350-601 Practice Test 27 — 15 Questions

Question 1

Which authentication protocol is recommended by Cisco for network device administration due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ separates the three AAA functions, while RADIUS combines authentication and authorization.

Answer

802.1X

Answer

RADIUS

Answer

LDAP

Question 2

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

Accepted Answer

RADIUS. 802.1X uses RADIUS for communication between the authenticator and the authentication server.

Answer

TACACS+

Answer

LDAP

Answer

DIAMETER

Question 3

Which Nexus feature dynamically validates ARP packets to prevent man-in-the-middle attacks?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) intercepts ARP packets and validates them against DHCP snooping bindings.

Answer

DHCP snooping

Answer

IP Source Guard

Answer

Port security

Question 4

A network engineer is hardening a Nexus 9000 switch. Which action is most effective in reducing the attack surface?

Accepted Answer

Disabling all unused services. Disabling unused services reduces the number of potential attack vectors.

Answer

Configuring a strong enable password

Answer

Implementing CoPP

Answer

Enabling SNMP v3 with secure keys

Question 5

Which feature prevents IP spoofing by ensuring that a client uses only the IP address assigned by DHCP?

Accepted Answer

IP Source Guard. IP Source Guard uses DHCP snooping binding to filter traffic based on source IP and MAC.

Answer

DHCP snooping

Answer

Port security

Answer

Dynamic ARP Inspection

Question 6

An engineer needs to protect the control plane of a Nexus 9000 switch from CPU-targeted attacks. Which feature should be configured?

Accepted Answer

CoPP. Control Plane Policing (CoPP) applies QoS policies to control plane traffic to prevent DoS attacks.

Answer

DHCP snooping

Answer

Port security

Answer

IP Source Guard

Question 7

A data center uses self-encrypting drives (SEDs) in UCS servers. Which type of protection does SED provide?

Accepted Answer

At-rest encryption on the drive. SEDs provide at-rest encryption, protecting data when the drive is powered off or removed.

Answer

In-flight encryption for Fibre Channel

Answer

Encryption of SAN traffic

Answer

Network-level encryption

Question 8

Which AAA protocol is recommended by Cisco for network device administration, as it separates authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions, making it preferred over RADIUS for admin access.

Answer

RADIUS

Answer

LDAP

Answer

802.1X

Question 9

An engineer is configuring micro-segmentation in an ACI fabric. Which object defines the whitelist model for communication between EPGs?

Accepted Answer

Contract. ACI contracts define a whitelist model where communication between EPGs is explicitly allowed by the contract's subject and filters.

Answer

Taboo contract

Answer

Filter

Answer

VRF

Question 10

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Accepted Answer

DHCP Snooping. DHCP snooping, DAI, and IP Source Guard work together to prevent various Layer 2 attacks.

Answer

RBAC

Answer

CoPP

Question 11

In a UCS environment, which method provides management plane isolation for the fabric interconnects?

Accepted Answer

Configuring the management IP on a dedicated management port. UCS fabric interconnects have a dedicated management interface that can be placed in a separate management VLAN for isolation.

Answer

Enabling CoPP on the fabric interconnect

Answer

Using RBAC roles in UCS Manager

Answer

Using a separate VRF for management traffic

Question 12

A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?

Accepted Answer

ip access-group ACL_NAME in on VLAN interface. ACLs on Nexus switches can be applied to VLANs using the 'ip access-group' command under the VLAN interface.

Answer

ip access-group ACL_NAME on VLAN

Answer

access-list ACL_NAME in on VLAN interface

Answer

vlan access-group ACL_NAME in

Question 13

An engineer is deploying data encryption in a SAN environment. Which two methods provide at-rest encryption? (Choose two.)

Accepted Answer

Self-encrypting drives (SED). SED encrypts data on the drive; SAN array encryption encrypts data at the storage level.

Answer

MACsec encryption

Answer

FC-SP-2 encryption

Answer

IPsec encryption

Question 14

In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?

Accepted Answer

RBAC in UCS Manager. UCS Manager role-based access control (RBAC) allows granular assignment of privileges to users.

Answer

CoPP

Answer

IP Source Guard

Answer

SED encryption

Question 15

In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?

Accepted Answer

Taboo contract. Taboo contracts are used to explicitly deny traffic between EPGs, overriding the default permit of a contract? Actually, by default, no traffic is permitted between EPGs unless a contract is applied. A taboo contract denies traffic, even if a regular contract exists? In ACI, the default is no communication; contracts permit traffic. To deny specific traffic, you use a taboo contract that explicitly denies.

Answer

No contract

Answer

Regular contract with a deny filter

Answer

Intra-EPG contract