350-601 practice questions
Cisco · 350-601 · 300 questions
Original practice questions for the Implementing and Operating Cisco Data Center Core Technologies (DCCOR) exam, covering every domain of the official exam objectives.
This course contains the use of artificial intelligence.
About the 350-601 exam
- Questions
- not published
- Passing score
- not published
- Format
- 120-minute exam associated with CCNP Data Center and CCIE Data Center; languages English and Japanese
Schedule this exam The certification this earns
Exam details published by the vendor, checked 7 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Network (25%) · 75 questions
- A national retailer has VXLAN tunnel endpoints up and OSPF adjacencies in the underlay, but no host MAC routes appear in BGP. The EVPN address family is not activated for the fabric neighbors. Which advertisement stays missing until that address family is turned on?
- A regional hospital sends multicast video from a source that is registered, but receivers on another leaf get no stream. That leaf's unicast route to the source points out a different interface than the one where the multicast packets arrive. Which check is dropping the stream?
- A government agency's vPC pair loses the peer-link, and the peer-keepalive link stays up. What happens to the vPC member ports on the secondary peer, and why?
- A national retailer uses the same anycast gateway IP on every VTEP for one VXLAN segment, but two leaves were built with different anycast gateway MAC addresses. Hosts that move between those leaves cannot use the gateway until ARP times out. What must match on the VTEPs?
- A regional hospital's two Nexus leaf switches exchange OSPFv2 hellos, use the same area, and use the same hello and dead intervals, but the neighbor stays in EXSTART and the databases never sync. Which mismatch should the engineer check first?
- A national retailer's HSRP active router failed, the standby took over, and the original router is back online with a higher priority. Traffic still uses the standby router. Preempt is not configured. Why did the original router remain standby?
- A retail bank port-channel between two Nexus switches never bundles. One side is channel mode active and the other side is mode on. Why does the bundle fail to form?
- A national retailer runs HSRP on a vPC pair. Some gateway-bound frames hash to the standby peer and use the HSRP virtual MAC. Those frames are dropped while peer-gateway is off. Why does enabling peer-gateway fix the forwarding?
- A national retailer's two Nexus switches exchange OSPFv2 hellos, the interface MTU matches, and the hello and dead timers match, but the adjacency never forms. One side of the link is a stub area and the other is not. Which mismatch is stopping the neighbor?
- A game studio runs PIM sparse mode. Receivers send joins, the source is sending, and the unicast route to the source matches the interface where multicast would arrive. No rendezvous point is defined for the group. What is missing?
- A retail bank's leaves already show EVPN routes in BGP, including remote host advertisements, but no VXLAN tunnel forms to one VTEP. The BGP next hop is a loopback that underlay OSPF does not advertise. What is missing?
- A national retailer cabled two ACI leaves directly to each other for extra bandwidth. That link never becomes a fabric port. How should a standard ACI fabric be cabled instead?
- A retail bank bridge domain uses hardware proxy for unknown unicast. A frame arrives for a MAC address that no leaf has learned. How does the fabric handle that frame?
- A game studio built a VLAN pool and a physical domain, and the server port uses an interface policy group. Endpoints still do not come up on those VLANs. The attachable access entity profile on that group does not reference the domain. What should be linked?
- A national retailer has a vCenter VMM domain in ACI. A web EPG is associated only with a physical domain, and no matching port group appears in vCenter. What makes the APIC push that port group?
- A national retailer's VTEPs use the same anycast gateway MAC, and same-subnet bridging works. Routed traffic between two VXLAN subnets in one VRF fails. The leaves use different Layer 3 VNIs for that VRF. What must match?
- A national retailer runs virtual machines at a public cloud provider. Retailer staff install and patch the guest operating systems and the applications, and the provider supplies the infrastructure. Which NIST service model is this?
- A retail bank is building an ACI fabric and has placed the infrastructure VLAN into a tenant VLAN pool so servers can use that VLAN. What is wrong with that plan?
- A retail bank has a new NX-OS system image and an EPLD file on bootflash. The bank wants to know whether installing the system image will reload the switch, and it is not programming EPLDs yet. Which check answers the system-image question?
- A national retailer will add Nexus Dashboard for fabric control and insights on an existing VXLAN network. Which description of the dashboard is correct?
- A game studio saved a known-good checkpoint on a Nexus switch last week and now needs to see how the running configuration drifted, without changing the switch. What should the engineer do?
- Two Nexus switches at a retail bank send OSPFv2 hellos on a link, use the same area, and use the same IP MTU, but no adjacency forms. One side's dead interval was changed and no longer matches. What is keeping the adjacency down?
- A retail bank's management station polls Nexus switches with SNMP, and the poll interval is too coarse for interface counters. The team wants the switches to push those counters on a short cadence. Which method matches?
- A national retailer wants a daily record of which hosts sent the most traffic toward a payment VLAN, including byte counts, without copying every frame to an analyzer. Which record matches?
- A national retailer's vPC pair loses the peer-keepalive, and the peer-link stays up. What happens to the vPC member ports?
- A game studio cabled each new ACI leaf management port to an out-of-band switch and did not uplink those leaves to any spine. The leaves never join the fabric. What is missing?
- A national retailer uses PIM sparse mode for one group. The source and the receivers are up, unicast between them works, and the two leaves list different static rendezvous points for that group. Why does the shared tree fail to form?
- A retail bank's VXLAN hosts on one subnet can reach each other, but they cannot reach a second subnet in the same VRF. One VTEP is missing the Layer 3 VNI for that VRF. What does symmetric routing need?
- A game studio leaf receives EVPN prefixes for a new VRF, but those prefixes are imported into the production VRF. The route target on the new VRF was copied from production. Which value should change so only the new VRF imports them?
- A retail bank's vPC pair runs HSRP. Some hosts address frames to the other peer's own router MAC, and the receiving peer is not routing them locally and forces them toward the peer-link. Which vPC feature lets the receiving peer route them?
- A game studio engineer runs the NX-OS install impact check and it reports the upgrade as disruptive. What happens to forwarding if the install continues?
- A national retailer created a VLAN pool and a physical domain and attached that domain to an EPG. A leaf access port still does not encapsulate the VLAN. The port's policy group uses an AAEP that does not include this domain. What should be linked?
- A retail bank's ACI VMM domain created port groups in vCenter, yet virtual machines on the new port group never reach the fabric. The host ports' AAEP does not include this VMM domain. What is missing?
