Cisco Data Center Core Specialist — Practice Set 1

Question 1

Which NX-OS command is used to verify the consistency parameters between two vPC peer switches and determine if there is a type-1 inconsistency that would suspend the vPC?

Accepted Answer

'show vpc consistency-parameters global' displays all vPC global consistency parameters (such as STP mode, STP region, and LACP settings) and whether they match between the two peer switches. A type-1 inconsistency (e.g., mismatched STP mode) will suspend all vPC member ports. 'show vpc brief' shows port state and peer status but does not list the consistency parameter details. 'show port-channel summary' and 'show spanning-tree' do not expose vPC consistency details.

Question 2

A Nexus 9000 is being configured as a VXLAN VTEP. Which interface type must be used as the source interface for the NVE interface?

Accepted Answer

The NVE (Network Virtualization Endpoint) interface uses a loopback interface as its source IP address — the VTEP IP. A loopback interface is used because it is always up as long as the switch is operational, regardless of physical link state, providing a stable source IP for VXLAN tunnel endpoints. This loopback IP is also the IP advertised via the underlay routing protocol (typically OSPF or IS-IS) so remote VTEPs can reach it. Physical interfaces, port-channels, and SVIs are not appropriate source interfaces for NVE.

Question 3

An engineer is implementing a new ACI fabric. After connecting leaf and spine switches to the APIC, the leaf switches are not discovered. What is the most likely reason ACI fabric discovery fails?

Accepted Answer

Cisco ACI fabric discovery uses LLDP as the discovery protocol. The APIC discovers leaf switches via LLDP from its directly connected interfaces, and leaf switches discover spines via LLDP on their uplinks. If LLDP is disabled on these inter-connection ports, the APIC cannot learn the fabric topology and switches will not be added to the fabric inventory. VLAN pools, OSPF, and BGP are configured after fabric discovery is complete — they are not prerequisites.

Question 4

A Nexus 9000 leaf switch has the following NX-OS configuration:

vlan 100
  vn-segment 10100

interface Vlan100
    no shutdown
    vrf member Tenant-A
    ip address 10.1.0.1/24
    fabric forwarding mode anycast-gateway

What does 'fabric forwarding mode anycast-gateway' accomplish on this SVI?

Accepted Answer

'fabric forwarding mode anycast-gateway' configures the SVI as a VXLAN distributed anycast gateway. This allows every leaf switch to use the same gateway IP address and the same virtual MAC address (configured via 'fabric forwarding anycast-gateway-mac') for a given VNI. Hosts always reach their default gateway locally — at the first-hop leaf — eliminating hairpinning traffic through a centralized gateway. This requires the 'feature fabric forwarding' to be enabled on the Nexus 9000. It is unrelated to OSPF underlay, BUM multicast groups, or ARP bypass.

Question 5

In an ACI fabric, two EPGs — 'Web' and 'App' — are in the same VRF but different Bridge Domains. A contract is applied between them but traffic is still blocked. The engineer verifies the contract has a 'permit any' filter. What is most likely missing?

Accepted Answer

In ACI, inter-BD routing within the same VRF requires 'Unicast Routing' to be enabled on each Bridge Domain. Without Unicast Routing enabled, the BD operates as a pure Layer 2 flood domain and the SVI gateway is not active — so hosts in one BD cannot route to hosts in another BD. A contract alone does not enable routing; routing must be functional in the BD first. The VRF in 'Unenforced' mode would actually allow all traffic (not block it). The 'Advertised Externally' flag is for L3Out external advertisement, not internal BD-to-BD routing.

Question 6

On a Cisco Nexus 9000, a network engineer configures the following:

router bgp 65001
    address-family l2vpn evpn
      advertise-pip

In a VXLAN BGP EVPN multi-homed (ESI-based) environment, what is the purpose of the 'advertise-pip' command?

Accepted Answer

In NX-OS VXLAN BGP EVPN with ESI-based multi-homing (active-active), the 'advertise-pip' command under the L2VPN EVPN address-family causes each PE (VTEP) to originate Type-2 (MAC/IP) routes with its unique Physical IP (PIP — the individual loopback address) as the next-hop, in addition to Type-1 routes that may use a shared virtual IP. Without advertise-pip, all Type-2 routes from multi-homed PEs use the anycast VTEP IP, which prevents remote PEs from sending ARP replies or unicast traffic directly to a specific PE in the ES. This is critical for proper ESI multi-homing operation.

