Cisco Data Center Design Specialist — Practice Set 1

Question 1

Why is it a best practice to minimize the Spanning Tree Protocol (STP) domain in a modern data center design?

Accepted Answer

In data center environments, STP is undesirable because reconvergence after a topology change (even with RSTP) introduces traffic disruption (typically 1–4 seconds for port transitions), and STP inherently blocks redundant paths to prevent loops — preventing ECMP utilization of all uplinks. Modern DC designs use routing protocols (BGP, OSPF) at the access layer (routed access) or VXLAN/EVPN to achieve sub-second convergence and full ECMP across all paths. STP CPU overhead and VLAN limitations are not the primary design concerns.

Question 2

A data center architect is designing the vPC peer-keepalive path. The architect has two options: use a dedicated out-of-band management network or use a Layer 3 SVI on the same switches (in-band). What is the recommended best practice for the peer-keepalive path?

Accepted Answer

The vPC peer-keepalive link must be reachable even when the peer-link and production network fail. Using the out-of-band management network (or a dedicated routed link separate from production traffic) ensures that when the peer-link goes down, the secondary vPC peer can use the keepalive to determine whether the primary is alive. If the keepalive uses the same production path as the peer-link, a simultaneous failure of both would leave the secondary unable to determine the primary's state — potentially causing it to remain suspended or assume dual-active incorrectly. The keepalive must never traverse the peer-link itself.

Question 3

A data center design uses a routed access layer (Layer 3 to the top-of-rack switch) instead of a traditional Layer 2 access design. What is the primary benefit of this design?

Accepted Answer

A routed access layer design runs a routing protocol (typically BGP or OSPF) from the access switch upward, enabling ECMP load balancing across all available uplinks from day one. This eliminates STP blocking, reduces convergence time to milliseconds (routing protocol timers vs STP timers), and provides loop-free equal-cost multipathing at every tier. The trade-off is that VLAN boundaries are limited to each access switch (no Layer 2 stretching), so VM mobility across racks requires an overlay like VXLAN. Routed access does not inherently simplify VXLAN — it is complementary to VXLAN.

Question 4

A data center network uses BGP as the underlay routing protocol in a spine-leaf fabric. Compared to OSPF, what is a key design advantage of BGP for large-scale data center underlay routing?

Accepted Answer

In large-scale data center fabrics (such as those used by hyperscalers), eBGP is preferred over OSPF as the underlay protocol because each leaf and spine can be in its own AS (unnumbered BGP), providing autonomous failure domain isolation. BGP's rich policy mechanisms (communities, local preference, MED) enable traffic engineering that OSPF cannot match. BGP also scales horizontally without the flooding/SPF concerns of OSPF in very large fabrics. OSPF can converge faster with tuned timers in small fabrics, and both protocols require ECMP configuration. BGP does require IP addresses on interconnects unless unnumbered BGP is used.

Question 5

In a data center with a vPC domain, an architect wants to use HSRP on the two vPC peer switches to provide a default gateway for servers. The architect notices that with standard HSRP, the standby vPC peer forwards traffic to the HSRP active peer across the peer-link, adding a hop. Which Cisco feature eliminates this peer-link hop for gateway traffic?

Accepted Answer

The 'vpc peer-gateway' command in the vPC domain configuration enables each vPC peer to locally respond to traffic destined to the other peer's MAC address (including the HSRP virtual MAC and the peer's own MAC). Without this feature, frames sent to the standby peer using the active's MAC are forwarded across the peer-link unnecessarily. With peer-gateway enabled, the receiving peer processes these frames locally, eliminating the suboptimal peer-link hop for gateway traffic. VRRP, OSPF, and GLBP do not solve this specific vPC HSRP traffic path problem.

Question 6

An architect is designing a spine-leaf fabric where each leaf connects to every spine with 25GE links. There are 4 spines. A server connects to the leaf with two 10GE links. What is the oversubscription ratio at the leaf if each leaf has 48 × 10GE downlinks and 4 × 25GE uplinks?

