350-601 Security Practice Test 2 — 15 Questions

Question 1

An engineer is configuring AAA on a Cisco Nexus switch to authenticate management access via TACACS+. The switch is reachable, but login attempts repeatedly fail. Which action should the engineer take to isolate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run 'test aaa authentication login legacy' to validate AAA configuration.. The 'test aaa authentication login' command with the 'legacy' keyword directly validates the AAA authentication configuration against the TACACS+ server without requiring a full login session. This isolates whether the issue is with the AAA configuration itself versus network connectivity or server reachability, as the command simulates the exact authentication flow the switch uses.

Answer

Enable 'debug tacacs' on the switch to see detailed TACACS+ exchange.

Answer

Verify IP connectivity to the TACACS+ server using ping.

Answer

Check if the TACACS+ server port (49) is open using Telnet.

Question 2

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

Accepted Answer

Create a contract between EPGs with appropriate filters.. In Cisco ACI, contracts are the primary mechanism for enforcing policy-based communication between EPGs. By creating a contract between the web and app EPGs with a filter that permits HTTP (TCP/80), and another contract between management and web EPGs with a filter that denies SSH (TCP/22), the architect can precisely meet both requirements. Contracts allow granular control over which protocols and ports are allowed or denied, making them the correct construct for this access control scenario.

Answer

Use a tenant to separate the EPGs logically.

Answer

Configure a VRF to isolate traffic between EPGs.

Answer

Define a bridge domain with L2 policies.

Question 3

A network engineer is troubleshooting CoPP drops on a Cisco Nexus 9000 switch. The 'show control-plane' output indicates that packets are being dropped due to 'CoPP' on the 'default' control-plane class. Which action is most likely to resolve the issue without affecting routing protocol stability?

Accepted Answer

Increase the policer rate for the 'default' class in the CoPP policy.. The 'default' class in a CoPP policy catches all control-plane traffic not explicitly matched by higher-priority classes. Drops in this class indicate that the aggregate policer rate for unmatched traffic is too low. Increasing the policer rate for the 'default' class allows more legitimate control-plane packets (e.g., ARP, BFD, or management traffic) to pass without impacting the dedicated policers for critical protocols like OSPF or BGP, thus preserving routing stability.

Answer

Disable CoPP globally to allow all control-plane traffic.

Answer

Modify the class-map to reclassify the dropped packets to a higher priority class.

Answer

Increase the ingress buffer size on the control-plane interface.

Question 4

An organization is deploying Cisco ISE for 802.1X authentication on Cisco Nexus switches. Some endpoints fail authentication and fall back to the MAB. The security policy requires that endpoints failing both 802.1X and MAB be placed in a restricted VLAN. Which configuration is needed on the switch port?

Accepted Answer

authentication failed action authorize vlan 999. The 'authentication failed action authorize vlan 999' command configures the switch port to place endpoints that fail both 802.1X and MAB into a restricted VLAN (VLAN 999). This directly meets the security policy requirement for endpoints that cannot authenticate via either method.

Answer

authentication order dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication event server dead action authorize vlan 999

Question 5

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. SXP (SGT Exchange Protocol) is specifically designed to propagate Security Group Tag (SGT) information between network devices that do not support hardware-based inline tagging (e.g., older switches or routers). SXP allows these devices to participate in TrustSec policy enforcement by exchanging SGT-to-IP bindings over TCP, enabling consistent access control across heterogeneous environments.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 6

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

Accepted Answer

Add 'spanning-tree bpdufilter enable' on the interface.. Enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Answer

Add 'spanning-tree guard loop' to the interface.

Answer

Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.

Answer

Change the port type to 'spanning-tree port type network trunk'.

Question 7

A company runs a multi-tenant data center using Cisco ACI with multiple tenants. Each tenant has its own VRF and EPGs. The security policy requires that tenant A's web servers (EPG web_tenantA) be accessible from tenant B's application servers (EPG app_tenantB) only via HTTPS (TCP 443). The ACI fabric is configured with contracts. The administrator has created a contract with a filter for HTTPS (tcp dstPort 443) and applied it as a provider contract on EPG web_tenantA and as a consumer contract on EPG app_tenantB. However, traffic from tenant B's app servers to tenant A's web servers is being dropped. The administrator has verified that the contracts are applied correctly and the filter is correct. What is the most likely cause of the traffic drop?

Accepted Answer

The contract is not marked as 'shared' between tenants; a shared contract must be created and both EPGs must be in the same VRF or use a shared VRF.. In Cisco ACI, contracts are local to a VRF by default. For inter-tenant communication where each tenant has its own VRF, the contract must be explicitly marked as 'shared' and both EPGs must either be in the same VRF or use a shared VRF that allows cross-VRF policy enforcement. Without this, the contract filter is not applied across VRFs, causing traffic to be dropped even though the contract and filter are correctly configured.

Answer

The EPGs are not in the same bridge domain; they must be in the same bridge domain to communicate.

Answer

The VRF of tenant A and tenant B must have route leaking configured to allow inter-VRF routing.

