132 free Cisco 350-601 DCCOR practice questions from the CertStash pack of 526, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 132 free here, all 526 in the pack, and each step includes the one before it.
Get all 526 questions (US$39) · Download the first 10 as a PDF
Question 1
Which virtual MAC address is the default for HSRP version 2 group 10?
Show answer and explanation
Correct answer: B. 0000.0C9F.F00A
HSRP version 2 derives its virtual MAC address from the range 0000.0C9F.F000 to 0000.0C9F.FFFF, with the last three hex digits carrying the group number. Group 10 in decimal is 00A in hexadecimal, so the default virtual MAC for HSRPv2 group 10 is 0000.0C9F.F00A. Converting the group number to hexadecimal before appending it is the key step, since writing the decimal digits directly produces a different group's address.
Why the other options are wrong
- A. 0000.5E00.0110 follows the IETF 0000.5E00.01xx format used by VRRP, not the Cisco HSRPv2 range.
- C. 3784.0898.1C0A is not in the HSRP virtual MAC range at all; it is not a reserved first-hop redundancy address.
- D. 0000.0C9F.F010 is the HSRPv2 address for group 16, because 010 hexadecimal equals 16, not 10.
Question 2
Which mroute state is created when Bidirectional PIM is deployed at a site?
Show answer and explanation
Correct answer: A. *,G
Bidirectional PIM builds a single shared tree rooted at the rendezvous point for each group and never switches to source trees. Traffic from any sender flows up the shared tree toward the RP and down to receivers along the same tree, so routers keep only (*,G) entries. This removes per-source state, which is why Bidir PIM scales well for many-to-many applications with large numbers of senders.
Why the other options are wrong
- B. MVPN Type-6 is a BGP route type used in multicast VPNs to carry shared tree joins between PEs, not the mroute state created by Bidir PIM.
- C. MVPN Type-7 is a BGP MVPN route type for source tree joins across a provider network, unrelated to Bidir PIM forwarding state.
- D. (S,G) state is created by source trees in PIM sparse mode or SSM, which Bidir PIM never builds.
Question 3
A small remote office is set to connect to the regional hub site via NSSA ASBR. Which type of LSA is sent to the remote office OSPF area?
Show answer and explanation
Correct answer: A. type 7 LSA
An NSSA does not accept type 5 external LSAs, yet it allows an ASBR inside the area to inject external routes. Those routes are carried within the NSSA as type 7 LSAs. The ABR toward the backbone translates them into type 5 LSAs for the rest of the OSPF domain. For a remote office connected as an NSSA with an ASBR, the external information circulating in that area is therefore type 7.
Why the other options are wrong
- B. Type 1 router LSAs exist in every OSPF area and are not what distinguishes the external routing in an NSSA.
- C. Type 5 external LSAs are blocked from an NSSA and are only produced when the ABR translates type 7 for other areas.
- D. Type 3 summary LSAs carry inter-area prefixes and do not describe the external routes an NSSA ASBR injects.
Question 4
The engineer must configure SPAN on a Cisco Nexus 5000 Series Switch to get a capture of application traffic for an in-depth packet analysis. Which two SPAN characteristics must be considered? (Choose two.)
Show answer and explanation
Correct answer: B, C. The Ethernet, FC, vFC, port channel, SAN port channel can be used as SPAN source ports; A SPAN source port cannot be a destination SPAN port.
On the Cisco Nexus 5000 Series, a SPAN session can monitor Ethernet ports, Fibre Channel ports, virtual Fibre Channel ports, Ethernet port channels and SAN port channels, so the supported list includes SAN port channels. A port configured as a SPAN source cannot also be configured as a SPAN destination, because the destination port is reserved for sending copied traffic to the analyzer. Both rules must be considered when planning the capture of the application traffic.
Why the other options are wrong
- A. This is not one of the planning constraints the stem requires; the key source-port rules are the supported port types and the separation of source and destination ports.
- D. This list leaves out SAN port channels, which the Nexus 5000 Series also supports as SPAN sources.
- E. VLAN and VSAN sources are monitored in the ingress direction only; the rx and tx choice applies to interface sources.
Question 5
A customer has a requirement to deploy a cloud service and needs to have full control over the underlying OS, data and applications. Which cloud model meets this requirement?
Show answer and explanation
Correct answer: D. IaaS
Infrastructure as a Service provides virtualized compute, storage and networking while the customer installs and manages the operating system, middleware, data and applications. Because the provider handles only the physical infrastructure and virtualization layer, IaaS is the cloud model that gives the customer full control over the OS and everything above it.
Why the other options are wrong
- A. MaaS is not one of the standard service models and does not describe a platform where the customer controls the operating system.
- B. With PaaS the provider manages the operating system and runtime, so the customer controls only applications and data.
- C. With SaaS the provider manages the whole stack, including the application, so the customer has no control over the OS.
Question 6
Due to a major version change, an engineer must perform a software upgrade on a Cisco Nexus Series switch. Which two technologies should be implemented to reduce disruptions to the network during the upgrade? (Choose two.)
Show answer and explanation
Correct answer: A, B. vPC; HSRP
During a disruptive major version upgrade, the goal is to keep forwarding through a redundant peer while one switch reloads. vPC lets downstream devices dual-home to two Nexus switches with a single port channel, so links to the upgrading peer simply drop out of the bundle while the other peer keeps forwarding. HSRP provides a redundant first-hop gateway, so when the active router is upgraded, the standby takes over the virtual IP and MAC and hosts keep their default gateway.
Why the other options are wrong
- C. VDCs partition one physical switch into logical switches, and they share the same hardware and do not provide a separate path during an upgrade.
- D. MLAG is a generic multichassis link aggregation term; on Cisco Nexus switches this function is delivered by vPC.
- E. PAgP is a Cisco link bundling negotiation protocol that NX-OS does not use, and it adds no redundancy across switches.
Question 7
What are two capabilities of the Cisco Network Assurance Engine? (Choose two.)
Show answer and explanation
Correct answer: A, B. It validates that devices comply with network security policies; It predicts the impact of changes to the network.
Cisco Network Assurance Engine builds a mathematical model of the network from its policies, configuration and state and continuously checks it against the intent. That lets it validate that devices comply with network security and segmentation policies, such as confirming that contracts permit or deny the expected traffic. It can also run pre-change analysis, predicting the impact of a proposed configuration change before it is deployed so errors are caught in advance.
Why the other options are wrong
- C. Network Assurance Engine analyzes policy and configuration correctness, not capacity forecasting of data center traffic load.
- D. It verifies that behavior matches intent, but it is not a performance tool that measures SLA metrics.
- E. Measuring flow speed with telemetry is a performance analytics function, not the formal verification Network Assurance Engine performs.
Question 8
What is an advantage of streaming telemetry over SNMP?
Show answer and explanation
Correct answer: B. periodic push-based subscription messages
Streaming telemetry reverses the SNMP polling model. A collector subscribes once, and the device then pushes the requested model-driven data at a configured interval, or on change, without waiting for each request. These periodic push-based subscription messages reduce polling overhead, give more frequent and consistent data, and scale better than repeatedly querying MIB objects with SNMP.
Why the other options are wrong
- A. Traps sent to a receiver are an SNMP mechanism, so they are not an advantage telemetry has over SNMP.
- C. Periodic polling of device status is the SNMP model that streaming telemetry is designed to replace.
- D. MD5-based authentication on polling describes SNMPv3 security, not a benefit of streaming telemetry.
Question 9
APIC EPG Resolution Immediacy is set to Immediate. Which statement is true about the Deployment Immediacy for VMM domains associated to EPGs?
Show answer and explanation
Correct answer: A. If "On demand" is selected, the policy is programmed in the hardware only when the first packet is received through the data path.
Deployment Immediacy controls when a policy already downloaded to a leaf is pushed into hardware. With On Demand, the leaf programs the policy into hardware only when the first packet for that EPG is received through the data path, which conserves hardware resources such as policy TCAM. With Immediate, the policy is programmed in hardware as soon as it is downloaded to the leaf software.
Why the other options are wrong
- B. Immediate programs the policy in hardware once it is downloaded to the leaf, not at leaf boot time.
- C. The VDS port group is created through the VMM domain association with the EPG, independent of the deployment immediacy choice.
- D. Reacting to a VM being attached to the EPG describes resolution behavior, not On Demand deployment, which waits for data path traffic.
Question 10
An engineer must configure a Nexus 7000 series switch for HSRP on VLAN 100. When fully functional, the router must be the active master. Which set of commands must be used to implement the scenario?
Show answer and explanation
Correct answer: A. feature hsrp interface vlan100 ip address 10.1.1.2 255.255.255.0 priority 255 preempt hsrp version 2 hsrp 1000 ip 10.1.1.1
On a Nexus 7000, HSRP is enabled with the feature hsrp command. Under interface vlan100, the configuration assigns 10.1.1.2/24, enables HSRP version 2, creates group 1000 with virtual IP 10.1.1.1, and sets priority 255 with preempt. Priority 255 is the highest value, so this router wins the election against any peer, and preempt lets it reclaim the active role whenever it is fully functional again.
Why the other options are wrong
- B. feature-set is not the command that enables HSRP on NX-OS, and priority 20 is below the default, so the router would not become active.
- C. feature-set is not the command that enables HSRP on NX-OS, and priority 80 is below the default, so the router would not become active.
- D. Priority 240 wins only against lower-priority peers, while 255 is the highest value and guarantees the active role.
Question 11
A storage array must be connected to port ethernet1/10 on a Cisco MDS 9000 Series Switch. In addition, the array must connect using the FCoE protocol and be single-homed. Which configuration meets these requirements?
Show answer and explanation
Correct answer: B. interface vfc 10 switchport mode f bind interface ethernet 1/10 vsan database vsan 101 vlan 101 fcoe vsan 101 vsan 101 interface vfc 10
A single-homed FCoE storage array connects to a virtual Fibre Channel interface that is bound to the physical Ethernet port. This configuration creates interface vfc 10, sets it to switchport mode f because the array is an N port device, and binds it to interface ethernet 1/10. In the VSAN database it creates VSAN 101 and assigns vfc 10 to it, and the vlan 101 with fcoe vsan 101 statement maps the FCoE VLAN to that VSAN so the array's FIP and FCoE frames are carried in the correct VSAN.
Why the other options are wrong
- A. This version sets the Ethernet port to E mode for FCoE and never binds the vFC to the physical port, so it describes an inter-switch link rather than an array attachment.
- C. This version uses a nonexistent vlan database syntax and places the bind command on the Ethernet interface instead of the vFC.
- D. This version uses invalid statements such as fcoe vsan 101 enable, switchport mode fcoe and a VLAN access setting on the vFC, so it is not a valid vFC configuration.
Question 12
The VMM domain is integrated between Cisco APICs and vCenter using a distributed vSwitch. The traffic must be blocked between a subset of endpoints in an EPG based on specific VM attributes and the rest of the VMs in that EPG. Which set of actions blocks this traffic?
Show answer and explanation
Correct answer: D. 1. Set Allow Microsegmentation under the EPG VMM Domain Association to "True". 2. Set Intra-EPG Isolation to "Enforced" for the EPG. 3. Set Intra-EPG Isolation to "Unenforced" for the uSeg EPG.
To separate a subset of VMs from the rest of their EPG based on VM attributes, a microsegmented (uSeg) EPG is created with matching attributes, and Allow Microsegmentation must be set to True on the base EPG VMM domain association so the distributed vSwitch uses private VLANs and sends traffic to the leaf for classification. Setting Intra-EPG Isolation to Enforced on the base EPG prevents the remaining VMs from switching traffic locally on the DVS, so all flows reach the leaf where the policy between the base EPG and the uSeg EPG is applied and traffic without a contract is blocked. Leaving the uSeg EPG Unenforced still lets the selected VMs communicate among themselves.
Why the other options are wrong
- A. With isolation unenforced on the base EPG, VMs can still switch locally on the DVS, so traffic between the subset and the rest of the EPG is not reliably blocked.
- B. With Allow Microsegmentation set to False, the uSeg EPG classification on the distributed vSwitch is not enabled, so the attribute-based subset cannot be separated.
- C. Enforcing isolation on the uSeg EPG also blocks traffic among the selected VMs themselves, which goes beyond the requirement.
Question 13
When the default firmware package is set to a new version, which type of policy determines the timing of server reboots during the firmware upgrade?
Show answer and explanation
Correct answer: B. maintenance
When the default host firmware package is updated to a new version, every server whose service profile uses that package must reboot to activate the new firmware. The maintenance policy associated with the service profile controls when that disruptive change is applied: immediately, only after user acknowledgment, or at the next scheduled maintenance window. This prevents servers from rebooting unexpectedly during production hours.
Why the other options are wrong
- A. A diagnostics policy defines server diagnostic tests and does not schedule firmware-related reboots.
- C. A local disk policy defines the RAID and local storage configuration, not reboot timing.
- D. A BIOS policy sets BIOS parameters on the server and does not control when reboots occur.
Question 14
An infrastructure architect is analyzing the deployment type for an application. Several companies must be able to operate the application environment and integrate it with a third-party protocol. The development team also must have maximum control over their development environment, including the operating system used, Python interpreter, and corresponding libraries. Which cloud deployment solution meets these requirements?
Show answer and explanation
Correct answer: D. community cloud Infrastructure as a Service
Two requirements drive the choice. First, several companies must operate the application environment together, which describes a community cloud: infrastructure shared by multiple organizations with common needs. Second, the developers need maximum control over the operating system, the Python interpreter and its libraries. Infrastructure as a Service delivers compute, storage and networking while leaving the operating system and everything above it to the customer, giving the deepest level of control among the service models. A community cloud running IaaS therefore satisfies both the multi-company operation and the development control requirements.
Why the other options are wrong
- A. Platform as a Service fixes the operating system and runtime, so developers cannot fully control the OS or interpreter, and a private cloud serves only a single organization.
- B. Storage as a Service provides only storage capacity, with no control over compute, operating systems or development runtimes.
- C. Software as a Service delivers a finished application, leaving the customer no control over the operating system, interpreter or libraries.
Question 15
In an FCoE environment, for which two sets of data must an interface that implements the PAUSE mechanism always provision sufficient ingress buffer? (Choose two.)
Show answer and explanation
Correct answer: B, D. frames that were sent on the link but not yet received; frames that were processed and transmitted by the transmitter before the PAUSE frame left the sender
With a PAUSE mechanism such as priority flow control, traffic does not stop the instant the receiver decides to pause. The receiving interface must therefore reserve enough ingress buffer for frames that were already sent on the link but have not yet arrived, since they are still in flight over the cable. It must also absorb frames that the transmitter had already processed and sent before the PAUSE frame left the sender. Reserving buffer for both sets ensures that no frames are dropped, preserving the lossless behavior FCoE requires.
Why the other options are wrong
- A. Buffer-to-buffer credits belong to native Fibre Channel flow control, and there is no category of frames sent with high credit in the PAUSE model.
- C. Frames that would be transmitted after the PAUSE takes effect are held by the transmitter, so they do not consume receiver buffer.
- E. Frames already received have been accounted for in normal buffering; the extra reservation is for frames still in flight or already queued.
Question 16
What is a recommended design choice in a topology for multipathing iSCSI traffic?
Show answer and explanation
Correct answer: D. initiators and targets in separate subnets
iSCSI multipathing relies on the host multipath software seeing independent, separately routed paths to the storage, each with its own iSCSI session. The recommended design gives each path its own IP subnet, with the initiator interfaces and target portals on each path kept in separate subnets. This keeps the operating system from sending all sessions out of one interface, gives deterministic path selection and lets the multipath driver balance load and fail over when a path is lost. Bonding NICs hides the individual paths from the multipath layer and is therefore avoided.
Why the other options are wrong
- A. A single initiator still leaves one path from the host side, so it does not provide true multipathing.
- B. Bonding NICs presents one logical interface, which hides the separate paths from iSCSI multipath software and is not the recommended approach.
- C. Bonded interfaces again hide the individual paths, and a single target remains a single point of failure on the storage side.
Question 17
An engineer must implement a VXLAN-based data center interconnect. The long-distance transport provided by a service provider is IP-based, supports a maximum MTU of 1554 bytes, and does not support outbound traffic replication. Which action must be taken to build the data center interconnect?
Show answer and explanation
Correct answer: D. Implement BGP EVPN ingress replication.
VXLAN must deliver broadcast, unknown unicast and multicast (BUM) traffic to every VTEP in a VNI. Normally this can be done with underlay multicast, but the provider transport does not replicate traffic, so the VTEPs must do it themselves. With BGP EVPN ingress replication, each VTEP learns its remote peers through EVPN routes and sends a unicast copy of each BUM frame to every remote VTEP in the VNI. Only unicast IP transport is required, and the 1554-byte MTU leaves room for the VXLAN encapsulation overhead on standard frames, so the interconnect can be built.
