350-601

DCCOR 350-601 Exam Details

Domain Weight Breakdown

Certification Path & Prerequisites

The 350-601 DCCOR is the core exam required for the CCNP Data Center certification. Candidates must also pass one concentration exam (such as 300-610 DCID, 300-615 DCIT, 300-620 DCACI, 300-625 DCSAN, or 300-635 DCAUTO) to earn the full CCNP Data Center credential. Passing DCCOR alone also earns the Cisco Certified Specialist - Data Center Core designation.

The exam covers five major data center technology domains: networking protocols and fabric architectures, compute platforms (Cisco UCS), storage networking (Fibre Channel, FCoE, iSCSI), automation and orchestration, and data center security. Candidates should have three to five years of experience implementing and operating data center technologies before attempting this exam.

Tip: The Networking and Compute domains together account for 50% of the exam. Focus heavily on VXLAN/EVPN overlays and UCS architecture for the best score impact.

VXLAN (Virtual Extensible LAN)

VXLAN is the primary overlay encapsulation technology in modern data center fabrics. It extends Layer 2 segments over a Layer 3 underlay network, enabling scalable multi-tenancy beyond the 4094 VLAN limit.

Tip: VXLAN uses a MAC-in-UDP encapsulation model. The 24-bit VNI maps to VLANs locally on each VTEP, enabling L2 extension across L3 boundaries.

VXLAN with BGP EVPN Control Plane

BGP EVPN (Ethernet VPN, address family L2VPN EVPN) replaces flood-and-learn with a standards-based control plane for VXLAN. It distributes MAC and IP reachability information via MP-BGP, enabling efficient forwarding without data-plane flooding.

• Route Type 2 (MAC/IP Advertisement): Distributes host MAC and IP bindings learned on local VTEPs to all remote VTEPs. Enables silent host detection and ARP suppression.
• Route Type 3 (Inclusive Multicast Ethernet Tag): Autodiscovers VTEPs participating in a given VNI and builds the ingress replication list for BUM (Broadcast, Unknown unicast, Multicast) traffic.
• Route Type 5 (IP Prefix Route): Advertises IP prefixes for inter-VNI (inter-subnet) routing across the fabric, enabling distributed anycast gateway routing.
• ARP Suppression: The VTEP answers ARP requests locally using the EVPN MAC/IP binding table, reducing broadcast flooding across the fabric.
• Distributed Anycast Gateway: All leaf switches share the same gateway IP and virtual MAC (e.g., via fabric forwarding anycast-gateway-mac), providing optimal first-hop routing regardless of which leaf the host is connected to.

OTV (Overlay Transport Virtualization)

OTV extends Layer 2 domains across geographically separated data centers over a Layer 3 transport network without the risks of traditional L2 DCI (no STP propagation).

• Edge Device: Performs OTV encapsulation/decapsulation. Has a join interface (facing the transport) and internal interfaces (facing the local site).
• MAC-in-IP Encapsulation: OTV wraps original L2 frames in an IP/GRE header for transport across the WAN.
• STP Isolation: OTV does NOT forward BPDUs between sites, preventing STP loops across the DCI link.
• AED (Authoritative Edge Device): For each VLAN, one OTV edge device per site is elected as the AED to forward traffic, preventing duplicate frames.
• Use Case: Data center interconnect (DCI) for VM mobility, disaster recovery, and workload migration without merging STP domains.

LISP (Locator/Identifier Separation Protocol)

LISP separates endpoint identity (EID) from network location (RLOC), enabling host mobility and multi-homing without renumbering. Used in Cisco SD-Access as the control plane protocol.

Data Center Routing Protocols

Tip: In a modern VXLAN/EVPN fabric, eBGP is used for underlay reachability (advertising loopback/VTEP IPs) and iBGP with EVPN address family is used for overlay MAC/IP advertisement. Spine switches serve as iBGP route reflectors.

vPC (Virtual Port Channel)

vPC allows two Nexus switches to appear as a single logical switch to downstream devices, providing active-active redundancy without STP blocking. Critical for data center access and aggregation layer designs.

