350-601 Security Practice Test 9 — 15 Questions

Question 1

Which Nexus security feature validates ARP packets to prevent ARP spoofing attacks?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) intercepts and validates ARP packets based on DHCP snooping bindings.

Answer

Port Security

Answer

IP Source Guard

Answer

DHCP Snooping

Question 2

An engineer is configuring 802.1X for network access control. Which AAA protocol should be used for communication between the authenticator (switch) and the authentication server?

Accepted Answer

RADIUS. 802.1X uses RADIUS for communication between the authenticator and the authentication server.

Answer

TACACS+

Answer

LDAP

Answer

DIAMETER

Question 3

Which feature on a Nexus switch uses DHCP snooping binding information to filter IP traffic on a per-port basis?

Accepted Answer

IP Source Guard. IP Source Guard uses DHCP snooping bindings to filter IP traffic, allowing only traffic from valid IP-MAC pairs.

Answer

Port Security

Answer

Dynamic ARP Inspection

Answer

CoPP

Question 4

A UCS administrator needs to ensure that only the fabric interconnect management plane is accessible from the management network. Which feature should be implemented?

Accepted Answer

Management plane isolation. Management plane isolation ensures that management traffic is separate from data traffic, often using dedicated management interfaces or VRFs.

Answer

SED encryption

Answer

CoPP

Answer

RBAC

Question 5

An engineer wants to enforce security policies in a data center based on user identity rather than IP addresses. Which Cisco technology enables identity-based tagging and policy enforcement?

Accepted Answer

Cisco TrustSec. Cisco TrustSec uses SGTs to tag traffic based on user/device identity, and SGACLs enforce policies.

Answer

VLAN ACLs

Answer

ACI micro-segmentation

Answer

Nexus port security

Question 6

A network engineer is hardening a Nexus switch. Which two security best practices should be applied? (Choose two.)

Accepted Answer

Disable unused services. Disabling unused services reduces attack surface; enabling SSH only provides secure remote access.

Answer

Use default SNMP community strings

Answer

Enable HTTP server for management

Answer

Enable Telnet for remote access

Question 7

An engineer is deploying data encryption in a SAN environment. Which two methods provide at-rest encryption? (Choose two.)

Accepted Answer

Self-encrypting drives (SED). SED encrypts data on the drive; SAN array encryption encrypts data at the storage level.

Answer

MACsec encryption

Answer

FC-SP-2 encryption

Answer

IPsec encryption

Question 8

Which three features are used on Nexus switches to mitigate Layer 2 attacks? (Choose three.)

Accepted Answer

DHCP Snooping. DHCP snooping, DAI, and IP Source Guard work together to prevent various Layer 2 attacks.

Answer

RBAC

Answer

CoPP

Question 9

An engineer is configuring micro-segmentation in an ACI fabric. Which object defines the whitelist model for communication between EPGs?

Accepted Answer

Contract. ACI contracts define a whitelist model where communication between EPGs is explicitly allowed by the contract's subject and filters.

Answer

Taboo contract

Answer

Filter

Answer

VRF

Question 10

A Nexus switch is configured with DHCP snooping. Which switchport mode is required for trusted ports to prevent rogue DHCP server attacks?

Accepted Answer

ip dhcp snooping trust. DHCP snooping treats ports as untrusted by default. Trusted ports are explicitly configured, typically on uplink interfaces.

Answer

trunk

Answer

access

Answer

spanning-tree portfast

Question 11

A network administrator must enforce security policies for east-west traffic in a Cisco TrustSec-enabled data center without using IP-based ACLs. Which technology should be used?

Accepted Answer

SGACL. TrustSec uses SGTs for identity-based tagging and SGACLs to enforce policy without IP addresses.

Answer

VLAN ACLs

Answer

CoPP

Answer

ACI contracts

Question 12

Which AAA protocol is recommended by Cisco for network device administration, as it separates authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions, making it preferred over RADIUS for admin access.

Answer

RADIUS

Answer

LDAP

Answer

802.1X

Question 13

An engineer needs to protect the control plane of a Nexus 9000 switch from CPU-targeted attacks. Which feature should be configured?

Accepted Answer

CoPP. Control Plane Policing (CoPP) applies QoS policies to control plane traffic to prevent DoS attacks.

Answer

DHCP snooping

Answer

Port security

Answer

IP Source Guard

Question 14

In a UCS environment, which method provides management plane isolation for the fabric interconnects?

Accepted Answer

Configuring the management IP on a dedicated management port. UCS fabric interconnects have a dedicated management interface that can be placed in a separate management VLAN for isolation.

Answer

Enabling CoPP on the fabric interconnect

Answer

Using RBAC roles in UCS Manager

Answer

Using a separate VRF for management traffic

Question 15

A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?

Accepted Answer

ip access-group ACL_NAME in on VLAN interface. ACLs on Nexus switches can be applied to VLANs using the 'ip access-group' command under the VLAN interface.

Answer

ip access-group ACL_NAME on VLAN

Answer

access-list ACL_NAME in on VLAN interface

Answer

vlan access-group ACL_NAME in