350-601 Security Practice Test 3 — 15 Questions

Question 1

A company uses Cisco ISE for 802.1X authentication on data center edge switches. After a recent upgrade, some endpoints that previously authenticated successfully now fail. The ISE logs show the endpoint is in the wrong authorization profile. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The endpoint posture assessment is failing. A failing posture assessment can cause ISE to apply a different authorization profile (e.g., a quarantine or remediation profile) instead of the expected one, even though the endpoint previously authenticated successfully. Posture checks occur after 802.1X authentication and can change the authorization result based on endpoint compliance, which aligns with the symptom of the endpoint being in the wrong profile after an upgrade.

Answer

The switch port is in multi-authentication mode

Answer

The switch has incorrect RADIUS shared secret

Answer

The ISE policy is using a different identity source

Question 2

An attacker attempts to spoof a legitimate client's IP address to intercept traffic. DHCP snooping is enabled. Which feature prevents this spoofing by validating source IP in data packets?

Accepted Answer

IP Source Guard. IP Source Guard (IPSG) uses the DHCP snooping binding database to validate the source IP address in data packets received on untrusted ports. If a packet's source IP does not match an entry in the binding table, IPSG drops the packet, preventing IP spoofing attacks.

Answer

Port security

Answer

Dynamic ARP Inspection

Answer

DHCP Snooping binding database

Question 3

Two data center switches are connected via a fiber link. They need to encrypt all traffic at Layer 2. Which configuration is required on both switches to establish MACsec?

Accepted Answer

Enable MACsec and configure a pre-shared key or CA. MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption between directly connected switches. To establish a MACsec session, both switches must enable MACsec on the interface and either configure a pre-shared key (PSK) or use a CA (Connectivity Association) key agreement protocol like MKA (MACsec Key Agreement, IEEE 802.1X-2010). This ensures all Ethernet frames are encrypted at the data link layer.

Answer

Configure the interface as a trunk

Answer

Enable IPsec on the interface

Answer

Enable 802.1X on the interface

Question 4

Which two statements are true about Cisco TrustSec? (Choose two.)

Accepted Answer

It requires a Cisco ISE policy server. Cisco TrustSec relies on a Cisco ISE policy server to define and enforce security policies based on Security Group Tags (SGTs). ISE acts as the centralized policy decision point, dynamically assigning SGTs to authenticated endpoints and distributing the SGT-to-IP bindings to network devices via SXP or inline tagging.

Answer

It requires 802.1X authentication

Answer

It provides encryption at Layer 2

Answer

It uses VLANs for segmentation

Question 5

Which two mechanisms are used by Dynamic ARP Inspection to prevent ARP spoofing? (Choose two.)

Accepted Answer

DHCP snooping binding table. Dynamic ARP Inspection (DAI) validates ARP packets by comparing the sender MAC and IP addresses against the DHCP snooping binding table. If an ARP packet's MAC-IP binding does not match an entry in the binding table, DAI drops the packet, preventing ARP spoofing attacks. Additionally, DAI can use ARP access lists (ARP ACLs) to statically define valid MAC-IP bindings for hosts that do not use DHCP, providing an alternative validation mechanism.

Answer

Port security

Answer

ARP rate limiting

Answer

ARP inspection VLAN configuration

Question 6

Which three actions can be taken when a port security violation occurs? (Choose three.)

Accepted Answer

Shutdown. When a port security violation occurs, the switch can be configured to take one of three actions: shutdown, restrict, or protect. The shutdown action (A) immediately disables the port and places it in an errdisable state, which is the default behavior. This is correct because it provides the most secure response by completely blocking traffic from the violating MAC address.

Answer

Errdisable recovery

Answer

Log

Question 7

Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?

Accepted Answer

The DHCP server port is trusted for all VLANs. When a DHCP server is connected to a switch port and clients in different VLANs (like VLAN 10) obtain IP addresses, the switch must trust the DHCP server port for all VLANs. This is typically achieved by configuring the port as a DHCP snooping trusted port or by using an IP helper address on the VLAN interface. Without trust, DHCP snooping would drop server responses on untrusted ports, preventing the client from obtaining an address.

Answer

The DHCP server is in VLAN 20

Answer

The DHCP client is using a static IP address

Answer

The DHCP client MAC address is not verified

Question 8

Refer to the exhibit. An administrator connects a new server to Ethernet1/1 and the port immediately goes into errdisable state. The previous device was connected to that port. What is the most likely cause?

Accepted Answer

The new server has a different MAC address than the sticky MAC. The port immediately entering errdisable state upon connecting a new server indicates a port security violation. When port security is enabled with sticky MAC addresses, the switch dynamically learns and 'sticks' the MAC address of the first connected device to the running configuration. Connecting a device with a different MAC address triggers a security violation, and if the violation mode is 'shutdown' (the default), the port is placed into errdisable state. This matches the scenario where the previous device's MAC was learned as sticky, and the new server's MAC differs.

