350-601 Security — All Questions With Answers

In ACI, which model is used for micro-segmentation to allow traffic between EPGs?

Question 2mediummultiple choice

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

Question 3easymultiple choice

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

Question 4mediummultiple choice

A Nexus switch is experiencing high CPU utilization due to control plane traffic. Which feature should be configured to protect the CPU?

Question 5hardmultiple choice

In Cisco TrustSec, which technology is used to enforce east-west traffic policies based on identity without relying on IP addresses?

Question 6mediummultiple choice

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

Question 7mediummultiple choice

Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?

Question 8hardmultiple choice

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

Question 9easymultiple choice

Which feature on Nexus switches prevents ARP spoofing attacks by validating ARP packets?

Question 10mediummultiple choice

An administrator needs to limit the number of MAC addresses learned on a Nexus access port to prevent MAC flooding attacks. Which feature should be configured?

Question 11hardmultiple choice

In UCS Manager, which feature provides role-based access control for managing the fabric interconnects?

Question 12mediummultiple choice

Which technology provides at-rest encryption for disk drives in UCS servers?

Question 13hardmultiple choice

An organization wants to encrypt Fibre Channel traffic in-flight between storage and servers. Which standard should be used?

Question 14mediummulti select

Which TWO features are commonly used together to prevent IP spoofing on a Nexus switch? (Choose two.)

Question 15hardmulti select

An engineer is hardening a Nexus switch. Which THREE actions should be taken? (Choose three.)

Question 16mediummultiple choice

A network engineer is configuring micro-segmentation in an ACI fabric. Two EPGs, Web and App, must communicate via HTTPS only. Which type of contract should be applied between the EPGs?

Question 17easymultiple choice

Which authentication protocol is recommended by Cisco for network device administration due to its separation of authentication, authorization, and accounting?

Question 18hardmultiple choice

A Nexus switch is being hardened. An engineer wants to protect the control plane from CPU-targeted attacks, such as heavy ICMP traffic. Which feature should be configured?

Question 19mediummultiple choice

An engineer is deploying Cisco TrustSec in a data center. Which technology uses Security Group Tags (SGTs) to enforce east-west traffic policies without relying on IP addresses?

Question 20mediummultiple choice

In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?

Question 21easymultiple choice

Which security feature on a Nexus switch prevents a rogue DHCP server from assigning invalid IP addresses to clients?

Question 22hardmultiple choice

A data center uses self-encrypting drives (SEDs) in UCS servers. Which type of protection does SED provide?

Question 23mediummultiple choice

An engineer applies an IPv4 ACL to a Nexus switch interface. The ACL must permit traffic from host 10.1.1.1 to host 10.2.2.2 on TCP port 443 and deny all other traffic. Which configuration is correct?

Question 24mediummultiple choice

A Nexus switch is configured with port security. Which violation action will cause the switch to shut down the interface when a security violation occurs?

Question 25hardmultiple choice

In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?

Question 26easymultiple choice

Which Nexus security feature validates ARP packets to prevent ARP spoofing attacks?

Question 27mediummultiple choice

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

Question 28mediummultiple choice

Which feature on a Nexus switch uses DHCP snooping binding information to filter IP traffic on a per-port basis?

Question 29hardmultiple choice

A UCS administrator needs to ensure that only the fabric interconnect management plane is accessible from the management network. Which feature should be implemented?

Question 30mediummultiple choice

An engineer wants to enforce security policies in a data center based on user identity rather than IP addresses. Which Cisco technology enables identity-based tagging and policy enforcement?

Question 31mediummulti select

A network engineer is hardening a Nexus switch. Which two security best practices should be applied? (Choose two.)

Question 32hardmulti select

An engineer is deploying data encryption in a SAN environment. Which two methods provide at-rest encryption? (Choose two.)

Question 33easymulti select

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Question 34easymultiple choice

An engineer is configuring micro-segmentation in an ACI fabric. Which object defines the whitelist model for communication between EPGs?