Consistency Checks: Type 1 (strict) parameters must match exactly or the vPC will not come up (e.g., STP mode, VLAN membership, MTU). Type 2 (graceful) parameters should match but will only generate warnings (e.g., STP port priority, storm control).

FEX (Fabric Extender)

Cisco Nexus Fabric Extenders (e.g., Nexus 2000 series) act as remote line cards of a parent Nexus switch. The FEX itself has no local control plane; all forwarding decisions are made by the parent switch. FEX connects to the parent via FEX fabric interfaces (typically 10G or 40G uplinks) and presents host-facing ports (1G or 10G) to servers.

• Straight-through FEX: FEX connected to a single parent switch.
• Active-Active FEX (dual-homed): FEX uplinks to two parent switches in a vPC pair, providing redundancy.
• Benefits: Simplified management (single point of configuration), reduced switch count in ToR deployments, centralized policy enforcement.

Spine-Leaf Architecture

The spine-leaf (Clos) topology is the standard data center fabric design. Every leaf switch connects to every spine switch, providing consistent low-latency paths and predictable bandwidth scaling.

• Leaf Switches: Top-of-rack (ToR) switches connecting servers, storage, and firewalls. Act as VTEPs in VXLAN fabrics.
• Spine Switches: Interconnect all leaf switches. Provide only transit/forwarding; no host connections. Serve as BGP route reflectors in EVPN designs.
• Border Leaf: Connects the fabric to external networks (WAN, internet, other DCs). Handles inter-fabric and north-south traffic.
• Equal-Cost Multi-Path (ECMP): All paths from any leaf to any other leaf traverse exactly one spine hop, enabling full ECMP utilization.

Cisco UCS Architecture Overview

Cisco Unified Computing System (UCS) integrates compute, networking, storage access, and virtualization into a single cohesive system managed by a central controller. UCS eliminates the traditional silos between server, network, and storage teams.

Service Profiles & Service Profile Templates

The service profile is the foundational concept in UCS management. It is a software definition of a server that encapsulates the complete identity and configuration of a physical server, including its BIOS settings, firmware policy, boot policy, network identity (MAC, WWNN, WWPN), and storage connectivity.

• Service Profile: Defines UUID, MAC addresses, WWNs, VLAN/VSAN membership, boot order, BIOS policy, firmware packages, QoS policies, and server pool assignment. Associating a service profile to a blade or rack server provisions it completely.
• Initial Template: Creates service profiles that are independent copies. Changes to the template do NOT propagate to already-created profiles. Use when individual customization is needed.
• Updating Template: Created service profiles remain bound to the template. Changes to the template automatically propagate to all associated profiles. Ideal for consistent fleet management.
• Server Mobility: If a blade fails, the service profile (identity) can be migrated to a spare blade. The replacement server boots with the same UUID, MAC, and WWN, so the SAN and network see it as the same server — zero reconfiguration on storage or network side.

Tip: Updating templates are the recommended best practice. They ensure consistency across all servers derived from the same template and simplify firmware and policy rollouts at scale.

UCS Manager vs. Cisco Intersight

Server Provisioning & Firmware Management

• Boot Policy: Defines the boot order — local disk, SAN boot (from specific WWPN target/LUN), iSCSI boot, PXE, or virtual media. SAN boot is the preferred method in enterprise DCs for stateless computing.
• Host Firmware Package: Bundles blade BIOS, adapter firmware, board controller, and storage controller firmware into a single manageable unit. Apply to service profiles for consistent firmware across the fleet.
• Maintenance Policy: Controls when firmware changes take effect — immediate, user-ack (admin approves reboot), or scheduled timer window. Prevents unplanned downtime during firmware updates.
• Server Pools: Group servers by characteristics (e.g., blade type, location). Service profiles use pool-based assignment so that any qualifying server can receive the identity. Enables rapid failover and scaling.
• Management IP Pool: Assigns out-of-band management IPs (KVM) to each server from a defined CIMC address pool.

Blade Servers vs. Rack Servers

Fibre Channel (FC) Fundamentals

Fibre Channel is a lossless, high-performance storage networking protocol designed for block-level storage access. It provides dedicated, deterministic bandwidth for storage traffic with guaranteed in-order delivery.

Tip: The FC login sequence is always FLOGI (fabric) → PLOGI (port-to-port) → PRLI (process). Remember this order for exam questions about FC initialization.

FC Zoning

Zoning is the FC equivalent of access control. It restricts which initiators can communicate with which targets within the SAN fabric, providing security and reducing unnecessary RSCN (Registered State Change Notification) traffic.

Best Practice — Single-Initiator, Single-Target Zoning: Each zone should contain one server HBA (initiator) and one storage port (target). This minimizes RSCN disruption and simplifies troubleshooting. A zoneset is a collection of zones; only one zoneset can be active per VSAN at a time.

VSANs (Virtual SANs)

VSANs segment a physical SAN fabric into independent virtual fabrics, similar to VLANs in Ethernet. Each VSAN has its own name server, zone database, and fabric services. Traffic between VSANs requires an inter-VSAN routing (IVR) device.

• VSAN 1: Default VSAN. All FC ports are initially in VSAN 1. Best practice is to create custom VSANs and move ports out of VSAN 1.
• VSAN 4079: Isolated VSAN. Ports assigned here cannot communicate with any other VSAN. Used as a parking VSAN for unused ports.
• VSAN 4094: Isolated VSAN (another reserved). Both 4079 and 4094 are reserved for isolation purposes.
• VSAN Trunking: ISL (Inter-Switch Link) ports can carry multiple VSANs using VSAN trunking (E_port becomes TE_port). Only allowed VSANs are carried across the trunk.

FCoE (Fibre Channel over Ethernet)

FCoE encapsulates Fibre Channel frames within Ethernet frames, allowing FC and Ethernet traffic to share the same physical infrastructure. This enables I/O consolidation — a single Converged Network Adapter (CNA) replaces separate NICs and HBAs.

Tip: FCoE requires lossless Ethernet (PFC must be enabled on the storage CoS class). FC is inherently lossless with credit-based flow control; FCoE must emulate this via PFC on the Ethernet side.

iSCSI (Internet Small Computer Systems Interface)

iSCSI transports SCSI commands over standard TCP/IP networks, enabling block-level storage access without dedicated FC infrastructure. Uses TCP port 3260.

• Initiator: The client (server) that sends SCSI commands. Can be software-based (OS driver) or hardware-based (iSCSI HBA/TOE card).
• Target: The storage system presenting LUNs via iSCSI. Identified by an iSCSI Qualified Name (IQN), e.g., iqn.2024-01.com.storage:array01.
• CHAP Authentication: Challenge-Handshake Authentication Protocol secures initiator-target connections. Can be unidirectional (target verifies initiator) or mutual/bidirectional.
• MPIO (Multipath I/O): Multiple iSCSI sessions across different network paths for redundancy and load balancing.
• Advantages: Uses existing Ethernet infrastructure, lower cost than FC, easier to manage. Suitable for SMB and non-latency-critical workloads.

NVMe over Fabrics (NVMe-oF)

NVMe-oF extends NVMe (Non-Volatile Memory Express) across a network fabric, providing ultra-low-latency access to remote flash storage. Transport options include NVMe/FC (over Fibre Channel), NVMe/RoCE (RDMA over Converged Ethernet), and NVMe/TCP.

• NVMe/FC: Runs NVMe commands natively over Fibre Channel. Leverages existing 32G/64G FC infrastructure. Supported on MDS 9000 series switches.
• NVMe/TCP: Runs over standard TCP/IP; no RDMA or FC required. Easiest to deploy on existing Ethernet infrastructure.
• Key Advantage: NVMe supports 64K queues with 64K commands per queue (vs. SCSI single queue of 32 commands), delivering massive parallelism and lower latency for modern flash storage.

