Cisco Certified Internetwork Expert (CCIE) Data Center — Practice Set 1

Question 1

A Nexus 9000 leaf is configured for VXLAN BGP EVPN. The following is displayed:

leaf1# show bgp l2vpn evpn
  BGP routing table information for VRF default
  Route Distinguisher: 10.0.0.1:32867
  *>i[2]:[0]:[0]:[48]:[aabb.cc00.0100]:[32]:[10.1.1.10]/272
                        10.0.0.2           100      0 65000 i

The local leaf has ARP requests for 10.1.1.10 but never sends them onto the fabric. What must be configured on the bridge domain SVI to enable ARP suppression using this BGP EVPN Type-2 route?

Accepted Answer

On NX-OS, ARP suppression for VXLAN BGP EVPN is enabled per-SVI with the command 'ip arp suppression' under the VLAN SVI interface (e.g., 'interface Vlan100'). When a leaf receives a Type-2 route carrying an IP binding, it populates a local ARP suppression cache. With 'ip arp suppression' on the SVI, the leaf intercepts ARP requests from local hosts and answers them from this cache, preventing ARP flooding across the VXLAN fabric. The NVE interface member vni stanza does not accept 'ip arp suppression'. The BGP EVPN address-family has no such sub-command.

Question 2

In a Cisco ACI fabric, a network engineer needs to allow communication between all EPGs within a VRF without creating individual contracts. Which ACI feature should be used?

Accepted Answer

ACI Preferred Group allows EPGs that are marked as members of the preferred group within a VRF to communicate with each other without requiring explicit contracts. It implements an 'open' model where member EPGs are trusted to communicate freely. vzAny simplifies contract attachment by applying a contract to all EPGs in a VRF at once, but still requires a contract to be defined and attached. vzTaboo is used to explicitly deny traffic. Intra-EPG isolation does the opposite — it restricts communication within a single EPG. Preferred Group is the correct tool for open intra-VRF communication without individual contract management.

Question 3

A VXLAN BGP EVPN fabric uses a distributed anycast gateway. Leaf switches have identical gateway MAC and IP addresses for each VNI. A host in VNI 10010 sends a packet to a host in VNI 20020. Which BGP EVPN route type carries the inter-VNI (inter-subnet) prefix information between VTEPs?

Accepted Answer

EVPN Type-5 (IP Prefix Route) is used to advertise IP prefixes — typically host routes (/32 or /128) or subnet prefixes — between VTEPs for inter-subnet (L3VNI) routing. When a VTEP performs inter-VRF routing for a host, it originates a Type-5 route carrying the host's IP prefix associated with the L3VNI, allowing remote VTEPs to route to that destination. Type-2 carries MAC+IP bindings within a single L2 segment. Type-3 signals BUM traffic replication group membership. Type-4 is used for multi-homed Ethernet segment election.

Question 4

An ACI engineer needs to allow a specific EPG to initiate connections to an external network (L3Out) while preventing the external network from initiating connections into the EPG. Which ACI contract role assignment achieves this?

Accepted Answer

In ACI, traffic is permitted based on the contract's filter entries, but the provider/consumer roles determine which side can initiate the connection in conjunction with stateful policy. When the internal EPG is the provider and the L3Out external EPG is the consumer, ACI enforces the contract from consumer to provider — meaning the external network (consumer) initiates, while the EPG (provider) responds. To allow the EPG to initiate outbound, the EPG should be the consumer (initiator) and L3Out should be the provider. However, the question asks the EPG to initiate while blocking external initiation. In ACI's stateless contract model, both directions defined in filters are allowed symmetrically, but typically the EPG-as-provider with L3Out-as-consumer controls which direction the 'service' contract applies. The standard design for outbound-only internet access is EPG as consumer, L3Out as provider — but for 'EPG initiates, external cannot': EPG is consumer. The correct answer given the choices is A — EPG as provider allows the EPG to respond but in practice bilateral filter traffic passes in ACI unless stateful rules are applied. Given the available options, the correct ACI design to restrict external initiation is EPG as provider with appropriate unidirectional filter.