Question 35mediummultiple choice

A Nexus switch is configured with DHCP snooping. Which switchport mode is required for trusted ports to prevent rogue DHCP server attacks?

Question 36hardmultiple choice

A network administrator must enforce security policies for east-west traffic in a Cisco TrustSec-enabled data center without using IP-based ACLs. Which technology should be used?

Question 37easymultiple choice

Which AAA protocol is recommended by Cisco for network device administration, as it separates authentication, authorization, and accounting?

Question 38mediummultiple choice

An engineer needs to protect the control plane of a Nexus 9000 switch from CPU-targeted attacks. Which feature should be configured?

Question 39hardmultiple choice

Open the full VLAN trunking answer →

In a UCS environment, which method provides management plane isolation for the fabric interconnects?

Question 40mediummultiple choice

A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?

Question 41easymultiple choice

Which feature prevents IP spoofing by ensuring that a client uses only the IP address assigned by DHCP?

Question 42mediummultiple choice

An organization requires disk encryption for data at rest in their UCS environment. Which technology should be used?

Question 43hardmultiple choice

In ACI, a tenant requires that all traffic between two EPGs is denied except for specific HTTP traffic. Which policy elements must be configured?

Question 44mediummultiple choice

A network engineer is hardening a Nexus 9000 switch. Which action is most effective in reducing the attack surface?

Question 45mediummultiple choice

Which Nexus feature dynamically validates ARP packets to prevent man-in-the-middle attacks?

Question 46easymultiple choice

In Cisco TrustSec, what is used to tag traffic based on identity or group membership?

Question 47hardmultiple choice

A data center architect needs to enforce role-based access control for UCS Manager. What is the correct approach?

Question 48mediummultiple choice

Which encryption technology is used to secure Fibre Channel traffic in flight between storage and switches?

Question 49mediummulti select

A security engineer is deploying IP Source Guard on a Nexus switch. Which two components must be operational for IP Source Guard to function correctly?

Question 50hardmulti select

An organization wants to encrypt data at rest in a storage array. Which two technologies can be used? (Choose two.)

Question 1easymultiple choice

In ACI, which model is used for micro-segmentation to allow traffic between EPGs?

Question 2mediummultiple choice

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

Question 3easymultiple choice

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

Question 4mediummultiple choice

A Nexus switch is experiencing high CPU utilization due to control plane traffic. Which feature should be configured to protect the CPU?

Question 5hardmultiple choice

In Cisco TrustSec, which technology is used to enforce east-west traffic policies based on identity without relying on IP addresses?

Question 6mediummultiple choice

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

Question 7mediummultiple choice

Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?

Question 8hardmultiple choice

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

Question 9easymultiple choice

Which feature on Nexus switches prevents ARP spoofing attacks by validating ARP packets?

Question 10mediummultiple choice

An administrator needs to limit the number of MAC addresses learned on a Nexus access port to prevent MAC flooding attacks. Which feature should be configured?

Question 11hardmultiple choice

In UCS Manager, which feature provides role-based access control for managing the fabric interconnects?

Question 12mediummultiple choice

Which technology provides at-rest encryption for disk drives in UCS servers?

Question 13hardmultiple choice

An organization wants to encrypt Fibre Channel traffic in-flight between storage and servers. Which standard should be used?

Question 14mediummulti select

Which TWO features are commonly used together to prevent IP spoofing on a Nexus switch? (Choose two.)

Question 15hardmulti select

An engineer is hardening a Nexus switch. Which THREE actions should be taken? (Choose three.)

Question 16mediummultiple choice

A network engineer is configuring micro-segmentation in an ACI fabric. Two EPGs, Web and App, must communicate via HTTPS only. Which type of contract should be applied between the EPGs?

Question 17easymultiple choice

Which authentication protocol is recommended by Cisco for network device administration due to its separation of authentication, authorization, and accounting?

Question 18hardmultiple choice

A Nexus switch is being hardened. An engineer wants to protect the control plane from CPU-targeted attacks, such as heavy ICMP traffic. Which feature should be configured?

