350-601 Security Practice Test 8 — 15 Questions

Question 1

In UCS Manager, which feature provides role-based access control for managing the fabric interconnects?

Accepted Answer

Role-Based Access Control (RBAC). UCS Manager includes RBAC with roles and privileges.

Answer

Cisco ISE integration

Answer

CoPP

Answer

AAA with TACACS+

Question 2

Which technology provides at-rest encryption for disk drives in UCS servers?

Accepted Answer

SED. Self-encrypting drives (SED) provide at-rest encryption.

Answer

IPsec

Answer

FC-SP-2

Answer

SSL

Question 3

An organization wants to encrypt Fibre Channel traffic in-flight between storage and servers. Which standard should be used?

Accepted Answer

FC-SP-2. FC-SP-2 provides encryption for Fibre Channel data in transit.

Answer

IPsec

Answer

MACsec

Answer

SED

Question 4

Which TWO features are commonly used together to prevent IP spoofing on a Nexus switch? (Choose two.)

Accepted Answer

DHCP Snooping. DHCP snooping builds a binding database used by IP Source Guard and DAI.

Answer

VLAN ACL

Answer

Port Security

Answer

CoPP

Question 5

An engineer is hardening a Nexus switch. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Disable unused services like HTTP and Telnet. Disabling unused services, enabling SSH only, and configuring CoPP are standard hardening practices.

Answer

Use SNMPv1 for monitoring

Answer

Enable LLDP on all interfaces

Question 6

A network engineer is configuring micro-segmentation in an ACI fabric. Two EPGs, Web and App, must communicate via HTTPS only. Which type of contract should be applied between the EPGs?

Accepted Answer

Regular contract with a filter allowing HTTPS. ACI contracts use a whitelist model: a contract between EPGs explicitly permits desired traffic. A taboo contract would deny specific traffic, not permit.

Answer

Taboo contract

Answer

Intra-EPG contract

Answer

Filter contract

Question 7

Which authentication protocol is recommended by Cisco for network device administration due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ separates the three AAA functions, while RADIUS combines authentication and authorization.

Answer

802.1X

Answer

RADIUS

Answer

LDAP

Question 8

A Nexus switch is being hardened. An engineer wants to protect the control plane from CPU-targeted attacks, such as heavy ICMP traffic. Which feature should be configured?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) allows the switch to rate-limit or drop traffic destined to the control plane.

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Question 9

An engineer is deploying Cisco TrustSec in a data center. Which technology uses Security Group Tags (SGTs) to enforce east-west traffic policies without relying on IP addresses?

Accepted Answer

SGACL. SGACLs use SGTs to define policies based on group membership, independent of IP addresses.

Answer

ACI contracts

Answer

VLAN ACLs

Answer

Port security

Question 10

In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?

Accepted Answer

RBAC in UCS Manager. UCS Manager role-based access control (RBAC) allows granular assignment of privileges to users.

Answer

CoPP

Answer

IP Source Guard

Answer

SED encryption

Question 11

Which security feature on a Nexus switch prevents a rogue DHCP server from assigning invalid IP addresses to clients?

Accepted Answer

DHCP Snooping. DHCP snooping filters DHCP messages and blocks unauthorized DHCP servers.

Answer

Port Security

Answer

IP Source Guard

Answer

Dynamic ARP Inspection

Question 12

A data center uses self-encrypting drives (SEDs) in UCS servers. Which type of protection does SED provide?

Accepted Answer

At-rest encryption on the drive. SEDs provide at-rest encryption, protecting data when the drive is powered off or removed.

Answer

In-flight encryption for Fibre Channel

Answer

Encryption of SAN traffic

Answer

Network-level encryption

Question 13

An engineer applies an IPv4 ACL to a Nexus switch interface. The ACL must permit traffic from host 10.1.1.1 to host 10.2.2.2 on TCP port 443 and deny all other traffic. Which configuration is correct?

Accepted Answer

ip access-list WEB; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443. ACLs are processed top-down; a permit statement for the desired traffic followed by an implicit deny all other traffic.

Answer

ip access-list WEB; permit ip 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0

Answer

ip access-list WEB; deny ip any any; permit tcp 10.1.1.1 0.0.0.0 10.2.2.2 0.0.0.0 eq 443

Answer

ip access-list WEB; permit tcp any any eq 443

Question 14

A Nexus switch is configured with port security. Which violation action will cause the switch to shut down the interface when a security violation occurs?

Accepted Answer

shutdown. The 'shutdown' violation mode disables the interface, preventing further traffic.

Answer

restrict

Answer

log

Answer

protect

Question 15

In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?

Accepted Answer

Taboo contract. Taboo contracts are used to explicitly deny traffic between EPGs, overriding the default permit of a contract? Actually, by default, no traffic is permitted between EPGs unless a contract is applied. A taboo contract denies traffic, even if a regular contract exists? In ACI, the default is no communication; contracts permit traffic. To deny specific traffic, you use a taboo contract that explicitly denies.

Answer

No contract

Answer

Regular contract with a deny filter

Answer

Intra-EPG contract