350-601 Security Practice Test 7 — 15 Questions

Question 1

Two Cisco Nexus 9000 switches are connected via Ethernet interface 1/1. The engineer wishes to secure the link using MACsec (IEEE 802.1ae) with a pre-shared key for connectivity association key (CAK) protection. Both switches have the same hardware and software version supporting MACsec. The engineer configures the following on both switches:

feature macsec
macsec policy MACSEC_POLICY
  cipher-suite gcm-aes-128
  security-mode no-encrypt
  mka sak-rekey-time 30
interface ethernet 1/1
  macsec policy MACSEC_POLICY

However, the link comes up without MACsec encryption (the port counter shows MACsec frames dropped). The engineer checks that the pre-shared key is configured correctly via 'macsec key-chain' but notices it was not explicitly applied. What is the most likely reason for MACsec failing to establish?

Accepted Answer

The MACsec key chain must be created and referenced in the macsec policy, and the MKA policy must be applied to the interface with 'macsec mka policy'.. MACsec on Cisco Nexus 9000 switches requires a key chain to be defined and explicitly referenced within the MACsec policy. Without the 'key-chain' command under the 'macsec policy', the pre-shared key (CAK) is not available for MKA (MACsec Key Agreement) to derive session keys. Additionally, the MKA policy must be applied to the interface using 'macsec mka policy' to enable the key agreement protocol; simply enabling MACsec on the interface without these steps leaves the link unsecured, causing MACsec frames to be dropped.

Answer

Both switches must have the same MACsec profile name.

Answer

The interface must be put in a 'macsec' mode with 'switchport macsec'.

Answer

The 'feature macsec' command is not enabled, so MACsec is not operational.

Question 2

A network engineer is implementing port security on a Cisco Nexus 9000 switch to limit the number of MAC addresses learned on a single access port. The switchport is configured as follows:

interface Ethernet 1/2
  switchport mode access
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation shutdown
  switchport port-security mac-address sticky

After connecting two authorized devices, a third unauthorized device is connected, causing the port to enter the err-disabled state. The engineer needs to restore connectivity for the two authorized devices as quickly as possible, while maintaining the security posture. What is the best practice to recover the port automatically in the future?

Accepted Answer

Configure 'errdisable recovery cause psecure-violation' to automatically recover the port after the configured interval.. The 'errdisable recovery cause psecure-violation' command enables automatic recovery from the err-disabled state caused by a port-security violation. This allows the port to come back up after a default or configured interval (typically 300 seconds) without manual intervention, restoring connectivity for the two authorized devices while maintaining the security posture of limiting MAC addresses to two.

Answer

Manually shut down and then no shutdown the interface to recover from err-disabled state.

Answer

Remove port-security configuration entirely to prevent future err-disables.

Answer

Increase the maximum MAC address limit to 3 to accommodate the third device.

Question 3

Which TWO methods are used to secure management plane access on Cisco Nexus 9000 series switches?

Accepted Answer

SSH. SSH (Secure Shell) is correct because it provides encrypted remote access to the management plane, preventing eavesdropping and session hijacking. AAA (Authentication, Authorization, and Accounting) is correct because it centralizes user authentication and authorization for management access, enforcing role-based access control (RBAC) via RADIUS or TACACS+ servers.

Answer

SNMPv3

Answer

CoPP

Answer

VRF

Question 4

Refer to the exhibit. What is the effect of this configuration on traffic in VLAN 10?

Accepted Answer

Telnet traffic is denied; all other traffic is permitted.. The ACL applied to VLAN 10 contains two entries: the first denies TCP traffic destined for port 23 (Telnet), and the second permits all IP traffic (permit ip any any). As a result, Telnet packets are denied by the first entry, while all other traffic (including other TCP, UDP, ICMP, etc.) is permitted by the second entry. Option C correctly states this behavior. Option A incorrectly says Telnet is permitted. Option B incorrectly says all except telnet is denied; actually all other traffic is permitted. Option D incorrectly says all traffic is permitted; telnet is denied.

