Network (25%)

350-601 · 75 questions

• A national retailer has VXLAN tunnel endpoints up and OSPF adjacencies in the underlay, but no host MAC routes appear in BGP. The EVPN address family is not activated for the fabric neighbors. Which advertisement stays missing until that address family is turned on?
• A regional hospital sends multicast video from a source that is registered, but receivers on another leaf get no stream. That leaf's unicast route to the source points out a different interface than the one where the multicast packets arrive. Which check is dropping the stream?
• A government agency's vPC pair loses the peer-link, and the peer-keepalive link stays up. What happens to the vPC member ports on the secondary peer, and why?
• A national retailer uses the same anycast gateway IP on every VTEP for one VXLAN segment, but two leaves were built with different anycast gateway MAC addresses. Hosts that move between those leaves cannot use the gateway until ARP times out. What must match on the VTEPs?
• A regional hospital's two Nexus leaf switches exchange OSPFv2 hellos, use the same area, and use the same hello and dead intervals, but the neighbor stays in EXSTART and the databases never sync. Which mismatch should the engineer check first?
• A national retailer's HSRP active router failed, the standby took over, and the original router is back online with a higher priority. Traffic still uses the standby router. Preempt is not configured. Why did the original router remain standby?
• A retail bank port-channel between two Nexus switches never bundles. One side is channel mode active and the other side is mode on. Why does the bundle fail to form?
• A national retailer runs HSRP on a vPC pair. Some gateway-bound frames hash to the standby peer and use the HSRP virtual MAC. Those frames are dropped while peer-gateway is off. Why does enabling peer-gateway fix the forwarding?
• A national retailer's two Nexus switches exchange OSPFv2 hellos, the interface MTU matches, and the hello and dead timers match, but the adjacency never forms. One side of the link is a stub area and the other is not. Which mismatch is stopping the neighbor?
• A game studio runs PIM sparse mode. Receivers send joins, the source is sending, and the unicast route to the source matches the interface where multicast would arrive. No rendezvous point is defined for the group. What is missing?
• A retail bank's leaves already show EVPN routes in BGP, including remote host advertisements, but no VXLAN tunnel forms to one VTEP. The BGP next hop is a loopback that underlay OSPF does not advertise. What is missing?
• A national retailer cabled two ACI leaves directly to each other for extra bandwidth. That link never becomes a fabric port. How should a standard ACI fabric be cabled instead?
• A retail bank bridge domain uses hardware proxy for unknown unicast. A frame arrives for a MAC address that no leaf has learned. How does the fabric handle that frame?
• A game studio built a VLAN pool and a physical domain, and the server port uses an interface policy group. Endpoints still do not come up on those VLANs. The attachable access entity profile on that group does not reference the domain. What should be linked?
• A national retailer has a vCenter VMM domain in ACI. A web EPG is associated only with a physical domain, and no matching port group appears in vCenter. What makes the APIC push that port group?
• A national retailer's VTEPs use the same anycast gateway MAC, and same-subnet bridging works. Routed traffic between two VXLAN subnets in one VRF fails. The leaves use different Layer 3 VNIs for that VRF. What must match?
• A national retailer runs virtual machines at a public cloud provider. Retailer staff install and patch the guest operating systems and the applications, and the provider supplies the infrastructure. Which NIST service model is this?
• A retail bank is building an ACI fabric and has placed the infrastructure VLAN into a tenant VLAN pool so servers can use that VLAN. What is wrong with that plan?
• A retail bank has a new NX-OS system image and an EPLD file on bootflash. The bank wants to know whether installing the system image will reload the switch, and it is not programming EPLDs yet. Which check answers the system-image question?
• A national retailer will add Nexus Dashboard for fabric control and insights on an existing VXLAN network. Which description of the dashboard is correct?
• A game studio saved a known-good checkpoint on a Nexus switch last week and now needs to see how the running configuration drifted, without changing the switch. What should the engineer do?
• Two Nexus switches at a retail bank send OSPFv2 hellos on a link, use the same area, and use the same IP MTU, but no adjacency forms. One side's dead interval was changed and no longer matches. What is keeping the adjacency down?
• A retail bank's management station polls Nexus switches with SNMP, and the poll interval is too coarse for interface counters. The team wants the switches to push those counters on a short cadence. Which method matches?
• A national retailer wants a daily record of which hosts sent the most traffic toward a payment VLAN, including byte counts, without copying every frame to an analyzer. Which record matches?
• A national retailer's vPC pair loses the peer-keepalive, and the peer-link stays up. What happens to the vPC member ports?
