure the zone to use interface-based zoning instead of pWWN

Answer

Change the VSAN interop mode to mode 1 on the fabric

Question 19

A storage administrator is hardening an MDS Fibre Channel fabric. A junior engineer accidentally cabled an unauthorized HBA into interface fc1/12, and it successfully performed FLOGI and began accessing the fabric. The administrator wants to ensure that only pre-approved pWWNs can log in on specific physical ports, and that any unauthorized device attempting FLOGI is automatically rejected without requiring manual zoning changes. Which feature should be implemented to enforce this?

Accepted Answer

Fibre Channel port security binding pWWNs to specific interfaces per VSAN

Answer

Hard zoning enforcement using fWWN-based zone members

Answer

Fabric binding to control which switches can join the fabric

Answer

Port-channel VSAN trunking to restrict allowed VSANs on the ISL

Question 20

A storage administrator has correctly configured single-initiator zoning on a Cisco MDS 9000 fabric so that a specific server HBA can reach a storage array's target port. However, the security team is concerned that the server can still see and potentially access LUNs belonging to other servers presented by that same array target port. Which additional control most directly restricts which specific LUNs behind the target port that particular server is permitted to access?

Accepted Answer

LUN masking configured on the storage array

Answer

A more restrictive hard zoning enforcement mode on the MDS switch

Answer

Port security auto-learning locked down on the fabric

Answer

VSAN isolation separating the initiator and target

Question 21

A data center engineer is deploying a new Cisco MDS 9148 fabric switch at the edge of an existing storage fabric. The core directors are already at their maximum supported domain ID count, and adding another domain ID would exceed the fabric's scalability limits. The engineer needs the edge switch to connect servers to the fabric without consuming an additional domain ID, while the core switches must be able to allow multiple logins over a single uplink. Which combination of features must be enabled to meet these requirements?

Accepted Answer

Enable NPV mode on the edge MDS switch and enable NPIV on the core switch

Answer

Enable NPIV on the edge MDS switch and enable NPV mode on the core switch

Answer

Enable FSPF load balancing on the edge switch and trunking on the core switch

Answer

Enable VSAN trunking on both the edge and core switches

Question 22

A storage engineer is connecting two Cisco MDS/Nexus FC switches with two 32G Fibre Channel links bundled into a port channel. The port channel must carry traffic for VSAN 10 and VSAN 20 across the ISL. After configuration, VSAN 20 traffic is not passing, though VSAN 10 works. The engineer confirms both member ports are up and the port channel is operational. What is the MOST likely cause?

Accepted Answer

The trunk allowed VSAN list on the port channel does not include VSAN 20

Answer

The port channel is configured in mode active rather than mode on

Answer

The two member ports operate at different speeds, preventing VSAN 20 forwarding

Answer

Zoning for VSAN 20 has not been distributed via CFS to the peer switch

Question 23

A storage administrator is enabling Fibre Channel port security on VSAN 20 of a Cisco MDS switch to prevent unauthorized devices from logging into fabric ports. To speed initial configuration, they enable auto-learning, let all current devices perform FLOGI, and then plan to make the learned bindings permanent. Which action must they take so that the learned entries are retained and no NEW devices can be learned automatically afterward?

Accepted Answer

Disable auto-learning after the database is populated, then activate/commit the port security database so the learned bindings become enforced permanent entries

Answer

Leave auto-learning enabled permanently so the switch continuously validates every device that logs in against the fabric

Answer

Copy the running configuration to startup configuration, which automatically converts the auto-learned entries into static bindings

Answer

Deactivate the port security database and re-enable it, forcing the switch to freeze the current learned bindings

Question 24

A storage administrator wants to ensure that only authenticated switches and end devices can join a Cisco MDS Fibre Channel fabric. The requirement is a challenge-response protocol that mutually authenticates devices using a shared secret before allowing fabric access, without relying solely on WWN-based lists. Which security mechanism should be configured?

Accepted Answer

DHCHAP (Diffie-Hellman Challenge Handshake Authentication Protocol)

Answer

Port security with auto-learning of pWWNs

Answer

Enhanced zoning with fabric-wide lock

Answer

Fabric binding using an authorized sWWN list

Question 25

A storage administrator is configuring zoning on a Cisco MDS fabric that connects 40 servers to a dual-controller storage array. To follow Cisco and industry best practices while minimizing RSCN disruption and simplifying troubleshooting, how should the administrator structure the zones?

Accepted Answer

Create single-initiator zones, each containing one server HBA and only the target ports it needs to access

Answer

Create one large zone containing all 40 server HBAs and both storage array target ports

Answer

Create single-target zones, each containing one storage port and all 40 server HBAs

Answer

Disable zoning entirely and rely on VSAN separation to isolate the servers from each other