350-601 Security Practice Test 6 — 15 Questions

Question 1

An ACI fabric administrator wants to enable microsegmentation for workloads in a Virtual Routing and Forwarding (VRF) instance. The security policy must allow communication between two endpoints based on their EPG (Endpoint Group) membership, regardless of IP address. Which construct must be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Contract with filter and subject. A contract with a filter and subject is required to enable microsegmentation in ACI because it defines the explicit rules for communication between EPGs. The contract specifies which EPGs can talk to each other, the filter defines the L4/L7 parameters (e.g., protocol, ports), and the subject binds the filter to the contract, allowing policy enforcement regardless of IP address. This is the only construct that supports EPG-based security policies for intra-VRF microsegmentation.

Answer

vzAny

Answer

VRF

Answer

Bridge Domain (BD)

Question 2

Which TWO statements about Cisco TrustSec in a data center environment are true? (Choose two.)

Accepted Answer

Cisco ISE can dynamically assign SGTs to endpoints during authentication.. Cisco ISE can dynamically assign Security Group Tags (SGTs) to endpoints during authentication via 802.1X or MAB, enabling role-based access control. This is a core TrustSec feature where the SGT is propagated to the network infrastructure to enforce policies.

Answer

TrustSec requires MACsec encryption on all links to function.

Answer

SGTs are assigned based on the source IP address of the traffic.

Answer

TrustSec policies are enforced at Layer 3 only.

Question 3

Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)

Accepted Answer

DHCP snooping. DHCP snooping is a security feature that acts as a firewall between untrusted hosts and DHCP servers. It filters DHCP messages by validating DHCP packets received on untrusted ports, dropping those that are invalid (e.g., DHCP server messages from a client port), and building a DHCP snooping binding database that maps client MAC addresses, IP addresses, VLAN, and port information. This database is then used by other features like IP Source Guard and Dynamic ARP Inspection to prevent IP spoofing and ARP poisoning attacks.

Answer

Control Plane Policing (CoPP)

Answer

Port security

Question 4

Which THREE are best practices for securing a data center network? (Choose three.)

Accepted Answer

Apply device hardening, such as disabling unused services.. Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.

Answer

Disable logging to reduce CPU load.

Answer

Use default SNMP community strings for simplicity.

Question 5

A network administrator implements the ACL shown. After verifying the ACL statistics, all counters show 0 matches. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface.. If the ACL is applied to the wrong interface, traffic never traverses that interface, so the ACL counters remain at 0. ACLs must be applied to the interface where traffic enters (inbound) or exits (outbound) the device; applying to an interface that does not carry the relevant traffic results in no matches.

Answer

The ACL entries are in the wrong order.

Answer

The 'permit ip any any' entry causes all traffic to be permitted before inspection.

Answer

The ACL is applied outbound instead of inbound.

Question 6

An engineer observes that ARP packets are being dropped. Based on the exhibit, what is the drop rate percentage for ARP packets?

Accepted Answer

50%. The exhibit shows that out of 1000 total ARP packets, 500 were dropped. The drop rate percentage is calculated as (dropped packets / total packets) * 100, which is (500/1000)*100 = 50%. Therefore, option C is correct.

Answer

75%

Answer

25%

Answer

100%

Question 7

A large enterprise data center uses Cisco ACI with a spine-leaf architecture. The security team requires that all traffic between the Web and App tiers be inspected by a firewall, but traffic within the same tier should be allowed directly. The Web EPG is in VRF PROD with Bridge Domain WEB-BD, and App EPG is in VRF PROD with Bridge Domain APP-BD. The firewall is connected as a service graph device in a different VRF (FW-VRF). The administrator configures a contract between Web and App EPGs that redirects traffic through the firewall. However, after implementation, traffic from Web to App is not passing through the firewall; instead, it is forwarded directly. The contract is applied correctly. What is the most likely cause?

Accepted Answer

The firewall is in a different VRF; service graphs require the firewall to be in the same VRF as the endpoints or use a shared VRF with appropriate route leaking.. In Cisco ACI, service graphs redirect traffic through firewall devices by inserting the firewall as a Layer 4-Layer 7 device in the traffic path. However, the service graph device must reside in the same VRF as the consumer and provider EPGs, or a shared VRF with proper route leaking must be configured, because ACI uses VRF isolation to enforce policy-based redirect (PBR). Since the firewall is in FW-VRF while both EPGs are in VRF PROD, the leaf switches cannot redirect traffic to the firewall without a common routing context, causing the contract to bypass the firewall and forward traffic directly.

Answer

The firewall is not reachable from the leaf switches due to a routing issue.