Question 7

A network engineer is configuring a vPC peer-link on two Cisco Nexus 9000 switches. Which TWO interface types are supported as the physical members of a vPC peer-link port-channel? (Choose 2)

Accepted Answer

vPC peer-links on Cisco Nexus 9000 are standard Ethernet port-channels. Any supported Ethernet interface speed — including 10GE, 25GE, 40GE, and 100GE — can be used as physical members of the peer-link port-channel. In modern deployments, 100GE interfaces are commonly used for peer-links to accommodate the volume of traffic (including BUM flooding) that transits the peer-link. The question specifically lists 10GE and 100GE as two valid options. Fibre Channel interfaces are not Ethernet and cannot be part of an Ethernet port-channel for a vPC peer-link.

Question 8

On a Cisco Nexus 9000 operating in NX-OS mode (not ACI), the following configuration exists:

interface nve1
    member vni 10010
      mcast-group 239.1.1.1

The engineer wants to migrate to BGP EVPN control plane (ingress replication) for VNI 10010 without disrupting existing hosts. What configuration change is needed under the NVE member VNI?

Accepted Answer

On NX-OS, a VXLAN VNI can use either multicast (mcast-group) or ingress replication (ingress-replication protocol bgp) for BUM traffic handling — but not both simultaneously on the same VNI. To migrate from PIM multicast flood-and-learn to BGP EVPN ingress replication, the 'mcast-group' line is removed and replaced with 'ingress-replication protocol bgp'. The top-level NVE interface also needs 'host-reachability protocol bgp' if not already present. The NVE interface itself does not need to be deleted and recreated — changes to member VNI stanzas take effect immediately.

Question 9

An ACI engineer configures an L3Out on a border leaf with OSPF. After configuration, prefixes from the external router appear in the ACI routing table but EPGs inside the fabric cannot reach external hosts. The engineer checks and the contract between the EPG and the L3Out external EPG exists with the correct filter. What additional ACI L3Out setting is most commonly overlooked in this scenario?

Accepted Answer

In Cisco ACI, for traffic initiated from inside the fabric to reach external destinations via an L3Out, the source EPG's bridge domain must have a subnet configured with the 'Advertised Externally' scope (and optionally 'Shared Between VRFs' for shared services). This causes the BD gateway subnet to be advertised into the L3Out routing protocol, allowing the external router to learn a return path back to the fabric endpoints. Without this, external routers have no route back to the ACI EPG subnets, causing one-way reachability. OSPF area types, default routes, and path types are secondary to this subnet scope requirement.

Question 10

What is a Cisco UCS B-Series blade server chassis maximum blade server density (for the standard UCS 5108 chassis)?

Accepted Answer

The Cisco UCS 5108 blade server chassis supports up to 8 half-width blade servers (e.g., B200 M-series), or 4 full-width blades (e.g., B420 M-series), or any combination thereof. Each blade occupies one or two chassis slots. The chassis contains two IOM (I/O Module) slots that connect blades to the Fabric Interconnects. This 8-server density per chassis is fundamental to UCS capacity planning.

Question 11

A UCS service profile is configured with two vNICs: vNIC-A pinned to Fabric Interconnect A and vNIC-B pinned to Fabric Interconnect B. The operating system on the blade uses NIC teaming. What NIC teaming mode is required to actively use both vNICs simultaneously for load balancing?

Accepted Answer

To simultaneously utilize both vNICs across Fabric Interconnect A and B for active-active load balancing, the operating system NIC team must be configured in an active-active mode such as LACP (802.3ad) or balance-xor. In this mode, both links carry traffic and bandwidth is aggregated. Active-passive mode only uses one vNIC at a time (the other is a standby), so bandwidth is not combined. The Fabric Interconnect does not automatically aggregate bandwidth from separate vNICs — that requires OS-level teaming. Broadcast mode sends all traffic on all interfaces and is used for specific HA scenarios, not load balancing.

Question 12

An administrator needs to configure a UCS service profile to boot a blade server from a SAN LUN. In which order should the boot order items be configured in the Boot Policy to ensure SAN boot is attempted before local disk?

Accepted Answer

In a UCS Boot Policy configured for SAN boot, the vHBA SAN boot entry with primary (and optionally secondary) target WWPN and LUN must be placed first in the boot order so the server attempts to boot from SAN before trying the local disk. The local disk entry is placed second as a fallback. This ensures that if the SAN LUN is available, the server boots from it consistently. The Fabric Interconnect has no inherent preference for SAN boot — the Boot Policy's order dictates the BIOS boot sequence.

Question 13

Cisco UCS Manager uses pools to assign unique identifiers to servers. An engineer notices that new blade servers added to the domain fail to associate with service profiles because the UUID pool is exhausted. What is the correct corrective action?

Accepted Answer

The correct remediation for an exhausted UUID pool is to expand the pool by adding additional UUID blocks (suffix ranges) to the existing pool in UCS Manager. This does not disrupt existing associations. Deleting service profiles (Option A) would disrupt running workloads. Using hardware-default UUIDs (Option C) breaks stateless computing because the UUID is then tied to physical hardware. Creating a separate pool (Option D) works but is less clean than expanding the existing pool and may cause management complexity.