- Developers at a retail bank deploy only their application code, while the provider runs the runtime and the operating system. Which NIST 800-145 service model matches this split?
- A national retailer saved a checkpoint, then applied a bad change and copied the running configuration to startup. A reload would bring the bad configuration back. What restores the earlier state with the least disruption?
- A national retailer bridge domain uses hardware proxy, and ARP flooding is off. A silent register never transmits, so other servers cannot reach it. Where does unknown unicast for that register go?
- During a broadcast storm, a retail bank engineer suggests shutting down Nexus Dashboard to stop the frames. What is the effect on forwarding?
- A national retailer has EVPN sessions up and host routes on the route reflector, but one leaf VRF never installs those remote hosts. That VRF does not import the route target the other leaves export. What is missing?
- A retail bank needs to know which hosts exchanged how much data with a payment partner this afternoon, and it does not need the packet payload. Which record should the engineer collect?
- Two game studio Nexus switches share an area, timers, and MTU, but one OSPF neighbor stays Down and that interface sends no hellos. The interface is passive. What is stopping the adjacency?
- A retail bank uses PIM sparse mode for an any-source group. Receivers and the source are up, the unicast route to the source matches the interface where the stream would arrive, and no rendezvous point is configured. Why does the stream fail to start?
- A national retailer wants interface counters delivered every minute to a collector. The collector must not poll, and a quiet interface must still report. Which subscription matches?
- A retail bank server negotiates LACP, and the Nexus port-channel toward that server is set to on. The channel does not form. What change lets the link bundle?
- On a national retailer vPC pair, a file server sends return traffic to the physical MAC of peer A, but the hash delivers those frames to peer B and the flow fails. Peer-gateway is off. What does enabling peer-gateway change?
- A game studio's VTEPs bridge each VXLAN segment and answer the local anycast gateway, yet a host on one leaf cannot reach a host subnet that lives on another leaf. Which identifier carries that routed traffic in symmetric IRB?
- A national retailer built an ACI VMM domain for vCenter and tied that domain to a static VLAN pool. Port groups for the associated EPGs never appear in vCenter. What kind of VLAN pool does that VMM domain require?
- A retail bank added a VLAN to an ACI pool and associated an EPG, but the leaf access port never accepts that VLAN. The physical domain for the pool is not attached to the AAEP on the port's interface policy group. What is missing?
- A national retailer cabled a new ACI spine only to the APICs, and that spine never joins the fabric. Where must the spine be connected so the fabric can discover it?
- A retail bank saved a configuration checkpoint before an access-list change. The change is harmful, and the running configuration should return to that checkpoint without a reboot. Which action does that?
- A retail bank's ACI bridge domain uses hardware proxy, so unknown unicast is sent toward the spine, but a host broadcast still reaches the other leaves in that bridge domain. Why does the broadcast still flood?
- A national retailer is about to upgrade NX-OS on a production leaf and wants to know whether that upgrade will reload the switch before anyone starts it. Which check reports the impact?
- A game studio and three partner studios share one cloud that is closed to the general public and is not owned by only one of the studios. Which NIST 800-145 deployment model is that shared cloud?
- A national retailer wants the busiest host pairs and their byte counts on one VLAN for a business day, without copying every frame to an analyzer. Which record should be collected?
- A retail bank's Nexus switches exchange OSPF hellos in the same area number with matching timers and matching MTU, but the adjacency never reaches Full and the options field differs. Which setting should the engineer compare?
- A game studio leaf receives EVPN prefixes in BGP, but those prefixes do not enter the tenant VRF. The VRF does not import the route target that the advertising VRF exports. What has to be aligned?
- A retail bank's VTEPs deliver known unicast across a VXLAN segment, but ARP broadcasts from a host do not reach the remote VTEPs. The underlay has no multicast routing. Which BUM method fits this underlay?
- A game studio ACI bridge domain is set to hardware proxy. A leaf receives a unicast frame for a MAC that no leaf has learned. What does the fabric do with that frame?
- A national retailer added a VLAN to an ACI VLAN pool, but hosts on the leaf port still cannot use it. That pool is not referenced by the physical domain on the AAEP for the port. What should be fixed?
- A retail bank created an ACI VMM domain for vCenter, yet no new port groups appear on the distributed switch. Leaf servers are up. The VMM domain is not associated with the AAEP on those leaf ports. What is the missing relationship?
- A national retailer's storage array sends replies to one vPC peer's physical router MAC, and those frames arrive on the other peer, which does not route them. Which vPC feature lets the receiving peer forward that traffic?
- A hospital ACI fabric loses every APIC. A new leaf no longer completes discovery. An engineer opens Nexus Dashboard and expects it to register that leaf. Why does the leaf still fail discovery?
- A national retailer runs its ordering application on cloud virtual machines. The retailer patches the guest operating system and the application. The provider owns the hosts, storage, and hypervisor. Which NIST service model is this?
- A retailer has a file that is the complete desired running configuration of a Nexus switch. Pasting the file into configuration mode left extra VLANs in place. Which operation makes the running configuration match the file, including those removals?
- A retail bank upgraded the NX-OS system image on a Nexus switch. A later advisory says the programmable hardware logic on a module is still outdated. The system image on the switch is already the recommended release. What is the remaining upgrade?
- A logistics Nexus switch already pushes interface counters to a collector once a minute. Operators still learn about a link failure on the following minute. Which subscription reports the interface state at the moment it changes?
- A game studio must open one TCP handshake in a decoder. NetFlow on the Nexus leaf already shows the two addresses and the byte counts. Which tool supplies the frames themselves?
- A retailer configured a static rendezvous point. Unicast routing reaches that address from the leaves, and receivers still cannot join the shared tree. PIM sparse mode is enabled on the transit links and is missing on the loopback that owns the rendezvous-point address. What must be enabled on that loopback?
- A logistics pair replaced HSRP with a fresh VRRP configuration and did not enter a preempt command. When the higher-priority router returns, it becomes primary immediately. Why?
- A game studio maps the player VLAN to VNI 10010 on leaf A and to VNI 10020 on leaf B. Hosts on the same leaf can talk. Bridged traffic between the leaves never lands in the same segment. What must match on both VTEPs?
- A logistics VXLAN fabric runs iBGP EVPN from the leaves to two spines. Underlay routes exist, and leaf A advertises a type-2 host route that leaf B never receives. The spines are not route reflectors. What is missing?