Answer

Telnet traffic is permitted; all other traffic is denied.

Answer

All traffic is denied except telnet.

Answer

All traffic is permitted.

Question 5

A data center engineer is troubleshooting high CPU utilization on a Cisco Nexus 9000 switch. The engineer suspects a distributed denial-of-service (DDoS) attack targeting the switch. To mitigate the attack, the engineer configures a Control Plane Policing (CoPP) policy that drops all ICMP packets destined to the switch. The policy is applied to the control-plane using the 'service-policy input COPP' command. After applying the policy, the switch CPU utilization remains high, and ICMP traffic is still reaching the switch. The engineer verifies that the CoPP policy is applied and that the class-map matches ICMP. The policy-map has the correct police and drop actions. No other CoPP policies are applied. What is the most likely cause of the issue?

Accepted Answer

The attack traffic is entering through the management interface, which is not affected by CoPP.. The management interface (mgmt0) on Cisco Nexus 9000 switches operates in a separate management VRF and is not subject to Control Plane Policing (CoPP) policies applied to the default control-plane. CoPP only polices traffic that ingresses through data-plane interfaces (e.g., Ethernet, port-channel). If the DDoS attack is arriving via the management interface, the CoPP policy will not filter it, leaving CPU utilization high. This is a common oversight when troubleshooting control-plane protection.

Answer

The switch requires a reload for the CoPP policy to take effect.

Answer

The CoPP policy must be applied to the management VRF as well.

Answer

The class-map uses 'match protocol icmp' but the traffic uses a different protocol.

Question 6

In ACI, which model is used for micro-segmentation to allow traffic between EPGs?

Accepted Answer

Whitelist model using contracts. ACI uses a whitelist model via contracts to permit traffic between EPGs.

Answer

Blacklist model using taboo contracts

Answer

IP-based ACLs on leaf switches

Answer

VRF leaking

Question 7

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

Accepted Answer

Taboo contract. Taboo contracts are used to explicitly deny traffic between EPGs.

Answer

Filter with action deny

Answer

QoS policy

Answer

VRF with route leaking

Question 8

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions.

Answer

LDAP

Answer

RADIUS

Answer

Kerberos

Question 9

A Nexus switch is experiencing high CPU utilization due to control plane traffic. Which feature should be configured to protect the CPU?

Accepted Answer

Control Plane Policing. CoPP (Control Plane Policing) rate-limits control plane traffic.

Answer

IP Source Guard

Answer

Dynamic ARP Inspection

Answer

DHCP snooping

Question 10

In Cisco TrustSec, which technology is used to enforce east-west traffic policies based on identity without relying on IP addresses?

Accepted Answer

SGACL. SGACLs enforce policies based on SGTs, not IP addresses.

Answer

SGT

Answer

ACLs

Answer

VLAN ACLs

Question 11

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

Accepted Answer

DHCP Snooping. DHCP snooping filters DHCP server messages on untrusted ports.

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Answer

Port Security

Question 12

Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?

Accepted Answer

IP Source Guard. IP Source Guard uses DHCP snooping binding to validate source IP.

Answer

Port Security

Answer

ACL

Answer

Dynamic ARP Inspection

Question 13

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

Accepted Answer

It uses the SGACL to permit HTTP and deny other traffic. SGACLs enforce policy based on SGTs, not IP addresses.

Answer

It forwards the traffic to the Cisco ISE for policy decision

Answer

It applies an IP ACL based on the SGT

Answer

It drops all traffic between different SGTs unless a contract exists

Question 14

Which feature on Nexus switches prevents ARP spoofing attacks by validating ARP packets?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) intercepts ARP packets and validates them against the DHCP snooping binding database.

Answer

DHCP Snooping

Answer

Port Security

Answer

IP Source Guard

Question 15

An administrator needs to limit the number of MAC addresses learned on a Nexus access port to prevent MAC flooding attacks. Which feature should be configured?

Accepted Answer

Port Security. Port security limits MAC addresses per port.

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection

Answer

IP Source Guard