Why the other options are wrong
- A. Advertising host reachability over BGP handles unicast endpoint learning, but on its own it does not solve how BUM traffic is replicated without transport multicast.
- B. Access lists filter or classify traffic; they are not the mechanism used to replicate BUM traffic to remote VTEPs.
- C. A route map manipulates routing policy and does not create a replication list for BUM traffic toward remote VTEPs.
Question 18
A network engineer configures a converged network adapter (CNA) and must associate a virtual Fibre Channel 7 interface to VSAN 7. The CNA is connected to the interface Eth1/7, and VLAN 700 is mapped to the VSAN. Which configuration must be applied to create the virtual Fibre Channel interface and associate it with the Ethernet physical interface?
Show answer and explanation
Correct answer: A. switch(config)# interface vfc 7 switch(config-if)# bind interface ethernet 1/7
A virtual Fibre Channel interface is created with interface vfc and a number, and it carries FCoE traffic only after it is bound to the physical port or MAC address of the CNA. Entering interface vfc 7 creates the interface, and bind interface ethernet 1/7 associates it with the Ethernet port where the CNA is connected. Mapping VLAN 700 to VSAN 7 and placing vfc 7 into VSAN 7 are separate steps that complement this binding.
Why the other options are wrong
- B. Mapping VLAN 700 to VSAN 7 with fcoe vsan 7 is required for FCoE but does not create the vfc interface or bind it to Eth1/7.
- C. This assigns vfc 7 to VSAN 7 in the VSAN database but does not bind the vfc interface to the Ethernet port.
- D. There is no vfc attach command under an Ethernet interface; the binding is configured under the vfc interface.
Question 19
Which statement describes the MAC address that the FCoE Initialization Protocol chooses for use by an E-Node in an FCoE implementation?
Show answer and explanation
Correct answer: A. The FCoE Initialization Protocol uses a 24-bit FC-MAP and concatenates a 24-bit Fibre Channel ID to create a fabric-provided MAC address.
During fabric login, the FCoE Initialization Protocol gives the E-Node a fabric-provided MAC address. The address is formed by taking the 24-bit FC-MAP value configured on the fabric and concatenating the 24-bit Fibre Channel ID that the switch assigns at login, producing a 48-bit MAC. The E-Node then uses this address as the source for its FCoE frames, which ties the Ethernet address directly to the Fibre Channel identity and keeps it unique in the fabric.
Why the other options are wrong
- B. The burned-in adapter address is used for FIP discovery, but FCoE data frames use the fabric-provided MAC built from the FC-MAP and FCID.
- C. FCoE frames travel over Ethernet and must carry MAC addresses; the FCID is used to build the MAC rather than replace it.
- D. 01.00.0C is a Cisco multicast prefix, not the FC-MAP; the fabric-provided MAC starts with the configured FC-MAP value.
Question 20
Which component is disrupted when the Cisco Integrated Management Controller is upgraded on a Cisco UCS Series Server?
Show answer and explanation
Correct answer: C. KVM sessions
The Cisco Integrated Management Controller is the out-of-band management processor of the server, separate from the host data path. When its firmware is upgraded and the controller reboots to activate the new image, management services it hosts are interrupted, so active KVM console and virtual media sessions are disconnected and must be reopened. The host operating system, its network adapters and its storage connections keep running because they do not depend on the management controller, so production traffic continues.
Why the other options are wrong
- A. SAN traffic flows through the host adapters and storage path, which are independent of the management controller and continue during the upgrade.
- B. Cisco UCS Manager runs on the fabric interconnects, not on the server management controller, so it is not disrupted.
- D. Host data traffic uses the server adapters and the operating system, which are unaffected by a management controller reboot.
Question 21
An engineer is seeking the most optimal on demand CPU performance while configuring the BIOS settings of a UCS C-series rack mount server. What setting will accomplish this goal?
Show answer and explanation
Correct answer: D. C0/C1 state
Processor C-states control how deeply idle cores are allowed to sleep. Deeper states such as C2 and C6 save power but add wake-up latency, so a core takes longer to return to full execution when demand arrives. Limiting the processor to the C0/C1 state keeps cores active or in the lightest halt state, so they respond almost immediately and deliver the most consistent on-demand CPU performance. This is the setting chosen for latency-sensitive, performance-focused workloads on a UCS C-Series server.
Why the other options are wrong
- A. C6 Retention is a deep sleep state that saves power but increases wake-up latency.
- B. C6 non-Retention is an even deeper power-saving state with higher exit latency, which reduces responsiveness.
- C. C2 is deeper than C1 and adds wake-up latency, so it does not give the best on-demand performance.
Question 22
A network architect considers a Cisco HyperFlex design solution for a company. The proposed solution is for a virtual environment that is not performance-sensitive, but the solution must have high storage capacity and a low cost. Which Cisco HyperFlex storage configuration should be used?
Show answer and explanation
Correct answer: A. Hybrid
Cisco HyperFlex Hybrid nodes combine solid-state drives for caching with spinning hard disk drives for the capacity tier. Hard disks provide a large amount of storage at a much lower cost per terabyte than flash, while the SSD cache still gives reasonable performance for general workloads. For a virtual environment that is not performance-sensitive but needs high capacity at low cost, the Hybrid configuration is the appropriate choice.
Why the other options are wrong
- B. All-SAN is not a HyperFlex node configuration; HyperFlex uses internal drives in a hyperconverged cluster rather than external SAN storage.
- C. All-NVMe nodes target the highest performance and lowest latency, which raises cost and is not needed for this workload.
- D. All-Flash nodes use SSDs for every tier, delivering higher performance at a higher cost per terabyte than Hybrid.
Question 23
A network engineer is adding a Cisco HyperFlex data platform to the Cisco Intersight management portal. Which two components are required for Intersight to claim the Cisco HyperFlex data platform? (Choose two.)
Show answer and explanation
Correct answer: B, D. device claim code; device ID
Cisco Intersight claims a Cisco HyperFlex data platform through the device connector running on the cluster. The device connector displays a device ID and a claim code, and the administrator enters both in the Intersight portal under the claim target workflow. Intersight uses this pair to verify that the device is under the administrator's control and to bind it to the account, after which the HyperFlex cluster can be monitored and managed from the cloud.
Why the other options are wrong
- A. The FQDN identifies the device on the network, but Intersight does not use it to claim a target.
- C. The device connector initiates an outbound connection, so the device's public IP address is not needed to claim it.
- E. A serial number alone does not authorize the claim; the device ID and claim code are required.
Question 24
An engineer needs to perform a backup of user roles and locales from Cisco UCS Manager to replicate the setting to a different fabric interconnect. The engineer wants to review the file before importing it to a target fabric interconnect. Which backup type must be selected to meet these requirements?
Show answer and explanation
Correct answer: C. system configuration
A system configuration backup in Cisco UCS Manager exports system-level settings such as usernames, roles and locales in XML format. Because the file is XML, the engineer can open and review it before importing it on the target fabric interconnect, and the import replicates only those system settings. This matches the requirement to move user roles and locales without carrying over service profiles, pools or other logical configuration.
Why the other options are wrong
- A. A logical configuration backup contains service profiles, VLANs, VSANs, pools and policies, not user roles and locales.
- B. A full state backup is a binary snapshot for disaster recovery that cannot be reviewed as text or imported selectively.
- D. An all configuration backup also includes the logical configuration, which is more than the roles and locales the engineer needs to replicate.
Question 25
An engineer must perform a software upgrade on a production Cisco Nexus 7000 Series Switch. Before the upgrade activity, the requirement is for all ports to be shut down and routing protocols to terminate gracefully. Which feature must be used to meet these requirements?
Show answer and explanation
Correct answer: C. Maintenance Mode Profile
Graceful Insertion and Removal on Cisco Nexus switches isolates a device from the network before maintenance. The maintenance mode profile contains the commands that run when the switch enters maintenance mode, such as shutting down interfaces and isolating or gracefully shutting down routing protocols so that neighbors reroute traffic before the switch goes offline. A matching normal mode profile restores the configuration afterward. Placing the Nexus 7000 into maintenance mode before the software upgrade therefore meets the requirement for ports to be shut and routing protocols to terminate gracefully.
Why the other options are wrong
- A. A switch profile synchronizes configuration between peer switches; it does not isolate the switch for maintenance.
- B. A service profile template is a Cisco UCS Manager object for server identity and policy, not a Nexus maintenance feature.
- D. A configuration profile is a reusable set of configuration commands, typically for dynamic fabric automation, and does not drive graceful isolation before an upgrade.
Question 26
Which service profile is affected if the default host firmware policy in Cisco UCS Manager is changed?
Show answer and explanation
Correct answer: C. any service profile that has no host firmware policy defined
Cisco UCS Manager applies the policy named default to any service profile that does not reference a host firmware policy of its own. Because those service profiles rely on the default policy implicitly, changing the default host firmware policy changes the firmware that UCS Manager wants on their servers, and the update is pushed to them according to their maintenance policy. Service profiles that point to a specific user-created policy keep the versions defined there and are not affected by the change.
Why the other options are wrong
- A. A global-default host firmware policy is not how service profiles are bound; the default applies to profiles that name no policy.
- B. Service profiles that reference a user-created host firmware policy use that policy and ignore changes to the default.
- D. Membership in a sub-organization does not by itself decide the impact; what matters is whether the profile has no host firmware policy defined.
Question 27
An engineer wants to create a backup of Cisco UCS Manager for disaster recovery purposes. What are two characteristics of a full state backup of a Cisco UCS Manager database? (Choose two.)
Show answer and explanation
Correct answer: B, E. performs a complete binary dump of the database as a .bin file; contains all of the configurations
A full state backup in Cisco UCS Manager is a complete binary snapshot of the entire system database, saved as a .bin file, and it is the backup type intended for disaster recovery. Because it captures the whole database, it contains all of the configuration as well as the system state, so it can restore a fabric interconnect to the exact condition it was in when the backup was taken. The other backup types, such as all configuration, logical configuration and system configuration, are XML files that support import rather than a full restore.
Why the other options are wrong
- A. A full state backup is not limited to runtime state; it includes all of the configuration as well.
- C. The full state backup is a binary dump of the UCS Manager database, not a .sql file.
- D. The full state backup is saved as a .bin binary file, not as a .txz archive.
Question 28
A company is running a pair of Cisco Nexus 7706 Series Switches as part of a data center segment. All network engineers have restricted read-write access to the core switches. A network engineer must add a new FCoE VLAN to allow traffic from servers toward FCoE storage. Which set of actions must be taken to meet these requirements?
Show answer and explanation
Correct answer: C. 1. Create a user-defined role and add the required privileges. 2. Assign a role to a user.
On Cisco Nexus 7000 Series switches the predefined roles cannot be modified, so restricted access is delivered with user-defined roles. The engineer creates a custom role, adds rules that permit only the commands or features needed to create the FCoE VLAN, and then assigns that role to the user account. This grants exactly the privileges required while keeping the rest of the core switch configuration protected, which matches the restricted read-write access policy.
Why the other options are wrong
- A. network-admin grants full read-write access to the whole switch, which violates the restricted access requirement.
- B. The predefined network-operator role cannot be modified, and a VDC-operator role provides read-only access.
- D. The predefined VDC-admin role cannot be edited, and it already gives full access within the VDC, which is broader than required.
Question 29
An engineer must configure VXLAN routing on a Cisco Nexus 9000 Series Switch. The engineer requires a solution where all the leaf switches have the same gateway MAC and IP addresses. Which configuration set accomplishes this task?
Show answer and explanation
Correct answer: A. NX9K(config)# fabric forwarding anycast-gateway-mac AA:BB:AA:BB:AA:BB NX9K(config)# interface VLAN-interface-name NX9K(config-if)# vrf member vrf-name NX9K(config-if)# fabric forwarding mode anycast-gateway
The distributed anycast gateway in a VXLAN EVPN fabric gives every leaf the same gateway IP and MAC address for a subnet. On a Cisco Nexus 9000 switch, fabric forwarding anycast-gateway-mac sets a single virtual MAC that is shared globally on every leaf. Each tenant SVI is then placed in its tenant VRF with vrf member and enabled for the anycast gateway with fabric forwarding mode anycast-gateway. Configured identically on all leaf switches, this lets hosts keep the same default gateway wherever they attach or move, which is the stated requirement for VXLAN routing.
Why the other options are wrong
- B. install feature-set fabric and feature-set fabric are not used on Nexus 9000 for this purpose, and the SVI is not placed in a tenant VRF for VXLAN routing.
- C. This adds install feature-set fabric and feature-set fabric, which are not part of the Nexus 9000 anycast gateway configuration.
- D. This omits vrf member on the SVI, so the gateway is not placed in the tenant VRF that VXLAN routing uses.
Question 30
Which action must be performed before renumbering a Cisco UCS chassis?
Show answer and explanation
Correct answer: C. Decommission the chassis.
Cisco UCS Manager assigns a chassis its ID when the chassis is discovered and acknowledged, and that ID cannot be changed while the chassis is in service. To renumber a chassis, the engineer must first decommission it, which removes it from the UCS Manager inventory. The chassis can then be recommissioned and assigned the new chassis ID. Decommissioning is therefore the required action before renumbering.
Why the other options are wrong
- A. Shutting and reenabling the server ports only retriggers link and discovery events; the existing chassis ID is retained.
- B. Moving the chassis cabling to different fabric interconnect ports does not by itself change the chassis ID and can cause discovery issues.
- D. Reacknowledging rediscovers links and connectivity for the chassis but keeps the same chassis ID.
Question 31
An engineer configured an environment that contains the vPC and non-vPC switches. However, it was noticed that the downstream non-vPC switches do not receive the same STP bridge ID from the upstream vPC switch peers. Which vPC feature must be implemented to ensure that vPC and non-vPC switches receive the same STP bridge ID from the upstream vPC switch peers?
Show answer and explanation
Correct answer: B. peer-switch
The peer-switch feature makes both vPC peers appear as a single spanning tree root by using the vPC system MAC address as the bridge ID. Both peers then send BPDUs with the same root bridge ID on vPC and non-vPC ports alike, so downstream switches, whether dual-attached through a vPC or single-attached, see one consistent root. This also avoids spanning tree reconvergence if the vPC primary switch fails.
Why the other options are wrong
- A. Role priority only influences which peer becomes vPC primary; it does not make the peers present a common STP bridge ID.
- C. system-mac sets the vPC domain MAC used for LACP; without peer-switch, each peer still uses its own STP bridge ID.
- D. peer-gateway lets each peer route packets sent to the other peer's router MAC; it has no effect on spanning tree.
Question 32
A customer wants to offload some of its order processing to a public cloud environment. The customer environment is based on Cisco ACI and uses Puppet with containerized applications. The operations team requires a solution to orchestrate and optimize the cost of the new solution. Which product must be used to meet these requirements?
Show answer and explanation
Correct answer: B. Cisco CloudCenter
Cisco CloudCenter orchestrates the deployment and management of applications across on-premises data centers and public clouds. It models an application once and deploys it to the chosen environment, integrates with Cisco ACI, supports configuration tools such as Puppet and containerized workloads, and provides cost reporting and optimization. That combination fits a customer moving order processing into a public cloud while needing both orchestration and cost control.
Why the other options are wrong
- A. Cisco Workload Optimization Manager focuses on resource and placement optimization; it does not orchestrate application deployment to the public cloud.
- C. Cisco Intersight is a management platform for Cisco infrastructure such as UCS and HyperFlex, not an application orchestrator for public cloud.
- D. Cisco Data Center Network Manager manages data center network and SAN fabrics, not cloud application orchestration or cost.
Question 33
An engineer enters these commands while in EEM on a Cisco Nexus 9000 Series Switch: event manager applet Backup-config event timer watchdog time 1800 name timer event cli match "copy running-config startup-config" What is the result of applying this configuration?
Show answer and explanation
Correct answer: D. It blocks the copy running-config startup-config command.
In NX-OS EEM, an applet that matches a CLI command intercepts that command, and the command runs only if the applet includes the action event-default. This applet, Backup-config, ends with event cli match "copy running-config startup-config" and has no actions configured, so when a user enters copy running-config startup-config, the policy matches it and the default action of executing the command is never taken. As a result, the configuration blocks the copy running-config startup-config command.
Why the other options are wrong
- A. An applet without actions is accepted by the CLI; it simply performs nothing beyond intercepting the matched event.
- B. Without action event-default, the matched command is not executed.
- C. No action in the applet copies the running configuration, so nothing is saved every 1800 seconds.
Question 34
An engineer must design an automation solution for the Cisco ACI Fabric to speed up the deployment of logical network elements for tenant provisioning. When creating a solution, the engineer must keep in mind that the tool must support these requirements: Allow the rapid creation and removal of logical containers. Support the creation of custom modules and data structures. Be extensible with external libraries and modules. Allow rapid testing of code using an on-demand execution environment. Which automation tool meets these requirements?