- A retailer has two NX-OS switches exchanging OSPF hellos. MTU, hello timers, and dead timers match, and neither interface is passive. One interface is in area 0 and the other is in area 1. Why does the neighbor stay down?
- A retailer vPC peer-link fails while the keepalive stays up. The secondary suspends its vPC member ports. A single-attached server on the secondary still shows link up, and it cannot reach anything on the primary. Why is that server port still forwarding at layer 1?
- A bank builds an ACI VLAN pool, a physical domain, and an AAEP that references the domain. An interface profile selects the right leaf ports and the right policy group. No switch profile references that interface profile. The leaf never programs the VLAN. Why?
- A university EPG is attached to a vCenter VMM domain with resolution immediacy set to on-demand. The ESXi host is already on the distributed switch. The new virtual machine is powered off and is not in the EPG port group, and the leaf has not programmed the encapsulation. What causes that programming?
- A retailer registers a new ACI leaf that is cabled only to an APIC. The leaf shows up in the fabric membership. Endpoints on that leaf cannot reach endpoints on any other leaf, and the leaf has no cable to a spine. What is missing?
Compute (25%) · 75 questions
- A media company cabled a new UCS blade chassis to a fabric interconnect pair, but the chassis never appears for discovery. The ports facing the chassis IOMs are still unconfigured Ethernet ports. What must change before discovery can start?
- A retail bank's blade chassis is discovered and shows a power-redundancy warning. Each side of the chassis power supplies is plugged into a separate utility feed. Which chassis power policy matches that cabling?
- A retail bank deployed standalone UCS C-series rack servers and did not install fabric interconnects. An administrator needs out-of-band virtual KVM and BIOS settings for one of those servers. Which management target is the correct place to open?
- A media company's blades cannot use VLAN 240. The VLAN exists on the fabric interconnects and is allowed on the uplink port-channel. The updating vNIC template on the service profiles does not list VLAN 240. Where should the engineer add it?
- A game studio blade logs its vHBA into the Fibre Channel fabric, then boots from the local disk. The boot policy lists no SAN target. The LUN is on an array that the fabric can already reach. What should be added so the blade boots from that LUN?
- A SaaS platform cabled a blade chassis to fabric interconnect server ports, and the chassis appears as a discovered object that still cannot be used. Discovery is waiting for an administrator to accept it. What completes that step?
- A media company is installing a UCS X-series chassis and wants server profiles and policies managed in Intersight, not in a local UCS Manager domain. Which management model matches that goal?
- A retail bank changes the boot order on a service profile template, and the profiles already created from it do not change. The template type is initial. Why do those profiles keep the old boot order?
- A media company wants Intersight inventory and virtual KVM for a standalone UCS C-series rack server, and no fabric interconnects are installed. How should that server be brought into Intersight?
- A SaaS platform blade vHBA never logs into the VSAN where the array lives. The vHBA template names a different VSAN, and the Fibre Channel uplinks carry only the array VSAN. What should change?
- A SaaS platform runs a UCS X-series chassis in Intersight Managed Mode. An engineer adds a VLAN and an uplink port policy inside a server profile, and the fabric interconnect ports do not change. Where do those domain-wide policies belong?
- A regional hospital points a service profile at a newer host firmware package. The blade still runs the old BIOS, and the maintenance policy is set to wait for an administrator. Why is the new firmware not active yet?
- A media company wants a new service profile to associate only to blades that have a specific VIC model. Other blades in the same chassis must not receive it. Which object filters that hardware?
- A regional hospital applied a new host firmware package to a service profile. Blade BIOS can change, but the chassis IOM and the fabric interconnects stay on the previous code. Which package updates the IOM and the fabric interconnects?
- A media company loses traffic for one blade vNIC when a single uplink fails. That vNIC is in a LAN pin group that names only the failed uplink. Other vNICs on the blade keep forwarding. Why did this vNIC stay down?
- A media company wants an XML export of service profiles, pools, and policies that an engineer can read. A binary snapshot of the whole fabric interconnect domain is not required. Which backup matches that request?
- A SaaS platform has claimed a UCS server in Intersight. After a field notice is published for that hardware, an operator needs the list of notices that apply to the server. A copy of vNIC frames is not required. Where is that list?
- A media company already uses CIMC for virtual KVM on a standalone C-series server. They now want a UCS Manager service profile and vNIC templates to own that server. What does that management model require?
- A SaaS platform can open each fabric interconnect on its own address, but the cluster virtual IP does not answer. The L1 and L2 cluster ports between the pair are not cabled. What is missing?
- A media company blade loses its only vNIC whenever one specific uplink fails, even though another uplink on the same fabric interconnect stays up. The vNIC belongs to a pin group aimed at the failing uplink. What removes that single-uplink dependency?
- A regional hospital cabled one link from each fabric interconnect to a new blade chassis, and the chassis is not discovered. The chassis discovery policy requires four links. Which setting is blocking discovery?
- A media company must rebuild service profiles, pools, and policies on a replacement fabric interconnect pair and wants an importable XML file. Which backup contains that logical configuration?
- A SaaS platform blade completes Fibre Channel login, but its vHBA is in a different VSAN from the array it must reach. Zoning in the array's VSAN is already correct. What should change on the service profile?
- A regional hospital updated a blade's host firmware package and the server rebooted at once during clinic hours. The maintenance policy applies firmware changes immediately. How should the next update be kept from rebooting on its own?
- A SaaS platform runs UCS X-series in Intersight Managed Mode. An engineer edits a server profile to change which fabric ports are uplinks, and the ports do not change. Where does that port role belong?
- A media company service profile stays unassociated. Its server pool has free blades, but the pool qualification requires an adapter model none of those blades have. What prevents association?
- A SaaS platform wants a warning when a published security advisory applies to the firmware on a claimed rack server. Which view answers that?
- A media company has a standalone UCS C-series server and no fabric interconnects. They want that server in the Intersight inventory so its firmware is visible. What achieves the claim?
- A media company service profile stays unassociated. The server pool qualification requires more memory than the selected blade has. Why does association fail?
- A SaaS platform powered on two fabric interconnects, and each one stayed a standalone device. The L1 and L2 cluster ports were never cabled between them. What must be connected before they form a cluster?
- A regional hospital applied a new host firmware package, and the blades came up on the new server firmware. The chassis IOM firmware did not change. Which package updates the IOM?