Question 5

A CCIE candidate is designing a VXLAN BGP EVPN fabric with multi-homed servers (servers connected to two leaf switches via active-active port-channel). Which TWO BGP EVPN route types are specifically used in the Ethernet Segment (ES) multi-homing process? (Choose 2)

Accepted Answer

In EVPN multi-homing, Type-1 (Ethernet Auto-Discovery) routes serve two purposes: per-EVI (Ethernet VPN Instance) routes enable aliasing (load balancing toward multi-homed CEs) and per-ES routes enable mass withdrawal (when a PE detects a link failure, it withdraws its Type-1 routes to trigger fast convergence without withdrawing individual Type-2 routes). Type-4 (Ethernet Segment) routes are used by PEs sharing the same Ethernet Segment to elect a Designated Forwarder (DF) responsible for BUM traffic forwarding toward the multi-homed CE — preventing duplication. Type-2, Type-3, and Type-5 serve different purposes unrelated to the multi-homing election and withdrawal mechanism.

Question 6

An engineer is reviewing a Nexus 9000 NX-OS configuration snippet:

interface nve1
    no shutdown
    source-interface loopback0
    host-reachability protocol bgp
    member vni 10010
      ingress-replication protocol bgp
    member vni 99900 associate-vrf

What is the role of VNI 99900 in this configuration?

Accepted Answer

The 'associate-vrf' keyword on a member VNI within the NVE interface configuration designates that VNI as an L3VNI (Layer 3 VNI) associated with a tenant VRF. The L3VNI is used to carry inter-subnet routed traffic between VTEPs within the same VRF — it is the VXLAN encapsulation identifier for the routed VRF context. VNI 10010 (without 'associate-vrf') is the L2VNI used for VLAN-to-VNI mapping and MAC learning. The BGP EVPN control plane uses the standard BGP session, not a special VNI.

Question 7

In Cisco ACI, a vzTaboo contract is configured between two EPGs. What is the effect of a vzTaboo contract?

Accepted Answer

A vzTaboo contract in ACI creates explicit deny rules for the filter entries defined within it. When applied, matching traffic is dropped even if another regular permit contract would otherwise allow it — vzTaboo takes precedence. This is analogous to an explicit deny ACE at a higher priority than any permit rule. vzTaboo does not perform logging, QoS queuing, or cross-VRF operations — its sole function is to create deny entries in the forwarding policy that cannot be overridden by regular contracts.

Question 8

A Cisco ACI L3Out is configured with OSPF to a physical router. The external router advertises prefix 192.168.100.0/24. An EPG needs to communicate with this external prefix. The contract is applied between the EPG (consumer) and the L3Out external EPG (provider). Endpoints in the EPG can ping the external router's interface but cannot reach 192.168.100.0/24 hosts. What is the most likely misconfiguration?

Accepted Answer

In Cisco ACI, an L3Out external EPG must have explicit subnet entries configured with the scope 'External Subnets for the External EPG' (the 0.0.0.0/0 or specific prefix) to classify external traffic into the external EPG for contract enforcement. Without this subnet scope, ACI does not classify traffic from 192.168.100.0/24 as belonging to the L3Out external EPG, so the contract is never matched. Pings to the router's own interface succeed because the router interface IP is typically included in the L3Out node profile, but transit destinations require explicit external EPG subnet classification. The OSPF route provides reachability, but ACI's policy model still requires the external EPG classification.

Question 9

On a Cisco Nexus 9000 in NX-OS mode, a vPC domain is configured. After a planned maintenance where the peer-link goes down, the secondary vPC switch suspends all vPC member ports. An engineer wants to prevent this behavior and allow the secondary to continue forwarding if it can verify the primary is unreachable via the keepalive. What NX-OS vPC command enables this behavior?

Accepted Answer

'auto-recovery' in the vPC domain configuration allows a vPC switch to restore vPC member ports after a reload or peer-link failure, provided the keepalive confirms the peer is unreachable (not just the peer-link) — preventing a permanently suspended secondary. Normally, after a peer-link failure, if the secondary cannot determine whether the primary is alive via keepalive, it suspends vPC ports. With auto-recovery (and a configurable delay timer), the secondary switch can re-assume active status. 'peer-gateway' enables the vPC peer to route packets destined to the peer's MAC address. 'layer3 peer-router' enables direct Layer 3 routing between vPC peers.

Question 10

In Cisco UCS stateless computing, a blade server running a critical application fails. The administrator wants to recover by moving the application identity to a spare blade with zero reconfiguration of the SAN or network. Which sequence of actions accomplishes this?