Show answer and explanation
Correct answer: D. Python
Python fits every requirement. Scripts can call the APIC REST API, or use Cisco libraries built on it, to create and delete tenants, VRFs, bridge domains and EPGs quickly. Python lets the engineer define custom modules, classes and data structures, and it is extended with external libraries installed through standard package tools. Because Python is interpreted, code can be tested immediately in the interactive interpreter or a notebook, giving the on-demand execution environment the team needs for rapid testing.
Why the other options are wrong
- A. SaltStack is a configuration management platform built around a master and minions, not a general programming environment for custom data structures and on-demand testing.
- B. YAML is a data serialization format, not a programming language, so it cannot create custom modules or execute code on its own.
- C. Chef is an agent-based configuration management tool using Ruby recipes, not a flexible language for custom ACI modules and rapid interactive testing.
Question 35
A network architect is asked to design and manage geographically distributed data centers across cities and decides to use a Multi-Site Orchestrator deployment. How many orchestrators should be deployed?
Show answer and explanation
Correct answer: B. 3
Cisco ACI Multi-Site Orchestrator is deployed as a cluster of three nodes. The three-node cluster provides redundancy and keeps the orchestrator database consistent, so the cluster continues to operate if a single node fails. The nodes can be placed in different locations as long as the latency requirements between them are met, which suits a design spanning geographically distributed data centers. The orchestrator then manages the APIC clusters of every site from a single point, independent of how many sites are added.
Why the other options are wrong
- A. Five orchestrator nodes is not a supported cluster size; the orchestrator cluster is built from three nodes.
- C. Four nodes is not the supported cluster size and an even member count adds no resiliency over three.
- D. Two nodes cannot form the supported orchestrator cluster and would not tolerate a node failure while keeping a majority.
Question 36
Which communication method does NFS use for requests between servers and clients?
Show answer and explanation
Correct answer: B. RPC
NFS is built on the Remote Procedure Call framework. A client sends file operations such as lookup, read and write to the server as RPC requests, and the server returns the results as RPC replies. The data in those messages is encoded with XDR so that different platforms interpret it the same way, but RPC is the mechanism that carries the requests between clients and servers.
Why the other options are wrong
- A. SMB is a separate file sharing protocol used mainly by Windows systems, not the request mechanism of NFS.
- C. SSC is not the mechanism NFS uses to exchange requests between clients and servers.
- D. XDR is the data encoding format used inside NFS RPC messages, not the communication method that carries the requests.
Question 37
Which server policy is used to install new Cisco IMC software on a server?
Show answer and explanation
Correct answer: B. host firmware policy
In Cisco UCS Manager, server firmware is applied through a host firmware policy (host firmware package) referenced by the service profile. The policy lists the firmware versions for server components such as the adapters, BIOS, storage controller and Cisco IMC. When the service profile is associated, or when the policy is updated, UCS Manager installs and activates those versions on the server, so the host firmware policy is how new Cisco IMC software is installed on a server.
Why the other options are wrong
- A. UCS Manager has no hypervisor firmware policy; hypervisor software is installed by the operating system process, not by a server policy.
- C. A BIOS policy configures BIOS settings such as tokens and boot options; it does not install firmware.
- D. UCS Manager does not have a Cisco IMC software policy; Cisco IMC firmware is delivered through the host firmware policy.
Question 38
What is required for using Ansible with HTTP/HTTPS protocol in a Cisco NX-OS environment?
Show answer and explanation
Correct answer: D. NX-API
When Ansible manages Cisco NX-OS devices over HTTP or HTTPS, it sends its requests to the NX-API interface on the switch. NX-API exposes CLI and model-driven operations through a REST-style web service, so it must be enabled with feature nxapi before Ansible can use the HTTP-based connection. Without NX-API, the switch has no HTTP or HTTPS endpoint to accept the automation calls, and Ansible would have to fall back to SSH-based CLI access instead.
Why the other options are wrong
- A. The XML management interface is accessed over SSH using NETCONF-style XML, not through HTTP or HTTPS calls from Ansible.
- B. SSH is used for CLI-based Ansible connections, not for the HTTP or HTTPS transport the stem describes.
- C. Open Agent Container hosts agents such as Puppet or Chef on the switch and is not needed for Ansible over HTTP or HTTPS.
Question 39
The FCoE technology is used in a data center and the MDS switches are configured as Fibre Channel Forwarders. Which configuration should be applied to an MDS switch in order to be used as the BEST switch for the CNAs in the fabric to connect to?
Show answer and explanation
Correct answer: B. fcoe fcf-priority 0
During FIP discovery a CNA collects advertisements from all available Fibre Channel Forwarders and logs in to the one with the best priority. The FCF priority is a value from 0 to 255 in which a lower number is preferred, and the default is 128. Configuring fcoe fcf-priority 0 gives the switch the highest possible priority, so the CNAs in the fabric select it as the best FCF to connect to.
Why the other options are wrong
- A. 512 is outside the valid FCF priority range of 0 to 255, so it cannot make the switch preferred.
- C. Removing the command returns the switch to the default priority of 128, which does not make it the best choice.
- D. 1024 is outside the valid FCF priority range of 0 to 255, and higher values are less preferred in any case.
Question 40
A UCS B-Series server located in B5108 chassis 1 slot 1 is currently unavailable. The server needs to be associated with a specific service profile when it becomes available. Which associate service profile option should be selected to accomplish this goal?
Show answer and explanation
Correct answer: D. custom server
When associating a service profile, UCS Manager offers several choices for where it should land. The Custom Server option lets the administrator enter a specific chassis ID and slot, here chassis 1 slot 1, rather than picking from the list of currently available servers. If no usable server is present in that location, the association is held and completes automatically when the server becomes available. This meets the requirement of binding the profile to that exact blade position even though the server is currently unavailable.
Why the other options are wrong
- A. Restrict migration is a check box that prevents the profile from moving to another server; it does not specify the target blade.
- B. Selecting a server pool lets UCS Manager pick any qualifying server from the pool, not the specific blade in chassis 1 slot 1.
- C. The Server option lists only servers that are available now, so an unavailable blade cannot be selected.
Question 41
An engineer must configure multiple EPGs on a single access port in a large Cisco ACI fabric without using VMM integration. The relevant access policies and tenant policies have been created. A single AAEP is used to configure the access ports in the fabric. Which two additional steps must be taken to complete the configuration? (Choose two.)
Show answer and explanation
Correct answer: C, E. The EPGs must be configured as static ports; The EPGs must be linked to the correct physical domain
Without VMM integration, EPGs are bound to access ports manually. Each EPG must be associated with the physical domain that is linked to the AAEP and VLAN pool used on those ports, which authorizes the EPG to use those VLANs on that interface. Each EPG is then deployed on the access port with a static port binding that specifies the encapsulation VLAN, so several EPGs can share one port by using different VLANs. In a large fabric, using static ports is more targeted than mapping EPGs to the AAEP itself.
Why the other options are wrong
- A. Linking EPGs directly to the AAEP deploys them on every interface using that AAEP, which is unsuitable when a single AAEP serves the whole fabric.
- B. Contracts control communication between EPGs but are not needed to deploy multiple EPGs on an access port.
- D. Legacy mode changes how a bridge domain handles VLANs and does not enable multiple EPGs on one access port.
Question 42
What is an advantage of using Ansible for automation as compared to Puppet and Chef?
Show answer and explanation
Correct answer: A. Ansible performs automation without installing a software agent on the target node.
Ansible is agentless: the control node connects to managed devices over existing transports such as SSH or, for Cisco NX-OS, NX-API and NETCONF, and executes tasks without any software agent installed on the target. Puppet and Chef traditionally require an agent on each managed node that communicates with a central server. Not having to install, maintain and secure an agent simplifies onboarding network devices and is the key advantage of Ansible in this comparison.
Why the other options are wrong
- B. Abstracting configuration across operating systems is also achieved by Puppet and Chef through their resource models, so it is not an Ansible-specific advantage.
- C. Puppet and Chef also automate and continuously enforce configuration state, so this is not something that distinguishes Ansible.
- D. Sending CLI commands does not use NETCONF, and the transport choice is not what sets Ansible apart from Puppet and Chef.
Question 43
What is a benefit of independent resource scaling in Cisco HyperFlex hybrid architecture?
Show answer and explanation
Correct answer: B. flexible expansion of compute, caching, and capacity
Cisco HyperFlex hybrid clusters let resources grow independently. Compute-only nodes can be added when more processing power is needed without buying storage, cache drives can be sized for performance, and capacity drives or converged nodes can be added when more storage is needed. This avoids the rigid scaling of systems where every expansion adds a fixed amount of compute and storage together, so the benefit is flexible expansion of compute, caching and capacity to match workload demand.
Why the other options are wrong
- A. Remote booting of servers is a deployment option, not the benefit that independent resource scaling provides.
- C. HyperFlex converged nodes are Cisco UCS servers; independent scaling does not mean mixing hardware from multiple vendors.
- D. Compute nodes in HyperFlex consume storage from the HyperFlex cluster itself; independent scaling is not about attaching third-party storage.
Question 44
A POAP-enabled Cisco Nexus switch will not enter POAP mode. Which two conditions should be verified? (Choose two.)
Show answer and explanation
Correct answer: A, B. No startup configuration is available; The switch is in bootup process.
A Cisco Nexus switch enters POAP mode only when it boots and finds no startup configuration. During the bootup process the switch checks for a startup configuration, and if none exists it starts POAP to locate a DHCP server and download its script, image and configuration. If a startup configuration is present, or the switch is not going through a boot, POAP does not start. Verifying that no startup configuration is available and that the switch is in the bootup process addresses the two conditions that trigger POAP.
Why the other options are wrong
- C. POAP does not depend on a license file, so a missing license does not prevent the switch from entering POAP mode.
- D. The POAP script is downloaded from a server during the process; no special POAP directory with poap.py is needed on bootflash.
- E. The switch needs a bootable NX-OS image to run POAP at all, so a missing image is not a condition for entering POAP mode.
Question 45
What is a feature of NFS?
Show answer and explanation
Correct answer: B. Kerberos-based security model
NFS is a file-level network storage protocol, and its security model can use Kerberos through the RPCSEC_GSS framework, which is standard in NFSv4. Kerberos provides strong mutual authentication of users, clients and servers, and can add integrity checking and encryption of NFS traffic. This replaces the weaker host-based trust used by early NFS versions, in which the server simply trusted the user and group identifiers sent by the client machine. Kerberos-based security is therefore a defining feature of NFS in modern deployments.
Why the other options are wrong
- A. Zone-based access control describes Fibre Channel zoning in a SAN fabric, not NFS.
- C. NFS provides file-level access to shared directories; block-based access is characteristic of Fibre Channel, FCoE and iSCSI.
- D. Role-based access control governs administrative privileges on devices such as Nexus and MDS switches, not NFS client access.
Question 46
An engineer needs to create a new user in the local user database on Cisco UCS Fabric Interconnect. The user needs permissions to change the following configuration inside UCS Manager version 3.1: • vNIC and vHBA profiles • Fan speed and power redundancy profile of UCS Manager Which two roles must be assigned to a user to achieve this goal? (Choose two.)
Show answer and explanation
Correct answer: A, D. facility-manager; server-profile
Cisco UCS Manager uses predefined roles that bundle privileges. The server-profile role grants the right to configure service profiles and their components, including vNIC and vHBA definitions and the related policies. The facility-manager role carries the power management privileges, so it allows changes to the power redundancy policy and related environmental settings such as fan speed. Assigning both roles to the local user covers both requirements without granting broad administrative rights.
Why the other options are wrong
- B. server-equipment covers physical server hardware operations, not vNIC and vHBA profile settings or power redundancy policy.
- C. operations covers system logs, Call Home and fault management rather than service profile or power and fan policies.
- E. server-compute is a limited role for server compute tasks and does not provide the vNIC, vHBA or power policy rights required.
Question 47
An engineer is configuring AAA authentication on a Cisco MDS 9000 Series switch. The LDAP server is located under the IP 10.10.2.2. The data sent to the LDAP server should be encrypted. Which command should be used to meet these requirements?
Show answer and explanation
Correct answer: D. ldap-server host 10.10.2.2 enable-ssl
On a Cisco MDS 9000 Series switch, an LDAP server is defined with the ldap-server host command followed by the server address. Adding the enable-ssl keyword makes the switch use SSL/TLS for the LDAP session, so the bind credentials and other data exchanged with 10.10.2.2 are encrypted. The command ldap-server host 10.10.2.2 enable-ssl therefore defines the server and secures the communication in one step, meeting both requirements.
Why the other options are wrong
- A. The ldap-server command requires the host keyword, and port 443 is the HTTPS port, not a setting that turns on LDAP encryption.
- B. The host keyword is missing, and a key is not the mechanism that encrypts LDAP sessions on MDS switches.
- C. Configuring a key does not enable SSL/TLS for the LDAP session, so the data sent to the server is not encrypted by this command.
Question 48
An engineer must build a lab replica of a Cisco UCS production environment. The file must be imported into a new Cisco UCS cluster using a Cisco UCS Manager GUI. The file must be in XML format and be exported from Cisco UCS Manager using an encrypted method. Which two configuration parameters should be selected to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: D, E. Type: All configuration; Protocol: SCP
Cisco UCS Manager offers several backup types, and only the configuration backups (All configuration, System configuration and Logical configuration) are written as XML files that can be imported into another UCS domain through the GUI. All configuration captures both the system and logical settings, which is what a complete lab replica of production needs. For the transfer, SCP runs over SSH and encrypts the file in transit, satisfying the encrypted-method requirement. Together, Type: All configuration and Protocol: SCP produce an importable XML file that is exported securely.
Why the other options are wrong
- A. A full state backup is a binary snapshot of the entire system meant for disaster recovery restores, not an XML file that is imported into a new cluster.
- B. Logical configuration is XML but contains only service profiles, policies, pools, VLANs and VSANs, leaving out the system settings a full replica needs.
- C. TFTP sends the file in clear text over UDP and provides no encryption, so it fails the encrypted export requirement.
Question 49
A Cisco Nexus 9000 Series Switch experiences a startup configuration corruption. The engineer must implement a procedure to recover the backup configuration file from the switch. Which command set must be used?
Show answer and explanation
Correct answer: A. 1. Clear the current configuration of the switch 2. Restart the device 3. Copy a previously saved configuration file to the running-configuration 4. Copy the running-configuration to the startup configuration
To recover from a corrupted startup configuration on a Cisco Nexus 9000 switch, the engineer first clears the existing configuration (write erase) and restarts the device so it comes up clean. A previously saved configuration file is then copied into the running configuration, restoring the known-good settings. Finally, the running configuration is copied to the startup configuration so the recovered configuration persists across the next reload. This order ensures the backup is applied to a clean device and then saved.
Why the other options are wrong
- B. This sequence saves the empty running configuration to startup before restoring the backup, so the recovered settings are never saved.
- C. Saving running to startup first preserves the problem configuration, and the restored backup is again never written to startup.
- D. This sequence never restores the saved backup file; it only exports and then saves the current configuration.
Question 50
An engineer is asked to manage a large-scale data center and collect information from multiple Cisco NX-OS devices using the Cisco NX-OS Data Management Engine model. Which technology should be used to accomplish this goal?
Show answer and explanation
Correct answer: C. NX-API REST
Cisco NX-OS stores its configuration and operational state in the Data Management Engine (DME), an object model organized as a management information tree. NX-API REST exposes that DME object model directly over HTTP or HTTPS, so each managed object can be read or changed with standard REST calls using its distinguished name or class. Because it is a programmatic, model-based interface, a script or controller can query many NX-OS switches the same way and collect information at scale, which matches the requirement to use the DME model.
Why the other options are wrong
- A. NETCONF is an XML-based configuration protocol carried over SSH that works with YANG data models, not a direct REST interface to the DME object model.
- B. NX Yang refers to the Cisco native YANG models used by NETCONF, RESTCONF and gNMI, not the interface that exposes the DME object model.
- D. JSON-RPC is a message format supported by NX-API CLI for sending CLI commands, not a model-based interface to the DME.
Question 51
An engineer must implement an automation solution to allow the backup of the configuration of Cisco Nexus Series Switches to a centralized location. The solution must: support the team-developed custom monitoring scripts that are packaged using RPM packaging that the framework must support. be decoupled from the underlying Cisco Nexus operating system. have no impact on the operating system of the underlying switch if resource contention occurs. use Python to expand the existing automation framework. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Guest Shell
Guest Shell is a secure Linux container (CentOS based) that runs on Cisco Nexus switches and is decoupled from the host NX-OS. Its CPU, memory and storage are limited through Linux control groups, so resource contention inside the container does not affect switch operation. It includes Python and a package manager that installs RPM packages, so team-built monitoring scripts packaged as RPMs can be deployed there. Python in Guest Shell can also run NX-OS commands, letting the team back up configurations to a central location.