Accepted Answer

Oversubscription ratio = total downlink bandwidth ÷ total uplink bandwidth. Downlinks: 48 × 10 Gbps = 480 Gbps. Uplinks: 4 × 25 Gbps = 100 Gbps. Oversubscription = 480 ÷ 100 = 4.8:1. This is a common calculation in data center design — a 4.8:1 ratio is acceptable for most enterprise workloads where not all servers transmit at line rate simultaneously. Option C incorrectly counts uplink bandwidth as bidirectional. Option D counts only one uplink. Option A would require equal downlink and uplink capacity.

Question 7

A network architect is selecting a data center network topology. The design requires that any server can communicate with any other server with a predictable, consistent latency (any-to-any). Which topology best meets this requirement?

Accepted Answer

A spine-leaf (two-tier Clos) topology provides consistent any-to-any latency because every leaf connects to every spine, ensuring that any two servers (on the same or different leaves) are always exactly two hops apart (leaf → spine → leaf). This equal-hop-count property is fundamental to the Clos topology. Three-tier topologies have variable hop counts depending on source and destination location. Ring and bus topologies are not used in modern data center network design.

Question 8

An architect designs a VXLAN BGP EVPN fabric for a multi-tenant data center. Each tenant must have isolated routing. Which VXLAN component provides per-tenant Layer 3 routing isolation?

Accepted Answer

In VXLAN BGP EVPN multi-tenancy, each tenant is assigned a dedicated VRF (Virtual Routing and Forwarding instance) for routing isolation. The L3VNI (Layer 3 VNI) is the VXLAN encapsulation identifier associated with that VRF — it is used to carry inter-subnet routed traffic between VTEPs within the same tenant VRF. L2VNIs provide per-VLAN segment isolation but do not provide Layer 3 routing separation. Per-tenant SVIs exist but routing isolation is enforced by the VRF, not the SVI alone. BGP AS numbers are for the underlay routing protocol and are not per-tenant.

Question 9

A large enterprise has two data centers and needs to extend Layer 2 VLANs between them over an MPLS WAN while preventing STP from spanning the WAN link. The solution must also provide a centralized control point for MAC routing decisions. Which Cisco DCI technology is most appropriate?

Accepted Answer

Cisco OTV is specifically designed for data center interconnect over IP or MPLS WANs. OTV features STP isolation at each site (BPDUs are not forwarded over the OTV overlay), an Adjacency Server for control-plane MAC learning, and a site VLAN mechanism to prevent duplicate flooding. OTV provides MAC routing over the overlay, giving a centralized control point for MAC reachability. VXLAN BGP EVPN DCI is also valid for modern deployments but is not the traditional Cisco OTV answer for this specific set of requirements. Q-in-Q does not inherently block STP. OMP is for SD-WAN routing, not L2 extension.

Question 10

A company operates two ACI fabrics in different data centers and wants to extend policies and EPGs between them. Which Cisco solution provides a centralized policy orchestration layer for multi-site ACI deployments?

Accepted Answer

Cisco Multi-Site Orchestrator (MSO), now called Nexus Dashboard Orchestrator (NDO), is the centralized management and policy orchestration platform for ACI Multi-Site deployments. NDO manages multiple APIC domains (sites), allowing administrators to define schemas and templates that stretch EPGs, VRFs, and Bridge Domains across sites — ensuring consistent policy enforcement. NDO communicates with each site's APIC cluster independently. DCNM/NDFC manages NX-OS fabric deployments, not ACI multi-site policy. The vCenter plugin manages VMM integration per-site. A second APIC cluster would create a separate fabric, not extend policies.

Question 11

In a VXLAN BGP EVPN fabric, an architect must choose between a centralized L3 gateway and a distributed anycast gateway for inter-subnet routing. What is the primary advantage of a distributed anycast gateway?