• A game studio cabled each new ACI leaf management port to an out-of-band switch and did not uplink those leaves to any spine. The leaves never join the fabric. What is missing?
• A national retailer uses PIM sparse mode for one group. The source and the receivers are up, unicast between them works, and the two leaves list different static rendezvous points for that group. Why does the shared tree fail to form?
• A retail bank's VXLAN hosts on one subnet can reach each other, but they cannot reach a second subnet in the same VRF. One VTEP is missing the Layer 3 VNI for that VRF. What does symmetric routing need?
• A game studio leaf receives EVPN prefixes for a new VRF, but those prefixes are imported into the production VRF. The route target on the new VRF was copied from production. Which value should change so only the new VRF imports them?
• A retail bank's vPC pair runs HSRP. Some hosts address frames to the other peer's own router MAC, and the receiving peer is not routing them locally and forces them toward the peer-link. Which vPC feature lets the receiving peer route them?
• A game studio engineer runs the NX-OS install impact check and it reports the upgrade as disruptive. What happens to forwarding if the install continues?
• A national retailer created a VLAN pool and a physical domain and attached that domain to an EPG. A leaf access port still does not encapsulate the VLAN. The port's policy group uses an AAEP that does not include this domain. What should be linked?
• A retail bank's ACI VMM domain created port groups in vCenter, yet virtual machines on the new port group never reach the fabric. The host ports' AAEP does not include this VMM domain. What is missing?
• Developers at a retail bank deploy only their application code, while the provider runs the runtime and the operating system. Which NIST 800-145 service model matches this split?
• A national retailer saved a checkpoint, then applied a bad change and copied the running configuration to startup. A reload would bring the bad configuration back. What restores the earlier state with the least disruption?
• A national retailer bridge domain uses hardware proxy, and ARP flooding is off. A silent register never transmits, so other servers cannot reach it. Where does unknown unicast for that register go?
• During a broadcast storm, a retail bank engineer suggests shutting down Nexus Dashboard to stop the frames. What is the effect on forwarding?
• A national retailer has EVPN sessions up and host routes on the route reflector, but one leaf VRF never installs those remote hosts. That VRF does not import the route target the other leaves export. What is missing?
• A retail bank needs to know which hosts exchanged how much data with a payment partner this afternoon, and it does not need the packet payload. Which record should the engineer collect?
• Two game studio Nexus switches share an area, timers, and MTU, but one OSPF neighbor stays Down and that interface sends no hellos. The interface is passive. What is stopping the adjacency?
• A retail bank uses PIM sparse mode for an any-source group. Receivers and the source are up, the unicast route to the source matches the interface where the stream would arrive, and no rendezvous point is configured. Why does the stream fail to start?
• A national retailer wants interface counters delivered every minute to a collector. The collector must not poll, and a quiet interface must still report. Which subscription matches?
• A retail bank server negotiates LACP, and the Nexus port-channel toward that server is set to on. The channel does not form. What change lets the link bundle?
• On a national retailer vPC pair, a file server sends return traffic to the physical MAC of peer A, but the hash delivers those frames to peer B and the flow fails. Peer-gateway is off. What does enabling peer-gateway change?
• A game studio's VTEPs bridge each VXLAN segment and answer the local anycast gateway, yet a host on one leaf cannot reach a host subnet that lives on another leaf. Which identifier carries that routed traffic in symmetric IRB?
• A national retailer built an ACI VMM domain for vCenter and tied that domain to a static VLAN pool. Port groups for the associated EPGs never appear in vCenter. What kind of VLAN pool does that VMM domain require?
• A retail bank added a VLAN to an ACI pool and associated an EPG, but the leaf access port never accepts that VLAN. The physical domain for the pool is not attached to the AAEP on the port's interface policy group. What is missing?
• A national retailer cabled a new ACI spine only to the APICs, and that spine never joins the fabric. Where must the spine be connected so the fabric can discover it?
• A retail bank saved a configuration checkpoint before an access-list change. The change is harmful, and the running configuration should return to that checkpoint without a reboot. Which action does that?
• A retail bank's ACI bridge domain uses hardware proxy, so unknown unicast is sent toward the spine, but a host broadcast still reaches the other leaves in that bridge domain. Why does the broadcast still flood?
• A national retailer is about to upgrade NX-OS on a production leaf and wants to know whether that upgrade will reload the switch before anyone starts it. Which check reports the impact?