Answer

The contract filter is misconfigured, allowing direct communication without redirection.

Answer

The contract is applied only to intra-EPG traffic, not inter-EPG traffic.

Question 8

A network engineer is troubleshooting inter-VLAN routing on a Cisco Nexus 9000 switch. The switch is configured with VLAN 10 and VLAN 20. Hosts in VLAN 10 cannot ping hosts in VLAN 20. The engineer checks the VLAN ACL (VACL) applied to VLAN 10 and finds the following configuration:

ip access-list VACL-FILTER
  10 permit ip any any
...
vlan access-map VACL-MAP 10
  match ip address VACL-FILTER
  action forward
vlan filter VACL-MAP vlan-list 10

What is the most likely reason for the connectivity failure?

Accepted Answer

The VACL does not apply to traffic routed through the SVI; a Router ACL (RACL) must be used instead.. VACLs filter traffic at the ingress of a VLAN, but they only apply to traffic that is bridged within the same VLAN. When traffic is routed between VLANs (inter-VLAN routing), it passes through the SVI (Switch Virtual Interface), and VACLs do not inspect routed traffic. To filter inter-VLAN routed traffic, a Router ACL (RACL) must be applied to the SVI. Since the hosts in VLAN 10 cannot ping VLAN 20, the VACL on VLAN 10 is not blocking the traffic; rather, the traffic is being routed and is not subject to the VACL, so the failure is likely due to a missing or misconfigured RACL or routing issue.

Answer

The access-list permits all, so the VACL should work; perhaps the access-map is missing a default action.

Answer

The 'vlan filter' command is applied to VLAN 10 only, but the access-map is misconfigured.

Answer

The VACL is applied only to VLAN 10, so traffic from VLAN 20 to VLAN 10 is not filtered, but this should not cause a failure.

Question 9

An engineer is configuring AAA authentication on a Cisco MDS 9000 series switch. The goal is to authenticate users via RADIUS first, then local as a fallback. Which command sequence should be used?

Accepted Answer

aaa authentication login default group radius local. The 'aaa authentication login default group radius local' command configures the switch to first attempt RADIUS authentication for all login methods (default), and if the RADIUS server is unreachable or returns an error (not a rejection), it falls back to the local user database. This matches the requirement of RADIUS first with local fallback.

Answer

aaa authentication login default local radius

Answer

aaa authentication login default radius local

Answer

aaa authentication login console radius local

Question 10

Which THREE methods can be used to propagate Cisco TrustSec Security Group Tags (SGTs) across a network? (Choose three.)

Accepted Answer

VXLAN with group-based policy. VXLAN with group-based policy (GBP) is a valid method for propagating SGTs because it embeds the SGT into the VXLAN Group Policy ID (GPID) field within the VXLAN header. This allows the SGT to be carried across an overlay network, enabling scalable, policy-based segmentation in a fabric environment without requiring inline tagging or SXP.

Answer

CDP (Cisco Discovery Protocol)

Answer

LLDP

Question 11

Which TWO statements are true about Control Plane Policing (CoPP) on a Cisco Nexus 9000 switch? (Choose two.)

Accepted Answer

CoPP can be used to limit the rate of ICMP unreachable messages.. CoPP can rate-limit control-plane traffic such as ICMP unreachable messages. By applying a policy-map in the 'control-plane' sub-mode, you can define class-maps that match specific control-plane protocols (e.g., ICMP) and then police their rate to prevent CPU overload from floods of such packets.

Answer

CoPP automatically drops all unknown unicast traffic.

Answer

CoPP applies only to traffic destined to the switch management IP.

Answer

CoPP can be used to prioritize OSPF traffic over SSH.

Question 12

A data center network uses Cisco Nexus 9000 switches running NX-OS. The operations team notices that the CPU utilization on the supervisor module spikes intermittently, causing BGP session flaps. Analysis shows that the CPU spikes coincide with traceroute probes from external networks, which generate ICMP TTL exceeded messages that are process-switched. The engineer must implement a solution to protect the control plane without affecting normal ICMP functionality. The goal is to rate-limit ICMP traffic to a maximum of 1000 packets per second with a burst of 200 bytes, while allowing other control plane traffic without restriction. Which configuration should be applied?

Accepted Answer

class-map type control-plane match-all COPP-ICMP
  match protocol icmp
policy-map type control-plane COPP
  class COPP-ICMP
    police 1000 pps 200 byte burst
control-plane
  service-policy type control-plane COPP. It uses a Control Plane Policing (CoPP) policy with a class-map that matches ICMP protocol traffic in the control plane, then applies a police rate of 1000 pps with a 200-byte burst. This configuration rate-limits ICMP TTL-exceeded messages that are process-switched, protecting the supervisor CPU from spikes while allowing other control plane traffic unrestricted. The 'service-policy type control-plane' command applies the policy to the control plane, which is the proper method for NX-OS CoPP.