Accepted Answer

The core value of UCS stateless computing is that the server's identity (MAC addresses, WWNs, UUID, boot policy) is encapsulated in the service profile, not burned into hardware. When the failed blade's service profile is disassociated and re-associated to the spare blade, the spare blade receives the exact same MACs and WWNs as the original — so SAN zoning, network ACLs, and external configurations require no changes. Option A requires physical hardware manipulation. Option C creates a new identity requiring SAN and network reconfiguration. Option D requires OS re-imaging and SAN reconfiguration.

Question 11

A UCS engineer creates an Updating Service Profile Template. Which behavior distinguishes an Updating template from an Initial template?

Accepted Answer

In Cisco UCS Manager, service profile templates exist in two modes: 'Updating' (also called Updating Type) and 'Initial'. Profiles derived from an Updating template maintain a live link to the template — any change to the template (e.g., a new vNIC policy or boot policy) is automatically propagated to all derived service profiles. Profiles derived from an Initial template receive a one-time copy of the template settings at creation time; subsequent template changes do not affect already-derived profiles. This distinction is fundamental to UCS lifecycle management at scale.

Question 12

A Cisco HyperFlex cluster with replication factor 2 (RF2) has 4 nodes. One node fails. An engineer observes that the HyperFlex cluster is still online but the datastore is read-only. What is the correct interpretation of this behavior?

Accepted Answer

In Cisco HyperFlex with RF2, every data block must have exactly 2 copies distributed across different nodes. When a node fails, the cluster immediately loses one copy of the blocks that were on that node. The remaining 3 nodes can serve reads (data is still accessible), but the cluster cannot write new data without potentially violating RF2 — there is now insufficient redundancy to guarantee 2 copies for new writes (the cluster needs to rebuild first). HyperFlex enters a protected read-only state to prevent data loss. This is not a quorum issue (3 of 4 nodes maintain quorum). HyperFlex does not auto-demote replication factors.

Question 13

An architect is designing a Cisco UCS domain for a financial services workload that requires zero unplanned downtime. Which TWO design choices directly provide hardware-level redundancy for server-to-fabric connectivity? (Choose 2)

Accepted Answer

Dual Fabric Interconnects with vNICs split across FI-A and FI-B (Option A) ensure that if one FI fails, the server retains its network connectivity through the surviving FI. Similarly, assigning vHBAs across both FIs in a service profile (Option B) provides redundant SAN paths — if FI-A's FC uplink or the FI itself fails, SAN traffic continues via FI-B. Option C provides management plane HA (UCSM stays reachable) but does not provide data-plane connectivity redundancy. A third cold standby FI (Option D) is not a supported UCS design pattern for active-active redundancy. Server pool policies (Option E) are provisioning automation, not connectivity redundancy.

Question 14

Cisco Intersight is being used to manage UCS servers in Intersight Managed Mode (IMM). An administrator needs to configure a network policy that defines VLANs and QoS for server vNICs. What is the IMM equivalent of the UCSM vNIC template?

Accepted Answer

In Cisco Intersight Managed Mode (IMM), the LAN Connectivity Policy defines vNIC configurations including placement, VLAN assignments, and adapter settings — functionally equivalent to vNIC templates in classic UCSM. The Ethernet Network Policy defines the allowed VLANs for a vNIC (analogous to a VLAN group in UCSM). The Network Control Policy controls behaviors like CDP/LLDP advertisement on vNICs. A vNIC Adapter Policy tunes advanced adapter settings (interrupt count, completion queue, etc.). The LAN Connectivity Policy is the top-level policy that binds vNICs to servers, combining what UCSM handled through vNIC templates and service profile network configuration.

Question 15

A UCS engineer needs to ensure a blade server always boots from a specific SAN LUN on a Cisco MDS storage array. The service profile must encode the boot target's WWPN and LUN ID. Where in the UCS service profile is this configured?

Accepted Answer

In Cisco UCS, the SAN boot target (the storage array's WWPN and the LUN ID) is configured in the Boot Policy under a SAN boot device. The Boot Policy defines the ordered list of boot devices; a SAN entry in the boot policy specifies the primary and secondary target WWPNs along with the LUN. The vHBA defines the server-side FC initiator identity (WWPN/WWNN) but not the target. The Storage Profile with Disk Group Policy manages local disk configuration (RAID, JBOD), not SAN boot. The BIOS Policy controls CPU and memory settings, not OS-level boot targets.