- A media company host uses VLAN 50, the vNIC template already allows VLAN 50, and the upstream router uses that VLAN, but the fabric interconnect uplink port-channel does not allow it. Where should VLAN 50 be added?
- A SaaS platform blade's vHBA logs into the fabric, but the array never matches it. The zone names the blade WWNN, while the vHBA presents a different WWPN at login. What should the zone name instead?
- A media company has a standalone UCS C-series server and no fabric interconnects. The server should appear in the Intersight inventory and receive advisories. What accomplishes that?
- A SaaS platform added a VLAN on a UCS X server profile vNIC, but the Intersight Managed Mode uplinks still do not carry that VLAN. The domain profile was not updated. Which change programs the uplinks?
- A SaaS platform chassis is visible on the fabric interconnects, the attached ports are already server ports, and the chassis still waits for an administrator. What finishes this discovery step?
- A media company imported a logical configuration backup into a rebuilt UCS domain. Service profiles and pools returned, and the local usernames did not. Why are the local users missing?
- A regional hospital updated the host firmware package on a service profile. The maintenance policy waits for an administrator to acknowledge a reboot, and the blade still runs the old firmware. Why has the new firmware not started?
- A SaaS platform operator wants the published hardware advisory that affects a claimed UCS server, not a copy of that server's frames. Where should the operator look?
- A media company blade has a SAN boot target in its boot policy, and it still boots the local disk, which is listed first and is bootable. What change makes the blade boot from the array?
- A SaaS platform blade logs its vHBA into VSAN 20. The array and the zones that should include this blade are in VSAN 10, so the LUN never appears. The SAN boot target is already filled in. What should change?
- A SaaS platform created Intersight server profiles for UCS X-series nodes, and the profiles do not associate. No domain profile has been deployed to the fabric interconnects. What has to happen first?
- A regional hospital assigns a new host firmware package and the bound servers reboot immediately, even though the team wanted to wait for a change window. Which policy turns that package change into an immediate reboot?
- A regional hospital updated the host firmware package on every blade. The chassis IOM firmware did not change. Which upgrade carries new IOM firmware?
- A media company vNIC is pinned to one uplink. That uplink fails, and the vNIC goes down even though other uplinks on the same fabric interconnect are up. Why did the vNIC stay down?
- A SaaS platform can open the CIMC page on a standalone rack server, but that server never appears in Intersight. Which action registers the server with Intersight?
- A media company replaced a failed fabric interconnect, and an XML export of service profiles, pools, and policies did not restore the interconnect system state. Which backup is built for that restore?
- A media company powered a fabric interconnect pair, configured the server ports, and still has no cluster and no virtual management address. The L1 and L2 ports between the interconnects are not cabled. What must be connected?
- A media company vHBA logs into the fabric, but the zone and the array mask were built from the vHBA node name. The port name issued from the WWPN pool is a different value. Which name should the zone and the mask use?
- A SaaS platform updated its servers with a host firmware package, but each chassis IOM is still on the old firmware and the fabric interconnect reports a mismatch. Which update brings the IOM in line with the interconnect?
- A regional hospital vNIC goes down when its only uplink fails, even though the other fabric interconnect uplinks stay up. The LAN pin group on that vNIC contains only the failed port. Why does the vNIC stay down?
- A SaaS platform service profile points at a server pool and stays unassociated. The pool qualification requires an adapter model that none of the blades have. What change allows a blade to be selected?
- A media company cabled two links from a new blade chassis to each fabric interconnect and configured those ports as server ports, but the chassis is not discovered. The chassis discovery policy requires four links. Which change matches the cabling?
- A regional hospital wants a rack server that is managed only from CIMC today to receive a service profile from the existing UCS Manager domain. What does that design require?
- A media company changed uplink port roles inside a UCS X server profile in Intersight Managed Mode, and the fabric interconnect uplinks did not change. Which profile owns those domain-wide port roles?
- A SaaS platform must upgrade firmware on both fabric interconnects in a cluster and keep one interconnect forwarding throughout the work. Which sequence meets that goal?
- Blades on one fabric interconnect in a SaaS platform can reach each other in a VLAN, but none of them can reach the upstream router in that VLAN. The vNIC template already allows the VLAN, and the uplink port-channel does not. Where must the VLAN be allowed?
- A SaaS platform team associates new service profiles to a server pool, and the profiles remain unassociated. The pool qualification requires a VIC model these blades do not have. Why does association fail?
- A SaaS platform team changes BIOS settings in the CIMC of a C-series server that is integrated with UCS Manager. After the next association the settings revert. The service profile has a BIOS policy. Where should the change be made so it stays?
- A media company blade shows a vHBA, but FLOGI never succeeds toward the array. The SAN uplink allows VSAN 20 only. The vHBA template places the blade in VSAN 12. Which change matches the path the fabric actually carries?
- A media company applied a new host firmware package to a service profile. Hours later the blade still runs the previous firmware. The maintenance policy is user-ack, and no reboot has been acknowledged. Why is the firmware unchanged?
- A regional hospital built Intersight server profiles for a new UCS X-series domain. Deployment fails because no domain profile has been deployed to the fabric interconnects. What has to happen first?
- A media company must capture the frames leaving one blade vNIC and open them in an analyzer. Intersight already lists that server as healthy, with no advisory. Which UCS Manager feature produces the frame copy?
- A media company uploaded new images and created a new host firmware package. Associated blades still run the previous BIOS. The maintenance policy is immediate. Why has no blade rebooted into the new package?
- A hospital chassis is still cabled to both fabric interconnects. UCS Manager lists it as decommissioned, and acknowledging the chassis does not return it to inventory. What brings it back?
- A media blade's fabric B vHBA logs in and is zoned to the array in the correct VSAN. The boot policy names a SAN boot target only on fabric A, and no target exists there. The blade never boots from the LUN. What should change?
- A bank restores a logical configuration backup onto a replacement fabric interconnect pair. Service profiles, pools, and policies return, but every vHBA logs in with a new WWPN and the SAN zones miss the blades. What was left off when that backup was taken?
- A SaaS chassis is cabled to fabric interconnect ports, and UCS Manager never discovers it. Those ports were configured as Ethernet uplink ports toward the LAN. Which port role lets a chassis be discovered?
- A bank edits the BIOS settings on a service profile template. Every blade already associated from that template schedules a reboot under the maintenance policy. Which template type pushes a later edit into profiles that already exist?
