350-601 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. The CoPP policy above is applied. Which traffic is most likely to be dropped?

Accepted Answer

ICMP traffic that exceeds 1000 bps. Option B is correct because the CoPP policy explicitly defines a class-map for ICMP traffic with a police rate of 1000 bps. Any ICMP traffic exceeding this rate is dropped due to the 'drop' action in the police command. The other classes (OSPF and class-default) have higher rates and are not as constrained, making ICMP the most likely to be dropped when exceeded.

Answer

Both ICMP and class-default traffic that exceed their rates

Answer

class-default traffic that exceeds 20000 bps

Answer

OSPF traffic that exceeds 5000 bps

Question 2

Which TWO of the following are valid methods to enforce security on a Cisco Nexus switch? (Choose two.)

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is a valid security enforcement method on Cisco Nexus switches because it protects the control plane from excessive or malicious traffic by applying QoS policies that rate-limit packets destined for the supervisor module. By filtering traffic such as routing protocols, SSH, or ICMP, CoPP prevents CPU overload and DoS attacks, directly enforcing security at the control plane level.

Answer

SSHv2

Answer

NetFlow

Answer

FabricPath

Question 3

A data center network engineer wants to encrypt all traffic between two top-of-rack (ToR) switches that are connected via a direct link. The encryption should be transparent to upper-layer protocols and operate at Layer 2. Which technology should be used?

Accepted Answer

MACsec (802.1AE). MACsec (802.1AE) is the correct choice because it provides hop-by-hop encryption at Layer 2, encrypting the entire Ethernet frame (excluding the source/destination MAC and VLAN tag) to secure traffic between two directly connected switches. It operates transparently to upper-layer protocols (Layer 3 and above) and requires no IP-level configuration, making it ideal for encrypting a direct link between ToR switches.

Answer

IPsec VPN

Answer

MKA (MACsec Key Agreement)

Answer

TLS/SSL

Question 4

Which TWO security features are used to prevent MAC address flooding attacks on a Cisco Nexus switch? (Choose two.)

Accepted Answer

Port Security. Port Security (A) is correct because it limits the number of MAC addresses allowed on a switch port, preventing MAC flooding attacks by dropping frames from unknown source MACs once the limit is exceeded. DHCP Snooping (D) is correct because it builds a trusted database of IP-to-MAC bindings from DHCP messages, which can be used to validate traffic and prevent MAC spoofing that often accompanies flooding attacks.

Answer

IP Source Guard

Answer

Control Plane Policing

Answer

BPDU Guard

Question 5

A network engineer is troubleshooting inter-VLAN routing on a Cisco Nexus 9000 switch. The switch is configured with VLAN 10 and VLAN 20. Hosts in VLAN 10 cannot ping hosts in VLAN 20. The engineer checks the VLAN ACL (VACL) applied to VLAN 10 and finds the following configuration:

ip access-list VACL-FILTER
  10 permit ip any any
...
vlan access-map VACL-MAP 10
  match ip address VACL-FILTER
  action forward
vlan filter VACL-MAP vlan-list 10

What is the most likely reason for the connectivity failure?

Accepted Answer

The VACL does not apply to traffic routed through the SVI; a Router ACL (RACL) must be used instead.. VACLs filter traffic at the ingress of a VLAN, but they only apply to traffic that is bridged within the same VLAN. When traffic is routed between VLANs (inter-VLAN routing), it passes through the SVI (Switch Virtual Interface), and VACLs do not inspect routed traffic. To filter inter-VLAN routed traffic, a Router ACL (RACL) must be applied to the SVI. Since the hosts in VLAN 10 cannot ping VLAN 20, the VACL on VLAN 10 is not blocking the traffic; rather, the traffic is being routed and is not subject to the VACL, so the failure is likely due to a missing or misconfigured RACL or routing issue.

Answer

The access-list permits all, so the VACL should work; perhaps the access-map is missing a default action.

Answer

The 'vlan filter' command is applied to VLAN 10 only, but the access-map is misconfigured.

