350-401 Infrastructure Security — 20 Questions

Question 1

A network engineer is configuring port security on a Cisco switch. The requirement is to allow only the first MAC address that appears on the port to be learned and to automatically disable the port if a violation occurs. The engineer configures 'switchport port-security mac-address sticky' but does not specify a maximum number of secure MAC addresses. After connecting a single host, the port works. However, when the host is replaced with a different device, the port is error-disabled. What is the most likely reason?

Accepted Answer

The default maximum number of secure MAC addresses is 1, so the second MAC address triggers a violation.. The sticky command learns MAC addresses dynamically and stores them in the running configuration. By default, the maximum number of secure MAC addresses is 1. When a new device is connected, its MAC address is different, causing a violation. The default violation mode is 'shutdown', which error-disables the port. Option A is correct because the sticky feature does not change the default maximum count. Option B is incorrect because sticky does not require a specific maximum; it uses the default. Option C is incorrect because the violation mode is shutdown by default, not restrict. Option D is incorrect because aging is not configured and does not cause this behavior.

Answer

The sticky keyword requires the engineer to first manually configure a maximum number of MAC addresses.

Answer

The violation mode is set to 'restrict' by default, which causes the port to error-disable after one violation.

Answer

The port security aging type is set to 'absolute' by default, causing the sticky address to expire immediately.

Question 2

An enterprise network uses 802.1X for wired access. The authentication server is a Cisco ISE. Recently, some Windows 10 clients fail to authenticate, while others succeed. The engineer checks the switch configuration and finds 'authentication port-control auto' and 'dot1x pae authenticator' are configured. The failing clients show 'EAP failure' in the logs. The engineer suspects a mismatch in EAP method. Which EAP method is most likely causing the issue if the ISE is configured to require EAP-TLS but the Windows clients are configured for PEAP-MSCHAPv2?

Accepted Answer

EAP-TLS requires a client certificate, which the Windows clients do not have.. EAP-TLS requires a client certificate, while PEAP-MSCHAPv2 uses a username/password inside a TLS tunnel. If ISE is configured to only accept EAP-TLS, clients attempting PEAP will receive an EAP failure. Option A is correct because EAP-TLS is certificate-based and different from PEAP. Option B is incorrect because EAP-FAST uses a PAC, not certificates. Option C is incorrect because LEAP is deprecated and uses MS-CHAPv2, but it is not the same as PEAP. Option D is incorrect because EAP-MD5 is a simple challenge-response and not typically used in enterprise 802.1X.

Answer

EAP-FAST requires a PAC file that the Windows clients do not have.

Answer

LEAP uses a shared secret that is not configured on the clients.

Answer

EAP-MD5 does not support mutual authentication, causing the failure.

Question 3

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The router experiences high CPU utilization due to SSH and SNMP traffic. The engineer creates a class-map to match SSH (TCP/22) and SNMP (UDP/161) and applies a policy-map that polices this traffic to 1 Mbps. After applying the policy, legitimate SSH sessions from the management station start dropping intermittently. What is the most likely cause?

Accepted Answer

The police rate of 1 Mbps is too low for the combined SSH and SNMP traffic from the management station.. CoPP polices traffic destined to the control plane. If the police rate is too low, even legitimate traffic can be dropped. The engineer set a 1 Mbps limit for both SSH and SNMP combined. If the management station generates bursts above this rate, packets are dropped. Option A is correct because the aggregate police rate may be insufficient. Option B is incorrect because CoPP does not affect transit traffic. Option C is incorrect because the policy is applied to the control plane, not an interface. Option D is incorrect because the class-map matches both protocols, but the issue is the police rate.

Answer

The CoPP policy is applied to the wrong interface, affecting transit traffic instead of control plane traffic.

Answer

The class-map should match on DSCP values instead of port numbers to be effective.

Answer

The policy-map should use the 'drop' action instead of 'police' to protect the control plane.

Question 4

A network engineer is implementing DHCP snooping on a Cisco switch to prevent rogue DHCP servers. The switch has multiple VLANs, and the DHCP server is connected to interface GigabitEthernet0/1 in VLAN 10. The engineer enables DHCP snooping globally and for VLAN 10, then configures 'ip dhcp snooping trust' on GigabitEthernet0/1. However, clients in VLAN 10 are not receiving IP addresses. The engineer checks the DHCP snooping binding table and sees no entries. What is the most likely cause?