Question 19mediummultiple choice

An engineer is deploying Cisco TrustSec in a data center. Which technology uses Security Group Tags (SGTs) to enforce east-west traffic policies without relying on IP addresses?

Question 20mediummultiple choice

In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?

Question 21easymultiple choice

Which security feature on a Nexus switch prevents a rogue DHCP server from assigning invalid IP addresses to clients?

Question 22hardmultiple choice

A data center uses self-encrypting drives (SEDs) in UCS servers. Which type of protection does SED provide?

Question 23mediummultiple choice

An engineer applies an IPv4 ACL to a Nexus switch interface. The ACL must permit traffic from host 10.1.1.1 to host 10.2.2.2 on TCP port 443 and deny all other traffic. Which configuration is correct?

Question 24mediummultiple choice

A Nexus switch is configured with port security. Which violation action will cause the switch to shut down the interface when a security violation occurs?

Question 25hardmultiple choice

In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?

Question 26easymultiple choice

Which Nexus security feature validates ARP packets to prevent ARP spoofing attacks?

Question 27mediummultiple choice

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

Question 28mediummultiple choice

Which feature on a Nexus switch uses DHCP snooping binding information to filter IP traffic on a per-port basis?

Question 29hardmultiple choice

A UCS administrator needs to ensure that only the fabric interconnect management plane is accessible from the management network. Which feature should be implemented?

Question 30mediummultiple choice

An engineer wants to enforce security policies in a data center based on user identity rather than IP addresses. Which Cisco technology enables identity-based tagging and policy enforcement?

Question 31mediummulti select

A network engineer is hardening a Nexus switch. Which two security best practices should be applied? (Choose two.)

Question 32hardmulti select

An engineer is deploying data encryption in a SAN environment. Which two methods provide at-rest encryption? (Choose two.)

Question 33easymulti select

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Question 34easymultiple choice

An engineer is configuring micro-segmentation in an ACI fabric. Which object defines the whitelist model for communication between EPGs?

Question 35mediummultiple choice

A Nexus switch is configured with DHCP snooping. Which switchport mode is required for trusted ports to prevent rogue DHCP server attacks?

Question 36hardmultiple choice

A network administrator must enforce security policies for east-west traffic in a Cisco TrustSec-enabled data center without using IP-based ACLs. Which technology should be used?

Question 37easymultiple choice

Which AAA protocol is recommended by Cisco for network device administration, as it separates authentication, authorization, and accounting?

Question 38mediummultiple choice

An engineer needs to protect the control plane of a Nexus 9000 switch from CPU-targeted attacks. Which feature should be configured?

Question 39hardmultiple choice

Open the full VLAN trunking answer →

In a UCS environment, which method provides management plane isolation for the fabric interconnects?

Question 40mediummultiple choice

A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?

Question 41easymultiple choice

Which feature prevents IP spoofing by ensuring that a client uses only the IP address assigned by DHCP?

Question 42mediummultiple choice

An organization requires disk encryption for data at rest in their UCS environment. Which technology should be used?

Question 43hardmultiple choice

In ACI, a tenant requires that all traffic between two EPGs is denied except for specific HTTP traffic. Which policy elements must be configured?

Question 44mediummultiple choice

A network engineer is hardening a Nexus 9000 switch. Which action is most effective in reducing the attack surface?

Question 45mediummultiple choice

Which Nexus feature dynamically validates ARP packets to prevent man-in-the-middle attacks?

Question 46easymultiple choice

In Cisco TrustSec, what is used to tag traffic based on identity or group membership?

Question 47hardmultiple choice

A data center architect needs to enforce role-based access control for UCS Manager. What is the correct approach?

Question 48mediummultiple choice

Which encryption technology is used to secure Fibre Channel traffic in flight between storage and switches?

Question 49mediummulti select

A security engineer is deploying IP Source Guard on a Nexus switch. Which two components must be operational for IP Source Guard to function correctly?

Question 50hardmulti select