Accepted Answer

With a distributed anycast gateway, every leaf switch is configured with the same virtual IP and MAC for each VNI gateway. When a host sends inter-subnet traffic, it is routed locally at the first-hop leaf — the packet is encapsulated into VXLAN with the L3VNI and forwarded directly to the destination leaf's VTEP. This eliminates the hairpin through a centralized gateway, reducing east-west latency and removing the central gateway as a bottleneck. L3VNIs are still required. BGP EVPN route types are unchanged. Distributed gateway actually distributes policy enforcement rather than centralizing it.

Question 12

A network architect is evaluating data center interconnect options: dark fiber, DWDM, and SD-WAN. The company has two data centers 50 km apart with very high bandwidth requirements (multiple 100GE circuits). Which interconnect option provides the highest bandwidth at the lowest cost per bit over this distance?

Accepted Answer

For very high bandwidth data center interconnect over distances where dark fiber may not be owned or available, DWDM is the most cost-effective option. DWDM multiplexes dozens to hundreds of wavelengths over a single fiber pair, each wavelength carrying 100 Gbps or 400 Gbps — achieving aggregate bandwidths of tens of terabits per second on a single fiber pair. This dramatically reduces cost per bit compared to running multiple separate fiber pairs. Dark fiber (Option B) requires owning or leasing fiber and is less efficient per fiber strand. SD-WAN over broadband cannot provide the required bandwidth. MPLS VPN has higher cost per bit at extreme bandwidths.

Question 13

A data center architect is designing a Cisco UCS domain for 200 blade servers. Which component provides the centralized management plane for the entire UCS domain, including service profile management and policy enforcement?

Accepted Answer

Cisco UCS Manager (UCSM) is embedded in the Fabric Interconnect pair and provides centralized management for the entire UCS domain — including service profile creation and association, pool management (MAC, WWN, UUID), firmware management, BIOS policies, and fault management. UCSM runs in an active/standby model across the two Fabric Interconnects. The IMC is used only for standalone C-Series rack servers not connected to FIs. APIC manages ACI fabrics and is not a UCS management platform. vCenter manages virtual machines but does not manage UCS hardware identity.

Question 14

An architect is designing a compute environment for a virtualized workload that requires shared storage access from all hypervisor hosts and flexible scale-out. Which UCS deployment model best meets these requirements?

Accepted Answer

For virtualized workloads requiring shared storage access from all hypervisor hosts (necessary for vSphere HA, vMotion, and DRS), UCS B-Series blades connected to Fabric Interconnects with SAN (FC via MDS or FCoE) or NAS storage is the traditional enterprise design. The Fabric Interconnects provide centralized switching for both LAN and SAN traffic, and shared block storage (SAN) allows all hosts to access the same datastores. Standalone C-Series with local storage prevents vMotion. HyperFlex clusters do provide shared storage across nodes but Option D incorrectly describes it as no-replication isolated storage.

Question 15

A solutions architect is sizing a Cisco HyperFlex cluster for a production workload that requires 48 TB of usable storage capacity with a replication factor of 2 (RF2). How much raw storage must be provisioned across the cluster nodes (assuming no spare capacity)?

Accepted Answer

With Replication Factor 2 (RF2), Cisco HyperFlex stores exactly 2 copies of every data block across different nodes. To achieve 48 TB of usable capacity, the cluster requires 48 TB × 2 = 96 TB of raw storage. RF2 is not erasure coding — it is full mirroring, so the overhead is exactly 2x. RF3 would require 3x raw capacity (144 TB for 48 TB usable). This calculation is fundamental to HyperFlex cluster sizing. Additional overhead for spare capacity, metadata, and cluster filesystem should also be factored into a real-world deployment.

Question 16

An architect is choosing between N+1 and N+2 HA design for a VMware vSphere cluster running mission-critical workloads on Cisco UCS B-Series. What does N+2 HA provide that N+1 does not?