Accepted Answer

The switch does not have an 'ip helper-address' configured to forward DHCP requests to the server.. DHCP snooping requires the DHCP server port to be trusted. If the server is on a different VLAN than the clients, the switch must also have IP routing enabled or use a DHCP relay. However, the scenario does not mention a relay. The most likely cause is that the DHCP server is not on the same subnet as the clients, and no IP helper address is configured. Option A is correct because without a helper address, DHCP broadcasts are not forwarded to the server. Option B is incorrect because the trust configuration is correct. Option C is incorrect because rate limiting is not configured. Option D is incorrect because DHCP snooping does not require a specific VLAN for the server port.

Answer

The interface GigabitEthernet0/1 should be configured as an untrusted port for DHCP snooping.

Answer

The switch has DHCP snooping rate limiting enabled, which is dropping all DHCP packets.

Answer

The DHCP server is connected to a port in a different VLAN, and DHCP snooping only works within the same VLAN.

Question 5

A network engineer is configuring dynamic ARP inspection (DAI) on a Cisco switch to prevent ARP spoofing. The switch has DHCP snooping enabled and the DHCP server is trusted. The engineer enables DAI on VLAN 10 and configures 'ip arp inspection trust' on the port connected to the DHCP server. After enabling DAI, some legitimate ARP replies from hosts are being dropped. The engineer checks the DAI statistics and sees 'ARP ACL drops' incrementing. What is the most likely reason?

Accepted Answer

The hosts have static IP addresses, so their MAC-IP bindings are not in the DHCP snooping database.. DAI validates ARP packets against the DHCP snooping binding table. If a host has a static IP address, its MAC-IP binding is not in the DHCP snooping database, so DAI drops the ARP replies unless an ARP ACL is configured to permit them. Option A is correct because static hosts need an ARP ACL. Option B is incorrect because the DHCP server port is trusted, but that does not affect host ARP replies. Option C is incorrect because DAI does not require the DHCP server to be in the same VLAN. Option D is incorrect because DAI validates source MAC and IP, not destination.

Answer

The port connected to the DHCP server should be untrusted for DAI to work correctly.

Answer

The DHCP server is in a different VLAN, and DAI cannot validate cross-VLAN ARP.

Answer

DAI is checking the destination MAC address, which does not match the expected value.

Question 6

A network engineer is configuring IPv6 First Hop Security on a Cisco switch to mitigate rogue RA attacks. The engineer enables RA guard on the switch and applies a policy that allows only the default gateway to send RAs. After configuration, hosts are unable to obtain IPv6 addresses via SLAAC. The engineer checks the switch and sees that RA guard is dropping all RAs. What is the most likely cause?

Accepted Answer

The RA guard policy does not include the IPv6 address or MAC address of the legitimate default gateway.. RA guard uses a policy to determine which devices can send RAs. If the policy is configured to allow only a specific device (e.g., the default gateway), but the device's MAC address or IPv6 address is not correctly identified, all RAs are dropped. Option A is correct because the policy must include the gateway's address. Option B is incorrect because RA guard does not require DHCPv6. Option C is incorrect because RA guard can work with SLAAC. Option D is incorrect because RA guard does not block all RAs by default; it uses the policy.

Answer

The switch has DHCPv6 snooping enabled, which conflicts with RA guard.

Answer

SLAAC requires the host to send a router solicitation first, which is being blocked by RA guard.

Answer

RA guard is configured in 'block' mode, which drops all RAs regardless of the policy.

Question 7

A network engineer is configuring a zone-based firewall (ZBF) on a Cisco router to allow traffic from the inside zone to the outside zone while blocking traffic from outside to inside. The engineer creates zones, assigns interfaces, and configures a policy-map with a class-map that matches all traffic from inside to outside. The engineer applies the policy to the zone-pair inside-to-outside. However, traffic from inside to outside is being dropped. What is the most likely reason?

Accepted Answer

The policy-map does not include an 'inspect' or 'pass' action for the matched traffic.. In ZBF, the policy-map must include an action for the matched traffic. If the class-map matches traffic but the policy-map does not have an 'inspect' or 'pass' action, the default action is to drop. Option A is correct because the engineer likely omitted the action. Option B is incorrect because the zone-pair is correctly defined. Option C is incorrect because the class-map does not need to match return traffic; inspection handles that. Option D is incorrect because the policy is applied to the correct zone-pair.

Answer

The zone-pair should be configured as outside-to-inside instead.

Answer

The class-map must also match return traffic for the firewall to allow the session.

Answer

The policy-map is applied to the wrong zone-pair; it should be applied to the inside zone.

Question 8

A network engineer is implementing MACsec on a Cisco switch-to-switch link to provide encryption. Both switches support MACsec and are configured with the same pre-shared key (PSK). The engineer configures 'mka' and 'macsec' on the interfaces. After configuration, the link does not come up, and the engineer sees 'MKA not operational' in the show macsec status. What is the most likely cause?

Accepted Answer

The pre-shared key (PSK) configured on both switches does not match.. MACsec requires that both ends have matching keys and that the interfaces are in the same security mode (e.g., should-secure or must-secure). If one end is configured as 'must-secure' and the other as 'should-secure', they may not establish a secure channel. Option A is correct because a mismatch in the key chain or key string is a common issue. Option B is incorrect because MACsec can work with PSK. Option C is incorrect because MACsec does not require dot1q. Option D is incorrect because MACsec does not require a specific duplex setting.

Answer

MACsec requires a RADIUS server for key distribution, which is not configured.

Answer

The interfaces are configured with different VLANs, causing MACsec to fail.

Answer

The interfaces must be configured as trunk ports for MACsec to work.

Question 9

A network engineer is configuring uRPF (unicast Reverse Path Forwarding) on a Cisco router to prevent spoofed IP traffic. The engineer enables uRPF in strict mode on the ingress interface connected to the internal network. After enabling uRPF, legitimate traffic from internal hosts is being dropped. The engineer checks the routing table and sees that the routes for the internal subnets are present. What is the most likely cause?

Accepted Answer

The return route for the source IP points to a different interface than the one where the packet arrived.. uRPF strict mode checks that the source IP address of a packet has a route back to the same interface. If the router has multiple equal-cost paths or if the return route points to a different interface, uRPF drops the packet. Option A is correct because the return path must match the ingress interface. Option B is incorrect because uRPF does not check the destination. Option C is incorrect because uRPF does not require a default route. Option D is incorrect because uRPF works with static routes.

Answer

uRPF is checking the destination IP address, which is not reachable.

Answer

The router does not have a default route, so uRPF drops all traffic.

Answer

uRPF cannot be used with static routes; it requires a dynamic routing protocol.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2         1   FULL/DR         00:00:38    192.168.1.2     GigabitEthernet0/0
10.0.0.3         1   2WAY/DROTHER   00:00:32    192.168.1.3     GigabitEthernet0/0
10.0.0.4         1   FULL/BDR        00:00:35    192.168.1.4     GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

Router R1 is a DROTHER on this segment.. The output shows OSPF neighbors on a multi-access network. The router with the highest priority becomes DR, and the next highest becomes BDR. Here, 10.0.0.2 is DR (FULL/DR), 10.0.0.4 is BDR (FULL/BDR), and 10.0.0.3 is a DROTHER (2WAY/DROTHER). The router R1 itself is not shown, but its state is implied: since it has a FULL adjacency with DR and BDR, but only 2WAY with DROTHER, R1 is likely a DROTHER.

Answer

Router R1 is the DR on this segment.

Answer

Router R1 is the BDR on this segment.

Answer

Router R1 has no OSPF neighbors.

Question 11

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             Cost        19
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4466
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Root FWD 19        128.1    P2p
Gi0/2               Altn BLK 19        128.2    P2p
Gi0/3               Desg FWD 19        128.3    P2p

Based on this output, what can be concluded?

Accepted Answer

Gi0/2 is in blocking state due to loop prevention.. The output shows that the root bridge has address 0011.2233.4455, and SW1's bridge ID is 0011.2233.4466. Since the root bridge has a lower MAC address (and same priority), SW1 is not the root. Gi0/1 is the root port, Gi0/2 is an alternate port (blocking), and Gi0/3 is a designated port. This indicates a redundant topology with a loop, and STP is blocking Gi0/2 to prevent it.

Answer

SW1 is the root bridge for VLAN 10.

Answer

Gi0/3 is a root port.

Answer

The root bridge has a higher priority than SW1.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip access-lists 101

Extended IP access list 101
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    20 deny tcp any any eq 23 (50 matches)
    30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Accepted Answer

Telnet traffic from any source is denied.. The ACL 101 has three entries. The first permits HTTP traffic from 192.168.1.0/24 to any destination. The second denies Telnet traffic from any source. The third permits all other IP traffic. The match counters show hits. Since Telnet is denied, any Telnet attempt will be blocked unless it matches a preceding permit (which it doesn't).

