Domain 1: Network
- A routed fabric replaces a large bridged domain because failures stop at a routed boundary and equal cost paths can all forward at once. The consequence is that layer two adjacency, where an application genuinely needs it, has to be carried as an overlay rather than provided by the underlay.
- An overlay encapsulates the original frame and carries it across the routed underlay. The network identifier in the header is what keeps two tenants using identical addressing entirely separate, and the tunnel endpoint on each leaf is what terminates the encapsulation, which is why the spine can stay a simple routed transit.
- A distributed anycast gateway puts the same gateway address and the same hardware address on every leaf that carries a segment. That is what allows a workload to keep its default gateway wherever it lands, and it is the property that makes mobility across the fabric transparent.
- Encapsulation overhead pushes a full sized frame past an underlay limit sized for ordinary frames. The symptom is a small test packet succeeding while large transfers fail, which reads as an application fault and is a transmission unit fault.
- In a controller managed fabric, the access policy chain is the seam between the physical world and the logical one. Almost every new deployment problem is a tenant object referencing a physical construct nobody built, so an endpoint group that looks correct and passes no traffic is usually a missing domain or attachable entity profile.
- Traffic between endpoint groups is denied until a contract permits it. A default of deny is what makes the policy readable, because every permitted flow appears somewhere as a deliberate statement rather than as the absence of a rule.
- A virtual port channel lets a downstream device see one logical peer across two switches, so both uplinks forward and losing one upstream switch becomes a link failure rather than an outage. The peer keepalive is deliberately routed away from the peer link so that one failure cannot take both.
- Multi-pod keeps one control plane across locations while multi-site keeps one per site. The distinction decides how far a failure travels, which is the whole reason a designer chooses between them.
Domain 2: Compute
- A service profile holds the identity of a server rather than the server holding its own. Because identity travels with the profile, replacing failed hardware becomes a matter of moving a profile rather than reconfiguring a storage array and a network.
- Identities are drawn from managed pools rather than from a spreadsheet, which removes the duplicate address that is the most common cause of a server that boots and cannot reach its storage. An identity must be retired deliberately, because the next server to draw it inherits everything the last one could reach.
- An updating template propagates changes to every profile derived from it; an initial template does not. The choice decides whether a later change is one action or fifty, and equally whether an accidental change is one mistake or fifty.
- The fabric interconnects carry both the server aggregation and the management plane for the domain, which is why they are always deployed as a redundant pair and why the chassis modules are extensions of them rather than independent switches.
- A maintenance policy decides whether a disruptive change is applied at once or held for a window. Setting it deliberately is the cheapest protection there is against a change that reboots a production server the moment somebody saves it.
- In a cloud operated model, policy is authored centrally and enforced locally. Workloads keep running when connectivity to the platform is lost, because the fabric enforces the policy it already holds.
- Processor overcommitment works because most workloads idle most of the time and fails when they stop idling together. Rising ready time inside the guests is the signal, and it explains a machine that feels slow while its own utilisation looks unremarkable.
- Accelerated servers are bought for their accelerators, so the measure that matters is whether those accelerators are busy. Low accelerator utilisation with a quiet fabric points at the data path rather than the network.
Domain 3: Storage Network
- A worldwide name is permanent and a fabric address is assigned at login. Zoning is written against the permanent name so that it survives a device being recabled, which is exactly what a port based zone does not do.
- Zoning on the switch and masking on the array are two halves of one permission and both are required. A host that is correctly zoned and sees no storage has almost always had one half done and the other forgotten, and the two usually belong to different teams.
- Single initiator zoning keeps one server port with the storage ports it needs. It stops one misbehaving server disturbing another and keeps state change notifications small, which is why it is the standard recommendation.
- A zone set that was written and never activated is the single most common storage change failure. It takes one command to confirm, which makes it the right first check rather than the last.
- Thin provisioning reports capacity in full and consumes it on write, so an array can run out of real capacity while every host still believes it has room. Monitoring the pool rather than the volumes is the price of the efficiency.
- Synchronous replication acknowledges a write only once both arrays hold it, which guarantees no loss and puts a hard limit on distance. Asynchronous replication buys distance by accepting a window of possible loss, and naming the size of that window is what turns the choice into an engineering decision.
- Replication faithfully copies a corruption to the second site, which is why it is not a backup however many copies exist. A backup has to be isolated from whatever damaged the original, and it has to have been restored in a test.
- A slow drain device receives more slowly than traffic arrives and holds buffer credits that other conversations need, so one struggling host degrades an entire fabric. The port spending time at zero transmit credit identifies it directly.
Domain 4: Automation and Artificial Intelligence
- A data model defines the structure a configuration must follow, separately from the protocol carrying it. Validating against the model locally means a malformed request is rejected before it is half applied to a device.
- A candidate configuration is edited freely and takes effect on commit, and a commit that rolls back unless confirmed is the only protection that still works once a change has cut off your own access.
- Declaring the desired state lets the tool compute the difference and change only what does not match, which is what allows one definition to be applied to a fresh system and to one somebody already configured halfway.
