350-601 Practice Test 26 — 15 Questions

Question 1

A network engineer is configuring micro-segmentation in an ACI fabric. Two EPGs, Web and App, must communicate via HTTPS only. Which type of contract should be applied between the EPGs?

Accepted Answer

Regular contract with a filter allowing HTTPS. ACI contracts use a whitelist model: a contract between EPGs explicitly permits desired traffic. A taboo contract would deny specific traffic, not permit.

Answer

Taboo contract

Answer

Intra-EPG contract

Answer

Filter contract

Question 2

An administrator needs to limit the number of MAC addresses learned on a Nexus access port to prevent MAC flooding attacks. Which feature should be configured?

Accepted Answer

Port Security. Port security limits MAC addresses per port.

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Question 3

An engineer is deploying Cisco TrustSec in a data center. Which technology uses Security Group Tags (SGTs) to enforce east-west traffic policies without relying on IP addresses?

Accepted Answer

SGACL. SGACLs use SGTs to define policies based on group membership, independent of IP addresses.

Answer

ACI contracts

Answer

VLAN ACLs

Answer

Port security

Question 4

Which encryption technology is used to secure Fibre Channel traffic in flight between storage and switches?

Accepted Answer

FC-SP-2. FC-SP-2 (Fibre Channel Security Protocol) provides authentication and encryption for Fibre Channel frames.

Answer

SSL

Answer

SED

Answer

IPsec

Question 5

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

Accepted Answer

It uses the SGACL to permit HTTP and deny other traffic. SGACLs enforce policy based on SGTs, not IP addresses.

Answer

It forwards the traffic to the Cisco ISE for policy decision

Answer

It applies an IP ACL based on the SGT

Answer

It drops all traffic between different SGTs unless a contract exists

Question 6

Which TWO features are commonly used together to prevent IP spoofing on a Nexus switch? (Choose two.)

Accepted Answer

DHCP Snooping. DHCP snooping builds a binding database used by IP Source Guard and DAI.

Answer

VLAN ACL

Answer

Port Security

Answer

CoPP

Question 7

A data center architect needs to enforce role-based access control for UCS Manager. What is the correct approach?

Accepted Answer

Create user roles with specific privileges in UCS Manager. UCS Manager provides RBAC by allowing administrators to create custom roles with specific privileges and assign them to users.

Answer

Enable CoPP for management access

Answer

Use TACACS+ to assign roles

Answer

Use RADIUS for authentication only

Question 8

An organization wants to encrypt Fibre Channel traffic in-flight between storage and servers. Which standard should be used?

Accepted Answer

FC-SP-2. FC-SP-2 provides encryption for Fibre Channel data in transit.

Answer

IPsec

Answer

MACsec

Answer

SED

Question 9

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

Accepted Answer

DHCP Snooping. DHCP snooping filters DHCP server messages on untrusted ports.

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Answer

Port Security

Question 10

An engineer wants to enforce security policies in a data center based on user identity rather than IP addresses. Which Cisco technology enables identity-based tagging and policy enforcement?

Accepted Answer

Cisco TrustSec. Cisco TrustSec uses SGTs to tag traffic based on user/device identity, and SGACLs enforce policies.

Answer

VLAN ACLs

Answer

ACI micro-segmentation

Answer

Nexus port security

Question 11

Arrange the steps to create a service profile template in Cisco UCS Manager.

Accepted Answer

Create UUID Suffix Pool, then Create vNIC Template, then Create Service Profile Template (referencing the pool and vNIC template), then Associate with a Server Pool. Service profile template requires UUID pool, vNIC template, profile creation, server pool association, and assignment.

Answer

Create vNIC Template, then Create UUID Suffix Pool, then Create Service Profile Template, then Associate with a Server Pool

Answer

Create Service Profile Template, then Create UUID Suffix Pool, then Create vNIC Template, then Associate with a Server Pool

Answer

Associate with a Server Pool, then Create UUID Suffix Pool, then Create vNIC Template, then Create Service Profile Template

Question 12

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

Accepted Answer

Taboo contract. Taboo contracts are used to explicitly deny traffic between EPGs.

Answer

Filter with action deny

Answer

QoS policy

Answer

VRF with route leaking

Question 13

In ACI, a tenant requires that all traffic between two EPGs is denied except for specific HTTP traffic. Which policy elements must be configured?

Accepted Answer

Create a contract with a subject that includes a filter for HTTP only. ACI uses a whitelist model. To allow only HTTP, a contract with a subject and filter for HTTP is applied, and no other filters are included.

Answer

Use an external firewall for filtering

Answer

Create a taboo contract to deny all traffic and a separate contract to allow HTTP

Answer

Create a filter for HTTP and apply it directly to the EPGs

Question 14

An organization requires disk encryption for data at rest in their UCS environment. Which technology should be used?

Accepted Answer

SED. Self-encrypting drives (SEDs) provide hardware-based encryption for data at rest.

Answer

AES-256 software encryption

Answer

FC-SP-2

Answer

SAN encryption

Question 15

Which feature on Nexus switches prevents ARP spoofing attacks by validating ARP packets?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) intercepts ARP packets and validates them against the DHCP snooping binding database.

Answer

DHCP Snooping

Answer

Port Security

Answer

IP Source Guard