10 free Cisco 350-601 DCCOR practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 526 questions. Work through them, then open each answer to check your reasoning.
Get all 526 questions (US$39) · Download these 10 as a PDF
Question 1
Which virtual MAC address is the default for HSRP version 2 group 10?
Show answer and explanation
Correct answer: B. 0000.0C9F.F00A
HSRP version 2 for IPv4 uses the virtual MAC range 0000.0C9F.Fxxx, where xxx is the three hex digit representation of the group number. Group 10 in hex is 00A, so the default virtual MAC is 0000.0C9F.F00A. HSRPv1 uses a different range, 0000.0C07.ACxx, which would give 0000.0C07.AC0A for the same group.
Why the other options are wrong
- A. 0000.5E00.01xx is the VRRP virtual MAC range, so this address belongs to VRRP group 16, not HSRP.
- C. 3784.0898.1C0A is a burned-in style address and does not match any HSRP virtual MAC range.
- D. 0000.0C9F.F010 is the HSRPv2 virtual MAC for group 16, because 010 hex equals 16 decimal.
Question 2
Refer to the exhibit.
Which statement about the ERSPAN configuration in this environment is true?
Show answer and explanation
Correct answer: D. Host A is the source of ERSPAN spanned traffic and host B is the traffic analyzer.
In ERSPAN configurations, the source is the switch that monitors traffic using the monitor session command, and the destination is the switch receiving the mirrored traffic at the destination IP address. Switch A is configured with 'monitor session 48 type erspa-ource' monitoring Ethernet2/11 with destination IP 10.11.11.2, making it the traffic source. Switch B is configured with 'monitor session 47 type erspan-destination' receiving traffic from source IP 10.11.11.2 on interface Ethernet2/33, making it the traffic analyzer. Host A is connected to Switch A (the source), and Host B is connected to Switch B (the destination/analyzer). Therefore, Host A is the source of ERSPAN spanned traffic and Host B is the traffic analyzer.
Why the other options are wrong
- A. Session 47 is the destination session number on Switch B (the analyzer), not the source session number that controls traffic capture.
- B. This is reversed; Host B is the traffic analyzer and Host A is the source, not the other way around.
- C. While session 48 is correctly identified as the source session, the statement incorrectly implies session 48 must match on the analyzer, when in fact the ERSPAN destination uses session 47.
Question 3
Refer to the exhibit.
Which two statements about the routing table of the leaf switch are true? (Choose two.)
Show answer and explanation
Correct answer: A, D
A. 10.20.1.0/24 is a BD subnet in ACI. D. The next hop 10.1.168.95 for route 172.16.100.0/24 is the TEP address of a border leaf in ACI. The 10.20.1.0/24 entry is marked attached, direct, pervasive, which is exactly how ACI installs a bridge domain subnet on the leaf switches, so A is true. The 172.16.100.0/24 entry is learned through MP-BGP and marked internal with mpls-vpn tagging, and its next hop 10.1.168.95 sits in overlay-1, identifying the TEP of the border leaf that advertised the prefix, so D is true.
Why the other options are wrong
- B. 172.16.99.0/24 is marked external, meaning it is learned directly from an outside peer, so 10.0.1.14 is the external router next hop rather than a border leaf TEP.
- C. 172.16.100.0/24 is an MP-BGP learned external route carried inside the fabric, not a bridge domain subnet.
- E. 10.0.8.65 is the local pervasive overlay next hop used for the BD subnet gateway, not the TEP of a border leaf.
Question 4
Which mroute state is created when Bidirectional PIM is deployed at a site?
Show answer and explanation
Correct answer: A. *,G
Bidirectional PIM builds only shared trees rooted at the rendezvous point, so the only state created is (*,G). Traffic from any source travels up the shared tree toward the RP and back down to receivers, and no source registration or shortest path tree switchover occurs. That is why BiDir-PIM scales well for many-to-many applications: the router state is independent of the number of sources.
Why the other options are wrong
- B. MVPN Type 6 is the Shared Tree Join C-multicast route in BGP MVPN signaling, not a local mroute state created by PIM.
- C. MVPN Type 7 is the Source Tree Join C-multicast route in BGP MVPN signaling, not a PIM mroute state.
- D. (S,G) entries are source specific state built by PIM-SM or PIM-SSM, and BiDir-PIM never creates them.
Question 5
Refer to the exhibit.
Which statement about the default gateway configuration of the vPC is true?
Show answer and explanation
Correct answer: A. Either switch can act as the active default gateway.
When HSRP runs over vPC, both peers program the HSRP virtual MAC in hardware and route packets sent to the gateway locally, so traffic is forwarded actively by whichever switch receives it. N7K-1 has the higher HSRP priority (150) and therefore owns the ARP response for 10.16.165.1, but in the data plane either switch acts as the active default gateway. This active/active gateway behavior is the expected result of HSRP in a vPC domain.
Why the other options are wrong
- B. N7K-1 is the HSRP active router, but it does not carry all gateway traffic because N7K-2 also routes frames addressed to the HSRP virtual MAC.
- C. N7K-2 routes gateway destined traffic locally, so the peer link is not used for that traffic and is reserved for control plane sync and orphan or failure scenarios.
- D. N7K-2 has the lower HSRP priority (50) and does not own the gateway role by itself.
Question 6
Refer to the exhibit.