Question 16

On a Cisco MDS 9000, an administrator creates a zone with a single initiator WWPN and multiple target WWPNs. After activating the zoneset, the initiator can see all targets. Another team's initiator cannot access these targets even though it logs into the same VSAN. What does this confirm about the zoning model in use?

Accepted Answer

On Cisco MDS 9000, the default zone (the implicit zone for devices not explicitly assigned to a zone) can be configured with a policy of 'permit' or 'deny'. When set to 'deny' (the recommended secure setting), any device that is not included in an active zone cannot communicate with any other device. The behavior described — where non-zoned initiators cannot see the targets — is the result of the default zone deny policy, not specifically soft vs hard zoning (both types enforce this in conjunction with the default zone policy). If the default zone were 'permit', all devices in the VSAN could communicate regardless of zoning.

Question 17

A Cisco MDS 9000 administrator is setting up an Inter-Switch Link (ISL) between two MDS directors in separate VSANs. The engineer wants to carry multiple VSANs over a single physical ISL without manually configuring one E-port per VSAN. Which MDS feature achieves this?

Accepted Answer

Cisco MDS VSAN Trunking allows a TE-port (Trunking E-port) to carry multiple VSANs over a single physical FC ISL, similar to VLAN trunking on Ethernet. The TE-port negotiates with the remote TE-port and the administrator uses 'switchport trunk allowed vsan <list>' to specify which VSANs are permitted on the trunk. NPV mode is used at edge switches to reduce fabric management complexity but does not aggregate VSANs on an ISL. FCIP extends FC over IP networks (WAN). PortChannel aggregates multiple ISL links for bandwidth and redundancy but does not carry multiple VSANs on a single link.

Question 18

NVMe over Fabrics (NVMe-oF) is increasingly deployed in data centers for low-latency storage access. Which transport protocol for NVMe-oF provides the lowest latency by using RDMA over a lossless Ethernet network?

Accepted Answer

NVMe over RoCEv2 achieves the lowest latency by using RDMA (Remote Direct Memory Access), which allows direct memory-to-memory transfers between storage and compute nodes, bypassing the operating system kernel and CPU for data movement. This requires a lossless Ethernet network (Priority Flow Control — PFC, and optionally ECN for congestion control). FC-NVMe also achieves very low latency over FC fabric but requires FC HBAs. NVMe/TCP is the most flexible (any IP network) but has higher CPU overhead and latency than RDMA-based transports. NVMe over iSCSI is not a standard NVMe-oF transport.

Question 19

An engineer writes a Python script to run on a Cisco Nexus 9000 (on-box) using the nxos module. The script imports cli and runs a 'show interface' command. The engineer notices the output includes escape characters and XML-like formatting. Which function should be used to obtain structured JSON output instead of raw CLI text?

Accepted Answer

In the NX-OS on-box Python environment, the nxos module provides several functions: 'cli()' returns raw CLI text output, 'clip()' prints formatted output, and 'clid()' returns structured JSON (dictionary) output — the 'd' stands for dictionary. When a command supports structured output via DME/NX-API, 'clid()' returns a Python dictionary parsed from the JSON response, making it suitable for programmatic processing without string parsing. 'xmlcli()' is not a standard NX-OS on-box function, and 'restcli()' is not a native on-box API call.

Question 20

A network automation engineer uses Ansible with the cisco.nxos collection to manage Nexus switches. After a change window, the engineer runs a playbook with the nxos_vlan module and observes 'changed: false' for all tasks even though the VLANs were manually deleted from the switches during the window. What is the most likely cause?

Accepted Answer

Ansible check mode ('check_mode: yes' or running the playbook with '--check') performs a dry run: modules query the device to determine what changes would be made but do not apply any configuration. In check mode, a module reports 'changed: true' if a change would be needed, but when reporting back to the user it can sometimes be misread. However, if 'check_mode' is accidentally set to 'yes' in the playbook, no changes are ever applied to the device, and the module will report based on whether the desired state differs from current state. The nxos_vlan module fully supports idempotency. Ansible does not cache device state between playbook runs. NX-API failures would generate error output, not silent 'changed: false'.

Question 21

An automation engineer uses the ACI REST API to create a new EPG. The HTTP POST is sent to:
  https://<apic>/api/mo/uni/tn-Production/ap-WebApp/epg-Frontend.json
The APIC returns HTTP 400 with error code 'RBAC error'. What is the most likely cause?