Question 14

A Cisco UCS engineer is troubleshooting a Cisco VIC (Virtual Interface Card) 1400-series adapter in a blade server. The VIC supports both Ethernet and Fibre Channel personalities. To use Fibre Channel over the VIC, what must be configured in the UCS service profile?

Accepted Answer

Cisco VIC adapters (including the 1400 series) support both vNICs (Ethernet) and vHBAs (Fibre Channel / FCoE) as software-defined personalities managed through UCS Manager service profiles. To use FC, a vHBA must be configured in the service profile with an assigned WWPN from a WWPN pool. Additionally, the Fabric Interconnect must have the corresponding uplink port(s) configured for FC or unified port (FCoE) to carry the FC traffic to the SAN. No separate physical HBA is required; the BIOS policy does not control VIC interface personality.

Question 15

A Cisco HyperFlex administrator runs 'hxcli cluster info' on a HyperFlex converged node and sees 'cluster state: unknown'. Network connectivity between nodes is confirmed. What is the most likely cause?

Accepted Answer

The 'unknown' cluster state in HyperFlex typically indicates that the cluster management service cannot collect state from all nodes — most commonly because the Cisco HyperFlex cluster management IP (CMIP) is unreachable from the node running the CLI, or because the Springpath storage management service (stMgr) is not running on one or more cluster nodes. Even with IP connectivity confirmed between nodes, the CMIP is a virtual IP that may be floating, or a specific service could be stopped. Licensing issues produce different errors. vCenter is used for VM management but HyperFlex cluster health is reported independently. Drive failures produce different specific messages.

Question 16

On a Cisco MDS 9000, which command displays the list of all N-ports (servers and storage targets) that have logged into the fabric on a specific VSAN?

Accepted Answer

'show flogi database vsan <id>' (FLOGI = Fabric Login) displays all N-ports that have successfully logged into the fabric on the specified VSAN, including their FCID (Fibre Channel ID), WWPN (World Wide Port Name), and WWNN (World Wide Node Name), and the switch interface they are logged in through. 'show fcns database' shows the Name Server database (registered port attributes after FLOGI). 'show zoneset active' shows the active zone configuration, not logins. 'show interface fc summary' shows port state, not logged-in devices.

Question 17

A storage administrator is configuring iSCSI on a server to connect to a storage array in the data center. Compared to Fibre Channel, what is a primary operational advantage of iSCSI?

Accepted Answer

The primary operational advantage of iSCSI over Fibre Channel is that iSCSI uses standard IP/Ethernet network infrastructure. Organizations can leverage existing Ethernet switches, standard NICs (optionally with iSCSI offload), and IP networking knowledge — avoiding the cost and complexity of a separate FC SAN fabric, dedicated FC switches (like Cisco MDS), and specialized FC HBAs. FC generally provides lower latency for latency-sensitive workloads (Option A is not always true). NVMe-oF over FC or RoCEv2 outperforms iSCSI for high IOPS workloads. iSCSI multipathing requires software (iSCSI initiator with MPIO).

Question 18

A Cisco Nexus 5000 series switch is configured as an FCoE Forwarder (FCF). The switch has VFC interfaces bound to Ethernet ports where servers are connected. A server's FCoE initiator completes FIP login but the FLOGI to the FC fabric fails. The MDS switch shows the Nexus 5000's N-port as logged in to the VSAN. What is the most likely cause of the server FLOGI failure?

Accepted Answer

On a Cisco Nexus 5000 acting as an FCF, each VFC interface must be explicitly added to the correct VSAN using the 'vsan database' → 'vsan interface vfc ' command. The Nexus 5000's N-port in the MDS VSAN confirms the FCF itself has FC fabric connectivity. If the VFC on the server-facing side is not added to the same VSAN, the Nexus 5000 cannot map the server's FLOGI request to that VSAN — the FLOGI fails at the FCF stage. The VSAN must exist on both the Nexus 5000 and the MDS. If 'feature fcoe' were missing, the FCF would not work at all (FIP login would also fail). WWN configuration is on the server NIC driver, not the VFC.

Question 19

Which NX-OS command enables the NX-API feature on a Cisco Nexus switch, allowing programmatic access via HTTP/HTTPS REST calls?

Accepted Answer

'feature nxapi' enables the Cisco NX-API on the Nexus switch, which exposes an HTTP/HTTPS interface (default port 80/443) that accepts JSON or XML-formatted API requests. This is the foundation for programmatic access using REST-style calls to execute NX-OS CLI commands or structured API calls. 'feature restconf' enables RESTCONF (RFC 8040) model-driven API access. 'feature openconfig' enables OpenConfig model support. 'feature telemetry' enables streaming telemetry for monitoring.