Storage Policies in UCS

• vHBA (Virtual HBA): Defined in the service profile. Specifies WWPN, VSAN assignment, and QoS for FC/FCoE connectivity from the server to the SAN fabric.
• SAN Boot Policy: Configures the server to boot from a specific SAN target by defining primary and secondary boot paths (WWPN of the storage target + LUN ID).
• WWNN/WWPN Pools: Pools of World Wide Names assigned to service profiles. Ensures consistent identity even when physical servers are replaced.
• Storage Connection Policy (Intersight): Defines FC or iSCSI connectivity parameters, including VSAN/VLAN, target information, and authentication settings.

Cisco ACI (Application Centric Infrastructure)

ACI is Cisco's SDN solution for data centers. It uses a centralized controller (APIC) to manage a spine-leaf fabric built on Nexus 9000 switches running in ACI mode. ACI shifts from traditional CLI-based per-device configuration to a declarative policy model.

ACI Policy Model (Logical Constructs)

ACI uses a hierarchical object model where all configuration is defined as managed objects in a tree structure (MIT — Management Information Tree). The key logical constructs are:

Tip: ACI follows a whitelist security model — all traffic between EPGs is denied unless explicitly permitted by a contract. Traffic within the same EPG is allowed by default. This is the opposite of traditional networking where all traffic is allowed unless blocked by an ACL.

Contracts, Subjects, and Filters

• Contract: Applied between a provider EPG (offers a service) and a consumer EPG (consumes the service). Contracts are directional but can be bidirectional.
• Subject: A grouping within a contract that references one or more filters. Subjects can also apply service graphs (L4-L7 devices like firewalls or load balancers).
• Filter: Defines Layer 3/4 match criteria (IP protocol, ports). Example: TCP port 443 (HTTPS), TCP port 3306 (MySQL). Filters are reusable across multiple contracts.
• vzAny: A shortcut to apply a contract to all EPGs in a VRF simultaneously. Useful for shared services (DNS, NTP, monitoring).
• Preferred Group: EPGs within a preferred group can communicate freely without contracts. Only traffic to/from non-preferred-group EPGs requires explicit contracts.

Ansible for Data Center Automation

Ansible is the most widely used automation tool for Cisco data center environments due to its agentless architecture and extensive module library for NX-OS, ACI, UCS, and Intersight.

NX-OS Programmability & REST APIs

• NX-API REST: RESTful API on Nexus switches. Accepts JSON/XML payloads over HTTPS. Enabled with feature nxapi. Accessible via https://<switch-ip>/ins for NX-API CLI or /api for NX-API REST.
• NX-API CLI: Sends CLI commands via HTTP POST (JSON-RPC). Useful for migration from CLI scripts to API-based automation. Returns structured JSON output.
• NETCONF/YANG: Model-driven programmability using YANG data models over NETCONF (SSH, port 830). Supports candidate configuration, commit/rollback, and granular configuration retrieval.
• gRPC/gNMI: High-performance streaming telemetry protocol. Supports dial-in and dial-out telemetry subscriptions for real-time monitoring of interface stats, BGP state, etc.
• Python on NX-OS: Nexus switches include an embedded Python interpreter and the NX-OS SDK (cisco.nxos). Scripts can be run directly on the switch via python or scheduled as EEM (Embedded Event Manager) actions.
• ACI REST API: APIC exposes its entire object model via REST API at https://<apic>/api. All GUI and CLI operations can be replicated via API. Uses token-based authentication (POST to /api/aaaLogin.json).

Data Center Security

VXLAN vs. VLAN

vPC vs. Traditional Port Channel

FC vs. FCoE vs. iSCSI

UCS Service Profile: Initial vs. Updating Template

ACI Mode vs. NX-OS Standalone Mode (Nexus 9000)

OTV vs. VXLAN for Data Center Interconnect (DCI)

Tip: For new data center builds, VXLAN/EVPN with Multi-Site is the recommended DCI approach. OTV is primarily relevant for legacy or non-EVPN environments. Know both technologies for the exam, but understand that VXLAN/EVPN is the strategic direction.