Accepted Answer

An RBAC (Role-Based Access Control) error from the ACI APIC REST API indicates the authenticated user lacks sufficient privileges to perform the requested operation on the specified object. The Distinguished Name (DN) 'uni/tn-Production/ap-WebApp/epg-Frontend' specifies the exact object path; an RBAC error means the user's security domain and role do not grant write access to that tenant or ANP. A payload JSON error would return a different error code (e.g., invalid object). A missing parent object would return a 'not found' or integrity violation error. The ACI API does not require a GET before POST.

Question 22

Cisco DCNM (now Nexus Dashboard Fabric Controller) provides fabric management for NX-OS-based data centers. Which deployment model does Nexus Dashboard use for DCNM-equivalent functionality?

Accepted Answer

Cisco Nexus Dashboard (ND) is a Kubernetes-based platform that hosts multiple data center management applications — including Nexus Dashboard Fabric Controller (NDFC, formerly DCNM), Nexus Dashboard Insights, and Nexus Dashboard Orchestrator. It is deployed as an OVA on VMware/KVM, as an ISO on bare-metal servers, or on purpose-built Cisco ND hardware appliances (ND-NODE). It is not a single-VM standalone product, not an NX-OS feature, and while some Cisco cloud management exists via Intersight, Nexus Dashboard itself is on-premises or co-managed.

Question 23

In Cisco ACI, micro-segmentation is achieved using uSeg (micro-segmentation) EPGs. A uSeg EPG uses attribute-based policies to classify endpoints. Which attribute can be used to dynamically classify a VM into a uSeg EPG without changing the VM's VLAN?

Accepted Answer

ACI uSeg EPGs enable micro-segmentation by classifying endpoints based on attributes rather than VLAN or port alone. Supported attributes include IP address, MAC address, and — via VMM domain integration with VMware vCenter — VM-level attributes such as VM name, operating system, custom tag, or datacenter. This allows an endpoint to be reclassified into a more restrictive policy group dynamically without changing its network configuration (VLAN, IP, etc.). Physical port attributes are used in static path binding, not uSeg. The VLAN and bridge domain define the base EPG — uSeg EPGs override the base classification.

Question 24

On a Cisco Nexus 9000, the existing CoPP policy is being reviewed. The following class-map is defined:

class-map type control-plane match-any COPP-CLASS-CRITICAL
    match access-group name COPP-ACL-BGP

A network engineer wants to change the police rate for BGP traffic from 36000 pps to 50000 pps. In which part of the NX-OS MQC policy configuration is this change made?

Accepted Answer

In NX-OS Modular QoS CLI (MQC), the class-map defines the traffic classification (what to match) and the policy-map defines the actions (what to do). The police action — specifying the rate, burst, and conform/exceed actions — is configured under the policy-map type control-plane in the class stanza that references the class-map. The command syntax is: 'policy-map type control-plane ' → 'class ' → 'police rate 50000 pps'. ACLs define match criteria only; class-maps reference ACLs for matching; policy-maps apply policing. CoPP is applied to the control-plane, not a specific interface like mgmt0.

Question 25

A security architect is implementing Cisco TrustSec in a data center with Cisco Nexus switches and Cisco ISE. Servers are classified into SGT 10 (Web tier) and SGT 20 (Database tier). The policy requires that Web tier servers can initiate TCP connections to Database tier servers on port 1521, but the Database tier cannot initiate connections to the Web tier. Where is the SGT Access Control List (SGACL) policy defined and downloaded from in this architecture?

Accepted Answer

Cisco ISE (Identity Services Engine) is the central policy server for TrustSec. SGT-to-SGT communication policies (SGACLs) are defined in ISE's TrustSec policy matrix and downloaded to network devices — including Nexus switches — via the RADIUS protocol (specifically the TrustSec RADIUS attributes and PAC — Protected Access Credential). Switches download the SGACL policy at authentication time and refresh it periodically or via CoA. While static SGACLs can be configured locally on switches (Option A) for fallback, the centralized ISE model is the standard enterprise deployment. DCNM and ACI APIC are not the authoritative sources for TrustSec SGACL policy.

350-601 DCCOR — Cisco Certified Internetwork Expert (CCIE) Data Center