- A logistics C-series server should be discovered by UCS Manager. The only cable into a fabric interconnect server port is the server's dedicated CIMC management port. The server never appears. What must be connected to that server port?
- A SaaS operator needs a keyboard and video session to a UCS X blade. The fabric interconnects run Intersight Managed Mode, and browsing to the fabric interconnect does not open UCS Manager. Where is the console session started?
- A media company adds a VLAN to an initial vNIC template. Blades that already received their vNICs from that template still do not have the VLAN. Profiles created from the template after the edit do. Why did the existing vNICs stay unchanged?
- A SaaS UCS domain has free blades that meet every server pool qualification. New service profiles stay unassociated and report that a WWPN cannot be assigned. The WWPN pool has no free addresses. What has to be expanded?
- A bank sets a vNIC template MTU to 9000. The QoS system class that vNIC uses still has an MTU of 1500. Large frames from the blade are dropped. Which MTU has to be raised so those 9000-byte frames can pass?
- A factory replaces a failed blade and associates the same service profile to the new blade. The SAN zones still name the previous WWPN, and the new blade logs in with that same WWPN. Why did the WWPN stay the same?
Storage Network (20%) · 60 questions
- After a successful FLOGI, a host in a SaaS storage fabric receives a 24-bit Fibre Channel address. An engineer inspects the high 8 bits of that address. What do those bits identify?
- Two MDS switches in a SaaS company's new pod are linked by an ISL that isolates as soon as it comes up. Both switches are configured with the same static Fibre Channel domain ID. What change lets the fabrics merge?
- A SaaS storage admin adds a host and a target to a new zone, adds that zone to the zoneset, and the host still cannot see the target. The zoneset was not activated again after the edit. What is the missing step?
- A university engineer creates a device alias on one MDS switch and commits it there. A second MDS in the same fabric never shows the alias. CFS distribution for device alias is disabled. What is missing?
- A university storage engineer wants two ISLs between a pair of MDS switches to run as one SAN port-channel. One switch has the port-channel configured, and the peer still has two independent E ports. What is the right fix?
- A factory is choosing which MDS switch should be principal. One switch is set to priority 1 and the other is left at the default priority of 128. Which switch has the stronger bid?
- A factory IoT network host finishes FLOGI and receives a 24-bit Fibre Channel address. The HBA was not configured with a manual Fibre Channel address. Where does that address come from?
- A factory IoT network creates an fcalias in one VSAN and expects that same name to exist in a second VSAN on the same MDS. The second VSAN does not have the name. Which alias is fabric-wide rather than VSAN-local?
- A factory IoT network has a working zoneset in a VSAN. An engineer builds a second zoneset for a change window and activates it. Hosts that existed only in the first zoneset lose their targets. Why?
- A state university has a SAN port-channel configured on both MDS switches, and one member is already up in the channel. The second ISL stays out and is running at a different speed. What lets that member join?
- A state university enables device-alias distribution with CFS, enters a new alias, and the peer MDS still does not list it. The device-alias change was never committed. What is the missing step?
- A state university puts a host WWPN in a zone with an array, but the Fibre Channel name server on the MDS has no entry for that host. The host has not completed FLOGI. Why is the name server empty for it?
- A state university edge switch runs NPV toward a core MDS. The NPV connection is rejected, NPIV is disabled on the core, and the edge switch has no Fibre Channel domain ID. What should change on the core?
- A state university hypervisor reaches its datastore with iSCSI. An engineer edits a Fibre Channel zoneset, and the session still fails. The initiator has no HBA in this path. What identifies this host to the target?
- A factory IoT network carries two SAN applications on one MDS pair. A zoneset change for the sensor application must not disturb the controller application. What isolates those two fabrics?
- A factory IoT network brings up two MDS switches in a new VSAN, and both switches use the same domain-manager priority. Which switch becomes the principal switch?
- A state university storage engineer needs the actual Fibre Channel frames from one MDS port to inspect a malformed host sequence. Which tool collects those frames?
- A factory IoT network director has two supervisors, and both a system-image upgrade and an EPLD update are pending. The impact check reports the system image as nondisruptive. Which upgrade can keep Fibre Channel logins up?
- A factory IoT network host could see its target until an engineer activated a different zoneset in the same VSAN. The host's zone exists only in the previous zoneset. Why did access stop?
- A state university has a SAN port-channel configured on both MDS switches, yet one member stays out of the bundle while the other member is inside it. That member is hard-set to a different speed. What should change?
- A state university host is a member of the active zone with its target, yet the Fibre Channel name server has no entry for that host. What does the missing name-server entry mean?
- A state university enabled CFS distribution for device alias, edited an alias, and the peer MDS still shows the old database. The change is sitting in the pending copy and was never committed. What is the missing step?
- A factory IoT network engineer created an fcalias in one VSAN and cannot use that name when zoning a second VSAN on the same MDS pair. Which object is fabric-wide instead?
- A factory IoT network host is a member of the active zone, yet it has no Fibre Channel address and does not appear as logged in. When does the switch assign that 24-bit address?
- A state university host reaches its array by IP and an initiator IQN, but a new Fibre Channel zone does not make the LUN appear. Which control actually admits this iSCSI host?
- A factory IoT network has a sensor and a storage array logged into two different VSANs on the same MDS switch, and zoning inside each VSAN still does not let them communicate. Why are the two devices isolated?
- A state university set an edge MDS to NPV mode so the edge would not take a domain ID. The NP port comes up, but hosts behind the edge cannot log in through the core. NPIV is disabled on the core. What should be enabled, and where?
- A new MDS joins a factory IoT network fabric and is given a Fibre Channel domain ID. Which switch granted that domain ID?
- A state university storage engineer must see the actual Fibre Channel frames between a host and an array during a failed read. Which tool provides that frame copy?
- A factory IoT network MDS 9700 director has only one supervisor module installed. An engineer plans a system-image upgrade and expects forwarding to continue the whole time. Why will this upgrade interrupt the switch?
- A state university host completed FLOGI and now appears in the FCNS database, but it still cannot reach the array. An engineer treats the name-server entry as proof the zone allows the pair. What does that entry actually prove?
- A state university SAN port-channel is up with one member. A second ISL between the same MDS pair stays out because that link runs at a different speed. What lets the second link join?
- A state university MDS already has device-alias distribution enabled. An engineer adds an alias and the peer still shows the old database. The change was never committed. What is missing?