Answer

The port security violation mode is set to protect

Answer

The port security maximum MAC addresses is set too high

Answer

The port is configured as a trunk

Question 9

A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?

Accepted Answer

Set Ethernet 1/1 as a trusted port. DHCP snooping uses the concept of trusted and untrusted ports. By default, all ports are untrusted. Setting Ethernet 1/1, where the legitimate DHCP server is connected, as a trusted port allows DHCP server messages (OFFER, ACK, etc.) from that port to be forwarded. All other ports, including Ethernet 1/2, remain untrusted, so any DHCP server messages received on them are dropped, effectively blocking the unauthorized DHCP server.

Answer

Enable the DHCP snooping information option

Answer

Set Ethernet 1/2 as a trusted port

Answer

Disable DHCP snooping globally

Question 10

A Nexus switch experiences high CPU utilization due to excessive ICMP traffic. An engineer applies a CoPP policy that includes a class matching ICMP with a drop action. After applying, legitimate OSPF hello packets are also being dropped. What is the most likely cause?

Accepted Answer

OSPF packets match the default class which has a drop action. When a CoPP policy is applied, traffic that does not match any explicit class-map falls into the default class. If the default class has a drop action, all unmatched traffic—including OSPF hello packets (which use IP protocol 89)—will be dropped. The class-map matching ICMP (typically based on protocol or DSCP) does not match OSPF, so OSPF packets are handled by the default class, causing the observed behavior.

Answer

The CoPP policy is applied to the wrong interface

Answer

The CoPP policy rate-limits all traffic including OSPF below its needed rate

Answer

The class-map matches multiple protocols including OSPF

Question 11

An engineer wants to prevent unauthorized devices from connecting to access ports. Which port security violation mode will disable the port and generate a syslog message?

Accepted Answer

shutdown. The 'shutdown' violation mode is the only port security mode that both disables the port (placing it in an err-disabled state) and generates a syslog message when a violation occurs. This mode immediately shuts down the interface upon detecting an unauthorized MAC address, providing both a clear security alert and a physical disconnection of the offending device.

Answer

protect

Answer

restrict

Answer

shutdown vlan

Question 12

A VACL is configured to capture traffic between hosts in the same VLAN. The capture port is configured and the VACL is applied to the VLAN. However, no traffic is being captured. What is a likely reason?

Accepted Answer

The VACL does not have a capture action. A VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.

Answer

The VACL is applied in the wrong direction

Answer

The capture port is a SPAN destination port

Answer

The capture port is not in the same VLAN

Question 13

Two Nexus switches are configured for MACsec using MKA. The link between them is up, but MKA does not establish. Which issue is most likely?

Accepted Answer

Mismatched cipher suites. MKA (MACsec Key Agreement) requires both endpoints to agree on a cipher suite during the CAK (Connectivity Association Key) exchange. If the cipher suites are mismatched (e.g., one switch uses GCM-AES-128 and the other uses GCM-AES-256), the MKA negotiation will fail, and the link will remain up but unsecured. This is the most common cause of MKA not establishing on an otherwise functional Layer 2 link.

Answer

Different MTU sizes

Answer

Switches are in different VLANs

Answer

Mismatched MKA key strings

Question 14

An administrator configures 'aaa authentication login default group tacacs+ local'. What happens if the TACACS+ server is unreachable?

Accepted Answer

Local username database is used. The command 'aaa authentication login default group tacacs+ local' configures a method list where the first method is TACACS+ and the second is local. If the TACACS+ server is unreachable (not responding, not rejecting), the switch falls back to the next method in the list, which is local authentication using the local username database. This fallback behavior is defined by Cisco IOS/IOS-XE authentication method lists, where 'local' acts as a backup when the primary method is unavailable.

Answer

The switch uses no authentication

Answer

Authentication fails

Answer

The switch tries the next method in the group

Question 15

In a private VLAN configuration, a host in a community VLAN needs to communicate with a host in the primary VLAN. What configuration is required on the switch?

Accepted Answer

The host in primary VLAN must be on a promiscuous port. In a private VLAN configuration, a host in a community VLAN can communicate with a host in the primary VLAN only if the host in the primary VLAN is on a promiscuous port. The promiscuous port can communicate with all other ports in the private VLAN, including community and isolated ports, enabling inter-VLAN traffic through a Layer 3 gateway or a server connected to that port.

Answer

The host in community VLAN must be on an isolated port

Answer

The host in community VLAN must be on a promiscuous port

Answer

The host in primary VLAN must be on a community port