Accepted Answer

In vSphere HA cluster design, N+1 means the cluster has one extra host's worth of compute capacity reserved — allowing all VMs from one failed host to be restarted on remaining hosts. N+2 means two hosts' worth of capacity is reserved — tolerating two simultaneous host failures. N+2 is appropriate for mission-critical workloads where the probability of a second failure during the repair window is non-negligible. N+2 requires more physical servers (more capital expense) but provides higher availability. N+2 does not imply vSphere FT (which is per-VM continuous availability, not a cluster-level HA setting).

Question 17

A company wants to manage multiple Cisco UCS domains globally from a single cloud-based portal with cross-domain visibility, automated recommendations, and policy-based management. Which management option achieves this?

Accepted Answer

Cisco Intersight in Intersight Managed Mode (IMM) provides a cloud-delivered SaaS management platform that centralizes management of multiple UCS domains globally. It offers cross-domain inventory, health, and policy management in a single pane of glass, along with AI/ML-driven recommendations based on telemetry from Cisco's installed base. This eliminates the need for per-domain UCSM management and provides API-first automation capabilities. Separate UCSM instances with CSV exports do not provide unified management. A single global FI pair is not a valid design for geographically distributed sites. Prime Infrastructure is an enterprise network management tool, not a UCS-specific manager.

Question 18

In a Fibre Channel SAN design, what is the best practice regarding the number of initiator WWPNs (server HBAs) per zone?

Accepted Answer

Single-initiator zoning is the industry best practice for FC SANs. Each zone contains exactly one initiator WWPN (the server's HBA port) along with the target WWPNs (storage array ports) that the initiator is permitted to access. This limits the blast radius of any fault or misconfiguration — a rogue or failing initiator cannot affect other initiators' sessions. Single-initiator zoning also improves security by minimizing which devices each initiator can communicate with. Placing all devices in one zone creates a single flat broadcast domain that is unmanageable and insecure. Separating all initiators and all targets in two zones does not work because zone members communicate only within their zone.

Question 19

A storage network architect is designing an FCoE fabric. The design uses Cisco Nexus 5000 series switches as Fibre Channel Forwarders (FCFs). Which design consideration must the architect address when deploying FCoE on the access Ethernet switches that connect servers?

Accepted Answer

When access-layer Ethernet switches are not FCFs but pass FCoE traffic toward an FCF (like a Cisco Nexus 5000), they must support FIP (FCoE Initialization Protocol) Snooping. FIP Snooping Bridges (FSBs) inspect and enforce FIP frames, preventing unauthorized FCoE logins and ensuring only legitimate FCoE initialization traffic is forwarded to the FCF. Without FIP Snooping, the access switch passes all FCoE traffic indiscriminately, creating security gaps. Access switches do not need to be FC switches, do not need to run NX-OS, and FCoE does not inherently require jumbo frames for standard Ethernet FCoE segments (though it is recommended for some deployments).

Question 20

A storage architect is designing an NVMe over Fabrics (NVMe-oF) solution using RoCEv2 (RDMA over Converged Ethernet v2). Which Ethernet quality-of-service mechanism is mandatory on all switches in the NVMe-oF RoCEv2 fabric to ensure lossless delivery?

Accepted Answer

RDMA (including RoCEv2) is highly sensitive to packet loss — even a single dropped packet can cause an RDMA operation to fail or significantly impact performance because RDMA does not use TCP's loss recovery. Priority Flow Control (PFC, IEEE 802.1Qbb) provides per-priority-class pause frames that allow a receiver to pause a specific CoS queue on its upstream neighbor when its buffer is filling — creating a lossless Ethernet environment for RDMA traffic. All switches in the fabric must support and have PFC enabled on the RDMA priority queue. ECN (Explicit Congestion Notification) is also recommended (DCB/DCQCN) for congestion management, but PFC is the mandatory lossless mechanism. Jumbo frames reduce fragmentation but do not prevent loss.

Question 21

A storage architect is selecting between a modular FC SAN director (such as Cisco MDS 9710) and a fixed-configuration modular switch (such as Cisco MDS 9396) for a large enterprise SAN. What is the primary advantage of the director-class switch?