- A factory IoT network needs one friendly name for a controller port WWN in two VSANs, but an fcalias created in the first VSAN does not resolve in the second VSAN or on the peer switch. Which object supplies that shared name?
- A factory IoT network VSAN had a zoneset active that included the camera zone. An engineer activated a different zoneset that omits that zone, and the cameras lost the array. Why did the original zone stop working?
- A factory IoT network host is already in an active zone with its array, yet it has no Fibre Channel address because it has not completed FLOGI. When does the switch assign that 24-bit FCID?
- A state university runs an edge MDS in NPV mode so the edge does not take a domain ID, but the servers still cannot complete fabric login toward the core. NPIV is disabled on the core switch. What must change on the core?
- A factory IoT network will install a new system image on an MDS switch that has only one supervisor. The team wants forwarding to continue straight through the upgrade. What should they expect from this upgrade?
- A state university presents LUNs to hosts with iSCSI. An engineer adds a Fibre Channel zone that names those hosts and the array, and the hosts still cannot see the LUNs. What identifies an iSCSI host to that array?
- A factory IoT network trunks two VSANs across one TE port-channel. The first VSAN merges, and the second stays isolated because the trunk allows only the first VSAN. What lets the second VSAN use that same cable?
- A state university needs a copy of the Fibre Channel frames on one host port while that host attempts a process login to a target. Which MDS tool supplies that frame copy?
- A factory IoT network merged two MDS switches, and Fibre Channel domain IDs are being assigned by the switch the team did not want in charge. Which switch is allowed to assign those domain IDs?
- A factory IoT network host sits in the active zoneset, yet it has no Fibre Channel address and does not appear in the name server. The host has not completed fabric login. What assigns the 24-bit address?
- A factory IoT network converts an edge MDS to NPV mode so it will not take a Fibre Channel domain ID. Hosts behind that edge never complete FLOGI. NPIV is disabled on the core switch. What must change on the core?
- A state university has a SAN port-channel up between two MDS switches, but one member stays out of the channel. That member allows a different VSAN list than the channel, and both switches already have the channel configured. What should be corrected?
- A state university activates a second zoneset in a VSAN where a different zoneset was already active. Hosts that were members only of the first zoneset lose their targets. Why did the first zoneset stop enforcing?
- A state university creates an fcalias for a host in VSAN 10 and then references that same name from a zone in VSAN 20. The VSAN 20 zone will not resolve the name. Why?
- A factory IoT network shows a new host in the Fibre Channel name server after FLOGI, and an operator assumes the host can reach its target. The zoneset has no entry for that host. Which statement is correct?
- A factory IoT network cannot boot a host from an iSCSI LUN. The initiator IQN and the target portal IP were never configured. An administrator instead added the host to a Fibre Channel zoneset. What will actually let the host reach the LUN?
- A university VSAN has an active zoneset. Two devices that do not share any zone can still read and write to each other. The default-zone policy on the switches is permit. What is allowing that traffic?
- A university needs a copy of the Fibre Channel frames on one MDS port delivered to an analyzer. The SPAN session's destination is an existing ISL, and no frames arrive at the analyzer. What should the destination be?
- A factory connects a new MDS to a SAN whose device aliases run in basic mode. The new switch is in enhanced device-alias mode. The ISL comes up, but the device-alias databases never merge. Why?
- A factory MDS director has two supervisors. The install impact for the new system image reports that the upgrade is disruptive. What happens if the engineer continues with that image?
- A state university host logs in on VSAN 10. The target and the active zoneset that pairs them are in VSAN 20. Both VSANs exist on the same MDS. Why can the host not see the target?
- A media editor mounts a datastore with NFS. The storage admin adds the editor host bus adapter to a Fibre Channel zoneset and also requests an iSCSI IQN. The mount still succeeds or fails with the export. What actually admits this host?
- A factory MDS is already running a domain ID in VSAN 10. An engineer configures a different static domain ID for VSAN 10 only. Hosts keep their current FCIDs, and the running domain ID does not change. What applies the new static domain ID?
- A factory edge switch is supposed to attach as NPV. Its uplink to the core came up as an E port, and the edge requested its own domain ID. NPIV is already enabled on the core. What is the edge missing?
- A game studio hypervisor completes FLOGI on an MDS F port and receives one FCID. Virtual machines on that host send FDISC to request their own FCIDs, and the switch rejects those requests. NPIV is disabled. What does enabling NPIV allow on that port?
- A university host in VSAN 20 is zoned to an array on a second MDS, and that array is also in VSAN 20. The TE port-channel between the switches allows only VSAN 1. FSPF in VSAN 20 shows no path. What is missing?
- A university builds a Fibre Channel port-channel between two MDS switches. The engineer sets the member interfaces to LACP active mode, the same way the campus Ethernet port-channels are built. The SAN port-channel never comes up. Why?
Automation and Artificial Intelligence (15%) · 45 questions
- A government agency created a scheduler job that records interface status, but the job has never run. The job exists, and no timetable is associated with it. What has to be added?
- A factory IoT network wants a Nexus switch to save the output of a transceiver command only when a specific interface-down syslog message appears. Which on-box tool matches that event and then runs the command?
- A logistics company wants a Nexus switch to create a configuration checkpoint every night at 02:00, whether or not any syslog event occurred. Which on-box tool should run that job?
- A logistics company needs an on-box tool to reach an archive server through an address and route that must not be installed in the Nexus default routing table. Which environment can hold that address in its own network namespace?
- A factory IoT team wants to install extra Python libraries on a Nexus switch without placing those packages in the NX-OS system root. Which environment is the supported place for that install?
- A logistics company has an EEM applet that should save the routing table only when a specific BGP neighbor-down syslog appears, but the applet also runs for unrelated syslog lines. Which part of the applet is matching too much?
- A logistics company developer runs Python on a jump host, not on the switch, and needs to add a VLAN over the network. Which approach matches that off-box script?
- A logistics company can retrieve show command output through NX-API, but a request that should add an NTP server never changes the configuration. The request uses the show message type. What should the client send instead?
- A government agency script runs inside the Nexus on-box Python interpreter and must execute a show command on that same switch. Which interface is built for that call?
- A government agency Nexus boots with no startup configuration and begins POAP, requesting an address from DHCP. The engineer wants the normal CLI and does not want a scripted install. What is the right conclusion?
- A logistics company runs three VXLAN fabrics and wants the same tenant network intent applied to all three from one controller. Which tool is built for that multi-fabric job?