Why the other options are wrong
- B. Vegas Shell is not a Cisco Nexus application hosting environment and offers no isolated container for RPM-based scripts.
- C. Bash Shell runs directly on the underlying NX-OS Linux, so it is not decoupled from the operating system and resource use can affect the switch.
- D. TCL Shell runs Tcl scripts within the NX-OS CLI, so it does not provide a separate Python environment that supports RPM packages.
Question 52
An engineer is performing an ISSU upgrade on the Cisco MDS 9000 Series Switch. What is the impact on the control plane of the switch?
Show answer and explanation
Correct answer: A. It is down for less than 80 seconds.
A nondisruptive in-service software upgrade on a Cisco MDS 9000 switch keeps the data plane forwarding Fibre Channel traffic while the software is replaced. The control plane, however, is briefly unavailable while the new software takes over, and Cisco states that this interruption lasts less than 80 seconds. During that time the switch keeps forwarding frames but cannot process control traffic, which is why the fabric should be stable, with no configuration changes or topology events, while the upgrade runs.
Why the other options are wrong
- B. The control plane interruption during a nondisruptive upgrade is less than 80 seconds, not a period between 80 and 140 seconds.
- C. The control plane comes back as part of the upgrade itself and does not wait for a later reboot.
- D. The control plane is briefly down during the upgrade; it is the data plane that keeps forwarding throughout.
Question 53
A network engineer plans to upgrade the firmware of a Cisco UCS B-Series chassis by using the Auto Install feature. Which component is upgraded during the infrastructure firmware upgrade stage?
Show answer and explanation
Correct answer: C. I/O Modules
Auto Install in Cisco UCS Manager upgrades firmware in two stages. The infrastructure firmware stage uses the infrastructure bundle to upgrade UCS Manager, the fabric interconnects and the I/O modules in the chassis. The later server firmware stage uses host firmware packages to update the components inside each server. Of the components listed, only the I/O modules belong to the infrastructure stage.
Why the other options are wrong
- A. Adapter firmware is part of the server firmware stage, applied through host firmware packages.
- B. Cisco IMC firmware on the blades is updated during the server firmware stage, not the infrastructure stage.
- D. BIOS firmware is a server component updated through the host firmware package in the server firmware stage.
Question 54
An engineer installed a new Nexus switch with the mgmt0 interface in vrf management. Connectivity to the rest of the network needs to be tested from the guest shell of the NX-OS. Which command tests connectivity from the guest shell of the NX-OS?
Show answer and explanation
Correct answer: B. [guestshell@guestshell ~]$ chvrf management ping 173.37.145.84
The Guest Shell is a Linux container, and NX-OS VRFs are exposed to it as Linux network namespaces. By default Guest Shell commands run in the default VRF, so reaching the network through mgmt0 requires running the command in the management namespace. The chvrf utility does exactly that: chvrf management ping 173.37.145.84 executes the standard Linux ping inside the management VRF, testing connectivity through the management interface directly from the Guest Shell.
Why the other options are wrong
- A. dohost passes a command to the NX-OS CLI rather than testing from the Guest Shell, and ping vrf management followed by the address is not valid NX-OS ping syntax.
- C. This is NX-OS CLI ping syntax; the Linux ping utility in the Guest Shell has no vrf keyword.
- D. iping is not a Guest Shell command, so this line does not run a connectivity test in the management VRF.
Question 55
An engineer configures the properties of a Cisco UCS Cisco Integrated Management Controller network adapter for a standalone Cisco C-Series Server. Failback Timeout in the vNIC was set to 600. When the failure occurs, the secondary interfaces must be used and then failback when the primary interface becomes available again. Which action must be taken to meet these requirements?
Show answer and explanation
Correct answer: C. Enable Uplink Failover.
On a Cisco VIC adapter in a standalone C-Series server managed by Cisco IMC, Enable Uplink Failover lets a vNIC move its traffic to the secondary uplink port when the primary port fails. The Failback Timeout value, here 600, defines how long the vNIC waits after the primary port becomes available again before returning traffic to it. The timeout only has an effect when uplink failover is enabled, so enabling Uplink Failover is the action that delivers both failover and failback.
Why the other options are wrong
- A. A default VLAN controls untagged traffic on the vNIC; it does not provide failover to a secondary interface.
- B. Class of service marks traffic priority and has no role in switching traffic between primary and secondary uplinks.
- D. Disabling VNTAG mode changes how virtual interfaces are tagged and does not enable failover or failback behavior.
Question 56
Which two statements describe the process of upgrading an EPLD on a Cisco MDS 9000 Series Switch? (Choose two.)
Show answer and explanation
Correct answer: C, E. An upgrade verification identifies the impact of each EPLD upgrade; EPLDs are capable of being upgraded without replacing the hardware.
EPLDs are programmable logic devices on MDS 9000 modules, and their logic is changed in the field by loading a new EPLD image, so new functions and fixes are delivered without replacing the hardware. Before committing, the administrator can run an upgrade verification that compares the running and new EPLD versions for each module and reports the impact of each upgrade, including which modules are disrupted. This lets the upgrade be planned for a maintenance window and limited to the modules that need new EPLD versions.
Why the other options are wrong
- A. The version installed comes from the EPLD image file the administrator specifies, so the upgrade is not restricted to the newest EPLD release.
- B. The module being upgraded is taken out of service and reloaded to load the new EPLD logic, so its operation is interrupted during the upgrade.
- D. EPLDs can be upgraded on individual modules by specifying the module, so all modules do not need to be upgraded together.
Question 57
An engineer must implement FCoE on the Cisco Nexus 9000 Series Switch-based infrastructure. The deployment will contain dual-homed fabric extenders and must support jumbo frames with port channels. Which two sets of actions complete the configuration? (Choose two.)
Show answer and explanation
Correct answer: A, D. Create a virtual Fibre Channel Interface. Bind vFC to physical interface; Execute fcoe enable-fex. Configure FEX uplinks with mtu 9216.
Two pieces complete this design. First, every FCoE attachment needs a virtual Fibre Channel interface bound to the physical Ethernet or port-channel interface that carries the FCoE traffic, so a vFC is created and bound. Second, because the hosts sit behind dual-homed fabric extenders, FCoE must be enabled toward the FEX with the fcoe enable-fex command, and the FEX uplinks must use a jumbo MTU of 9216 so full-size FCoE frames, which exceed a standard 1500-byte Ethernet frame, pass across the port channels without being dropped.
Why the other options are wrong
- B. Nexus 9000 interfaces use a maximum MTU of 9216, not 9516, and disabling NPIV does nothing to enable FCoE through fabric extenders.
- C. VSANs are not bound to FEX uplinks; FCoE traffic is mapped through a VLAN-to-VSAN mapping and vFC interfaces instead.
- E. Switch profiles with config sync are a configuration synchronization tool and are not a required step to enable FCoE with jumbo frames.
Question 58
An engineer must implement a Cisco UCS system at a customer site. One of the requirements is to implement SAN boot. The storage system maps the source WWPN to a unique LUN. Which method does Cisco recommend to configure the SAN boot?
Show answer and explanation
Correct answer: B. Create a SAN boot policy in which every initiator is mapped to a different target LUN.
With SAN boot, each server must reach its own boot LUN, and the storage array here maps every source WWPN to a unique LUN. In Cisco UCS this is handled with a SAN boot policy in the service profile that lists the vHBAs as primary and secondary boot devices and specifies the target WWPN and LUN for each one. Mapping each initiator to its own target LUN ensures every server boots its own operating system image, matching the array's per-WWPN masking and preventing servers from sharing or corrupting a boot volume.
Why the other options are wrong
- A. Leaving the boot target empty gives the vHBA no array WWPN and LUN to boot from, so the server cannot locate its boot volume.
- C. Default boot target values do not point to the array's WWPN and the unique LUN mapped to each initiator, so boot would fail.
- D. Pointing every initiator at the same boot LUN contradicts the array's unique per-WWPN mapping and would have servers sharing one operating system volume.
Question 59
An engineer must configure the Cisco IMC server management NIC for autonegotiation. Which setting should be selected?
Show answer and explanation
Correct answer: C. dedicated
Cisco IMC can be reached through several NIC modes. Autonegotiation of the management link speed and duplex is supported only when the NIC mode is set to dedicated, which uses the server's dedicated 1-Gb management port. In the shared modes, the management traffic rides on a port whose characteristics are governed by the host, so the speed and duplex cannot be autonegotiated by Cisco IMC.
Why the other options are wrong
- A. Shared LOM sends management traffic over the host LOM ports, and autonegotiation is not available in this mode.
- B. Cisco card mode uses ports on an installed Cisco VIC, which does not provide autonegotiation for the management NIC.
- D. Shared LOM EXT shares the LOM and Cisco card ports with the host, so autonegotiation is not offered.
Question 60
An engineer needs to implement a solution that prevents loops from occurring accidentally by connecting a switch to interface Ethernet1/1. The port is designated to be used for host connectivity. Which configuration should be implemented?
Show answer and explanation
Correct answer: A. switch# configure terminal switch(config)# interface Ethernet1/1 switch(config-if)# spanning-tree bpduguard enable
BPDU Guard is the protection designed for host-facing ports. When spanning-tree bpduguard enable is applied to Ethernet1/1, the port is placed in the error-disabled state as soon as it receives a BPDU, which is exactly what happens if someone plugs a switch into a port meant for a server or workstation. Shutting the port down immediately stops the unexpected switch from joining the topology and creating a bridging loop. Hosts never send BPDUs, so legitimate end devices are unaffected.
Why the other options are wrong
- B. Loop guard prevents alternate or root ports from moving to forwarding when BPDUs stop arriving; it does not block a switch attached to a host port.
- C. spanning-tree loopguard default is a global command enabling loop guard on point-to-point links, not an interface-level protection against a connected switch.
- D. BPDU filter stops sending and processing BPDUs on the port, which can hide a connected switch and allow a loop to form.
Question 61
Which statement is true about upgrading the firmware on a Cisco MDS storage switch with dual supervisors?
Show answer and explanation
Correct answer: B. The new firmware is loaded on the standby supervisor first.
On a Cisco MDS switch with dual supervisors, the nondisruptive upgrade process loads the new image on the standby supervisor first. Once the standby is running the new software and is synchronized, a switchover makes it the active supervisor, and the former active supervisor is then upgraded and returns as the new standby. Because one supervisor is always in control, the data plane keeps forwarding throughout the process and the upgrade is nondisruptive.
Why the other options are wrong
- A. Both supervisors must run the same software for high availability, so they are not upgraded independently as a test mechanism.
- C. The supervisors are not upgraded simultaneously; the standby is upgraded first and a switchover occurs before the original active is upgraded.
- D. The standby supervisor must be online and in HA standby state for a nondisruptive upgrade, not taken offline.
Question 62
A Cisco UCS C-Series server is installed at a data center. The server should be managed by the Cisco UCS Manager by using a single cable for management and data traffic. Which configuration should be applied after the physical connection is established?
Show answer and explanation
Correct answer: D. UCS-A# scope server 1 UCS-A /server# scope cimc UCS-A /server/cimc # scope mgmt-conn sideband UCS-A /server/cimc/mgmt-conn # set mgmt-conn-state enabled UCS-A /server/cimc/mgmt-conn* # commit-buffer
Single-wire management lets a UCS Manager integrated C-Series server carry both data and management traffic over the same cable to the fabric interconnect, using the sideband connection of the adapter. Rack servers are addressed in the UCS Manager CLI as servers, so the configuration enters scope server 1, then scope cimc, then scope mgmt-conn sideband. In that mode set mgmt-conn-state enabled turns on the sideband management connection, and commit-buffer applies the pending change. This sequence uses the correct object path and the required set keyword.
Why the other options are wrong
- A. This version tries mgmt-conn-state directly without the set keyword and stays in the cimc mode instead of the sideband mgmt-conn mode, so the command is not accepted.
- B. This version scopes a chassis instead of the rack server and omits the set keyword, so it does not configure the C-Series server.
- C. This version scopes a chassis and skips the scope mgmt-conn sideband step, so the management connection state cannot be set.
Question 63
An engineer must use the Embedded Event Manager to monitor events that occur on a Cisco Nexus 9000 Series Switch. An environment variable needs to be created so that several policies use the monitored events in their actions. The external email server is represented by IP address 10.10.10.10. Which command sets the environment variable?
Show answer and explanation
Correct answer: B. n9k2(config)# event manager environment mailserver "10.10.10.10"
EEM environment variables are defined in global configuration mode with the event manager environment command, followed by the variable name and its value. Entering event manager environment mailserver "10.10.10.10" at the n9k2(config)# prompt creates a variable named mailserver that holds the email server address. Because the variable is global, any number of EEM policies can reference it in their actions, so the server address is maintained in one place instead of being repeated in each applet.
Why the other options are wrong
- A. This command is entered at the privileged EXEC prompt, where EEM environment variables cannot be configured.
- C. Applet configuration mode defines events and actions for one applet; environment variables are not created there.
- D. event manager policy is used to register script-based policies and does not accept an environment keyword to define variables.
Question 64
Which two configuration settings are available in the Cisco UCS Firmware Auto Sync Server policy? (Choose two.)
Show answer and explanation
Correct answer: C, E. User Acknowledge; No Action
The Firmware Auto Sync Server policy determines what happens when a newly discovered server's firmware does not match the default host firmware package. It offers two settings. User Acknowledge holds the firmware synchronization until an administrator acknowledges the pending activity, giving control over when the server is updated. No Action means the server firmware is not synchronized automatically and is left as it is. These are the only two values the policy provides.
Why the other options are wrong
- A. Immediate Action is not a setting of this policy; immediate versus acknowledged behavior applies to maintenance policies, not firmware auto sync.
- B. User Notification is not an option; the policy requires acknowledgement rather than simply informing the user.
- D. Delayed Action is not one of the policy settings; the choices are only User Acknowledge and No Action.
Question 65
An engineer requires a solution to automate the configuration and deployment of remote network devices for a customer. The engineer must keep these considerations in mind: The customer's environment is based on industry-accepted standards and requires a solution that meets these standards. The security requirements mandate the use of a secure transport mechanism between the automation software and target devices such as SSH or TLS. The solution must be implemented using a human-readable language and provide the functionality to format data in XML or JSON. Which solution must be used to meet these requirements?
Show answer and explanation
Correct answer: A. Ansible
Ansible meets every consideration. It is an open source automation framework that works with industry-standard transports and interfaces, connecting to network devices over SSH or using secure APIs over HTTPS with TLS, so the security mandate is satisfied. Playbooks are written in YAML, a human-readable language, and Ansible can send and parse structured data in XML or JSON through its network modules and filters. This lets the engineer automate the configuration and deployment of remote devices from a single control node.
Why the other options are wrong
- B. A REST API is an interface exposed by a device, not a complete automation solution written in a human-readable language for deploying many devices.
- C. NETCONF is a configuration protocol that encodes data in XML only and is not itself an automation tool with a human-readable playbook language.
- D. SNMP is mainly a monitoring protocol, does not run over SSH or TLS and does not format data in XML or JSON.
Question 66
An engineer must perform an initial configuration of VXLAN Tunnel End-Point functionality on the Cisco Nexus 9000 Series platform. All the necessary features are already enabled on the switch. Which configuration set must be used to accomplish this goal?
Show answer and explanation
Correct answer: A. NX9K(config)# interface loopback0 NX9K(config-if)# ip address 10.10.10.11/32 NX9K(config)# interface VLAN10 NX9K(config-if)# ip unnumbered loopback0 NX9K(config)# interface nve1 NX9K(config-if-nve)# source-interface loopback0
A VTEP on a Cisco Nexus 9000 switch is represented by the NVE interface, and its tunnel source is a loopback that is reachable through the underlay. This configuration creates loopback0 with 10.10.10.11/32, lets interface VLAN10 borrow that address with ip unnumbered loopback0, and creates interface nve1 with source-interface loopback0. The NVE interface then uses the loopback address as the outer source IP for all VXLAN encapsulated traffic, which is the core of the initial VTEP setup.
Why the other options are wrong
- B. Nexus 9000 VTEP functionality is configured under an nve interface; interface overlay0 is not the VXLAN VTEP interface, and source-interface is wrongly placed under VLAN10.
- C. A tunnel interface with tunnel source builds a generic IP tunnel such as GRE, not a VXLAN VTEP, and no NVE interface is configured.
- D. This creates the NVE interface but applies ip unnumbered to physical Ethernet 1/1, which on Nexus 9000 also requires point-to-point medium settings not shown, so the set is incomplete.
Question 67
A network engineer is deploying a Cisco All-Flash HyperFlex solution. Which local storage configuration is required for the operating system and persistent logging?
Show answer and explanation
Correct answer: D. two solid state drives
Each Cisco HyperFlex All-Flash converged node uses two solid state drives outside the capacity tier for its own operation. One SSD is the boot drive that holds the hypervisor operating system, and a separate housekeeping SSD stores the HX Data Platform logs and other persistent system data. Keeping these functions on dedicated SSDs separates them from the caching and capacity drives used by the distributed storage cluster. The required local storage for the operating system and persistent logging is therefore two solid state drives.
Why the other options are wrong
- A. A single SSD cannot cover both roles; the design uses one drive for boot and a second dedicated drive for logging.
- B. HyperFlex All-Flash nodes use solid state drives for these system functions, not two spinning SATA drives.
- C. One SATA drive provides neither the solid state media nor the separate boot and logging drives the design requires.
Question 68
Which solution provides remote and direct file-level access to users and systems?
Show answer and explanation
Correct answer: C. network-attached storage
Network-attached storage is a dedicated file server connected to the IP network that shares its file systems with clients through file protocols such as NFS and SMB/CIFS. Users and systems mount or map those shares and work with whole files and directories, so access is file level, and because the storage sits on the network it can be reached remotely by any authorized client. This combination of remote reach and direct file-level access is what defines NAS.
Why the other options are wrong
- A. Direct-attached storage is connected to a single server and is not remotely shared over the network by itself.
- B. Fibre Channel over Ethernet carries block-level Fibre Channel traffic over Ethernet; it does not provide file-level access.
- D. A storage area network gives servers block-level access to LUNs, not file-level access to shared files.
Question 69
A Cisco MDS 9000 Series Storage Switch has reloaded unexpectedly. Where does the engineer look for the latest core dump file?
Show answer and explanation
Correct answer: D. /mnt/pss
Cisco MDS 9000 switches keep persistent state information in the /mnt/pss partition on the supervisor, which survives a reload. When a process crash or unexpected reload occurs, the most recent core dump is saved there so it can be retrieved after the switch comes back up and copied off the switch for analysis by Cisco TAC. An engineer investigating an unexpected reload therefore looks in /mnt/pss for the latest core dump file.
Why the other options are wrong
- A. The /mnt/recovery path is not where the switch stores its most recent core dump.
- B. The /mnt/core path is not the location used for the latest core dump on an MDS supervisor, despite its name.
- C. Log files are kept separately from core dumps, so /mnt/logs is not where the latest core dump is found.
Question 70
A customer asks an engineer to develop a framework that will be used to replace the process of the manual device configuration of Cisco NX-OS devices. The engineer plans to use the programmatic interface that meets these requirements: The development team is familiar with a Windows-based scripting environment using PowerShell. The customer's security requirements mandate the use of HTTPS transport. Which solution must be used to meet these requirements?
Show answer and explanation
Correct answer: B. NX-API
NX-API exposes the NX-OS CLI and data model through HTTP or HTTPS, accepting requests and returning structured JSON or XML. Because it is a web interface, any language that can issue HTTP requests can drive it, including PowerShell with cmdlets such as Invoke-RestMethod on a Windows workstation. Enabling the HTTPS transport satisfies the security requirement, so the development team can replace manual device configuration with scripts written in the environment they already know, without installing anything on the switch beyond enabling the feature.
Why the other options are wrong
- A. NETCONF with YANG models runs over SSH sessions rather than HTTPS, so it does not satisfy the stated transport requirement.
- C. Visore is the APIC managed object browser used to view the ACI object model, not an interface for configuring NX-OS devices.
- D. Open Agent Container is an on-switch environment for hosting agents such as Puppet or Chef, not an HTTPS programmatic interface for PowerShell scripts.
Question 71
What is the impact of an EPLD upgrade on a Cisco MDS 9000 Series Switch?
Show answer and explanation
Correct answer: C. The upgrade process disrupts only the module that is being upgraded.
EPLD images program the hardware logic devices on individual modules of a Cisco MDS 9000 switch. During an EPLD upgrade, the module being upgraded is taken out of service while its devices are reprogrammed and is then reloaded, so traffic through that module is interrupted. Other modules continue to forward traffic, and modules can be upgraded one at a time to keep the rest of the switch in service. The disruption is therefore limited to the module being upgraded.
Why the other options are wrong
- A. The standby supervisor is not reloaded repeatedly; an EPLD upgrade reprograms the selected module and reloads that module once.
- B. Traffic on the active supervisor and on other modules is not disrupted; only the module being upgraded is affected.
- D. Management connectivity stays available through the active supervisor while a module EPLD upgrade runs.
Question 72
An engineer is implementing FCoE. Which aspect of DCBXP on a Cisco Nexus switch affects this implementation?
Show answer and explanation
Correct answer: A. It requires that LLDP transmit and LLDP receive are enabled on the FCoE interface.
The Data Center Bridging Exchange protocol on Cisco Nexus switches is carried inside LLDP frames. DCBX uses LLDP TLVs to advertise and negotiate settings such as priority flow control, enhanced transmission selection and the FCoE application priority with the connected adapter. If LLDP transmit or LLDP receive is disabled on the interface, DCBX cannot exchange these parameters and FCoE cannot come up correctly, so both LLDP transmit and receive must be enabled on the FCoE interface.
Why the other options are wrong
- B. Cisco Fabric Services synchronizes state between vPC peer switches; DCBX exchanges parameters with the directly connected device over LLDP.
- C. DCBX negotiates capabilities and does not authenticate peers.
- D. DCBX is used on lossless 10-Gigabit and faster Ethernet links that carry FCoE, not on 10/100-Mbps ports.
Question 73
Which feature must be enabled to support the use of JSON and XML encodings when a Cisco Nexus 7000 Series Switch is deployed?
Show answer and explanation
Correct answer: B. NX-API
NX-API lets a client send commands to a Cisco Nexus switch over HTTP or HTTPS and receive structured responses. It supports XML and JSON encodings, including JSON-RPC, so external tools and scripts can parse output programmatically instead of screen-scraping CLI text. On a Cisco Nexus 7000 Series Switch the capability is disabled by default and is turned on with the feature nxapi command, after which the switch accepts NX-API requests in XML or JSON.
Why the other options are wrong
- A. Bash shell gives access to the underlying Linux environment for scripting; it does not provide an API that exchanges XML or JSON encoded requests.
- C. Open Agent Container is a hosting environment for third-party agents such as Puppet or Chef, not the feature that supplies XML and JSON encodings.
- D. LLDP is a link-layer neighbor discovery protocol and has no role in programmatic access with JSON or XML.
Question 74
Which product includes prebuilt templates that are available to be used to customize fabric deployments?
Show answer and explanation
Correct answer: B. Cisco Data Center Network Manager
Cisco Data Center Network Manager includes a library of prebuilt templates for fabric deployment. Fabric templates such as Easy Fabric for VXLAN EVPN, along with interface, policy and configuration templates, let administrators customize settings like underlay routing, replication mode and addressing, then have DCNM generate and push consistent configuration to the switches. Users can also edit these templates or create their own, making DCNM the product that uses prebuilt templates to customize fabric deployments.
Why the other options are wrong
- A. Cisco Tetration provides workload visibility, analytics and segmentation policy, not fabric deployment templates.
- C. Cisco ACI is driven by the APIC policy model with tenants and profiles, not by prebuilt fabric deployment templates.
- D. Cisco UCS Manager uses service profile templates for servers, not templates for building network fabrics.
Question 75
A company is investigating different options for IT automation tools. The IT team has experience with Python programming language and scripting using a declarative language. The proposed tool should be easy to set up and should not require installing an agent on target devices. The team will also need to build custom modules based on the Python programming language to extend the tool's functionality. Which automation tool should be used to meet these requirements?
Show answer and explanation
Correct answer: A. Ansible
Ansible is agentless: the control node connects to managed devices over SSH or APIs, so nothing has to be installed on the targets and setup is simple. Playbooks are written in YAML, a declarative and human-readable format that describes the desired state. Ansible itself is written in Python and is designed to be extended, so the team can write custom modules in Python to add functionality. These characteristics match the team's existing Python and declarative scripting skills.
Why the other options are wrong
- B. Chef relies on agents installed on managed nodes and uses Ruby-based recipes, which conflicts with the agentless and Python-based requirements.
- C. Puppet typically requires an agent on each managed node and uses its own declarative language based on Ruby, not Python modules.
- D. NX-API is a programmatic interface on Nexus switches, not a general automation tool with declarative playbooks and custom modules.
Question 76
Which command reduces the amount of time it takes to complete the ISSU on a Cisco Nexus 7000 Series Switch that has dual supervisor modules and two I/O modules?
Show answer and explanation
Correct answer: B. install all kickstart <image> system <image> parallel
An in-service software upgrade on a Nexus 7000 with dual supervisors is started with install all kickstart <image> system <image>. By default the I/O modules are then upgraded one after another, so the total upgrade time grows with every line card. Adding the parallel keyword tells the installer to upgrade the I/O modules at the same time, which shortens the overall ISSU while the supervisors still switch over in the normal hitless sequence. With two I/O modules in the chassis, upgrading them together noticeably reduces the time needed to finish the process.
Why the other options are wrong
- A. This line upgrades EPLD images rather than the kickstart and system software of an ISSU, so it does not shorten the NX-OS software upgrade.
- C. This starts a standard ISSU, but without the parallel keyword the I/O modules are upgraded serially, so it does not reduce the upgrade time.
- D. This upgrades the programmable logic devices on the modules, which is a separate and disruptive operation, not the ISSU of the NX-OS software.
Question 77
Which statement describes monitoring Fibre Channel traffic on a Cisco UCS 6332 Fabric Interconnect?
Show answer and explanation
Correct answer: B. Fibre Channel traffic is capable of being monitored as it is encapsulated as FCoE.
Inside a Cisco UCS domain, Fibre Channel traffic from server vHBAs is carried between the servers and the fabric interconnect as FCoE. Because of this encapsulation, a Cisco UCS 6332 fabric interconnect can monitor that traffic with an Ethernet traffic monitoring session, and the analyzer at the Ethernet destination port receives it as FCoE. This makes it possible to capture and analyze storage traffic even though the traffic originates as Fibre Channel.
Why the other options are wrong
- A. Monitoring sessions are not limited to a single vHBA per server; multiple sources can be added to a session.
- C. Monitoring is not restricted to the default VSAN; traffic from configured VSANs can be monitored.
- D. The destination does not have to be an unassigned Fibre Channel port; an Ethernet destination receives the traffic as FCoE.
Question 78
An engineer must configure a monitoring solution for a Cisco Nexus 9000 Series Switch based data center. The solution must provide real-time insight into the network health with subscription-based monitoring. The monitoring must be initiated from the client side, and the data must be sent via encryption. Which configuration steps complete the configuration?
Show answer and explanation
Correct answer: D. Enable GRPC on the Nexus switch. Generate a certificate. Configure gNMI inputs in Telegraf and output to InfluxDB.
Subscription-based, real-time telemetry that the client initiates is the dial-in model: an external collector opens a gNMI session to the switch and subscribes to the paths it wants. On a Cisco Nexus 9000 switch this requires the gRPC agent to be enabled, and a certificate must be generated and installed so that the gRPC session runs over TLS and the data is encrypted. On the collector side, Telegraf is configured with the gNMI input plugin pointing at the switch and subscription paths, and it writes the received data to InfluxDB for storage and visualization. These steps meet every requirement in the scenario.
Why the other options are wrong
- A. Grafana is a visualization tool that runs on a server, not on the Nexus switch, and syslog export is neither subscription based nor client initiated.
- B. A sensor group and destination define dial-out telemetry, where the switch initiates the session toward the collector rather than the client.
- C. SNMPv3 polling is a periodic pull mechanism, not a subscription-based real-time streaming model.
Question 79
A network architect must redesign a data center network based on OSPFv2. The network must perform fast reconvergence between directly connected switches. Which two actions must be taken to meet the requirements? (Choose two.)
Show answer and explanation
Correct answer: A, C. Set low OSPF hello and DEAD timers; Enable BFD for failure detection.
Fast reconvergence depends first on how quickly a switch notices that its directly connected neighbor has failed. Lowering the OSPF hello and dead timers shortens the time before an unresponsive neighbor is declared down, so OSPF starts recalculating routes sooner. Enabling Bidirectional Forwarding Detection goes further: BFD runs a lightweight, rapid hello mechanism between the directly connected switches and notifies OSPF of a failure in subsecond time, independent of the OSPF timers. Together, aggressive OSPF timers and BFD provide quick failure detection, which is the key element of fast convergence between neighboring switches.
Why the other options are wrong
- B. Placing every link in area 0 is a design choice about area hierarchy; it does not make failure detection between neighbors any faster.
- D. Point-to-point network type removes DR election, but by itself it does not speed up detection of a failed neighbor the way faster timers and BFD do.
- E. A virtual link connects a disconnected area to the backbone across a transit area; it is a repair for area design and does not improve convergence.
Question 80
What happens to the default host firmware policy after a Cisco UCS Manager upgrade?
Show answer and explanation
Correct answer: B. It is replaced by a new default policy without any firmware entries.
When Cisco UCS Manager is upgraded, the default host firmware policy is recreated as a new policy named default that contains no firmware entries. UCS Manager assigns this empty default policy to service profiles that do not already include a host firmware policy, so those servers are not automatically upgraded or downgraded as a side effect of the infrastructure upgrade. An administrator must explicitly add firmware versions to a host firmware policy before server components are changed.
Why the other options are wrong
- A. The default policy applies to service profiles that do not include a host firmware policy, not to those that already reference one.
- C. The default policy is not synchronized with any existing host firmware policy; it is created empty.
- D. The new default policy has no firmware entries, so it does not list firmware for every component.
Question 81
Which two statements describe the process of performing an EPLD upgrade on a Cisco MDS 9000 Series Switch? (Choose two.)
Show answer and explanation
Correct answer: B, E. The upgrade process disrupts only the module that is being upgraded; Modules must be online to be upgraded.
EPLD images on an MDS 9000 are upgraded module by module. Only the module whose EPLDs are being written is affected: it is taken out of service and reloaded to run the new logic, while the other modules keep forwarding traffic, so the disruption is limited to that module. The installer can only reach modules that are powered up and recognized by the supervisor, so a module must be online before its EPLDs can be upgraded. A module that is offline or powered down has to be brought online first, otherwise the upgrade skips it.
Why the other options are wrong
- A. The EPLD upgrade is driven from the active supervisor, which runs the install command; the standby supervisor does not perform the upgrade for the switch.
- C. Although the install command is entered on the active supervisor, the EPLD images are written to the target modules rather than to the active supervisor, so the upgrade is not performed on the active supervisor itself.
- D. An EPLD upgrade that is interrupted does not resume automatically; the upgrade of that module must be started again.
Question 82
A customer needs a tool to take advantage of the CI/CD model to streamline its operations and optimize cost. The customer wants to integrate the solution with the Cisco products it currently uses, including Cisco ACI networking and Cisco UCS Series servers. The solution should also provide on-premises Kubernetes and AppDynamics performance monitoring. Because of the security requirements, the solution should not install a local client on products under management. Which orchestration solution meets these requirements?
Show answer and explanation
Correct answer: B. Cisco CloudCenter
Cisco CloudCenter is an application-centric hybrid cloud management and orchestration platform that supports CI/CD pipelines, deploying applications consistently across data center and cloud environments. It integrates with Cisco ACI and Cisco UCS, supports on-premises Kubernetes deployments, and works with AppDynamics for application performance monitoring, while also providing cost visibility and optimization. Its orchestration works through APIs, so it does not require a local client on the managed products, meeting the security requirement.
Why the other options are wrong
- A. Cisco UCS Director automates infrastructure provisioning but is not an application-centric CI/CD platform with Kubernetes and AppDynamics integration.
- C. Cisco APIC is the controller for the ACI fabric itself and does not orchestrate applications across servers and clouds.
- D. Cisco DCNM manages and monitors data center networks and SANs, not application lifecycle, CI/CD or cost optimization.
Question 83
Which two authentication types does Cisco UCS Manager support when configuring authentication? (Choose two.)
Show answer and explanation
Correct answer: B, E. local; LDAP
Cisco UCS Manager authenticates users either against its own local user database or against a remote authentication service. Local authentication uses accounts created directly in UCS Manager, which also serve as a fallback for console access. For remote authentication, UCS Manager supports LDAP, RADIUS and TACACS+ providers, which are grouped into provider groups and referenced by authentication domains or the default authentication setting. Local and LDAP are therefore both valid authentication types when configuring UCS Manager authentication.
Why the other options are wrong
- A. PAM is a Linux framework for pluggable authentication modules, not an authentication realm that can be selected in UCS Manager.
- C. 802.1X is port-based network access control for endpoints, not a method for authenticating UCS Manager users.
- D. Kerberos is not one of the authentication realms offered by UCS Manager, which uses local, LDAP, RADIUS and TACACS+.
Question 84
A new employee must be granted access to add VLANs into an existing Cisco UCS Manager and configure NTP synchronization with date and time zone settings. Which two privileges must be granted to the employee to complete the task? (Choose two.)
Show answer and explanation
Correct answer: B, E. Ext LAN Policy (ext-lan-policy); Ext LAN Config (ext-lan-security)
Cisco UCS Manager role-based access control groups tasks into privileges. Adding VLANs to the fabric is an external LAN task covered by the Ext LAN Policy privilege (ext-lan-policy). NTP providers, date and time zone settings are covered by the ext-lan-security privilege, which is the keyword shown in option E. Granting both privileges lets the new employee create VLANs and configure time synchronization without receiving rights over service profiles or server compute settings, keeping the access limited to what the task requires.
Why the other options are wrong
- A. Service Profile Compute covers server compute settings inside service profiles, such as boot and BIOS-related policies, not VLAN creation or NTP.
- C. Service Profile Network Policy covers network policies applied to service profiles, not the global VLAN list or time synchronization settings.
- D. Service Profile Config allows creating and modifying service profiles themselves, which is unrelated to adding VLANs or setting NTP and time zone.
Question 85
Which NFS version uses the TCP protocol and needs only one IP port to run the service?
Show answer and explanation
Correct answer: D. NFSv4
NFSv4 was designed to be firewall friendly: it runs over TCP and consolidates its functions, including mounting and file locking, into a single protocol that listens on one well-known port, TCP 2049. Earlier versions depended on several auxiliary services such as the portmapper, mountd and the network lock manager, each using its own port and often dynamic port assignments, and they commonly ran over UDP. Because only one TCP port is needed, NFSv4 is much simpler to permit through firewalls and access lists than its predecessors.
Why the other options are wrong
- A. NFSv1 was an internal prototype that was never released for public use, so it does not describe a single-port TCP service.
- B. NFSv2 typically runs over UDP and relies on separate helper services such as portmapper and mountd on additional ports.
- C. NFSv3 added TCP support but still depends on separate services such as portmapper, mountd and the lock manager, so it needs more than one port.
Question 86
An engineer must create an EPG called "Test". The configuration request should succeed if the Tenant called "Tenant" and the application profile called "Test" exist. The firewall policy allows only the HTTP connectivity to APIC from the user's computer. Which action accomplishes this goal?
Show answer and explanation
Correct answer: B. Send <fvAEPg dn="uni/tn-Tenant/ap-Test/epg-Test" status="created"/> to APIC payload using HTTP POST to the Cisco APIC.
In the ACI object model, an EPG sits under an application profile, which sits under a tenant, so the distinguished name must be uni/tn-Tenant/ap-Test/epg-Test, with single slashes between each relative name. The APIC REST API creates and modifies objects with HTTP POST, and the payload is sent over HTTP as the firewall allows. Because the parent tenant and application profile already exist, posting the fvAEPg object with status="created" succeeds and builds the Test EPG in the right place.
Why the other options are wrong
- A. This payload uses double slashes and places the EPG before the application profile, and it relies on HTTP PUT rather than the POST method the APIC uses for configuration.
- C. This payload swaps the names, targeting tenant Test and an EPG called Tenant, so it does not create EPG Test under tenant Tenant.
- D. This payload swaps the tenant and EPG names, uses double slashes and is sent with HTTP PUT, so it fails on several counts.
Question 87
Which method must a network engineer use to upgrade the BIOS firmware of a Cisco UCS standalone C-Series rack-mount server?
Show answer and explanation
Correct answer: B. Use the Cisco host upgrade utility.
For a standalone Cisco UCS C-Series rack server that is not managed by Cisco UCS Manager, the Cisco Host Upgrade Utility is the tool used to upgrade server firmware, including the BIOS, the Cisco IMC and adapter firmware. The utility is supplied as an ISO image that is booted on the server, typically through the KVM virtual media, and it updates the components to a consistent, supported set of versions.
Why the other options are wrong
- A. There is no U-ACPI interface for upgrading Cisco server firmware.
- C. Cisco does not provide a hardware upgrade utility; the firmware tool is the Host Upgrade Utility.
- D. A host firmware policy is used by Cisco UCS Manager for managed servers, not for a standalone C-Series server.
Question 88
What is required for using Puppet in a Cisco NX-OS environment?
Show answer and explanation
Correct answer: D. Open Agent Container
Puppet uses an agent on each managed device that communicates with the Puppet server. On Cisco NX-OS platforms that support it, the Open Agent Container provides a separate Linux environment on the switch in which third-party agents such as the Puppet agent are installed and run without affecting the NX-OS processes. The agent inside the container then retrieves its catalog from the Puppet server and applies the configuration to the switch, so the Open Agent Container is the component required for Puppet.
Why the other options are wrong
- A. OpenNP is not a Cisco NX-OS component that Puppet requires for its agent.
- B. The XML management interface provides XML-based access over SSH and does not host the Puppet agent.
- C. NX-API provides HTTP-based programmatic access used by tools such as Ansible, but Puppet needs an environment to run its agent on the switch.
Question 89
A Cisco UCS user called "Employee1" accidentally changed the boot policy of the Cisco UCS server at the Cisco UCS Manager root level. This change impacted all service profiles, and their storage connectivity was lost. The system administrator wants to prevent this issue from recurring in the future. The new security policy mandates that access must be restricted up to the organization level and prevent other users from modifying root policies. Which action must be taken to meet these requirements?
Show answer and explanation
Correct answer: B. Assign users to a specific Cisco UCS locale
In Cisco UCS Manager, roles define what a user can do, while locales define where in the organization hierarchy those privileges apply. A locale maps a user to one or more organizations, so the user can modify only objects inside those suborganizations and their children. A user assigned to a locale cannot change policies at the root organization, which prevents a repeat of an edit to a root boot policy that affected every service profile. Assigning users to specific locales therefore restricts access up to the organization level as the security policy requires.
Why the other options are wrong
- A. Changing privileges controls which types of objects a user may modify, but without a locale the user can still change those objects at the root level.
- C. Network-operator is not a fitting role here, and any role alone still applies across the whole organization tree including root.
- D. A custom role only regroups privileges; it does not limit the organizational scope where those privileges can be exercised.
Question 90
A network engineer repeatedly saves a configuration on Catalyst switches to NVRAM using the write memory command. Which action should be taken to implement the same action on Nexus switches?
Show answer and explanation
Correct answer: B. Use the wri command to use the copy running-config startup-config command.
On Cisco Nexus switches the configuration is saved to the startup configuration with the copy running-config startup-config command; NX-OS does not use the Catalyst-style write memory syntax for this. An engineer who is used to typing a short write command can use the abbreviated wri form, which maps to the copy running-config startup-config operation, so the running configuration is preserved across a reload in the same way write memory preserves it on a Catalyst switch.
Why the other options are wrong
- A. Creating an alias is not required to save the configuration; the shortcut that maps to copy running-config startup-config is the expected method here.
- C. Leaving configuration mode with exit does not save anything; changes stay only in the running configuration until explicitly copied.
- D. write memory is Catalyst IOS syntax and is not the NX-OS command for saving the running configuration.
Question 91
An engineer must perform a backup operation of the Cisco UCS system. The backup must be transferred to a secure location using UDP and must contain information about VLANs, VSANs, and other policies. Also, the operations team requires the backup file to be in a human-readable format. Which configuration set meets these requirements?
Show answer and explanation
Correct answer: C. Type: Logical configuration Protocol: TFTP
A Logical configuration backup in Cisco UCS Manager is an XML file, so it is human readable, and it contains service profiles, VLANs, VSANs, pools and policies, which matches the content requirement. TFTP is the only listed transfer protocol that runs over UDP, satisfying the transport requirement. Combining Type: Logical configuration with Protocol: TFTP produces a readable file holding the VLAN, VSAN and policy information and moves it to the backup location using UDP.
Why the other options are wrong
- A. All configuration is XML, but FTP runs over TCP, so it does not meet the UDP requirement.
- B. Full state is a binary file that is not human readable, and SFTP runs over TCP.
- D. System configuration holds settings such as users, roles and management configuration rather than VLANs and VSANs, and SCP uses TCP.
Question 92
A network engineer must prevent data corruption due to cross fabric communication in an FCoE environment. Which configuration must be applied to the Cisco Nexus Unified Switches to achieve this objective?
Show answer and explanation
Correct answer: C. switch(config)# fcoe fcmap 0e.fc.2a
The FC-MAP value forms the upper 24 bits of the fabric-provided MAC addresses that an FCoE forwarder assigns to its ENodes. By giving each SAN fabric its own FC-MAP, the Nexus switches in fabric A and fabric B accept only FCoE frames carrying their own prefix, so a host or switch that is wrongly cabled to the other fabric cannot log in and exchange data across fabrics. The global command fcoe fcmap 0e.fc.2a changes the FC-MAP from the default 0e.fc.00 to a fabric-specific value, which is the documented method to prevent cross-fabric data corruption.
Why the other options are wrong
- A. The shutdown lan interface command disables only the Ethernet LAN traffic on a converged port while keeping FCoE up; it does not separate one SAN fabric from another.
- B. FCF priority influences which FCoE forwarder an ENode selects during discovery and is an interface or global setting; removing a priority value does not isolate fabrics.
- D. Removing an FCF priority of 255 only changes forwarder selection preference and does nothing to stop FCoE frames from crossing between fabrics.
Question 93
What are two requirements when planning a Cisco HyperFlex All Flash standard cluster installation using three Cisco HX240c M5 Series servers? (Choose two.)
Show answer and explanation
Correct answer: C, D. The servers must be discovered, unassociated, and connected to each fabric interconnect; If the Jumbo MTU option in the HyperFlex installer is enabled, then jumbo frames must also be enabled on the upstream switches.
A HyperFlex standard cluster is deployed through UCS Manager, so the HX240c M5 servers must be cabled to both fabric interconnects, discovered by UCS Manager and left unassociated, because the HyperFlex installer creates and associates the service profiles itself. The installer can also enable jumbo frames on the HyperFlex networks. If the Jumbo MTU option is chosen, the upstream switches must also be configured for jumbo frames, otherwise large frames between the fabric interconnects and the upstream network would be dropped and cluster traffic such as storage and vMotion would fail.
Why the other options are wrong
- A. Enabling jumbo MTU in the installer only configures the HyperFlex side; upstream switches still need jumbo frames for traffic that crosses them.
- B. An All Flash cluster uses only solid-state drives; mixing HDD and SSD describes a Hybrid cluster.
- E. HX240c M5 nodes boot the hypervisor from an internal M.2 boot drive rather than from FlexFlash SD cards.
Question 94
Port security is enabled on a Cisco MDS 9000 Series Switch. Which statement is true?
Show answer and explanation
Correct answer: C. Auto-learning is always enabled automatically when port security is enabled.
On a Cisco MDS 9000 Series Switch, activating port security for a VSAN automatically turns on auto-learning. With auto-learning enabled, the switch learns the devices that are already logged in, along with the ports they use, and adds them to the active port security database, so existing devices continue to work without manual entries. The administrator can later disable auto-learning to lock the database so that only the learned and configured devices are allowed to log in to the fabric.
Why the other options are wrong
- A. Port security is activated on a per-VSAN basis, so it can be applied to selected VSANs rather than only globally.
- B. Devices already logged in are learned automatically by auto-learning, so they do not have to be added to the database by hand.
- D. Cisco Fabric Services is optional for port security and can be used to distribute the database across switches; it does not have to be disabled.
Question 95
An engineer is duplicating an existing Cisco UCS setup at a new site. What are two characteristics of a logical configuration backup of a Cisco UCS Manager database? (Choose two.)
Show answer and explanation
Correct answer: A, B. contains the configured organizations and locales; contains the VLAN and VSAN configurations
A logical configuration backup of Cisco UCS Manager is an XML file containing the logical settings of the domain, which makes it well suited to duplicating a setup at a new site. It holds the organization hierarchy under which service profiles, pools and policies are defined, and it holds the VLAN and VSAN configurations that connect servers to the LAN and SAN. Importing this file on the new system recreates the same logical structure without carrying over the hardware-specific state of the original domain.
Why the other options are wrong
- C. AAA and RBAC settings such as usernames and roles are part of the system configuration backup, not the logical configuration backup.
- D. Containing every configuration describes the all configuration backup, which combines both system and logical settings.
- E. The logical configuration backup is an XML file, not a .tgz archive.
Question 96
What are two types of FC/FCoE oversubscription ratios? (Choose two.)
Show answer and explanation
Correct answer: B, D. port bandwidth to uplink bandwidth; edge ISL bandwidth to core ISL bandwidth
Oversubscription in FC and FCoE fabrics compares bandwidth that can be offered against the bandwidth available to carry it. At the edge switch, it is the ratio of total host-facing port bandwidth to the uplink bandwidth toward the core. Across the fabric, it is the ratio of edge ISL bandwidth to core ISL bandwidth, which shows whether the core can carry what the edge switches send. Designers size SANs by keeping both ratios within the limits acceptable for the expected workloads.
Why the other options are wrong
- A. Processing power of switches and end nodes is not a bandwidth measure and is not used to express oversubscription.
- C. Storage capacity per end node describes provisioning, not the bandwidth relationship that oversubscription measures.
- E. The relationship between hosts and storage ports describes fan-in and fan-out, not the switch port and ISL bandwidth ratios used as oversubscription types.
Question 97
An engineer performs a set of configuration changes for the vPC domain using Session Manager. Which two commands are used to verify the configuration and apply the device changes when no errors are returned? (Choose two.)
Show answer and explanation
Correct answer: A, B. commit; verify
Session Manager on NX-OS lets an engineer stage configuration changes in a named session and apply them as one batch. The verify command checks the staged configuration against current hardware and software resources and reports any errors without changing the device. When verification succeeds, the commit command applies all the changes in the session to the running configuration; if any part fails, the changes are rolled back so the device is not left partially configured.
Why the other options are wrong
- C. apply is not a Session Manager command; staged changes are applied to the device with commit.
- D. checkpoint creates a rollback snapshot of the running configuration and does not verify or apply a configuration session.
- E. write is not the command for validating or applying a Session Manager session.
Question 98
What is a characteristic of the NFS protocol?
Show answer and explanation
Correct answer: A. It uses remote procedure calls with TCP/IP for transport.
NFS is a distributed file system protocol built on the Open Network Computing remote procedure call framework. A client issues RPCs such as lookup, read and write against files on the server, and those calls are carried over the TCP/IP stack, using TCP in modern implementations and UDP in some older ones. This RPC-over-IP design is what lets NFS present remote files to clients as if they were local, over an ordinary IP network rather than a dedicated storage fabric.
Why the other options are wrong
- B. Cisco UCS B-Series servers boot from local disk, SAN (FC or FCoE), iSCSI or PXE; NFS is not the boot mechanism for them.
- C. NFS provides file-level access to shared files; block-level access to storage arrays is the role of protocols such as Fibre Channel, FCoE and iSCSI.
- D. NFS uses RPC over TCP or UDP and does not use HTTP as a transport.
Question 99
The Cisco Nexus switch Generic Online Diagnostics policy for a PortLoopback test requires 10 consecutive failures to error disable the port. The customer wants to change it to 5 consecutive failures. Which configuration applies the changes for module 1 only?
Show answer and explanation
Correct answer: B. Nexus(config)# event manager applet custom-PortLoopback override __PortLoopback Nexus(config-applet)# event gold mod 1 test PortLoopback testing-type monitoring consecutive-failure 5 Nexus(config-applet)# action 1 publish-default
The system policy __PortLoopback is changed by creating an applet that overrides it, here custom-PortLoopback. The event gold statement then defines the new trigger: mod 1 limits the change to module 1, test PortLoopback with testing-type monitoring selects the runtime health-monitoring test that the policy watches, and consecutive-failure 5 lowers the threshold from 10 to 5 failures. The action line keeps the default handling of the overridden policy, so the port is still error disabled, but now after five consecutive failures on module 1 only.
Why the other options are wrong
- A. This version uses mod all, applying the change to every module, and selects bootup testing instead of the monitoring test that drives the PortLoopback policy.
- C. This version uses mod all, so the new five-failure threshold applies to every module rather than module 1 only.
- D. This version targets module 1 but selects bootup testing, which runs only at startup, instead of the monitoring test used by the PortLoopback policy.
Question 100
When a strict CoPP policy is implemented, which statement describes an event during which packets are dropped?
Show answer and explanation
Correct answer: A. A large system image is copied to a switch by using the default VRF.
