Cisco Certified Network Professional (CCNP) Data Center — Practice Set 1

Question 1

Which NX-OS feature must be enabled before configuring a Virtual Port-Channel (vPC) on a Cisco Nexus switch?

Accepted Answer

The 'feature vpc' command enables the vPC feature on a Nexus switch and is a prerequisite before any vPC domain or peer-link configuration can be applied. Without this, vPC-related commands are rejected. The other features (ospf, fabricpath, lldp) are independent capabilities unrelated to vPC initialization.

Question 2

In a vPC configuration, what is the purpose of the peer-keepalive link?

Accepted Answer

The peer-keepalive link uses UDP hellos (default interval 1 second) over a separate management or Layer 3 path. Its sole purpose is liveness detection: if the peer-link fails, the secondary vPC peer uses the keepalive to verify whether the primary is still alive before bringing up vPC interfaces to avoid a dual-active split-brain scenario. Data forwarding and MAC synchronization occur over the peer-link, not the keepalive link.

Question 3

A network engineer is configuring VXLAN with BGP EVPN on a Cisco Nexus 9000. The NVE interface is configured but remote VTEPs are not appearing in the peer table. Which command provides the most direct visibility into BGP EVPN neighbor state and learned routes?

Accepted Answer

'show bgp l2vpn evpn summary' displays BGP neighbor state specifically for the L2VPN EVPN address family, including the number of prefixes received — directly confirming whether EVPN peering is established and routes are being exchanged. 'show nve peers' only shows VTEP peers that have already been discovered via data-plane or BGP control-plane; if BGP has not converged, this table will be empty. 'show ip pim neighbor' is relevant only to multicast-based VXLAN flood-and-learn, not BGP EVPN.

Question 4

In Cisco ACI, which object directly contains endpoint groups (EPGs) and represents a logical application within a tenant?

Accepted Answer

An Application Network Profile (ANP) is the ACI construct that groups EPGs together to represent an application. EPGs are created inside an ANP. The VRF (context) defines the Layer 3 routing domain, the Bridge Domain provides a flooding/gateway domain analogous to a VLAN + SVI, and the L3Out provides external routed connectivity — none of these directly contain EPGs.

Question 5

Which VXLAN BGP EVPN route type is used to advertise a MAC address and its associated IP address learned by a VTEP?

Accepted Answer

EVPN Route Type 2 (MAC/IP Advertisement) carries both a MAC address and, optionally, an IP address bound to that MAC. This enables remote VTEPs to perform ARP suppression by answering ARP requests locally. Type-1 is used for Ethernet segment redundancy, Type-3 signals inclusive multicast group membership for BUM traffic replication, and Type-5 carries IP prefixes for inter-VRF (L3VNI) routing.

Question 6

A data center engineer needs to extend Layer 2 VLANs between two geographically separate data centers over an IP WAN while preventing spanning tree from extending across the WAN link. Which Cisco technology best meets this requirement?

Accepted Answer

Cisco OTV is explicitly designed for data center interconnect (DCI): it encapsulates Layer 2 frames over an IP or MPLS WAN, contains spanning tree within each site (OTV terminates the STP domain at the edge device via STP isolation), and provides MAC routing over the overlay. VXLAN with static ingress replication extends L2 but does not inherently block STP propagation across the underlay. vPC peer-link extension is not a WAN DCI technology, and FabricPath IS-IS is a campus/DC fabric protocol, not a WAN extension mechanism.

Question 7

On a Cisco Nexus switch, a Virtual Fibre Channel (VFC) interface must be bound to which type of interface to carry FCoE traffic?

Accepted Answer

A VFC interface is a logical Fibre Channel interface that encapsulates FC frames into FCoE. It must be bound to either a physical Ethernet interface or a port-channel (configured as a trunk with the FCoE VLAN allowed) so that FCoE frames can traverse the Ethernet network. Routed Layer 3 and loopback interfaces do not carry Ethernet frames in the way required for FCoE encapsulation, and the management interface is not a data-plane interface.

