The Implementing Cisco Data Center Core Technologies (350-601 DCCOR) (350-601)

The correct answers are A and C. In Cisco UCS Manager RBAC, the privilege required to configure NTP providers, date, and time zone settings is Ext LAN Security (ext-lan-security). Cisco’s UCS Manager privileges documentation explicitly states that this privilege allows a user to configure NTP providers and date/time zone settings, which directly matches the second requirement in the question.

To add VLANs in Cisco UCS Manager, the required privilege is Ext LAN Policy (ext-lan-policy). Cisco documents that this privilege allows a user to configure LAN settings on the fabric interconnect, including VLANs and VLAN groups, along with other LAN policies. That maps exactly to the first requirement of adding VLANs into the existing UCS Manager configuration.

The other options are not correct for these tasks. Service Profile Network Policy, Service Profile Compute, and Service Profile Config are service-profile-related privileges and do not grant control over global fabric VLAN creation or NTP/time-zone configuration. Because the question asks for one privilege for VLAN administration and one for NTP/date/time settings, the verified combination is A and C.

The correct answer is A. Enhanced LACP.

In a Cisco ACI VMware VMM domain, the policy used for host uplink connectivity depends on how the ESXi hosts connect to the ACI leaf switches. The question states that vPC must connect to the leafs and the environment uses VMware Distributed Virtual Switch (DVS) 6.6. When hosts are dual-homed to ACI leaves using vPC, Cisco ACI uses Enhanced LACP as the preferred uplink policy because it provides active-active link utilization, fast convergence, and consistent forwarding behavior across both leaf switches.

MAC pinning is typically used when LACP is not available or not desired, but it does not provide the same standards-based port-channel negotiation and is not the best match when the requirement explicitly calls for vPC connectivity. Tag collection is related to VM attribute collection for policy mapping, not uplink formation. LLDP transmit helps with discovery and visibility, but it does not establish the host-to-leaf port-channel behavior.

Because the design specifically requires vPC attachment of VMware hosts through a supported DVS, the required ACI policy is Enhanced LACP.

The correct answer is D. through dual fabric interconnects.

Cisco UCS X-Series achieves management high availability by using a pair of Fabric Interconnects (FIs), which provide redundant connectivity and management-plane resiliency for the chassis and its components. In UCS architecture, the fabric interconnects are the central control and management point for the compute domain, so deploying them as a redundant pair ensures that management access and infrastructure communication continue if one FI fails.

Option A is incorrect because UCS Director is an orchestration platform, not the native HA mechanism for UCS-X management components. Option B is incorrect because UCS Manager is associated with classic UCS domains and is not described as separate redundant manager instances in this context. Option C is also incorrect because Cisco Intersight is a SaaS or appliance-based management platform, but UCS-X high availability at the domain level is not achieved by running multiple Intersight instances.

The actual device-level resiliency for management in UCS-X comes from the redundant fabric interconnect design, which protects management and connectivity paths for the chassis, I/O, and compute resources. Therefore, dual fabric interconnects are the correct answer.

The correct answer is B because Cisco OSPF MD5 authentication on an interface requires two specific elements: enabling message-digest authentication and defining a message-digest key. On Cisco platforms, the correct syntax is:

ip ospf authentication message-digest

ip ospf message-digest-key < key-id > md5 < encryption-type > < password >

In this question, the engineer must use MD5 and store the password using 3DES encryption, which corresponds to encryption type 3 in Cisco syntax. Therefore, ip ospf message-digest-key 2 md5 3 P@ssw01 is the valid form. The key ID can be any matching integer on both neighbors, and here it is 2.

Option A is incorrect because authentication-key is used for simple password authentication, not MD5 message-digest authentication. Option C is incorrect because ip ospf authentication md5 is not the NX-OS/IOS syntax used here; Cisco uses authentication message-digest. Option D is invalid because authentication-key does not take md5 in that format.

So the issue is resolved only by enabling message-digest authentication and configuring the MD5 key with encryption type 3, which is exactly what B does.

NX-API Sandbox is an interactive development utility that allows an administrator to enter familiar NX-OS CLI commands and view the corresponding API request and response structures. It can generate example code and display message formats such as XML and JSON, making it appropriate for translating traditional CLI operations into programmatic requests. JSON-RPC is an API message protocol, not the interactive translation and code-generation utility requested. Guest Shell supplies a Linux container in which scripts and tools can run, but it does not itself translate CLI commands into XML or JSON requests. Open NX-OS describes the broader programmability architecture and open interfaces available in NX-OS rather than a specific translation utility. Therefore, NX-API Sandbox is the tool that directly satisfies both the CLI translation and code-generation requirements on the Nexus platform.

Cisco APIC accepts a properly structured JSON authentication payload containing an aaaUser managed object and an attributes object. The username and password must be represented as valid quoted JSON name-value pairs. Option C follows valid JSON syntax and supplies both required authentication attributes. Option A resembles a JavaScript object literal but is not valid JSON because its property names and string values are not enclosed in quotation marks. Options B and D attempt to use XML, but their element and attribute structures do not match the required APIC XML authentication format. The JSON payload is sent through an HTTP POST request to the APIC login URI. If authentication succeeds, APIC returns an aaaLogin response containing a token. That token is then presented with subsequent API requests to maintain the authenticated management session.

Option B is correct because on Cisco Nexus NX-OS, the command aaa authentication login default group < server-group > local creates the default login authentication method list and tells the switch to try the named AAA server group first, then fall back to the local user database if the AAA servers are unreachable or do not respond. Cisco’s NX-OS AAA documentation states that the default login method list is used for user logins, and that the group keyword points authentication to a configured TACACS+ or RADIUS server group. It also notes that local authentication is the fallback method unless that behavior is explicitly disabled. (Cisco)

The key reason the answer is B is the syntax: group ISE local means “authenticate with the TACACS+ server group named ISE first, then use local if the server is unavailable.” Option C uses only local authentication, so it does not use TACACS+ at all. Option D applies to console login configuration and is not the correct default user-login command. Option A is incorrect syntax for enabling this behavior; Cisco documents fallback error local as a behavior that is already present by default and can be disabled with the no form. (Cisco)

The correct answer is B. In Cisco UCS Manager, a user’s effective access is determined by the combination of role and locale. The role defines what the user is allowed to do, while the locale defines where in the organizational hierarchy those permissions apply. Cisco UCS organizations are hierarchical, with root at the top. When a locale includes the root organization, the permissions associated with the user’s role extend throughout the organizational tree beneath root, which provides consistent access across all UCS domain organizations.

That is why adding root to the relevant locale is the correct action to ensure the network-admin account has the same privileges everywhere. Changing the role to admin is unnecessary and would grant broader privileges than required. Removing the dev locale would reduce scope, not standardize access across all organizations. Assigning the operations role changes the privilege set rather than extending the existing network-admin permissions consistently.

So the required fix is not to change the role, but to make the locale apply at the root level, which is exactly what option B accomplishes.

A logical-configuration backup contains service profiles, VLANs, VSANs, pools, policies, and other logical server-configuration objects. It excludes administrative and system-specific settings such as usernames, roles, locales, and management-network configuration. This makes it the correct choice when server configuration must be migrated while the destination system uses different network and administrative settings. A system-configuration backup contains administrative and system settings rather than the required server objects. A full-state backup is a binary snapshot designed for disaster recovery and recreating an entire UCS system, making it unsuitable for a selective import. An all-configuration backup includes both logical and system settings and would migrate settings that the scenario explicitly requires to remain different. Cisco identifies logical configuration as an importable XML backup containing service profiles, VLANs, VSANs, pools, and policies. Cisco UCS backup types