- A logistics company wants a repeatable NTP configuration pushed to many Nexus switches, with nothing installed on the switches, and a second run must not stack a duplicate NTP server. Which tool fits?
- A logistics company wants an Intersight server profile assigned to a new rack server. The server is powered and reachable on the management network, but it has never been claimed. What has to happen first?
- A government agency wants a Nexus switch to shut an uplink when that port's input-error counter crosses a threshold the operator sets. The reaction must follow the counter, not a clock. Which tool matches?
- A logistics company keeps automation on a Windows host and wants a PowerShell session to list Intersight server profiles, with no agent installed on the servers. Which tool matches that host?
- A government agency wants infrastructure described as desired state, reviewed as a plan, and recorded in a state file before anything is applied. Which tool matches that workflow?
- A logistics company wants each Nexus switch to save its interface counter output to a local file every hour, on the switch itself, whether or not a syslog event fired and with no external automation host. Which tool should run that job?
- A logistics company is connecting a GPU cluster that uses RDMA over Converged Ethernet version 2. Under load the fabric drops those frames and the job stalls. What does this traffic need from the Ethernet fabric?
- A government agency engineer runs Python on a workstation that sends show commands to a Nexus switch through NX-API. Which description matches this script?
- A logistics company wants a troubleshooting script on a Nexus switch to use its own IP address and its own routing table, separate from the switch management VRF. Which environment provides that separate network namespace?
- A logistics company script runs inside the Nexus Python interpreter on the switch and must execute a show command there. Which module should the script use?
- A replacement Nexus switch at a logistics company boots with an old startup configuration still stored, and the expected day-0 script never starts. Why did POAP not run?
- A government agency client can reach NX-API on a Nexus switch, yet a show command returns no show output because the request uses the configuration message type. What should the request use instead?
- A logistics company must ensure one VLAN exists on many Nexus switches, install no agent on them, and run the job again without creating a duplicate VLAN. Which tool fits?
- A logistics company wants a Nexus switch to shut a named downlink at the moment a named uplink goes down, and not because a clock reached a set time. Which on-box tool binds that interface event to the shutdown?
- A government agency's GPU cluster drops frames on a best-effort VLAN whenever the links congest, and the RoCEv2 jobs retry. Which fabric behavior do those jobs require?
- A logistics company wants image compliance and configuration for dozens of Nexus switches from one place, rather than a console session on each switch. Which platform service matches?
- A logistics company wants to claim new rack servers and stamp them from one set of policies through an external API, rather than configuring each server's local controller by hand. Which product is that automation plane?
- A government agency automates UCS and Intersight from a Windows host and wants cmdlets that open a session and apply a server policy. Which tool matches that host?
- A logistics company stores the desired Nexus configuration in files and wants a preview of what will change, based on a stored state file, before any switch is touched. Which tool matches that workflow?
- A government agency forbids guest shell and on-box package installs. An automation host must collect interface status from Nexus switches with a Python script the agency already runs on that host. Which approach matches the constraint?
- A government agency NX-API client receives JSON replies for show commands, but configuration commands sent the same way do not change the switch. Those requests use the show message type. What must a configuration request use?
- A logistics company wants a Python script that runs inside the NX-OS Python interpreter and executes CLI on that same switch. Which facility is built for those CLI calls?
- A logistics company can ping a log collector from the Nexus management VRF, but a script in the guest shell cannot reach that collector. The guest shell is already enabled. What is the guest shell missing?
- A logistics company finished configuring a Nexus switch, then every reload stops at the POAP prompt. The engineer applied the changes to running-config and never saved them. Why does POAP return?
- A logistics company wants VLAN changes pushed to dozens of Nexus switches from one control host, with no agent installed on the switches, and a second run should change nothing if the VLANs already match. Which tool fits?
- A logistics Windows host must list server profiles for a UCS X domain that runs only in Intersight Managed Mode. UCS Manager is not running on those fabric interconnects. Which automation path can list the profiles?
- A government operator runs terraform plan against a Nexus provider. The plan lists a VLAN to add. After the plan finishes, the switch does not have that VLAN. Why not?
- A government jump host cannot open NX-API on a Nexus switch. SSH to the same switch works, and show commands succeed on the CLI. What is missing on the switch?
- A logistics company wants one place to correlate interface errors, congestion, and anomalies across a Nexus fabric instead of opening SSH to every switch. Which product family is built for that fabric-wide view?
- Two government agency operators each run Terraform against the same ACI tenant from different laptops. Each laptop has its own state file. The second plan wants to create objects the first laptop already created. What is the right fix?
- A game studio GPU cluster uses RoCEv2. Jumbo frames already pass end to end, and the GPUs still drop when the fabric is busy. The traffic class has no flow control. What supplies lossless behavior for that class?
- A logistics rack server is claimed in Intersight. A server profile that contains the new BIOS policy is assigned to that server and has not been deployed. The server still runs the previous BIOS. What has not happened?
- A logistics engineer adds a VLAN on one leaf from the CLI. That VLAN is not part of the fabric intent stored on Nexus Dashboard. At the next deploy from the dashboard, the VLAN is gone. Why?
- A factory Nexus switch has no startup configuration, so it enters POAP. DHCP offers an address and a default gateway, and the switch never downloads a configuration script. What is missing from the offer?
Security (15%) · 45 questions
- A game studio has web and app EPGs in the same ACI VRF. Web servers cannot open a single required port to the app servers, and no contract exists between the EPGs. Which change permits only that port?
- A government agency needs a Nexus account that can run show commands and cannot enter configuration mode. An engineer is searching for an IOS-style privilege level. Which NX-OS control enforces this limit?
- A logistics company's Nexus switch has Dynamic ARP Inspection enabled on a VLAN, and ARP from legitimate hosts is dropped. DHCP snooping is not enabled on that VLAN. Why is the valid ARP being dropped?
- A game studio uses TACACS+ for Nexus logins. When both TACACS+ servers are unreachable, operators can still sign in with a local username. Which AAA arrangement allows that?
- A regional hospital must isolate one imaging server with a tighter policy based on a VM attribute, without moving it to a new VLAN or opening every port across the application tier. Which ACI construct classifies that server?
- A game studio rotates an OSPF key chain at a planned time. One Nexus starts sending the new key and drops the old key at that instant. Its peer, whose clock is slightly behind, still sends the old key, and the adjacency drops. What avoids that gap?