Control Plane Policing protects the supervisor by rate limiting traffic destined to the switch itself. A file transfer to the switch over the default VRF uses in-band ports, so every packet of the transfer is punted to the control plane and classified by CoPP. With the strict policy the permitted rates for management protocols are low, and copying a large system image generates a sustained high packet rate that exceeds them, so CoPP drops part of that traffic and the copy slows down or fails. Using the management VRF through the mgmt0 port avoids this.
Why the other options are wrong
- B. Fifteen established SSH sessions generate only light management traffic that stays well within the strict policy rates.
- C. A ping sweep across a network attached through the switch is forwarded in hardware and does not reach the switch control plane.
- D. A DDoS attack against a connected web server is transit traffic forwarded in hardware, so CoPP on the switch does not police it.
Question 101
Which storage protocol reduces file locks by using leasing?
Show answer and explanation
Correct answer: C. NFS 4
NFS version 4 builds file locking into the protocol itself and makes it lease based. When a client obtains a lock, the server grants it for a lease period that the client must renew; if the client crashes or loses contact, the lease expires and the server releases the lock automatically. This prevents stale locks from blocking other clients and removes the need for the separate lock manager used with earlier NFS versions.
Why the other options are wrong
- A. SMB relies on opportunistic locks and caching leases for client-side caching, whereas lease-based expiry of file locks is the defining locking design of NFS version 4.
- B. NFS version 3 is stateless and depends on the separate Network Lock Manager protocol rather than built-in leases.
- D. CIFS, the early SMB dialect, uses opportunistic locks rather than lease-based locking.
Question 102
What is the benefit of adding Cisco HyperFlex Hardware Acceleration Cards to a HyperFlex deployment?
Show answer and explanation
Correct answer: A. increased compression efficiency
Cisco HyperFlex Hardware Acceleration Cards offload data compression from the controller VM CPUs to dedicated hardware. Moving this work to the card improves compression efficiency, which increases the effective storage capacity and frees CPU resources for application workloads. The cards are aimed at storage data optimization rather than graphics, networking or encryption functions.
Why the other options are wrong
- B. The acceleration card does not add network bandwidth; throughput depends on the fabric and the adapters.
- C. GPU acceleration is provided by separate graphics cards, not by the HyperFlex acceleration card.
- D. The card is focused on compression offload rather than offline encryption.
Question 103
Several production and development database servers exist in the same EPG and IP subnet. The IT security policy is to prevent connections between production and development. Which attribute must be used to assign the servers to different microsegments?
Show answer and explanation
Correct answer: C. IP address
Cisco ACI microsegmentation lets an engineer pull endpoints out of a base EPG into uSeg EPGs based on endpoint attributes, and then control traffic between those uSeg EPGs with contracts. Because the production and development database servers share one EPG and one subnet, the attribute that reliably distinguishes each individual server is its IP address. Matching specific host addresses (or small address ranges) places production servers in one microsegment and development servers in another, and the absence of a contract between them blocks the connections that the security policy forbids. The IP attribute works for both virtual and bare-metal servers, so it does not depend on any hypervisor integration.
Why the other options are wrong
- A. Data center is a VMM attribute that groups everything hosted in one vCenter data center, so it cannot separate production and development servers that live together.
- B. VM name applies only to virtual machines learned through a VMM domain and depends on naming conventions, so it is not the attribute that must be used for servers in general.
- D. VMM domain identifies the virtualization integration as a whole, so all servers attached through that domain would match and could not be split into separate microsegments.
Question 104
An engineer updated firmware on Fabric Interconnects and activates it. However, the endpoint fails to boot from the new firmware image. What is expected to occur in this case?
Show answer and explanation
Correct answer: D. The system defaults to the backup image version
Cisco UCS endpoints that support activation keep two firmware images: a running or startup version and a backup version. When new firmware is activated, it becomes the startup version and the previous image is retained as the backup. If the endpoint cannot boot from the newly activated startup version, it falls back to the backup version and UCS Manager raises a fault. This protects the fabric interconnect from being left unbootable by a failed activation, and the administrator can then investigate the image before trying again.
Why the other options are wrong
- A. The kickstart image is part of the firmware being activated, not a separate fallback image used when activation fails.
- B. UCS Manager firmware activation does not fall back to a GOLD image; the retained backup version provides the fallback.
- C. The fallback target is the backup version kept for the endpoint, not a GOLD firmware image.
Question 105
An engineer must modify an overridden policy by changing the number of FCNS database entries to 1500 and then generate a message. What configuration will accomplish this task?
Show answer and explanation
Correct answer: C. event manager applet fcns_policy override __fcns_entries_max_per_switch event fcns entries max-per-switch 1500 action 1.0 syslog priority warnings msg FCNS DB entries have reached the EEM limit
On MDS switches, built-in system policies such as __fcns_entries_max_per_switch are changed by creating an overriding applet. This configuration creates applet fcns_policy with override __fcns_entries_max_per_switch, redefines the trigger with event fcns entries max-per-switch 1500 so the threshold becomes 1500 FCNS database entries, and adds action 1.0 syslog priority warnings msg FCNS DB entries have reached the EEM limit to generate the required message. All three parts needed to modify the overridden policy are present.
Why the other options are wrong
- A. This version defines a new event and syslog action but omits the override statement, so the built-in FCNS policy is not modified.
- B. This version overrides the policy but never sets the 1500-entry event threshold, so the number of FCNS entries is not changed.
- D. This version has neither an override nor an event setting the 1500-entry threshold, and only adds a syslog message with event-default.
Question 106
What is an advantage of NFS as compared to Fibre Channel?
Show answer and explanation
Correct answer: D. NFS provides the dynamic allocation of storage capacity.
NFS presents storage as shared file systems that are managed by the storage server. Because the client sees files and directories rather than a fixed-size block device, the administrator can grow or shrink the exported volume on the array and the change is immediately usable, without resizing LUNs, rescanning HBAs or extending file systems on each host. This dynamic allocation of storage capacity is a practical advantage of NFS over Fibre Channel, where capacity is delivered as LUNs that the host must format and manage.
Why the other options are wrong
- A. NFS runs over TCP/IP, so it adds IP overhead rather than removing it.
- B. Thin provisioning of LUNs is a block storage feature associated with SAN arrays and Fibre Channel, not an NFS capability.
- C. Direct block-level access to the underlying storage describes Fibre Channel; NFS abstracts the storage behind a file service.
Question 107
A DNS server with IP address 192.168.1.1 is deployed in a data center. A network engineer must configure a Cisco UCS Fabric Interconnect to use this DNS. Which configuration should be applied?
Show answer and explanation
Correct answer: D. ficl-mgmt-A# scope system ficl-mgmt-A /system # scope services ficl-mgmt-A /system/services # create dns 192.168.1.1 ficl-mgmt-A /system/services* # commit-buffer
In the Cisco UCS Manager CLI, DNS servers are configured under the system services scope. The engineer enters scope system, then scope services, and runs create dns 192.168.1.1 to add the server, which leaves a pending change marked by the asterisk in the prompt. Running commit-buffer then applies the transaction so the fabric interconnects use 192.168.1.1 for name resolution.
Why the other options are wrong
- A. set name under the fabric-interconnect scope changes the system name, not a DNS server, and the IP address is not a valid name entry.
- B. create dns is not available directly under scope system; DNS servers are created under the services scope.
- C. This sets the fabric interconnect name to an IP address rather than adding a DNS server under system services.
Question 108
Which feature is supported with an In-Service Software Upgrade on a Cisco Nexus 9000 Series Switch?
Show answer and explanation
Correct answer: A. nondisruptive upgrades via nonstop forwarding
In-Service Software Upgrade on a Cisco Nexus 9000 Series Switch upgrades the NX-OS software while the data plane keeps forwarding traffic. The control plane is restarted on the new image and nonstop forwarding keeps existing forwarding state in the hardware while protocols gracefully recover, so the upgrade is nondisruptive to traffic. ISSU is a whole-system operation driven by the install all command, and the switch does not accept configuration changes while the upgrade is in progress. That makes nondisruptive upgrading through nonstop forwarding the feature ISSU delivers.
Why the other options are wrong
- B. Configuration changes are not permitted while an ISSU is running; the configuration must remain stable until the upgrade completes.
- C. ISSU upgrades the system image as a whole through install all rather than offering a selective per-module or per-line-card upgrade feature.
- D. ISSU is designed for nondisruptive upgrades, not for guaranteeing zero-downtime downgrades, and it does not depend on dual supervisors on Nexus 9000 platforms.
Question 109
A host in EPG Client wants to talk to a webserver in EPG Web. A contract with default settings is defined between EPG Client and EPG Web, which allows TCP communication initiated by the client toward the webserver with TCP destination port 80. Which statement describes this scenario?
Show answer and explanation
Correct answer: C. The host in EPG Client is allowed to connect to TCP destination port 80 on the webserver in EPG Web. The webserver will not be allowed to initiate a separate TCP connection to a host port with TCP source port 80.
In ACI, the consumer EPG initiates traffic toward the provider EPG under the terms of the contract. Here EPG Client consumes a contract provided by EPG Web that permits TCP toward destination port 80, so the host can open sessions to port 80 on the webserver. The default subject settings apply the filter in both directions with reversed filter ports, which allows the webserver's replies from port 80 back to the client for those sessions. The contract defines the client as the initiator, so the webserver is not given permission to open its own separate connections toward the host from port 80.
Why the other options are wrong
- A. Preferred group membership permits free communication only when both EPGs are members, so making only EPG Web a member does not remove the need for the contract.
- B. A specific EPG-to-EPG contract takes precedence over rules applied through vzAny, so a vzAny deny contract does not override the existing permit.
- D. The contract lets the client initiate to port 80 and carries the replies; it does not grant the webserver permission to start new connections from port 80.
Question 110
Port security is statically configured on a Cisco Nexus 7700 Series switch and F3 line card. The switch is configured with an Advanced Services license. Which two actions delete secured MAC addresses from the interface? (Choose two.)
Show answer and explanation
Correct answer: A, E. The address must be removed from the configuration; The interface must be converted to a routed port.
On Cisco Nexus 7000 and 7700 Series switches, MAC addresses secured with the static method are stored in the running configuration and do not age out. They are deleted only when the administrator explicitly removes the address from the configuration, or when the interface is converted to a routed port, because port security applies to Layer 2 interfaces and changing to Layer 3 removes the Layer 2 port security settings. Aging and interface state changes affect dynamically learned addresses rather than statically configured ones.
Why the other options are wrong
- B. A shutdown and no shutdown cycle clears dynamically learned secure addresses, but static addresses remain in the configuration.
- C. Static secure addresses are saved in the configuration, so they persist across a restart once the configuration is saved.
- D. Aging applies to dynamically learned secure addresses; statically configured addresses do not age out.
Question 111
An engineer is implementing OTV on a transport that supports multicast. The solution needs to meet the following requirements: • Establish adjacency to the remote peer by using multicast. • Enable OTV advertisements for VLAN 100 to the other site. Which two commands should be configured to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, E. otv extend-vlan 100; otv control-group 232.1.1.1
On a multicast-capable transport, OTV edge devices discover each other and form adjacencies by joining the same multicast control group, configured on the overlay interface with otv control-group 232.1.1.1 in this case. OTV hello and MAC reachability advertisements are carried in that group. Separately, a VLAN is advertised to remote sites only when it is extended over the overlay, so otv extend-vlan 100 is required for the other site to learn MAC addresses in VLAN 100.
Why the other options are wrong
- B. otv site-vlan defines the local site VLAN used to elect the authoritative edge device within a site, not a VLAN extended to the remote site.
- C. otv use-adjacency-server is used when the transport does not support multicast, which is the opposite of this design.
- D. otv data-group defines the SSM range for extending multicast data traffic; it does not form adjacencies or advertise VLAN 100.
Question 112
A Cisco ACI engineer must configure an access port on a Cisco ACI leaf switch. The access policy should be configured so that it supports L3Out connectivity concurrently with several EPGs that are mapped to this interface with the static port method. How should the access policy be configured?
Show answer and explanation
Correct answer: D. with a single Attachable Access Entity Profile that is linked to the corresponding routed domain and physical domain
In Cisco ACI access policies, an interface policy group references exactly one Attachable Access Entity Profile, and the AAEP is the object that links the interface to domains and their VLAN pools. L3Out interfaces require a routed (L3) domain, while EPGs bound with static ports require a physical domain. To support both on the same access port, the single AAEP attached to the interface policy group must be associated with both the routed domain and the physical domain. The L3Out and the EPGs then each reference their own domain, and both can deploy VLANs on that interface.
Why the other options are wrong
- A. An interface policy group can be linked to only one Attachable Access Entity Profile, so it cannot reference multiple AAEPs.
- B. A port selector in an interface profile points to a single interface policy group, so two policy groups cannot be applied to the same port.
- C. An L3Out needs a routed (L3) domain; a physical domain alone serves EPGs with static ports but not the L3Out.
Question 113
An engineer is performing a configuration on a Cisco Nexus 5000 Series Switch. The requirement is for the current Fibre Channel IDs in VSAN 120 to be saved across reboots. The Cisco environment also must integrate with a third-party solution that requires persistent Fibre Channel IDs for the VSAN. The WWN of the Cisco switch must be 33:e8:00:05:30:00:16:df and its Fibre Channel ID 0x070128. Which command set meets these requirements?
Show answer and explanation
Correct answer: A. fcdomain fcid database vsan 120 wwn 33:e8:00:05:30:00:16:df fcid 0x070128 fcdomain fcid persistent vsan 120
Persistent FCIDs keep a device's Fibre Channel ID the same across reboots, which some third-party hosts and operating systems require. The fcdomain fcid database command enters the persistent FCID database, where vsan 120 wwn 33:e8:00:05:30:00:16:df fcid 0x070128 statically binds that WWN to the required FCID in VSAN 120. The fcdomain fcid persistent vsan 120 command enables the persistent FCID feature for the VSAN so the current FCIDs are saved and reused after a reload, meeting both requirements.
Why the other options are wrong
- B. Fabric binding controls which switches may join the fabric by switch WWN and domain ID; it does not make FCIDs persistent.
- C. This version mixes fabric binding activation with a purge for a different VSAN, which neither binds the FCID persistently nor enables persistence for VSAN 120.
- D. This version enters the WWN mapping outside the persistent FCID database and uses preserve rather than the persistent keyword, so it is not a valid persistent FCID configuration.
Question 114
Which two methods are available to manage an ACI REST API session authentication when a user is unauthenticated? (Choose two.)
Show answer and explanation
Correct answer: B, E. GET to aaaListDomains; POST to aaaLogin
Before a session exists, a client can use only methods that do not require a token. A GET to aaaListDomains returns the login domains configured on the APIC, so the client knows which domain to authenticate against, and it works without logging in. A POST to aaaLogin carries the user credentials in an aaaUser object and returns the session token used for all later requests. The other session methods, aaaRefresh and aaaLogout, act on a session that has already been authenticated.
Why the other options are wrong
- A. aaaUserLogin is not an APIC REST API authentication method; the login method is aaaLogin.
- C. aaaRefresh renews the token of an existing session, so it requires the client to be authenticated already.
- D. aaaLogout ends an authenticated session and is sent as a POST, so it neither applies to an unauthenticated user nor uses DELETE.
Question 115
An engineer evaluates a UI-based infrastructure management system capable of monitoring and deploying standalone VXLAN BGP EVPN deployments. The storage administrators also need the solution to manage the Cisco MDS 9000 Series Switches. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Cisco DCNM
Cisco DCNM is a GUI-based management system for Cisco data center networks. Its LAN fabric capabilities provision, deploy and monitor VXLAN BGP EVPN fabrics on Nexus switches, including standalone deployments that do not use ACI. DCNM also has a SAN deployment that manages Cisco MDS 9000 Series Switches, covering VSANs, zoning, device aliases and performance monitoring. A single platform therefore serves both the network engineers running the EVPN fabric and the storage administrators running the Fibre Channel fabric.
Why the other options are wrong
- B. Cisco Tetration provides application visibility and workload security analytics, not provisioning of VXLAN EVPN fabrics or MDS switches.
- C. Cisco UCS Director orchestrates infrastructure workflows across compute, network and storage, but is not the dedicated fabric manager for VXLAN EVPN and MDS SANs.
- D. Cisco Intersight is a cloud operations platform focused on UCS and HyperFlex servers, not the management of standalone VXLAN EVPN fabrics and MDS switches.
Question 116
An engineer must configure OSPF in the data center. The external routes have already been redistributed into OSPF. The network must meet these criteria: The data center servers must reach services in the cloud and the services behind the redistributed routes. The exit point toward the Internet should be propagated only when there is a dynamically learned default route from the upstream router. Which feature is required?
Show answer and explanation
Correct answer: C. default-information originate
The servers must reach both cloud services and the networks behind the redistributed external routes, so the area must keep carrying external routes and cannot be turned into a stub variant. The exit toward the Internet must be advertised only while a default route is learned from the upstream router. The default-information originate command does exactly that: the OSPF router injects a default route into the OSPF domain only if a default route exists in its routing table. If the upstream router stops advertising the default, the OSPF default is withdrawn, so traffic is not attracted to an exit that has no working path.
Why the other options are wrong
- A. A stub area blocks external routes, so data center servers would lose specific reachability to the services behind the redistributed routes.
- B. A totally stubby area blocks external and inter-area routes, replacing them with a default, which removes the redistributed routes the servers need.
- D. Adding always advertises the default route even when no default is learned from upstream, which violates the requirement to advertise it only when it is dynamically learned.
Question 117
An engineer is implementing an import operation in Cisco UCS Manager. What is the impact of performing this operation?
Show answer and explanation
Correct answer: A. Information is modified on the management plane only.
An import operation in Cisco UCS Manager applies configuration information from a previously exported backup file, using either merge or replace. Cisco documents that an import modifies information on the management plane only, and it can be performed while the system is up and running. Some changes made through the management plane, such as a modified vNIC on a service profile, can still lead to actions like a server reboot, but the import itself works on the management plane configuration rather than directly on the data plane.
Why the other options are wrong
- B. Importing a configuration from a higher release into a lower release is not supported.
- C. Import operations cannot be scheduled; only backup operations support scheduling.
- D. A configuration file exported from any Cisco UCS Manager can be imported; it does not have to come from the same system.
Question 118
An engineer is running an ACI fabric, has VMM integration with VMware vCenter, and wants to enable microsegmentation based on vCenter VM attributes. Which statement describes microsegmentation in this scenario?
Show answer and explanation
Correct answer: D. An ACI microsegmented EPG automatically creates a port group with a private VLAN configured on a VMware vCenter distributed virtual switch.
With VMM integration to VMware vCenter, ACI supports microsegmented EPGs (uSeg EPGs) that classify virtual machines by vCenter attributes such as VM name, guest operating system or custom attributes. To make this work on a VMware distributed virtual switch, the APIC programs the port group with a private VLAN configuration, which forces traffic from the virtual machines up to the leaf switch even when they share the same host. The leaf then classifies each endpoint into the correct microsegmented EPG and applies the contracts between EPGs.
Why the other options are wrong
- A. ACI does support microsegmentation based on vCenter VM attributes, such as VM name and guest operating system, in addition to network attributes.
- B. Microsegmentation sends traffic to the leaf for classification and policy enforcement; it does not move switching and routing onto the ESXi hosts.
- C. Attribute-based microsegmentation is also supported with the VMware distributed virtual switch, so it is not limited to AVE or AVS.
Question 119
An engineer is using REST API calls to configure the Cisco APIC. Which data structure must be used within a POST message to receive a login token?
Show answer and explanation
Correct answer: A. {"aaaUser":{"attributes":{"name":"apiuser","pwd":"cisco123"}}}
To obtain a token, the client sends a POST to aaaLogin with an aaaUser object. In JSON, the object class aaaUser is the top-level key, its properties sit under an attributes object, and the name and pwd properties are given as quoted strings, exactly as in {"aaaUser":{"attributes":{"name":"apiuser","pwd":"cisco123"}}}. The APIC validates the credentials and returns a token that is used as the APIC-cookie for later requests.
Why the other options are wrong
- B. This XML is malformed, because name and pwd are written as attribute assignments without an element, so the APIC cannot parse it.
- C. This payload omits the double quotes around keys and string values, so it is not valid JSON.
- D. In APIC XML, name and pwd must be attributes of the aaaUser element, not separate child elements.
Question 120
An engineer is implementing Cisco Intersight in a secure environment. The environment must use LDAP directory service and ensure information integrity and confidentiality. Which two steps must be taken to implement the solution? (Choose two.)
Show answer and explanation
Correct answer: B, C. Add a trusted root LDAP certificate to Cisco Intersight; Enable Encryption for LDAP
To protect the integrity and confidentiality of directory traffic, Cisco Intersight must use LDAP over TLS. Encryption is enabled in the LDAP settings so that bind credentials and directory queries are sent through an encrypted session instead of in clear text. For the TLS session to be trusted, Intersight must validate the certificate presented by the LDAP server, so the trusted root certificate of the authority that signed the LDAP server certificate is added to Intersight. Together these steps provide an encrypted and authenticated connection to the directory.
Why the other options are wrong
- A. A certificate signing request is used to obtain a certificate for Intersight itself, not to secure its connection to the LDAP directory.
- D. Adding a self-signed LDAP certificate does not establish validation through a trusted authority; the trusted root certificate is what Intersight uses to verify the LDAP server.
- E. OAuth tokens relate to API and application authorization and play no part in securing LDAP communication.
Question 121
Which behavior defines streaming telemetry as a push model in Cisco devices?
Show answer and explanation
Correct answer: A. Events and network changes generate telemetry data
Streaming telemetry is a push model because the network device itself originates the data. Rather than waiting for a collector to poll, the switch streams data periodically or when events and network changes occur, sending it to configured receivers as soon as it is generated. That device-initiated, event-driven behavior is what distinguishes telemetry from traditional polling and gives near real-time visibility.
Why the other options are wrong
- B. Clients pulling data from devices describes a polling model such as SNMP, which is the opposite of push.
- C. gRPC and JSON describe transport and encoding choices; they do not define whether the model is push or pull.
- D. Telemetry sends data to collectors for monitoring, not to configure endpoints, and encoding format does not make it push.
Question 122
After a Cisco Nexus 7000 Series Switch chassis replacement, the administrator discovers that all vPC-enabled LACP port channels are reinitialized. The administrator wants to prevent this issue the next time the chassis is replaced. Which two actions must be taken to meet this requirement before the isolated device is reloaded? (Choose two.)
Show answer and explanation
Correct answer: B, C. Set the vPC MAC address to a higher value than the peer; Configure auto-recovery to the disable state on both peers
When a replaced vPC peer comes back online, it must not take over the roles and identifiers that the surviving peer is using, or the vPC LACP port channels are renegotiated. Setting the replacement chassis vPC MAC address to a higher value than the peer keeps the existing switch preferred, so the identity presented to LACP partners stays the same. Disabling auto-recovery on both peers before the isolated device is reloaded prevents the replacement from assuming the primary role and bringing up its vPCs on its own while the peer link is not yet established.
Why the other options are wrong
- A. A higher system-priority value changes the LACP system priority presented to partners, which itself can cause the port channels to renegotiate.
- D. A lower vPC MAC address makes the replacement chassis preferred, so it would take over and disrupt the existing LACP port channels.
- E. Lowering the system-priority on the replacement changes the LACP system identity and favors the new chassis, triggering renegotiation.
Question 123
An engineer must implement a disaster recovery policy for the Cisco UCS infrastructure. The solution must meet these criteria: The Recovery Point Objective must be 48 hours. The backup must use encrypted transmission. The Recovery Time Objective must be 4 hours. Which configuration set must be used in the scheduled backup to meet these requirements?
Show answer and explanation
Correct answer: D. Protocol: SCP Schedule: Daily
A Recovery Point Objective of 48 hours means no more than 48 hours of changes may be lost, so a backup must be taken at least every 48 hours. A daily schedule meets that limit, while weekly or biweekly schedules do not. The backup must also be transmitted encrypted, which rules out FTP and TFTP because they send data in clear text. SCP runs over SSH and encrypts the transfer. A daily SCP scheduled backup also leaves a recent backup file available, which supports restoring within the 4-hour Recovery Time Objective.
Why the other options are wrong
- A. FTP sends data unencrypted, and a biweekly schedule exceeds the 48-hour Recovery Point Objective.
- B. SFTP encrypts the transfer, but a weekly schedule allows up to seven days of data loss, which violates the 48-hour Recovery Point Objective.
- C. TFTP has no encryption, and a biweekly schedule far exceeds the 48-hour Recovery Point Objective.
Question 124
An engineer creates a service profile in Cisco UCS Manager and must assign a policy that reboots blades when changes are applied. The changes must be applied only after user acknowledgment. Which two policies must be configured to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, E. Reboot Policy; Maintenance Policy
In Cisco UCS Manager, a maintenance policy attached to the service profile decides how disruptive changes that need a server reboot are deployed. Within that policy, the reboot policy setting chooses when the blade restarts, and selecting user acknowledgment holds the change as pending until an administrator acknowledges it. Configuring the maintenance policy with a user-ack reboot policy therefore makes the blades reboot to apply changes only after the administrator explicitly approves the pending activity.
Why the other options are wrong
- B. A boot policy defines the boot order and devices for the server, not when changes are applied.
- C. A power control policy sets power capping priority for the blade and has no effect on when changes are deployed.
- D. Global policies cover settings such as chassis discovery and are not attached to a service profile to control reboots.
Question 125
An engineer configures an Intersight Virtual Appliance and must claim over 200 targets. The engineer starts the Claim New Target Procedure. The engineer has prepared this initial comma-separated value file to provision the targets: UCSFI,10.1.1.3,user-1,pwd5516b917 IMC,10.1.1.5/26,user-2,pwdc65b1c43f HX,10.1.2.1/30,user-3,pwd39913690 UCSD,1.1.1.1,user-4,pwd5003e9d5 Which information must be included in the comma-separated value file to provision the targets?
Show answer and explanation
Correct answer: A. target type, hostname or IP address, user name, password
The Intersight Virtual Appliance can claim many targets at once by importing a comma-separated value file. Each line describes one target with four fields in order: the target type (for example UCSFI, IMC, HX or UCSD), the hostname or IP address of the target, the user name and the password used to log in. The file prepared by the engineer follows exactly this pattern, such as UCSFI, 10.1.1.3, user-1 and a password, which lets the appliance connect to and claim each device without entering the targets one by one.
Why the other options are wrong
- B. Location and name are not fields in the claim file; the appliance needs the target type to know which connector to use.
- C. FQDN, AD name and email do not supply the credentials Intersight needs to log in to and claim each target.
- D. Certificates and email addresses are not part of the claim file, and this option leaves out the target type and address that each line needs.
Question 126
Which statement describes the rolling EPLD upgrade on a Cisco MDS 9000 Series Switch?
Show answer and explanation
Correct answer: B. Only the modules that are being upgraded are disrupted.
Upgrading EPLD images on a Cisco MDS 9000 Series Switch requires the affected module to be reloaded, so the operation is disruptive to that module. The upgrade can be performed module by module, and only the modules that are being upgraded are disrupted while the rest of the switch keeps forwarding traffic. This allows the engineer to plan the upgrade around redundant paths and limit the service impact.
Why the other options are wrong
- A. The EPLD upgrade is driven from the active supervisor, not performed by the standby supervisor.
- C. Only the modules selected for upgrade are reloaded; the other modules continue to operate.
- D. EPLD upgrades require the upgraded module to reload, so they are disruptive to that module.
Question 127
An engineer must configure the order in which the server attempts to boot from available boot device types using Cisco IMC. The engineer must change the boot order configuration during the setup and apply the new requirements multiple times. The requirement is to change the Cisco IMC actual boot order so it is different from the configured boot order. Which setting accomplishes this goal?
Show answer and explanation
Correct answer: B. Set the boot configuration directly through BIOS.
Cisco IMC keeps a configured boot order, but the BIOS determines the actual order in which the server tries devices. When the boot configuration is changed directly in the BIOS setup utility, the actual boot order used by the server can differ from the configured boot order shown in Cisco IMC. Setting the boot configuration directly through the BIOS is therefore the way to make the actual boot order differ from the configured one, and it can be repeated during setup as requirements change.
Why the other options are wrong
- A. Booting with the configured boot order keeps the actual order the same as the configured order, which is the opposite of the goal.
- C. UEFI Secure Boot verifies boot loader signatures and is not a way to change boot device order; it requires a supported operating system.
- D. Legacy and precision boot order are separate configuration methods, and making them exclusive does not make the actual order differ from the configured order.
Question 128
What is an advantage of NFSv4 over Fibre Channel Protocol?
Show answer and explanation
Correct answer: A. uses IP transport
NFSv4 is a file-access protocol that runs over standard TCP/IP, so it travels across ordinary Ethernet and routed IP networks using the switches, NICs and operational skills a data center already has. Fibre Channel Protocol needs a dedicated FC fabric with HBAs, FC switches and its own addressing, or an FCoE design that still depends on a lossless Ethernet configuration. Using IP transport lowers cost and complexity and allows access across subnets and sites, which is the clear advantage NFSv4 holds over FCP.
Why the other options are wrong
- B. Fibre Channel already provides strong flow control through buffer-to-buffer credits, so congestion management is not an area where NFSv4 is ahead of FCP.
- C. Fibre Channel fabrics are physically isolated and protected by zoning, LUN masking and port security, so improved security is not a defining advantage of NFSv4 over FCP.
- D. Lossless delivery is a native Fibre Channel property based on credit flow control; NFSv4 over TCP/IP relies on retransmission instead of a lossless fabric.
Question 129
The EPLD update of the supervisor module has been scheduled for several Cisco MDS 9000 Series Switches. What will be the impact of the update?
Show answer and explanation
Correct answer: A. All traffic is stopped for the duration of the EPLD update and the switch is rebooted after the upgrade is completed.
Upgrading the EPLD on a supervisor module reprograms the hardware that the supervisor uses to control the switch, and the new image only takes effect after a reload. On the Cisco MDS 9000 switches in this scenario, the update is disruptive: traffic stops while the supervisor EPLD is programmed, and the switch is rebooted once the upgrade completes. For this reason supervisor EPLD updates are scheduled in a maintenance window.
Why the other options are wrong
- B. Traffic is not carried by a redundant supervisor during the update in this scenario; the update is disruptive and traffic stops.
- C. The impact is not limited to control plane traffic; data traffic stops as well, and the switch reboots rather than staying operational.
- D. A supervisor EPLD update is not hitless here; traffic is interrupted and the switch is reloaded.
Question 130
Which two hypervisors does Cisco HyperFlex support? (Choose two.)
Show answer and explanation
Correct answer: C, E. VMware vSphere; Microsoft Hyper-V
Cisco HyperFlex is a hyperconverged platform that runs the HX Data Platform alongside a hypervisor on each node. Cisco supports HyperFlex clusters running VMware vSphere (ESXi) and Microsoft Hyper-V, with the HX Data Platform controller providing distributed storage to the virtual machines on either hypervisor. These are the two hypervisors offered for HyperFlex deployments.
Why the other options are wrong
- A. OpenStack is a cloud orchestration platform, not a hypervisor supported for HyperFlex clusters.
- B. Citrix XenServer is not a supported hypervisor for Cisco HyperFlex.
- D. Red Hat KVM is not one of the hypervisors offered for Cisco HyperFlex clusters.
Question 131
Which two firmware packages are included in the Cisco UCS C-Series Rack-Mount UCS-Managed Server Software bundle? (Choose two.)
Show answer and explanation
Correct answer: A, B. CIMC; BIOS
The Cisco UCS C-Series Rack-Mount UCS-Managed Server Software bundle carries the firmware that runs on the rack server itself when it is integrated with UCS Manager. It includes the Cisco Integrated Management Controller (CIMC) firmware, which provides the server's management controller, and the BIOS firmware for the server platform, along with adapter and controller images. UCS Manager uses these images through host firmware packages to keep integrated rack servers at a consistent firmware level.
Why the other options are wrong
- C. Power supply firmware is not delivered as a package in the rack-mount server software bundle.
- D. System software for the fabric interconnects is part of the infrastructure bundle, not the rack-mount server bundle.
- E. Third-party drivers and utilities are distributed separately and are not a firmware package within this bundle.
Question 132
Which two statements describe modifying Cisco UCS user accounts? (Choose two.)
Show answer and explanation
Correct answer: A, D. Disabling a user account maintains all of the data in the Cisco UCS Fabric Interconnect; Local user accounts override the same account on a remote authentication server, such as TACACS, RADIUS, or LDAP.
In Cisco UCS Manager, disabling a local user account blocks login but keeps the account and all of its data on the fabric interconnect, so it can be re-enabled later without being recreated. When a local account has the same name as an account on a remote authentication server such as TACACS+, RADIUS or LDAP, the local account takes precedence and its settings override those of the remote account. These two statements describe how modifying user accounts behaves.
Why the other options are wrong
- B. The admin account can log in through the GUI and the CLI, not only over SSH.
- C. Strong passwords in Cisco UCS Manager require a minimum of eight characters, not ten.
- E. Password expiration is optional and configurable; there is no fixed 30-day expiration.
That was 132 of 526.
The full Cisco 350-601 DCCOR pack has all 526 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 263 free as one PDF by email. Get the Half Pack →