350-601 Security — 50 Questions

Question 1

An engineer is configuring a new data center leaf switch to enforce micro-segmentation using Cisco ACI. The requirement is to permit traffic from web servers to application servers on TCP port 8080, but deny all other traffic. The web servers are in EPG 'web_EPG' and application servers in EPG 'app_EPG'. Which contract configuration should be applied?

Accepted Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer.. Option C is correct because in Cisco ACI, contracts define the rules for communication between EPGs. The provider EPG offers a service, and the consumer EPG accesses it. By setting the filter direction to 'both', the contract enforces bidirectional traffic on TCP port 8080, which is necessary for web-to-application communication (e.g., HTTP responses). This configuration ensures that only traffic matching the filter is permitted, while all other traffic is implicitly denied by ACI's default deny behavior.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Use vzAny for both EPGs.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Assign web_EPG as provider and app_EPG as consumer.

Answer

Create a contract with subject 'web_to_app' and apply filter 'ip'. Assign web_EPG as provider and app_EPG as consumer.

Question 2

A customer is deploying Cisco ACI with a requirement to isolate tenant traffic in a multi-tenant environment. They want to ensure that a tenant admin can only manage their own tenant's objects. Which RBAC configuration should be implemented?

Accepted Answer

Create a security domain for each tenant and assign the 'tenant-admin' role to the user within that domain.. Option C is correct because Cisco ACI uses security domains to enforce Role-Based Access Control (RBAC) boundaries. By creating a security domain for each tenant and assigning the 'tenant-admin' role to a user within that domain, the tenant admin is restricted to managing only the objects (e.g., EPGs, contracts, policies) that belong to that specific tenant. This ensures isolation of tenant traffic management in a multi-tenant environment without granting global or cross-tenant privileges.

Answer

Assign the 'read-only' role to the user within the tenant.

Answer

Create a separate VRF for each tenant and assign admin to that VRF.

Answer

Assign the 'tenant-admin' role to the user globally.

Question 3

An engineer needs to secure the management plane on a Cisco Nexus 9000 switch. Which feature should be configured to restrict access to the switch's management interface based on source IP?

Accepted Answer

Configure a management CoPP policy to rate-limit and permit only specific source IPs.. Option D is correct because a management Control Plane Policing (CoPP) policy on a Cisco Nexus 9000 switch allows the engineer to explicitly permit or deny traffic destined to the management interface based on source IP addresses. CoPP applies QoS policies to control plane traffic, effectively restricting management plane access by rate-limiting or dropping packets from unauthorized sources before they reach the CPU.

Answer

Enable DHCP snooping on the management VLAN.

Answer

Enable port security on the management interface.

Answer

Configure AAA to require two-factor authentication.

Question 4

An organization is deploying Cisco ACI in a brownfield data center. They have existing VLANs that need to be mapped to ACI EPGs. The network team notices that some VLANs are used across multiple tenants. How should the engineer design the VLAN pool to support overlapping VLANs?

Accepted Answer

Create separate VLAN pools per tenant, each containing the required VLANs.. Option B is correct because in Cisco ACI, VLAN pools are scoped to a physical domain, and overlapping VLANs across tenants require separate VLAN pools per tenant. Each tenant's EPG is statically bound to its own VLAN pool, ensuring isolation and preventing VLAN conflicts. This design aligns with ACI's multi-tenant architecture where VLAN IDs must be unique within a domain but can be reused across different domains.

Answer

Configure the VLANs as part of the EPG static binding without a pool.

Answer

Create one VLAN pool per physical domain and assign tenants to that domain.

Answer

Create a global VLAN pool with all VLANs and assign it to all tenants.

Question 5

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

Accepted Answer

Enable DHCP snooping globally and configure uplink ports as trusted.. DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.

Answer

Enable dynamic ARP inspection on all VLANs.

Answer

Enable IP source guard on all access ports.

Answer

Enable MAC port security on all access ports.

Question 6

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

Accepted Answer

show authentication interface ethernet 1/1. Option C is correct because the 'show authentication interface ethernet 1/1' command displays the 802.1X authentication status, including the state machine, authorized status, and method list for a specific interface. This command is part of the Identity-Based Networking Services (IBNS) framework and provides a comprehensive view of all authentication methods (802.1X, MAB, WebAuth) configured on the port, which is essential for troubleshooting authentication failures on edge ports.

Answer

show aaa authentication

Answer

show dot1x

Answer

show port-security interface ethernet 1/1

Question 7

An engineer is configuring Cisco ACI to secure inter-tenant traffic. Tenants 'TenantA' and 'TenantB' need to communicate via a shared service, such as a DNS server in TenantA. How should the contract be configured?

Accepted Answer

Create a contract in TenantA. Set the DNS EPG as provider. In TenantB, create a consumer EPG and provide the contract from TenantA.. In Cisco ACI, inter-tenant communication via a shared service requires the contract to be created in the tenant that owns the shared service (provider). The provider EPG (DNS server in TenantA) is set as the provider, and the consumer EPG (in TenantB) consumes the contract from TenantA. This allows TenantB to access the DNS service without exposing its own EPGs, maintaining security isolation while enabling necessary traffic.

Answer

Create a contract in TenantA and apply it to the VRF shared between tenants.

Answer

Create a contract in TenantB. Set the DNS EPG as consumer. In TenantA, create a provider EPG and provide the contract from TenantB.

Answer

Create a contract in TenantA. Set both DNS EPG and TenantB EPG as providers.

Question 8

A data center architect is designing security for a Cisco ACI fabric that must comply with PCI DSS. The requirement is to encrypt all traffic between EPGs within the same tenant. Which solution should be used?

Accepted Answer

Use a contract with the 'encrypt' flag enabled between the EPGs.. Option B is correct because Cisco ACI supports encryption of traffic between EPGs within the same tenant using a contract with the 'encrypt' flag enabled. This leverages the ACI fabric's built-in capability to apply AES-based encryption (e.g., AES-256-GCM) at the leaf switch level, ensuring data confidentiality for PCI DSS compliance without requiring external devices or complex routing changes.

Answer

Enable port security on the leaf switch interfaces.

Answer

Create separate VRFs for each EPG and route traffic through a firewall.

Answer

Configure a site-to-site VPN between the leaf switches.

Question 9

Which TWO of these are best practices for securing the Cisco ACI fabric?

Accepted Answer

Use security domains to control RBAC.. Security domains in Cisco ACI provide role-based access control (RBAC) by partitioning the fabric into logical groups, allowing administrators to restrict user permissions to specific tenants, EPGs, or policies. This is a core best practice to enforce least-privilege access and prevent unauthorized configuration changes across the fabric.

Answer

Use in-band management for APIC connectivity.

Answer

Leave default passwords for fabric discovery.

Answer

Place APIC controllers in a DMZ.

Question 10

Which THREE of the following are valid methods to secure the control plane on a Cisco Nexus 9000 switch?

Accepted Answer

Enable control plane policing (CoPP) to rate-limit control plane traffic.. Control plane policing (CoPP) is a valid method to secure the control plane on a Cisco Nexus 9000 switch. CoPP uses a policy map applied to the control plane to rate-limit or drop traffic destined to the supervisor module, protecting the CPU from excessive or malicious traffic. This is a direct control plane security mechanism defined in Cisco NX-OS.

Answer

Enable Bidirectional Forwarding Detection (BFD) on all interfaces.

Answer

Implement routing protocol authentication (e.g., OSPF MD5).

Question 11

Which TWO of the following are required components for a Cisco ACI contract to allow communication between EPGs?

Accepted Answer

A filter that specifies the traffic parameters.. Option A is correct because a filter in Cisco ACI defines the specific traffic parameters—such as IP protocol, source/destination ports, and EtherType—that are permitted or denied between EPGs. Without a filter, the contract has no criteria to match traffic, so communication cannot be allowed. Option B is correct because a subject binds one or more filters to a contract and specifies the direction (consumer-to-provider or bidirectional) in which the filter is applied, making it an essential component for the contract to function.

Answer

A tenant.

Answer

A QoS class.

Answer

A VRF.

Question 12

A large financial institution has a Cisco ACI fabric with multiple tenants. The security team requires that all management access to the APIC controllers be authenticated via multi-factor authentication (MFA) using a RADIUS server. The RADIUS server is configured to send a One-Time Password (OTP) challenge during authentication. The current configuration uses local authentication. The engineer needs to implement RADIUS authentication with MFA for APIC GUI and CLI access. The RADIUS server is reachable at 10.10.10.10, shared secret 'SecureSecret123'. The APIC is running software version 4.2(3). The engineer must ensure that local authentication is used as fallback if the RADIUS server is unreachable. Which of the following actions should the engineer take?

Accepted Answer

Add a RADIUS provider with IP 10.10.10.10 and secret 'SecureSecret123', create a login domain with realm 'radius', set fallback to 'local', and assign the domain to users.. Option C is correct because it follows the required steps to configure RADIUS authentication with MFA on Cisco APIC: adding a RADIUS provider with the correct IP and shared secret, creating a login domain with realm 'radius', setting fallback to 'local', and assigning the domain to users. This ensures that the APIC sends authentication requests to the RADIUS server, which can issue an OTP challenge for MFA, and falls back to local authentication if the RADIUS server is unreachable.

Answer

Configure TACACS+ as the authentication protocol and set the server IP and secret.

Answer

Enable local authentication only and require strong passwords.

Answer

Configure LDAP authentication with the RADIUS server acting as an LDAP proxy.

Question 13

A data center engineer is troubleshooting connectivity issues between two EPGs in the same tenant on a Cisco ACI fabric. The first EPG 'web_epg' is in VLAN 100 and the second EPG 'db_epg' is in VLAN 200. The contract 'web_to_db' allows TCP port 3306 from web_epg to db_epg. The EPGs are in the same VRF. The engineer has verified that the physical connectivity is correct and the endpoints are learning their IP addresses. However, traffic from web_epg to db_epg is not reaching the destination. The engineer checks the contract and sees that the subject 'mysql_access' has filter 'mysql' with direction 'both'. The provider is db_epg and consumer is web_epg. The engineer also notices that the default action in the contract is 'deny'. What is the most likely cause of the issue?

Accepted Answer

The contract direction is reversed: the provider should be the destination of the traffic. Since web_epg initiates to db_epg, web_epg should be the provider.. In Cisco ACI, the provider EPG is the one that offers a service (the destination of the traffic), and the consumer EPG is the one that initiates the connection. Since web_epg initiates TCP traffic to db_epg, db_epg should be the provider and web_epg the consumer. The contract is reversed, so the default deny action blocks the traffic because the consumer (web_epg) is not allowed to initiate toward the provider (db_epg) under the reversed roles.

Answer

The VRF is not correctly associated with the EPGs.

Answer

A Layer 3 Outside (L3Out) is required for communication between EPGs in the same VRF.

Answer

The filter 'mysql' does not match TCP port 3306.

Question 14

An engineer is configuring AAA on a Cisco Nexus switch to authenticate management access via TACACS+. The switch is reachable, but login attempts repeatedly fail. Which action should the engineer take to isolate the issue?

Accepted Answer

Run 'test aaa authentication login legacy' to validate AAA configuration.. Option B is correct because the 'test aaa authentication login' command with the 'legacy' keyword directly validates the AAA authentication configuration against the TACACS+ server without requiring a full login session. This isolates whether the issue is with the AAA configuration itself versus network connectivity or server reachability, as the command simulates the exact authentication flow the switch uses.

Answer

Enable 'debug tacacs' on the switch to see detailed TACACS+ exchange.

Answer

Verify IP connectivity to the TACACS+ server using ping.

Answer

Check if the TACACS+ server port (49) is open using Telnet.

Question 15

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

Accepted Answer

Create a contract between EPGs with appropriate filters.. In Cisco ACI, contracts are the primary mechanism for enforcing policy-based communication between EPGs. By creating a contract between the web and app EPGs with a filter that permits HTTP (TCP/80), and another contract between management and web EPGs with a filter that denies SSH (TCP/22), the architect can precisely meet both requirements. Contracts allow granular control over which protocols and ports are allowed or denied, making them the correct construct for this access control scenario.

Answer

Use a tenant to separate the EPGs logically.

Answer

Configure a VRF to isolate traffic between EPGs.

Answer

Define a bridge domain with L2 policies.

Question 16

A network engineer is troubleshooting CoPP drops on a Cisco Nexus 9000 switch. The 'show control-plane' output indicates that packets are being dropped due to 'CoPP' on the 'default' control-plane class. Which action is most likely to resolve the issue without affecting routing protocol stability?

Accepted Answer

Increase the policer rate for the 'default' class in the CoPP policy.. The 'default' class in a CoPP policy catches all control-plane traffic not explicitly matched by higher-priority classes. Drops in this class indicate that the aggregate policer rate for unmatched traffic is too low. Increasing the policer rate for the 'default' class allows more legitimate control-plane packets (e.g., ARP, BFD, or management traffic) to pass without impacting the dedicated policers for critical protocols like OSPF or BGP, thus preserving routing stability.

Answer

Disable CoPP globally to allow all control-plane traffic.

Answer

Modify the class-map to reclassify the dropped packets to a higher priority class.

Answer

Increase the ingress buffer size on the control-plane interface.

Question 17

An organization is deploying Cisco ISE for 802.1X authentication on Cisco Nexus switches. Some endpoints fail authentication and fall back to the MAB. The security policy requires that endpoints failing both 802.1X and MAB be placed in a restricted VLAN. Which configuration is needed on the switch port?

Accepted Answer

authentication failed action authorize vlan 999. Option C is correct because the 'authentication failed action authorize vlan 999' command configures the switch port to place endpoints that fail both 802.1X and MAB into a restricted VLAN (VLAN 999). This directly meets the security policy requirement for endpoints that cannot authenticate via either method.

Answer

authentication order dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication event server dead action authorize vlan 999

Question 18

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. Option C is correct because SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 19

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

Accepted Answer

Add 'spanning-tree bpdufilter enable' on the interface.. Option C is correct because enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Answer

Add 'spanning-tree guard loop' to the interface.

Answer

Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.

Answer

Change the port type to 'spanning-tree port type network trunk'.

Question 20

A company runs a multi-tenant data center using Cisco ACI with multiple tenants. Each tenant has its own VRF and EPGs. The security policy requires that tenant A's web servers (EPG web_tenantA) be accessible from tenant B's application servers (EPG app_tenantB) only via HTTPS (TCP 443). The ACI fabric is configured with contracts. The administrator has created a contract with a filter for HTTPS (tcp dstPort 443) and applied it as a provider contract on EPG web_tenantA and as a consumer contract on EPG app_tenantB. However, traffic from tenant B's app servers to tenant A's web servers is being dropped. The administrator has verified that the contracts are applied correctly and the filter is correct. What is the most likely cause of the traffic drop?

Accepted Answer

The contract is not marked as 'shared' between tenants; a shared contract must be created and both EPGs must be in the same VRF or use a shared VRF.. In Cisco ACI, contracts are local to a VRF by default. For inter-tenant communication where each tenant has its own VRF, the contract must be explicitly marked as 'shared' and both EPGs must either be in the same VRF or use a shared VRF that allows cross-VRF policy enforcement. Without this, the contract filter is not applied across VRFs, causing traffic to be dropped even though the contract and filter are correctly configured.

Answer

The EPGs are not in the same bridge domain; they must be in the same bridge domain to communicate.

Answer

The VRF of tenant A and tenant B must have route leaking configured to allow inter-VRF routing.

Answer

The filter for HTTPS must also include the source port range 49152-65535 for ephemeral ports.