- A government agency enabled DHCP snooping on a Nexus VLAN. Clients send discovers, but offers never arrive. The port that faces the DHCP server is untrusted. What should change?
- A government agency uses UCS Manager. An operator should manage service profiles in one organization and have no rights in the other organizations. Which controls create that limit?
- A regional hospital enables MACsec on the link between two access switches. An engineer expects the traffic to stay encrypted after it is routed across the core toward a far server. Those core links do not run MACsec. What does this MACsec session protect?
- A government agency enabled DHCP snooping on a Nexus VLAN, and hosts never receive addresses. The port toward the DHCP server is untrusted, and the host ports are untrusted as well. What should change?
- A regional hospital keeps every clinical workstation in one EPG, but only imaging virtual machines, matched by a VM attribute, may open one port to the PACS servers. Which change permits only those virtual machines?
- A game studio needs an MDS account that can build and activate zones but cannot create user accounts or change AAA. Which control enforces that split on the SAN switch?
- A regional hospital wants only one known host PWWN to complete FLOGI on a specific MDS F port. A different HBA plugged into that same port should be rejected before it gets a fabric address. What enforces that?
- A game studio's Nexus switches still accept a local network-admin login after both TACACS+ servers become unreachable. The AAA login method list names the TACACS+ group and then local. Why does that login succeed?
- A government agency's MDS fabric rejects a replacement switch that has a new switch WWN, even though the ISL cables are correct and fabric binding is enabled. What must be updated before that switch can join?
- A government agency SAN rejects a newly cabled MDS. Fabric binding is enabled, and the new switch WWN is not in the binding list. What must be added before that switch may join?
- A game studio needs an MDS account that can display the zone database and must not be able to activate a zoneset. Which control enforces that command limit?
- A regional hospital wants only one known HBA port name to complete FLOGI on a specific MDS F port. A different HBA cabled into that port should be rejected. Which feature enforces that?
- A government agency operator can edit service profiles in one UCS organization and cannot see a second organization at all. The operator's role already permits service profile changes. What is limiting the view?
- A regional hospital enabled MACsec on the link between a leaf and a firewall and expects those frames to stay encrypted across the routed WAN to a remote clinic. What does this MACsec session actually protect?
- A game studio rotates the OSPF key chain on a Nexus link, and the adjacency drops at each rotation. The new key lifetime starts only after the old key lifetime ends. What prevents that drop?
- A game studio Nexus switch cannot reach its TACACS servers. Operators can still log in with a local username. Which configuration explains that result?
- A regional hospital keeps every monitor in one endpoint group. Only the ICU subnet may open one port to the records group. Which construct limits the contract to that subnet?
- A government agency account in UCS Manager can change every organization, but this person should keep the same privileges and touch only one organization. Which control adds that boundary?
- A game studio rotates an OSPF authentication key. The new key becomes valid only after the old key has expired, and the adjacency drops in that gap. What would have kept the neighbors up through the change?
- A government agency enabled IP Source Guard on an access VLAN. DHCP clients pass traffic. A server with a static IP address cannot. Why is that server blocked?
- A regional hospital enables MACsec on the link between an access switch and a server. Frames captured on the uplink from that access switch toward the core are still readable. Why is the uplink clear?
- A regional hospital replaced a host bus adapter, and the new port WWN is rejected when it tries to log in on the same F port. Fibre Channel port security is enabled on that port. What change lets the new adapter log in?
- A game studio keeps production and beta virtual machines in one EPG, so those machines can communicate freely. The beta machines carry a distinct attribute and need their own contract policy. Which construct classifies them by that attribute?
- A game studio contractor on an MDS can edit zones and can also create local users and change SNMP. The contractor should be allowed to edit zoning and nothing beyond that. Which control enforces the limit?
- A regional hospital finds that hosts accepted an IPv6 default router from a router advertisement that arrived on an access port. Which first-hop feature drops those advertisements on untrusted access ports?
- A government agency can log in to Nexus only while the TACACS+ servers answer. When those servers are unreachable, valid local accounts are rejected because the login method list names only the TACACS+ group. What should that list include next?
- A government agency rotates an OSPF key chain. Neighbors drop when the old key lifetime ends, and the replacement key is set to start the next morning. What was missing from the key schedule?
- A game studio can log in to Nexus switches, and the team cannot tell which account entered a configuration command after an outage. Authentication already works. Which AAA function records those commands?
- A government agency's MDS switches authenticate administrators only against TACACS+. During a TACACS outage nobody can log in, including on the console. Local accounts exist and are unused. What should be added to the login method?
- A game studio must encrypt Ethernet frames on specific leaf-to-spine links so a tap on those fibers cannot read them. The traffic is bridged and routed beyond that single link. Which control encrypts the frames on the link itself?
- A regional hospital UCS domain has several organizations. One administrator should create service profiles only inside the imaging organization and should not see the others. The account already has a server-admin role. What else is required?
- A regional hospital keeps many virtual machines in one ACI EPG because they share a VLAN. Only the imaging VMs should be limited to a single port toward the archive. Those VMs can be identified by a vCenter attribute. What enforces that smaller group?
- A university replacement MDS is rejected when it joins the SAN. Fabric binding already lists that switch WWN, paired with a domain ID the switch is not running. What has to match before the switch is allowed in?
- A hospital UCS user can see only one organization, which is what the design wants. Inside that organization the user cannot associate a service profile. The assigned role is read-only. What has to change?
- A government access VLAN has DHCP snooping enabled, and the DHCP server port is trusted. Clients receive addresses. They cannot learn the gateway MAC. Dynamic ARP inspection is on, and the uplink toward the router is an untrusted DAI port. What is being dropped?
- A game studio rotates an OSPF key on a Nexus link. Both peers will accept the new key today, and the send lifetime of that key starts tomorrow. Authentication fails tonight. Why is the new key absent from the packets?
- A hospital host PWWN is a member of the active zoneset, but FLOGI fails on the MDS F port where the cable is plugged. Port security on that port allows a different PWWN. What is rejecting the login?
- A bank sets MACsec on a leaf-to-spine link with the security policy must-secure. The spine has no MACsec key agreement. User frames on that hop disappear. What does must-secure do with those frames?
- A government MDS accepts logins through RADIUS. Operators reach the CLI, and the agency cannot authorize or deny individual configuration commands for those sessions. RADIUS is only authenticating them. Which service adds per-command authorization?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco.