350-601 Security Practice Test 4 — 15 Questions

Question 1

In an ACI fabric, an EPG is configured with a contract that allows HTTP traffic to an external network. The external network is reachable via a Layer 3 Outside. However, HTTP traffic from the EPG fails. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The L3Out and the EPG are in different VRFs. In Cisco ACI, communication between an EPG and an external network via a Layer 3 Outside requires both to be in the same VRF. If the EPG and the L3Out are in different VRFs, the contract cannot be enforced, and traffic will fail even if the contract allows HTTP. The VRF provides the routing and policy enforcement boundary for the contract.

Answer

The subject action is set to deny

Answer

The filter uses the wrong direction

Answer

The contract is applied to the consumer EPG instead of the provider

Question 2

A data center switch port is configured for 802.1X with MAB as fallback. A device that does not support 802.1X is connected. Which method will allow the device to authenticate?

Accepted Answer

MAC authentication bypass. When a device that does not support 802.1X is connected to a port configured for 802.1X with MAB as fallback, the switch detects that no EAPOL frames are received from the device. It then initiates MAC authentication bypass (MAB), which uses the device's MAC address as the identity for authentication against the RADIUS server. If the MAC address is allowed, the port is authorized, providing a seamless fallback authentication method for non-802.1X-capable devices.

Answer

EAP-TLS

Answer

Web authentication

Answer

Local authentication using a pre-shared key

Question 3

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

Accepted Answer

IP Source Guard. IP Source Guard (IPSG) uses the DHCP snooping binding table to validate the source IP address of packets received on untrusted ports. It drops any packet whose source IP does not match an entry in the binding table, preventing IP spoofing attacks. Dynamic ARP Inspection (DAI) also relies on the DHCP snooping binding table to validate ARP packets, ensuring that the sender MAC and IP addresses match a legitimate binding, thereby blocking ARP poisoning attacks.

Answer

Port Security

Answer

Private VLANs

Answer

MACsec

Question 4

Which THREE are characteristics of Cisco TrustSec? (Select exactly 3)

Accepted Answer

Uses SGTs to enforce policy. Cisco TrustSec uses Security Group Tags (SGTs) to enforce policy based on identity rather than IP addresses. It requires Cisco ISE as the policy server to assign SGTs and enforce access control. TrustSec operates at Layer 2 by embedding SGTs in Ethernet frames. The CTS auth-proxy is a mechanism for legacy devices but is not a core characteristic; likewise, MACsec encryption is optional and not required.

Answer

Uses CTS auth-proxy

Answer

Requires MACsec encryption

Question 5

Which TWO features are used to validate ARP packets and prevent ARP spoofing attacks? (Select exactly 2)

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is correct because it validates ARP packets by checking them against the DHCP snooping binding database, ensuring that only legitimate ARP replies and requests are forwarded. This prevents ARP spoofing attacks where an attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate device.

Answer

IP Source Guard

Answer

Private VLANs

Answer

Port Security

Question 6

Refer to the exhibit. A client connected to Ethernet1/2 cannot obtain an IP address via DHCP. What is the most likely cause?

Accepted Answer

The DHCP snooping trust configuration is missing on the server port. The client cannot obtain an IP address via DHCP because the DHCP server port (Ethernet1/1) is not configured as a DHCP snooping trusted port. By default, all ports are untrusted, and DHCP snooping drops all DHCP server responses (OFFER, ACK) received on untrusted ports. Configuring the port connecting to the DHCP server as trusted is required to allow these messages to reach the client.

Answer

The DHCP snooping information option is disabled

Answer

The DHCP server is on a different VLAN

Answer

IP source guard is enabled on the client port

Question 7

Refer to the exhibit. The CoPP policy above is applied. Which traffic is most likely to be dropped?

Accepted Answer

ICMP traffic that exceeds 1000 bps. The CoPP policy explicitly defines a class-map for ICMP traffic with a police rate of 1000 bps. Any ICMP traffic exceeding this rate is dropped due to the 'drop' action in the police command. The other classes (OSPF and class-default) have higher rates and are not as constrained, making ICMP the most likely to be dropped when exceeded.

Answer

Both ICMP and class-default traffic that exceed their rates

Answer

class-default traffic that exceeds 20000 bps

Answer

OSPF traffic that exceeds 5000 bps

Question 8

Refer to the exhibit. Two Nexus switches are connected via Ethernet1/1. MKA does not initiate. What is the issue?

Accepted Answer

The policy is not applied to the interface. The exhibit shows that the MACsec policy is defined but not applied to interface Ethernet1/1. Without applying the policy using the `macsec policy` command under the interface configuration, MKA (MACsec Key Agreement) cannot initiate because the switch does not know which security policy to enforce on that link.

Answer

The interface is not administratively up

Answer

The cipher-suite is not supported

Answer

The MACsec key chain is missing

Question 9

A network engineer is configuring VLAN ACLs on a Cisco Nexus 9000 switch to enforce traffic filtering between VLANs. Which configuration step is required to apply a VACL to a VLAN?

Accepted Answer

Use the 'vlan filter' command in global configuration mode.. VACLs on Cisco Nexus 9000 switches are applied using the 'vlan filter' command in global configuration mode, which references a VLAN access-map. This command binds the access-map to a specific VLAN, enabling Layer 2 traffic filtering between VLANs without requiring a Layer 3 interface.

Answer

Apply the VACL to a Layer 3 interface using 'ip access-group'.

Answer

Apply the VACL to a physical port using 'mac access-group'.

Answer

Define a VLAN access-map and then apply it under the VLAN configuration.

Question 10

A data center administrator is implementing Cisco TrustSec on a Nexus 7000 switch to enforce role-based access control. After configuring a security group tag (SGT) classification policy, users report that traffic between two servers is not being tagged. What is the most likely cause?

Accepted Answer

The ingress interface is missing the 'sgt' or 'ip policy' command to classify traffic.. Cisco TrustSec requires the ingress interface to be explicitly configured with either the 'sgt' command (for static SGT assignment) or an 'ip policy' command (for dynamic SGT classification via a security group ACL). Without this, the switch cannot classify traffic and apply the SGT tag. The scenario describes a classification policy that is not being applied, which directly points to a missing ingress classification command.

Answer

DHCP snooping is not enabled on the VLAN.

Answer

The switch ASIC does not support TrustSec in hardware.

Answer

The SGT is assigned on the egress interface instead of ingress.

Question 11

During a security audit, you discover that a Cisco Nexus 9000 switch is allowing traffic between two ports in the same VLAN despite having a VLAN ACL that should deny it. The VACL is applied correctly, and the ACL entries are properly configured. What is the most likely reason for this behavior?

Accepted Answer

VACLs only filter traffic between VLANs, not within the same VLAN.. VLAN ACLs (VACLs) operate at Layer 2 and filter traffic entering or leaving a VLAN, but they only apply to traffic that crosses VLAN boundaries (i.e., inter-VLAN routing). Traffic between two ports within the same VLAN is bridged at Layer 2 and never traverses the VACL enforcement point, so the ACL entries have no effect on intra-VLAN communication. This is a fundamental design limitation of VACLs on Cisco Nexus switches.

Answer

The VACL requires Layer 3 inspection to be enabled.

Answer

The switch does not support hardware VACL processing.

Answer

Spanning-tree is bypassing the VACL for PortFast ports.

Question 12

An engineer needs to implement port security on a Cisco Nexus 1000v virtual switch to prevent MAC flooding attacks. The requirement is to allow only the first MAC address learned on the port. Which command sequence accomplishes this?

Accepted Answer

interface ethernet 1/1
  switchport port-security
  switchport port-security maximum 1
  switchport port-security violation shutdown. The command sequence sets the maximum number of MAC addresses to 1, which ensures only the first learned MAC address is allowed on the port. The 'violation shutdown' action disables the port if a violation occurs, effectively preventing MAC flooding attacks by stopping any additional MAC addresses from being learned.

Answer

interface ethernet 1/1
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation restrict

Answer

interface ethernet 1/1
  switchport port-security
  switchport port-security maximum 10
  switchport port-security violation protect

Answer

interface ethernet 1/1
  switchport port-security manual
  switchport port-security mac-address 0000.1111.2222

Question 13

A Cisco ACI fabric administrator wants to implement microsegmentation using Cisco Group-Based Policy (GBP) in a network that hosts virtual machines and bare-metal servers. Which component must be used to enforce microsegmentation policies for bare-metal servers?

Accepted Answer

Leaf switch. In Cisco ACI, microsegmentation for bare-metal servers is enforced at the leaf switch using Cisco Group-Based Policy (GBP). Unlike virtual machines that rely on a virtual switch (e.g., Cisco AVS) to apply policies, bare-metal servers connect directly to the leaf switch via physical interfaces. The leaf switch uses the opflex protocol to receive policy definitions from the APIC and applies them at the port level, enabling microsegmentation without requiring a hypervisor or virtual switch.

Answer

Application Policy Infrastructure Controller (APIC)

Answer

Virtual Switch (e.g., Cisco AVS)

Answer

External firewall appliance

Question 14

A network administrator is configuring copp (Control Plane Policing) on a Cisco Nexus 9300 to protect the control plane from high-rate traffic. After applying the policy, the switch becomes unresponsive to SSH sessions, but ICMP still works. What is the most likely misconfiguration?

Accepted Answer

In the class-map for SSH, the 'match' statement is incorrectly configured, causing SSH traffic to fall under a drop class.. If the class-map for SSH traffic uses an incorrect match statement (e.g., matching on the wrong protocol or port), SSH packets will not be classified into the intended permit class. Instead, they fall through to a default drop class in the policy-map, causing SSH sessions to fail while ICMP (which may be matched by a different class or the default permit action) still works. CoPP relies on precise class-map matching; a misconfiguration here directly explains the selective loss of SSH access.

Answer

The control plane rate limit is set too low because the switch has many interfaces.

Answer

CoPP is not supported on the Nexus 9300 platform.

Answer

The default action of the policy-map is to drop traffic not explicitly matched.

Question 15

A data center engineer is configuring 802.1X authentication on Cisco Nexus switches for wired endpoints. The requirement is to allow traffic on the port even if no EAPOL packet is received from the endpoint (e.g., a printer). Which authentication method should be used?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct method because it allows a port to authenticate endpoints that do not send EAPOL frames, such as printers or other legacy devices. When no EAPOL is received within a configurable timeout, the switch falls back to using the source MAC address of the first frame as the authentication credential, sending it to the RADIUS server for verification. This satisfies the requirement to permit traffic even without 802.1X supplicant capability.

Answer

802.1X using RADIUS server

Answer

Port security with sticky MAC addresses

Answer

Local authentication with a predefined list of users