Question 20

An engineer uses the Ansible cisco.nxos.nxos_config module to push a multi-line configuration block to a Nexus switch. After the playbook runs, 'changed: true' is reported each time even though the configuration appears to be present on the switch. What is the most likely reason for this behavior?

Accepted Answer

The cisco.nxos.nxos_config module applies configuration lines and checks idempotency by matching the specified lines against the running configuration output. Because NX-OS may abbreviate commands, add default parameters, or format output differently than the input strings in the 'lines' parameter, the module's string-based comparison may fail to confirm the configuration is already present — triggering a push on every run. Purpose-built resource modules (like nxos_vlan, nxos_interface) use structured state comparison and are more reliably idempotent. nxos_config does have partial idempotency but requires exact string matching.

Question 21

A network automation team wants to use Python to collect interface statistics from 50 Nexus switches using NX-API REST. Which HTTP method and endpoint combination is correct for retrieving 'show interface eth1/1' output in JSON format?

Accepted Answer

Cisco NX-API uses HTTP POST to the /ins endpoint for all CLI-based API calls, regardless of whether the command is a show (read) or configuration (write) command. The request body is a JSON payload specifying the 'ins_api' object with 'type' (e.g., 'cli_show'), 'version', 'chunk', 'sid', 'input' (the command), and 'output_format' (json or xml). NX-API does not use GET with query parameters for CLI execution. The /api/mo/ path is used for DME (Data Model Engine) object-based access, not raw CLI execution.

Question 22

Cisco Nexus 9000 supports POAP (Power-On Auto Provisioning) for zero-touch deployment. When a new Nexus switch boots with no startup-config, which sequence of events describes the POAP process?

Accepted Answer

The Cisco POAP (Power-On Auto Provisioning) process on Nexus switches follows this sequence: (1) The switch boots with no startup-config and enters POAP mode. (2) It sends a DHCP Discover on the management interface. (3) The DHCP server returns an IP address and Option 150 or 67 pointing to a TFTP or HTTP server address. (4) The switch downloads the POAP Python script from that server. (5) The script orchestrates downloading the correct NX-OS software image and configuration file, applies them, and the switch reloads with the new configuration. This entire process requires no manual intervention on the switch.

Question 23

An NX-OS administrator wants to configure AAA authentication for login using TACACS+ on a Cisco Nexus switch. Which two commands are required at minimum to direct login authentication to a TACACS+ server at 192.168.1.100?

Accepted Answer

On NX-OS, configuring TACACS+ for login authentication requires two steps: (1) 'tacacs-server host key ' — defines the TACACS+ server with shared secret; and (2) 'aaa authentication login default group tacacs+' — directs login authentication to use the TACACS+ server group. Option B uses RADIUS syntax. Option C only defines the source interface and server group name but does not complete the authentication chain. Option D uses IOS syntax ('aaa new-model' and 'tacacs server' with 'address ipv4') which is not valid NX-OS syntax — NX-OS uses 'tacacs-server host'.

Question 24

In Cisco ACI, a security administrator wants to implement microsegmentation to isolate a specific group of VMs running a PCI-compliant workload. The VMs are currently in a shared EPG used by multiple workload types. The administrator cannot change the VLAN or IP address of the PCI VMs. Which ACI feature allows reclassification of these VMs into a more restrictive policy group without IP/VLAN changes?

Accepted Answer

A uSeg (micro-segmentation) EPG uses attribute-based matching (IP address range, MAC address, or VMware vCenter VM attributes such as VM name or custom tag) to reclassify endpoints from their base EPG into a more specific uSeg EPG — without changing the VM's VLAN, IP address, or any network configuration. Once reclassified, the VM is subject to the contracts defined on the uSeg EPG, enabling stricter policy enforcement for PCI VMs within the existing network architecture. Creating a new BD (Option A) requires IP changes. vzTaboo (Option C) blocks traffic globally from the EPG. Intra-EPG isolation (Option D) blocks all intra-EPG traffic, not just non-PCI.

Question 25

A network security engineer is implementing VRF-based network segmentation on a Cisco Nexus 9000 to isolate a multi-tenant data center. Which NX-OS configuration step is required to associate an existing Layer 3 interface (SVI) with a specific VRF?

Accepted Answer

On NX-OS, a Layer 3 interface (SVI or routed port) is assigned to a VRF using the command 'vrf member <vrf-name>' under the interface configuration. Importantly, adding a VRF member statement removes the existing IP address from the interface (a warning is displayed), so the IP address must be re-configured after the VRF assignment. This is a critical NX-OS behavior difference from IOS, where 'ip vrf forwarding' (Option A) is used — that syntax is not valid on NX-OS. Option C is how the VRF is defined, not how interfaces are assigned. Option D adds static routes within a VRF but does not assign the interface.

350-601 DCCOR — Cisco Data Center Core Specialist