Answer

The filter for HTTPS must also include the source port range 49152-65535 for ephemeral ports.

Question 8

Order the steps to upgrade the software on a Cisco Nexus switch using ISSU.

Accepted Answer

Copy the new image to the bootflash, then set the boot variable to the new image, then perform a compatibility check, then issue the 'install all' command, then reload the switch.. ISSU requires image copy, boot variable, compatibility check, upgrade command, and reload.

Answer

Copy the new image to the bootflash, then perform a compatibility check, then set the boot variable to the new image, then issue the 'install all' command, then reload the switch.

Answer

Copy the new image to the bootflash, then set the boot variable to the new image, then issue the 'install all' command, then perform a compatibility check, then reload the switch.

Answer

Set the boot variable to the new image, then copy the new image to the bootflash, then perform a compatibility check, then issue the 'install all' command, then reload the switch.

Question 9

Match each Cisco data center security feature to its purpose.

Accepted Answer

Port Security: Limits the number of MAC addresses allowed on a port.. Port Security limits MAC addresses per port; DHCP Snooping filters DHCP messages and builds a binding database; Dynamic ARP Inspection validates ARP packets; IP Source Guard filters traffic based on binding table. Common confusions include mixing DHCP Snooping with DAI and Port Security with DHCP Snooping.

Answer

Port Security: Filters DHCP messages to prevent rogue servers.

Answer

DHCP Snooping: Validates ARP packets to prevent spoofing.

Question 10

A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?

Accepted Answer

TACACS+. TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.

Answer

RADIUS

Answer

LDAP

Answer

SSH

Question 11

A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?

Accepted Answer

Configure the port connected to the DHCP server as trusted. Configuring the port connected to the DHCP server as trusted is a best practice because DHCP snooping treats all ports as untrusted by default. Only trusted ports are allowed to forward DHCP server messages (OFFER, ACK, NAK), preventing rogue DHCP server attacks. This ensures that only the legitimate DHCP server can assign IP addresses, maintaining network integrity.

Answer

Disable DHCP snooping on the DHCP server VLAN

Answer

Set the DHCP server IP address in the binding database

Answer

Enable DHCP snooping on all VLANs

Question 12

An engineer notices that AAA authentication using RADIUS is failing, and the RADIUS server logs show no incoming authentication requests. Which of the following is the most likely cause?

Accepted Answer

The device has not been configured with any RADIUS server host. If the RADIUS server logs show no incoming authentication requests, the issue is that the device is not sending any traffic to the server. This occurs when no RADIUS server host is configured on the device, meaning the device has no IP address or hostname to which it can send authentication packets. Without a configured server host, the device will not attempt any RADIUS communication, resulting in zero requests reaching the server.

Answer

The device is using TACACS+ instead of RADIUS

Answer

The RADIUS server is not reachable due to a firewall

Answer

The RADIUS shared secret is incorrect

Question 13

A data center switch is experiencing high CPU due to excessive BGP updates. Which action can mitigate this without affecting legitimate BGP traffic?

Accepted Answer

Apply a CoPP policy that rate-limits BGP traffic. Control Plane Policing (CoPP) protects the control plane by rate-limiting specific traffic classes. Applying a CoPP policy that rate-limits BGP traffic (option A) reduces CPU load from excessive BGP updates while still allowing legitimate BGP sessions to function, as the rate-limit only drops packets exceeding a configured threshold. This preserves BGP neighbor reachability and route exchange, unlike dropping all BGP traffic.

Answer

Apply a CoPP policy that drops all BGP traffic

Answer

Disable BGP route filtering

Answer

Increase BGP timers globally

Question 14

An organization uses VXLAN EVPN for network segmentation. Which component provides per-tenant isolation of control plane traffic?

Accepted Answer

VRF. In VXLAN EVPN, per-tenant isolation of control plane traffic is achieved through the use of VRFs (Virtual Routing and Forwarding instances). Each tenant is assigned a unique VRF, which maintains its own separate routing table and forwarding decisions, ensuring that control plane information (such as MAC/IP routes advertised via MP-BGP EVPN) is isolated between tenants. This is distinct from data plane isolation, which is provided by VXLAN Network Identifiers (VNIs).

Answer

VLAN

Answer

VNI

Answer

VXLAN tunnel

Question 15

A server team reports that after connecting a new server to a switchport, the server can receive traffic but cannot send traffic. The port is configured with port security. What is the most likely cause?

Accepted Answer

The port security violation mode is set to protect. When port security violation mode is set to 'protect', the switch drops traffic from unauthorized MAC addresses without generating a syslog message or incrementing the violation counter. In this scenario, the server can receive traffic because the switch still forwards broadcast and unknown unicast frames to the port, but the server's transmitted frames are silently dropped because the switch does not learn the server's MAC address or forward its frames. This matches the symptom of one-way communication where the server can receive but not send.

Answer

The port is in errdisable state

Answer

The port security maximum is set to 1 and another device is connected

Answer

The server MAC address is not in the allowed list