Question 8

A Cisco Nexus 7000 administrator is planning to use Virtual Device Contexts (VDCs). Which TWO statements accurately describe VDC behavior on the Nexus 7000? (Choose 2)

Accepted Answer

Each VDC on the Nexus 7000 maintains its own independent routing table, protocol processes, and management plane — providing strong administrative isolation. VDC 1 is the default (admin) VDC, is created automatically at boot, and cannot be deleted. Physical interfaces are allocated exclusively to one VDC at a time and cannot be shared simultaneously between VDCs. All VDCs run the same NX-OS image version as the supervisor, and no separate hardware module is required — VDC is a software feature.

Question 9

A network engineer configures VXLAN BGP EVPN distributed anycast gateway on a Cisco Nexus 9000 spine-leaf fabric. Hosts in the same subnet on different leaf switches can ping each other, but inter-subnet routing fails. The engineer examines a leaf and sees the L3VNI is configured but no Type-5 routes appear in the BGP EVPN table. Which configuration element is most likely missing?

Accepted Answer

In NX-OS VXLAN BGP EVPN, the L3VNI is linked to the NVE interface using the 'member vni <l3vni> associate-vrf' command. Without 'associate-vrf', the L3VNI is not associated with the tenant VRF on the NVE interface, so inter-subnet traffic cannot be VXLAN-encapsulated for the routed VNI — resulting in no Type-5 IP prefix routes being generated or imported. 'advertise-pip' is relevant for multi-homing, 'redistribute direct' is used to originate Type-5 routes from connected subnets but requires the L3VNI to be functioning first, and ARP suppression affects Type-2 route behavior, not inter-subnet routing.

Question 10

In Cisco UCS, what is the function of a Service Profile?

Accepted Answer

A UCS Service Profile is the central abstraction in Cisco UCS that decouples server identity from the physical hardware. It encapsulates vNIC/vHBA configurations, MAC addresses, WWNs, UUIDs, boot order, and firmware policies. When associated to a server, the server adopts these identities — enabling stateless computing where workloads can be moved to different physical hardware by reassociating the service profile without reconfiguring the SAN or network. It does not define chassis hardware, store OS images, or configure uplinks.

Question 11

A UCS administrator needs to deploy 50 identical blade servers with the same network, SAN, and boot policies. What is the most efficient UCS method to achieve this?

Accepted Answer

A Service Profile Template defines the common configuration (vNIC policies, boot policies, BIOS policies, etc.) once. Derived service profiles inherit all settings from the template; when the template is updated, all derived profiles are updated automatically. This is far more efficient than creating and maintaining 50 individual profiles. A Server Pool is an availability mechanism that assigns servers to profiles but does not reduce per-profile configuration effort.

Question 12

Which two hardware components in a Cisco UCS domain provide redundant data paths between blade servers and the upstream network and SAN?

Accepted Answer

Cisco UCS uses two Fabric Interconnects (FI-A and FI-B) as the central switching fabric for both Ethernet and Fibre Channel traffic. Each blade server has vNICs assigned to FI-A and vNICs assigned to FI-B, and vHBAs are similarly split — providing redundant paths for network and SAN connectivity. The IOM (I/O Module) in the chassis connects blades to the FIs but does not itself provide the redundant path — the dual-FI design does. APICs are ACI components unrelated to UCS compute paths.

Question 13

Cisco HyperFlex is a hyperconverged infrastructure (HCI) solution. What is the minimum number of nodes required to form a standard HyperFlex cluster?

Accepted Answer

A standard Cisco HyperFlex cluster requires a minimum of 3 converged nodes to satisfy the data replication factor of 2 (RF2) or 3 (RF3). With 3 nodes, the cluster can survive a single node failure while maintaining data availability. A 2-node configuration is not supported as a general production cluster because there would be no surviving majority quorum after a single node loss. Four or more nodes provide greater capacity and fault tolerance but are not the minimum.

Question 14

Cisco Intersight is a cloud-based management platform for UCS infrastructure. Which of the following describes a key advantage of Intersight Managed Mode (IMM) compared to traditional UCS Manager (UCSM)?

