350-601 Security — Timed 25 Questions

Question 1

In ACI, which model is used for micro-segmentation to allow traffic between EPGs?

Accepted Answer

Whitelist model using contracts. ACI uses a whitelist model via contracts to permit traffic between EPGs.

Answer

Blacklist model using taboo contracts

Answer

IP-based ACLs on leaf switches

Answer

VRF leaking

Question 2

An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?

Accepted Answer

Taboo contract. Taboo contracts are used to explicitly deny traffic between EPGs.

Answer

Filter with action deny

Answer

QoS policy

Answer

VRF with route leaking

Question 3

Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ encrypts the entire packet and separates AAA functions.

Answer

LDAP

Answer

RADIUS

Answer

Kerberos

Question 4

A Nexus switch is experiencing high CPU utilization due to control plane traffic. Which feature should be configured to protect the CPU?

Accepted Answer

Control Plane Policing. CoPP (Control Plane Policing) rate-limits control plane traffic.

Answer

IP Source Guard

Answer

Dynamic ARP Inspection

Answer

DHCP snooping

Question 5

In Cisco TrustSec, which technology is used to enforce east-west traffic policies based on identity without relying on IP addresses?

Accepted Answer

SGACL. SGACLs enforce policies based on SGTs, not IP addresses.

Answer

SGT

Answer

ACLs

Answer

VLAN ACLs

Question 6

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

Accepted Answer

DHCP Snooping. DHCP snooping filters DHCP server messages on untrusted ports.

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Answer

Port Security

Question 7

Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?

Accepted Answer

IP Source Guard. IP Source Guard uses DHCP snooping binding to validate source IP.

Answer

Port Security

Answer

ACL

Answer

Dynamic ARP Inspection

Question 8

An organization uses Cisco TrustSec to tag traffic. An endpoint is assigned SGT 5 (Developers) and another SGT 10 (Testers). The SGACL on the leaf switch permits traffic from SGT 5 to SGT 10 for HTTP but denies other. Which action is taken by the leaf switch?

Accepted Answer

It uses the SGACL to permit HTTP and deny other traffic. SGACLs enforce policy based on SGTs, not IP addresses.

Answer

It forwards the traffic to the Cisco ISE for policy decision

Answer

It applies an IP ACL based on the SGT

Answer

It drops all traffic between different SGTs unless a contract exists

Question 9

Which feature on Nexus switches prevents ARP spoofing attacks by validating ARP packets?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) intercepts ARP packets and validates them against the DHCP snooping binding database.

Answer

DHCP Snooping

Answer

Port Security

Answer

IP Source Guard

Question 10

An administrator needs to limit the number of MAC addresses learned on a Nexus access port to prevent MAC flooding attacks. Which feature should be configured?

Accepted Answer

Port Security. Port security limits MAC addresses per port.

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Question 11

In UCS Manager, which feature provides role-based access control for managing the fabric interconnects?

Accepted Answer

Role-Based Access Control (RBAC). UCS Manager includes RBAC with roles and privileges.

Answer

Cisco ISE integration

Answer

CoPP

Answer

AAA with TACACS+

Question 12

Which technology provides at-rest encryption for disk drives in UCS servers?

Accepted Answer

SED. Self-encrypting drives (SED) provide at-rest encryption.

Answer

IPsec

Answer

FC-SP-2

Answer

SSL

Question 13

An organization wants to encrypt Fibre Channel traffic in-flight between storage and servers. Which standard should be used?

Accepted Answer

FC-SP-2. FC-SP-2 provides encryption for Fibre Channel data in transit.

Answer

IPsec

Answer

MACsec

Answer

SED

Question 14

Which TWO features are commonly used together to prevent IP spoofing on a Nexus switch? (Choose two.)

Accepted Answer

DHCP Snooping. DHCP snooping builds a binding database used by IP Source Guard and DAI.

Answer

VLAN ACL

Answer

Port Security

Answer

CoPP

Question 15

An engineer is hardening a Nexus switch. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Disable unused services like HTTP and Telnet. Disabling unused services, enabling SSH only, and configuring CoPP are standard hardening practices.

Answer

Use SNMPv1 for monitoring

Answer

Enable LLDP on all interfaces

Question 16

A network engineer is configuring micro-segmentation in an ACI fabric. Two EPGs, Web and App, must communicate via HTTPS only. Which type of contract should be applied between the EPGs?

Accepted Answer

Regular contract with a filter allowing HTTPS. ACI contracts use a whitelist model: a contract between EPGs explicitly permits desired traffic. A taboo contract would deny specific traffic, not permit.

Answer

Taboo contract

Answer

Intra-EPG contract

Answer

Filter contract

Question 17

Which authentication protocol is recommended by Cisco for network device administration due to its separation of authentication, authorization, and accounting?

Accepted Answer

TACACS+. TACACS+ separates the three AAA functions, while RADIUS combines authentication and authorization.

Answer

802.1X

Answer

RADIUS

Answer

LDAP

Question 18

A Nexus switch is being hardened. An engineer wants to protect the control plane from CPU-targeted attacks, such as heavy ICMP traffic. Which feature should be configured?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) allows the switch to rate-limit or drop traffic destined to the control plane.

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Question 19

An engineer is deploying Cisco TrustSec in a data center. Which technology uses Security Group Tags (SGTs) to enforce east-west traffic policies without relying on IP addresses?

Accepted Answer

SGACL. SGACLs use SGTs to define policies based on group membership, independent of IP addresses.

Answer

ACI contracts

Answer

VLAN ACLs

Answer

Port security

Question 20

In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?

Accepted Answer

RBAC in UCS Manager. UCS Manager role-based access control (RBAC) allows granular assignment of privileges to users.

Answer

CoPP

Answer

IP Source Guard

Answer

SED encryption