Answer

Use the 'hardware rate-limiter' feature to limit ICMP globally.

Answer

class-map type control-plane match-any COPP-ICMP
  match access-group name ICMP-ACL
policy-map type control-plane COPP
  class COPP-ICMP
    police rate 1000 pps burst 200
control-plane
  service-policy input COPP

Answer

Apply a QoS policy on the management interface to drop excess ICMP.

Question 13

A Cisco MDS 9000 switch is used in a storage network. The security policy requires that a junior administrator named 'user1' can view zone configurations but cannot make any changes. Currently, 'user1' is assigned the default 'network-operator' role, which allows read-only access to most configuration, but the engineer wants to ensure that zone modification is explicitly denied. The engineer creates a custom role named 'zone-viewer' and assigns it to 'user1'. The role should permit viewing of the running configuration related to zones but deny any command that modifies zone or zoneset configurations. Which configuration best achieves this objective?

Accepted Answer

role name zone-viewer
  permit command show zone*; permit command show zoneset*. It uses the 'permit command' statements with wildcard patterns ('show zone*' and 'show zoneset*') to explicitly allow only show commands related to zones and zonesets. By not including any 'permit' or 'deny' statements for configuration commands (like 'configure terminal', 'zone', or 'zoneset'), the role implicitly denies all other commands, including those that modify zone or zoneset configurations. This matches the requirement to allow viewing but deny modifications.

Answer

role name zone-viewer
  feature zone; permit command configure terminal ; zone name etc.

Answer

role name zone-viewer
  rule 1 permit read-write; feature zone

Answer

role name zone-viewer
  permit command zone; permit command zoneset; permit command zone-create

Question 14

A network engineer is configuring DHCP snooping on a Cisco Nexus 9000 switch to prevent rogue DHCP server attacks. The switch connects to the legitimate DHCP server on Ethernet 1/1. Clients are connected to ports Ethernet 1/2 through 1/24. The engineer enables DHCP snooping globally and on VLAN 10, but clients are unable to obtain IP addresses from the DHCP server. Other connectivity between clients and the server works (e.g., static IPs). What is the most likely cause and solution?

Accepted Answer

Ethernet 1/1 is untrusted by default. Configure it as trusted with 'ip dhcp snooping trust' and verify DHCP snooping is enabled on VLAN 10.. By default, all interfaces on a Cisco Nexus 9000 switch are untrusted for DHCP snooping. The legitimate DHCP server is connected to Ethernet 1/1, which must be explicitly configured as trusted using the 'ip dhcp snooping trust' interface command. Without this, the switch discards DHCP server messages (OFFER, ACK) received on that port, preventing clients from obtaining IP addresses even though DHCP snooping is enabled globally and on VLAN 10.

Answer

Disable DHCP snooping as it is not needed in this topology.

Answer

Configure a static DHCP binding for each client on the switch.

Answer

Add 'ip dhcp snooping information option' on Ethernet 1/1 to allow DHCP option 82.

Question 15

In a Cisco Application Centric Infrastructure (ACI) fabric, a tenant has two EPGs: Web and App. A contract is created between Web (consumer) and App (provider) with a filter that permits TCP port 8080 (the only port used by the application). However, traffic from App to Web is failing. The application requires bidirectional communication: Web initiates requests to App on TCP 8080, and App responds on the same connection (stateful). The engineer verifies that the filter is correctly applied and that both EPGs are in the same VRF. The contract is applied in the direction Web -> App. What is the most efficient way to resolve this issue without compromising security?

Accepted Answer

Create a second contract from App to Web with the same filter, and apply it to App as consumer and Web as provider.. In Cisco ACI, contracts are unidirectional by default. Even though the filter permits TCP 8080 from Web to App, the return traffic from App to Web is not implicitly allowed because ACI does not perform stateful inspection for TCP connections; it relies on explicit contract rules for each direction. Option C correctly creates a second contract from App (consumer) to Web (provider) with the same filter, allowing the bidirectional communication required for the application's stateful TCP session without over-permitting.

Answer

Verify that no higher-priority contract is overriding; if not, the issue is elsewhere.

Answer

Set the contract to 'allow any' between the EPGs to bypass filtering.

Answer

Modify the existing filter to allow TCP 8080 from App to Web as well.