Accepted Answer

Cisco Intersight Managed Mode (IMM) shifts UCS management from the on-premises UCSM to a cloud-delivered SaaS platform. Key advantages include global visibility across all UCS domains in one pane of glass, REST API access from Intersight's cloud, intelligent recommendations powered by Cisco's telemetry data, and the use of Intersight policies instead of classic UCSM service profiles. IMM still requires Fabric Interconnects for data-plane operation and does not replace server identity abstraction — it modernizes the management layer.

Question 15

A UCS engineer is troubleshooting a blade server that fails to boot from SAN. The service profile has a vHBA with the correct WWN, and the MDS switch has the correct zone with the initiator and target WWNs. However, FLOGI does not appear on the MDS for this server. Which component should the engineer investigate first?

Accepted Answer

If FLOGI does not appear on the MDS at all, the FC login from the server is never reaching the fabric — the issue is upstream of the MDS. The most likely cause is that the vHBA on the Fabric Interconnect is either not assigned to the correct VSAN, is not connected (e.g., pinned to FI-B when only FI-A has an FC uplink in that VSAN), or the FI uplink port to the MDS is down. The SAN boot policy (Option A) only affects what the server tries to log into after FLOGI succeeds. Zoning affects access after login, not the FLOGI itself. The blade BIOS boot order does not affect whether FC FLOGI occurs.

Question 16

Which Cisco tool is used to manage Cisco UCS C-Series rack servers that are NOT connected to a Fabric Interconnect?

Accepted Answer

The Cisco Integrated Management Controller (IMC) is the embedded server management controller on UCS C-Series rack servers, analogous to IPMI/iDRAC on other vendors' hardware. When C-Series servers are deployed in standalone mode (not connected to a Fabric Interconnect), they are managed individually through IMC via its web GUI, CLI, or XMLAPI. UCSM only manages UCS domains with Fabric Interconnects, APIC manages ACI fabrics, and DCNM manages Nexus switching.

Question 17

In Fibre Channel SANs, which port type represents a node port on a server HBA that connects to the fabric?

Accepted Answer

An N-port (Node port) is the FC port type on a server HBA or storage array target that connects to the fabric. An F-port (Fabric port) is the switch-side port that connects to an N-port device. An E-port (Expansion port) connects two FC switches together (ISL). A G-port (Generic port) is a switch port that auto-negotiates to become an E-port or F-port depending on what connects to it.

Question 18

A storage administrator is configuring zoning on a Cisco MDS 9000. The security policy requires that only specific WWNs can communicate, regardless of which physical port they log in from. Which zoning type should be used?

Accepted Answer

Hard zoning based on WWN (World Wide Port Name — WWPN, or World Wide Node Name — WWNN) enforces access control in hardware at the switch ASIC level based on the identity of the FC device, not its physical port location. This means a server HBA can log into any port on the fabric and still be subject to the correct zoning policy. Port-based hard zoning ties enforcement to physical switch port, which breaks when devices move. Soft zoning is enforced by the name server (software) and can be circumvented. Smart zoning with default permit would allow communication between all non-zoned devices.

Question 19

An engineer configures FCoE on a Cisco Nexus 5000 acting as a Fibre Channel Forwarder (FCF). Hosts connected to access-layer switches (which are FIP Snooping Bridges, not FCFs) are not completing FIP login. The Nexus 5000 is receiving FIP VLAN Discovery Notifications but no FIP FLOGI requests. What is the most likely cause?

Accepted Answer

When access-layer switches act as FIP Snooping Bridges (FSBs), they must have FIP snooping enabled on the FCoE VLAN to properly forward FIP frames (including FIP FLOGI) toward the FCF. Without FIP snooping, FSBs may drop or incorrectly handle FIP frames other than VLAN Discovery. The fact that VLAN Discovery Notifications are being received at the Nexus 5000 confirms the VLAN is trunked correctly (eliminating Option B) and that 'feature fcoe' is active (eliminating Option C). The VFC binding issue (Option D) would affect a different stage of the FCoE initialization, not the FIP FLOGI forwarding.