• A game studio and three partner studios share one cloud that is closed to the general public and is not owned by only one of the studios. Which NIST 800-145 deployment model is that shared cloud?
• A national retailer wants the busiest host pairs and their byte counts on one VLAN for a business day, without copying every frame to an analyzer. Which record should be collected?
• A retail bank's Nexus switches exchange OSPF hellos in the same area number with matching timers and matching MTU, but the adjacency never reaches Full and the options field differs. Which setting should the engineer compare?
• A game studio leaf receives EVPN prefixes in BGP, but those prefixes do not enter the tenant VRF. The VRF does not import the route target that the advertising VRF exports. What has to be aligned?
• A retail bank's VTEPs deliver known unicast across a VXLAN segment, but ARP broadcasts from a host do not reach the remote VTEPs. The underlay has no multicast routing. Which BUM method fits this underlay?
• A game studio ACI bridge domain is set to hardware proxy. A leaf receives a unicast frame for a MAC that no leaf has learned. What does the fabric do with that frame?
• A national retailer added a VLAN to an ACI VLAN pool, but hosts on the leaf port still cannot use it. That pool is not referenced by the physical domain on the AAEP for the port. What should be fixed?
• A retail bank created an ACI VMM domain for vCenter, yet no new port groups appear on the distributed switch. Leaf servers are up. The VMM domain is not associated with the AAEP on those leaf ports. What is the missing relationship?
• A national retailer's storage array sends replies to one vPC peer's physical router MAC, and those frames arrive on the other peer, which does not route them. Which vPC feature lets the receiving peer forward that traffic?
• A hospital ACI fabric loses every APIC. A new leaf no longer completes discovery. An engineer opens Nexus Dashboard and expects it to register that leaf. Why does the leaf still fail discovery?
• A national retailer runs its ordering application on cloud virtual machines. The retailer patches the guest operating system and the application. The provider owns the hosts, storage, and hypervisor. Which NIST service model is this?
• A retailer has a file that is the complete desired running configuration of a Nexus switch. Pasting the file into configuration mode left extra VLANs in place. Which operation makes the running configuration match the file, including those removals?
• A retail bank upgraded the NX-OS system image on a Nexus switch. A later advisory says the programmable hardware logic on a module is still outdated. The system image on the switch is already the recommended release. What is the remaining upgrade?
• A logistics Nexus switch already pushes interface counters to a collector once a minute. Operators still learn about a link failure on the following minute. Which subscription reports the interface state at the moment it changes?
• A game studio must open one TCP handshake in a decoder. NetFlow on the Nexus leaf already shows the two addresses and the byte counts. Which tool supplies the frames themselves?
• A retailer configured a static rendezvous point. Unicast routing reaches that address from the leaves, and receivers still cannot join the shared tree. PIM sparse mode is enabled on the transit links and is missing on the loopback that owns the rendezvous-point address. What must be enabled on that loopback?
• A logistics pair replaced HSRP with a fresh VRRP configuration and did not enter a preempt command. When the higher-priority router returns, it becomes primary immediately. Why?
• A game studio maps the player VLAN to VNI 10010 on leaf A and to VNI 10020 on leaf B. Hosts on the same leaf can talk. Bridged traffic between the leaves never lands in the same segment. What must match on both VTEPs?
• A logistics VXLAN fabric runs iBGP EVPN from the leaves to two spines. Underlay routes exist, and leaf A advertises a type-2 host route that leaf B never receives. The spines are not route reflectors. What is missing?
• A retailer has two NX-OS switches exchanging OSPF hellos. MTU, hello timers, and dead timers match, and neither interface is passive. One interface is in area 0 and the other is in area 1. Why does the neighbor stay down?
• A retailer vPC peer-link fails while the keepalive stays up. The secondary suspends its vPC member ports. A single-attached server on the secondary still shows link up, and it cannot reach anything on the primary. Why is that server port still forwarding at layer 1?
• A bank builds an ACI VLAN pool, a physical domain, and an AAEP that references the domain. An interface profile selects the right leaf ports and the right policy group. No switch profile references that interface profile. The leaf never programs the VLAN. Why?
• A university EPG is attached to a vCenter VMM domain with resolution immediacy set to on-demand. The ESXi host is already on the distributed switch. The new virtual machine is powered off and is not in the EPG port group, and the leaf has not programmed the encapsulation. What causes that programming?
• A retailer registers a new ACI leaf that is cabled only to an APIC. The leaf shows up in the fabric membership. Endpoints on that leaf cannot reach endpoints on any other leaf, and the leaf has no cable to a spine. What is missing?