Accepted Answer

The primary design advantage of a director-class MDS switch (such as the MDS 9710 or 9706) over a fixed-configuration switch is the support for In-Service Software Upgrades (ISSU) and redundant supervisor modules. ISSU allows NX-OS software upgrades to be applied without taking the switch offline — critical for 24/7 SAN environments. Redundant supervisors ensure that a supervisor failure does not cause a SAN outage. Both directors and fixed-configuration MDS switches support modern FC speeds. Director-class switches have higher initial cost (not lower). ISL trunking is independent of switch class.

Question 22

An architect is designing Day-0 provisioning for new Cisco Nexus switches. The goal is zero-touch deployment where the switch auto-provisions its software and configuration upon first boot. Which Cisco Nexus feature enables this?

Accepted Answer

POAP (Power-On Auto Provisioning) is the Cisco NX-OS feature that enables zero-touch deployment of Nexus switches. When a Nexus switch boots with no startup-config, POAP automatically triggers a DHCP request on the management interface. The DHCP server returns an IP address and a pointer to a TFTP or HTTP server. The switch downloads a POAP Python script, which orchestrates downloading the appropriate NX-OS image and configuration file. POAP eliminates the need for any manual console configuration for Day-0 deployment. ZTP via USB requires physical access. ISSU is for upgrades, not initial provisioning.

Question 23

A DevOps team wants to apply Infrastructure-as-Code (IaC) principles to Cisco UCS deployments. Which tool would allow the team to define UCS domain configurations (service profiles, policies, pools) declaratively in code and manage them using version control?

Accepted Answer

Terraform with the Cisco UCS or Intersight Terraform provider enables true Infrastructure-as-Code for UCS deployments. Terraform declarative configuration files (HCL) describe the desired state of UCS objects (service profiles, pools, policies, vNIC templates), and Terraform calculates the diff and applies changes in a structured, version-controllable, and repeatable manner. This fulfills IaC principles: versioning, code review, automated apply, and state tracking via Terraform state files. Ansible ad-hoc commands are procedural and lack state tracking. Manual GUI configuration is not IaC. CLI scripts via SSH are not declarative and have no state management.

Question 24

An automation architect is designing an ACI deployment using intent-based networking principles. The team wants to define the application network policy (tenants, EPGs, contracts) in a version-controlled repository and apply them automatically. Which tool is best suited for this?

Accepted Answer

The cisco.aci Ansible collection provides purpose-built modules (aci_tenant, aci_vrf, aci_bd, aci_epg, aci_contract, etc.) that interact with the APIC REST API to manage ACI logical objects. Storing Ansible playbooks in a Git repository enables version control, code review, CI/CD pipeline integration, and automated policy deployment — fulfilling intent-based networking IaC principles. The APIC GUI is manual and not version-controlled. Nexus Dashboard Insights provides observability and recommendations but not policy-as-code deployment. VMware NSX-T is a separate SDN platform.

Question 25

A data center architect is designing a Day-2 automation platform for ongoing operational management of a Cisco NX-OS spine-leaf fabric. The platform must provide real-time anomaly detection, flow telemetry analysis, and automated fault correlation. Which Cisco solution is designed specifically for this operational intelligence use case?

Accepted Answer

Cisco Nexus Dashboard Insights (NDI) is the application on the Nexus Dashboard platform specifically designed for Day-2 operational intelligence for data center fabrics. NDI collects telemetry from ACI and NX-OS fabrics, performs AI/ML-based anomaly detection, provides flow analysis (using Streaming Telemetry and Network Assurance Engine technology), and correlates faults across the fabric. This makes it the appropriate tool for the described use case. NDFC (formerly DCNM) handles Day-0/1/2 fabric provisioning but not advanced anomaly detection. Intersight Workload Optimizer focuses on compute workload placement. Catalyst Center is for campus/enterprise networks, not data center fabric.

300-610 DCID — Cisco Data Center Design Specialist