Answer

The VACL is applied only to VLAN 10, so traffic from VLAN 20 to VLAN 10 is not filtered, but this should not cause a failure.

Question 6

A network administrator wants to prevent IP spoofing attacks on a data center access switch. The switch has IP Source Guard enabled on the client-facing ports. Which condition must be met for IP Source Guard to work properly?

Accepted Answer

DHCP snooping must be enabled on the VLAN and the port must be untrusted.. IP Source Guard uses a binding table created by DHCP snooping to validate the source IP address of packets received on a port. For IP Source Guard to work, DHCP snooping must be enabled on the VLAN, and the client-facing port must be configured as an untrusted port so that DHCP snooping can populate the binding table with valid DHCP lease information. Without this binding table, IP Source Guard has no source IP-to-MAC mapping to enforce.

Answer

DHCP snooping must be disabled on the VLAN.

Answer

All clients must use DHCP; static IPs are not supported.

Answer

Dynamic ARP Inspection must be enabled first.

Question 7

Which control plane protection mechanism should be configured to limit the rate of BGP updates destined to the CPU of a Nexus 9000 switch to prevent CPU overload?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) is the correct mechanism because it directly filters and rate-limits control plane traffic, such as BGP updates, before it reaches the CPU of a Nexus 9000 switch. By applying a CoPP policy, you can protect the CPU from being overwhelmed by excessive BGP updates, ensuring stability and preventing denial-of-service conditions.

Answer

VLAN Access Control Lists (VACLs)

Answer

EtherChannel load balancing

Answer

Switched Port Analyzer (SPAN)

Question 8

An ACI fabric administrator wants to enable microsegmentation for workloads in a Virtual Routing and Forwarding (VRF) instance. The security policy must allow communication between two endpoints based on their EPG (Endpoint Group) membership, regardless of IP address. Which construct must be used?

Accepted Answer

Contract with filter and subject. A contract with a filter and subject is required to enable microsegmentation in ACI because it defines the explicit rules for communication between EPGs. The contract specifies which EPGs can talk to each other, the filter defines the L4/L7 parameters (e.g., protocol, ports), and the subject binds the filter to the contract, allowing policy enforcement regardless of IP address. This is the only construct that supports EPG-based security policies for intra-VRF microsegmentation.

Answer

vzAny

Answer

VRF

Answer

Bridge Domain (BD)

Question 9

Refer to the exhibit. The configuration is intended to provide Layer 2 isolation within VLAN 100 while allowing the promiscuous port (Ethernet 1/1) to communicate with all ports in the community VLAN. However, hosts in VLAN 100 cannot communicate with each other. What is the most likely misconfiguration?

Accepted Answer

The 'switchport private-vlan association trunk' command on Ethernet 1/1 is incorrect; it should be 'switchport private-vlan association mapping' or similar.. The command 'switchport private-vlan association trunk' is invalid for configuring a promiscuous port in a private VLAN. The correct command is 'switchport private-vlan mapping primary-vlan-id secondary-vlan-id' to map the promiscuous port to the primary VLAN and the secondary community VLAN. Without this correct mapping, the promiscuous port cannot forward traffic to hosts in the community VLAN, causing Layer 2 isolation to fail.

Answer

The SVI interface needs 'ip address' to be removed.

Answer

The SVI interface should have 'private-vlan mapping' to the primary VLAN, not the community VLAN.

Answer

The command 'no ip redirects' should not be applied to the SVI.

Question 10

A data center engineer configures an ACL on a Nexus 9000 switch to block all traffic from the management network (10.10.0.0/16) to the production servers (192.168.1.0/24) except for SSH access from a specific jump host (10.10.1.100). The ACL is applied inbound on the management interface. Which ACL entry is correctly ordered to achieve this requirement?

Accepted Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit ip any any. Option C is correct because ACLs are processed top-down, and the first match wins. The explicit permit for SSH from the jump host (10.10.1.100) must come before the deny for the entire 10.10.0.0/16 range to ensure the exception is honored. The final permit ip any any allows all other non-management traffic, which is necessary to avoid dropping legitimate traffic on the management interface.

Answer

permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22

Answer

permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any
deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255

Answer

deny ip 10.10.0.0 0.0.255.255 192.168.1.0 0.0.0.255
permit tcp host 10.10.1.100 192.168.1.0 0.0.0.255 eq 22
permit ip any any

Question 11

Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)

Accepted Answer

DHCP snooping. DHCP snooping is a security feature that acts as a firewall between untrusted hosts and DHCP servers. It filters DHCP messages by validating DHCP packets received on untrusted ports, dropping those that are invalid (e.g., DHCP server messages from a client port), and building a DHCP snooping binding database that maps client MAC addresses, IP addresses, VLAN, and port information. This database is then used by other features like IP Source Guard and Dynamic ARP Inspection to prevent IP spoofing and ARP poisoning attacks.

Answer

Control Plane Policing (CoPP)

Answer

Port security

Question 12

A company uses Cisco TrustSec in its data center to enforce segmentation. Servers in VLAN 10 (Finance) should only communicate with servers in VLAN 20 (ERP) via an application gateway. Which TrustSec component is used to assign a Security Group Tag (SGT) to traffic from the Finance servers?

Accepted Answer

Identity Services Engine (ISE) as the authentication and policy server. In Cisco TrustSec, the Identity Services Engine (ISE) acts as the authentication and policy server that assigns Security Group Tags (SGTs) to endpoints or traffic based on identity and policy. ISE uses 802.1X, MAB, or web authentication to identify the Finance servers and then dynamically assigns the appropriate SGT, which is then used for segmentation enforcement.

Answer

MACsec encryption on the links

Answer

802.1X port-based authentication

Answer

VLAN ACL (VACL) on the switch

Question 13

An engineer observes that ARP packets are being dropped. Based on the exhibit, what is the drop rate percentage for ARP packets?

Accepted Answer

50%. The exhibit shows that out of 1000 total ARP packets, 500 were dropped. The drop rate percentage is calculated as (dropped packets / total packets) * 100, which is (500/1000)*100 = 50%. Therefore, option C is correct.

Answer

75%

Answer

25%

Answer

100%

Question 14

An engineer is troubleshooting a SAN performance issue. The MDS switch shows high CRC errors on an F port. The host is connected via a 16 Gbps FC link. The errors increase when the host sends large I/O. What is the most likely cause?

Accepted Answer

The cable length exceeds the supported distance for 16 Gbps.. At 16 Gbps Fibre Channel, signal integrity degrades over long cable distances, causing bit errors that manifest as CRC errors on the F port. The error increase with large I/O is characteristic of marginal signal quality, as larger frames are more likely to encounter corrupted bits. Option E correctly identifies that the cable length exceeds the supported distance for 16 Gbps, typically 10 meters for OM3 multimode fiber or 100 meters for OM4, depending on the transceiver type.

Answer

The host's HBA firmware is outdated.

Answer

The zone configuration is incorrect.

Answer

The host is experiencing buffer credit starvation.

Answer

The switch port is configured for 8 Gbps.

Question 15

A storage administrator needs to monitor traffic between two specific storage arrays without causing any disruption. Which approach should be used?

Accepted Answer

Configure a SPAN session on the MDS switch to copy traffic between the storage ports.. Option A is correct because configuring a SPAN session on the MDS switch allows copying traffic between the storage ports to a monitoring port without affecting the original traffic flow. Option B (FC traceroute) only shows path, not traffic. Option C (FC ping) tests connectivity. Option D (port channel) does not monitor. Option E (IVR) is for routing, not monitoring.

Answer

Use FC traceroute to identify the path.

Answer

Enable FC ping between arrays.

Answer

Use IVR to route traffic through a monitoring zone.

Answer

Configure port channel between arrays.

350-601 Practice Test 16 — 15 Questions

Exhibit

350-601 Practice Test 16 — 15 Questions

Exhibit