- An automation inventory states what should be true and the devices state what is true. Reconciling the two is what surfaces both a device changed outside the process and an inventory entry that has gone stale.
- An AI training fabric carries synchronised bursts between the same servers, so the job is paced by its slowest exchange. One congested path slows the entire job, which is why these fabrics are engineered for the worst case rather than the average.
- Remote direct memory access bypasses the processor on both ends, which is where the latency saving comes from and why the network beneath has to lose almost nothing. Priority flow control pauses one class rather than the whole link, and early congestion marking keeps the fabric from spending its time paused.
- Oversubscription is a bet that peaks do not coincide, and a synchronised exchange makes them coincide by design. That is why a training fabric wants equal bandwidth between any pair of servers rather than the usual assumption that most traffic stays local.
- Second level telemetry matters because a burst lasting two seconds disappears entirely in a five minute average, and that burst is what paced the job and prompted the complaint.
Domain 5: Security
- Authentication establishes identity and authorisation decides what that identity may do. Keeping them separate is what allows a read only operator and an administrator to use one identity source and receive quite different rights.
- A local account on each device survives a departure because nobody removes it everywhere. The legitimate exceptions are an emergency account whose use is alerted on, and a scoped account for automation that should never borrow a person's identity.
- Accounting records which identity ran which command and when. It is only as good as the identity behind it, which is why a shared administrative account destroys the record an incident review depends on.
- The management network reaches everything, which makes it among the most valuable targets in the estate. Restricting which sources may connect at all is a stronger control than any password policy, because a device that cannot be reached cannot have its password guessed.
- Segmentation limits how far an attacker moves after taking one workload. It is effective only where the default between groups is deny and the rules are narrow enough to describe real traffic rather than a whole subnet.
- Deploying a segmentation policy safely starts with observing the traffic that actually occurs, because the documented dependencies describe an application that has not existed for years. Alert only mode then finds what the observation missed, at the cost of a report rather than an outage.
- Hardening means disabling what is not required, because a service that is not running cannot be exploited or misconfigured. Vendor default credentials are published and are among the first things tried, so they are changed during the build rather than after the device is reachable.
- Credentials present on a compromised device are treated as compromised wherever else they are used. Credentials unique to each device are what turn a compromised device into a compromised device rather than a compromised estate.
Cisco DCCOR 350-601 (Data Center Core) exam tips
- Read each scenario for what has been observed rather than what might be true. Several options are usually real Cisco concepts and only one answers the question that was actually asked.
- When a symptom appears only under load or only on large transfers, suspect a transmission unit or a congestion mechanism before suspecting a configuration error. Small test packets succeeding is evidence, not reassurance.
- For any storage question about a host that sees nothing, check whether the zone and the masking entry both exist. They sit on different devices and are usually owned by different teams, which is exactly why one gets forgotten.
- Distinguish the recovery point objective from the recovery time objective every time they appear. One is how much data may be lost and the other is how long the service may be down, and a design that satisfies one while ignoring the other is a common way to fail.
- Where a question offers both a controller level action and a per device action, the controller answer is usually right for a fabric and the per device answer is usually right for troubleshooting one box.
- In the automation domain, prefer answers that describe intent, validation and reversibility. Answers that apply a change everywhere at once, skip a review or assume success are almost always the distractor.
- For security questions, ask what an attacker gains and how far they can take it. Controls that limit reach and controls that limit what a credential is worth beat controls that only detect after the fact.
- Watch for options that are correct statements about something else. A great many distractors here are true sentences about a different mechanism, which is why reading the stem twice is worth more than reading the options faster.
Study guide FAQ
What is the DCCOR 350-601 exam format?
It is a 120-minute exam associated with the CCNP Data Center and CCIE Data Center certifications. Cisco uses scaled scoring and does not publish a fixed cut score, so the threshold shown here is a practice figure rather than an official pass mark.
What changed in version 1.2 of the exam topics?
The fourth domain was renamed from Automation and Programmability to Automation and Artificial Intelligence, and topics were added for high-performance network technologies supporting AI workloads, AI-powered monitoring with Nexus Dashboard, UCS-X in Intersight Managed Mode and the Terraform CLI. The five domain weights themselves were unchanged.
How are the domains weighted?
Network 25 percent, Compute 25 percent, Storage Network 20 percent, Automation and Artificial Intelligence 15 percent, and Security 15 percent. This practice bank is built to those weights, so a full mock draws in the same proportions as the real exam.
Which certifications does this exam count towards?
It is the core exam for CCNP Data Center, where it is paired with one concentration exam, and it is also the qualifying exam for the CCIE Data Center laboratory. Passing it therefore counts towards both tracks.
How much command line syntax does the exam test?
Less than most candidates expect. The exam is far more interested in what follows from a situation, which is why this bank is written as scenarios and consequences rather than as command recall. Knowing why a mechanism behaves as it does is what the questions reward.
Do I need access to a real data centre to prepare?
It helps, but the exam is answerable from a solid understanding of how the pieces interact. Where hands-on experience matters most is in the troubleshooting questions, where recognising a symptom pattern quickly is the difference between reading a scenario once and reading it three times.