Question 20

An engineer wants to execute a Python script directly on a Cisco Nexus 9000 switch (on-box). Which NX-OS feature must be enabled first?

Accepted Answer

'feature bash-shell' enables a Linux Bash shell on the Nexus 9000, which is required to run Python scripts directly on the switch (on-box execution) using the embedded Python interpreter. 'feature nxapi' enables the NX-API REST and NX-API CLI interfaces for off-box programmatic access via HTTP/HTTPS — it does not enable on-box scripting. 'feature restconf' enables RESTCONF model-driven programmability. 'feature telemetry' enables streaming telemetry.

Question 21

A DevOps engineer uses the Ansible cisco.nxos collection to configure VLANs on multiple Nexus switches. Which module should be used to create VLAN 100 and set its name to 'Production'?

Accepted Answer

The cisco.nxos.nxos_vlan module is specifically designed to manage VLANs on Nexus switches. It accepts parameters for vlan_id and name, ensuring idempotent VLAN creation — it will only make changes if the VLAN does not exist or does not match the desired state. nxos_interface manages interface configurations, nxos_config pushes raw CLI lines (less idiomatic), and nxos_vrf manages VRF instances.

Question 22

NX-API on a Cisco Nexus switch supports two message formats for API responses. Which two formats are supported?

Accepted Answer

Cisco NX-API supports both XML and JSON as response formats for REST-style API calls over HTTP/HTTPS. The client specifies the desired format in the request payload (e.g., 'ins_api': {'type': 'cli_show', 'output_format': 'json'}). XML was the original format; JSON was added later for easier integration with modern tooling. YAML, TOML, CSV, and protobuf are not native NX-API response formats.

Question 23

An automation engineer sends an NX-API REST POST request to a Nexus 9000 at the endpoint /ins with a JSON payload containing a 'show version' command. The switch returns HTTP 200 but the response body contains error code 'cli_error'. What is the most likely cause?

Accepted Answer

An HTTP 200 response with 'cli_error' in the body indicates that NX-API received and processed the request but the NX-OS CLI returned an error for the command itself. This occurs when a syntactically invalid NX-OS command is sent, or when a configuration command (e.g., 'interface eth1/1') is submitted as type 'cli_show' rather than 'cli_conf'. If NX-API were disabled, the HTTP connection itself would fail (connection refused). The correct NX-API JSON key is 'input' for the command string. NX-API uses HTTP POST for all requests regardless of whether show or config commands are sent.

Question 24

Cisco TrustSec uses Security Group Tags (SGTs) for policy enforcement in data center networks. Where is the SGT applied to traffic in a TrustSec domain?

Accepted Answer

In Cisco TrustSec, an SGT is assigned to an endpoint at the point of network ingress — typically when the endpoint authenticates via 802.1X or MAC Authentication Bypass (MAB) against Cisco ISE. The SGT is embedded in the Cisco Meta Data (CMD) header (or inline tag) and propagates with the traffic through the TrustSec domain. SGACLs are then enforced at the egress switch near the destination based on source/destination SGT pairs. The spine does not assign tags, and the SGT model is independent of VLAN membership.

Question 25

A Nexus 9000 administrator needs to protect the switch control plane from a high rate of OSPF hellos arriving from an untrusted interface that is flooding the CPU. Which NX-OS feature provides rate-limiting of control-plane traffic to protect the CPU?

Accepted Answer

Control Plane Policing (CoPP) is the NX-OS mechanism specifically designed to rate-limit traffic destined for the switch's CPU (control plane). It uses a modular QoS CLI (MQC) policy map applied to the control plane, classifying traffic into categories (e.g., routing protocols, management, ICMP) and applying police actions to each class. This prevents CPU exhaustion from high-rate protocol floods. Port Security limits MAC addresses on an access port, DHCP Snooping rate-limit only affects DHCP packets per port, and IP Source Guard validates source IP addresses — none of these protect the entire control plane.

350-601 DCCOR — Cisco Certified Network Professional (CCNP) Data Center