What must be connected to clear the HA NOT READY status?
Show answer and explanation
Correct answer: B. server chassis
The output shows 'HA NOT READY' status with internal network interfaces (eth1, eth2) UP, but indicates the heartbeat mechanism is not functioning properly. In high-availability cluster configurations, the heartbeat requires a dedicated connection between chassis/nodes to exchange keepalive signals and cluster state information. This dedicated heartbeat link is typically separate from management and data network interfaces. Without the server chassis (the peer node) connected via the heartbeat mechanism, the HA system cannot establish mutual awareness and synchronization, resulting in the NOT READY state.
Why the other options are wrong
- A. Layer 1-Layer 2 ports (eth1, eth2) are already UP according to the output, so this is not the missing component.
- C. Management ports are separate from the HA heartbeat mechanism and would not directly cause HA NOT READY status.
- D. Network uplinks for data traffic are unrelated to the internal HA heartbeat communication required for cluster readiness.
Question 7
A small remote office is set to connect to the regional hub site via NSSA ASBR.
Which type of LSA is sent to the remote office OSPF area?
Show answer and explanation
Correct answer: A. type 7 LSA
An NSSA (Not-So-Stubby Area) uses Type 7 LSAs to advertise routes from external sources injected by an ASBR within the NSSA area. When an ASBR connects a remote office via an NSSA area, it sends Type 7 LSAs into that area to communicate external route information. These Type 7 LSAs are specific to NSSA areas and are translated to Type 5 LSAs only at area boundaries.
Why the other options are wrong
- B. Type 1 LSAs are router LSAs flooded within a single area, not used by ASBRs to advertise external routes.
- C. Type 5 LSAs are external LSAs flooded throughout the OSPF domain, but cannot be sent directly into an NSSA area; Type 7 is used instead.
- D. Type 3 LSAs are network summary LSAs used for inter-area route summarization, not for external route advertisement.
Question 8
Which adjacency server configuration makes two OTV edge devices located in the same site bring up the dual-site adjacency?
Show answer and explanation
Correct answer: B. Nexus-1: interface Ethernet1/2 ip address 20.1.1.1/24,
Overlay200 otv adjacency-server unicast-only otv join-interface Ethernet1/2. Nexus-2: interface Ethernet1/2 ip address 20.1.1.2/24, interface Overlay200 otv join-interface Ethernet1/2 otv adjacency-server unicast-only otv use-adjacency-server 20.1.1.1 unicast-only In unicast-only OTV, neighbor discovery depends on edge devices registering with an adjacency server, because there is no multicast in the transport. Option B configures Nexus-1 as the adjacency server and gives Nexus-2 both the adjacency server role and the otv use-adjacency-server 20.1.1.1 statement pointing at Nexus-1, which is the standard primary and secondary adjacency server pairing. With that registration in place the two edge devices learn each other's join interface addresses and bring up the overlay adjacency alongside the site adjacency.
Why the other options are wrong
- A. Both devices only point at each other with use-adjacency-server and neither is configured with the otv adjacency-server command, so there is no server to register with and no neighbor list is ever built.
- C. Both devices are configured only as adjacency servers and neither registers with the other, so neither one learns the peer's join interface address and the overlay adjacency never forms.
Question 9
Refer to the exhibit.
The STP priority of N7K-1 and N7K-2 are the lowest in the network.
Which statement describes STP on the vPC?
Show answer and explanation
Correct answer: A. N7K-1 and N7K-2 appear as a single STP root.
Both switches carry spanning-tree priority 8192 for VLANs 1-10 and both have vPC pee-witch enabled, so they originate BPDUs using a common bridge ID. Downstream devices therefore see one logical root bridge instead of two separate switches, and a vPC primary or secondary role change does not trigger an STP topology change. Without peer-switch only the vPC primary would send BPDUs on vPC member ports.
Why the other options are wrong
- B. N7K-1 does not present itself as an individual root because peer-switch makes both peers advertise the same bridge ID.
- C. There is no root preemption between the peers; peer-switch gives them a shared bridge identity, so no re-election occurs between them.
- D. N7K-2 does not appear as a separate root switch; it shares the single logical root identity with N7K-1.
Question 10
The engineer must configure SPAN on a Cisco Nexus 5000 Series Switch to get a capture of the traffic from these applications for an in-depth packet analysis.
Which two SPAN characteristics must be considered? (Choose two.)
Show answer and explanation
Correct answer: B, C
B. The Ethernet, FC, vFC, port channel, SAN port channel can be used as SPAN source ports. C. A SPAN source port cannot be a destination SPAN port. On the Cisco Nexus 5000 Series, SPAN source ports may be Ethernet, Fibre Channel, vFC, port channel, or SAN port channel interfaces, which is what makes it possible to capture both LAN and SAN application traffic in one design. A port that is already configured as a SPAN destination cannot simultaneously serve as a source, so the capture port must be dedicated to the analyzer. Those two rules drive the interface selection for this packet analysis.
Why the other options are wrong
- A. This addresses how sessions can overlap rather than the source interface types and port role restrictions that shape this capture design.
- D. This list omits SAN port channel, which is a supported SPAN source type on the Nexus 5000.
- E. VLAN and VSAN based SPAN capture ingress traffic only, so the rx/tx direction option does not apply to them.
That was 10 of 526.
The full Cisco 350-601 DCCOR pack has all 526 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.