Answer

Telnet traffic from 192.168.1.0/24 is permitted.

Answer

HTTP traffic from any source is permitted.

Answer

All traffic is permitted because of the last entry.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.10       192.168.1.10       ---                ---
--- 203.0.113.11       192.168.1.11       ---                ---
tcp 203.0.113.10:1024 192.168.1.10:1024  198.51.100.5:80    198.51.100.5:80

Based on this output, what can be concluded?

Accepted Answer

The router is performing static NAT for two internal hosts.. The output shows NAT translations. The first two lines are static NAT entries (no protocol, no outside address). The third line is a dynamic translation for a TCP session. The inside local addresses are private (192.168.1.x), and inside global addresses are public (203.0.113.x). The outside addresses are public. This is typical for PAT or dynamic NAT.

Answer

The router is performing dynamic NAT for all translations.

Answer

The router is performing Port Address Translation (PAT) for all translations.

Answer

The router is translating outside global addresses to inside local addresses.

Question 14

A network engineer runs the following command on Router R1:

R1# show policy-map interface GigabitEthernet0/0

GigabitEthernet0/0

Service-policy input: QOS_POLICY

Class-map: VOICE (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 0/0
      police cir 1000000 bc 31250 be 31250
        conformed 0 bytes; actions:  transmit
        exceeded 0 bytes; actions:  drop
        violated 0 bytes; actions:  drop

Class-map: class-default (match-any)
      100 packets, 12000 bytes
      5 minute offered rate 8000 bps, drop rate 0 bps
      Match: any 
      Queueing
        queue limit 64 packets
        (queue depth/total drops/no-buffer drops) 0/0/0
        (pkts output/bytes output) 100/12000

Based on this output, what can be concluded?

Accepted Answer

Voice traffic is being policed at 1 Mbps and any excess is dropped.. The policy-map QOS_POLICY is applied inbound on GigabitEthernet0/0. It has two classes: VOICE (matching DSCP EF) and class-default. The VOICE class has a police command with a CIR of 1 Mbps, and actions for conform (transmit) and exceed/violate (drop). The class-default has no police. The output shows no packets matched VOICE, so no policing has occurred for that class. The class-default has 100 packets.

Answer

The policy is applied in the output direction.

Answer

All traffic is being policed at 8 kbps.

Answer

The policy is shaping traffic to 1 Mbps.

Question 15

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reset: 10

Session Id: 5
  Unique Id: 5
  User Name: admin
  IP Address: 192.168.1.100
  Idle Time: 0:00:05
  Timeout: 0:10:00
  Type: SSH
  Method: local

Session Id: 6
  Unique Id: 6
  User Name: neteng
  IP Address: 10.0.0.2
  Idle Time: 0:02:30
  Timeout: 0:10:00
  Type: SSH
  Method: tacacs+

Based on this output, what can be concluded?

Accepted Answer

Session 5 is authenticated locally.. The output shows two active AAA sessions. Session 5 is authenticated locally (Method: local), while session 6 uses TACACS+. Both are SSH sessions. The idle time for session 6 is 2 minutes 30 seconds, which is approaching the timeout of 10 minutes.

Answer

Both sessions are authenticated using TACACS+.

Answer

Session 6 will be disconnected due to idle timeout.

Answer

Both sessions are using RADIUS for authentication.

Question 16

A network engineer runs the following command on Router R1:

R1# show vrf brief

Name                             Default RD            Protocols   Interfaces
  CUSTOMER_A                       65000:100              ipv4        Gi0/0.100
  CUSTOMER_B                       65000:200              ipv4        Gi0/0.200
  MANAGEMENT                       65000:999              ipv4        Gi0/1

Based on this output, what can be concluded?

Accepted Answer

CUSTOMER_A and CUSTOMER_B are on the same physical interface but different subinterfaces.. The output shows three VRFs: CUSTOMER_A, CUSTOMER_B, and MANAGEMENT. Each has a route distinguisher and is associated with specific interfaces. The CUSTOMER_A and CUSTOMER_B VRFs are on subinterfaces of GigabitEthernet0/0, while MANAGEMENT is on a separate physical interface.

Answer

All VRFs are using the same route distinguisher.

Answer

The MANAGEMENT VRF is used for customer traffic.

Answer

The router is running MPLS L3VPN.

Question 17

A network engineer runs the following command on Router R1:

R1# show ip bgp summary

BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 02:30:15       5
192.168.1.3     4        65003     500     498       10    0    0 00:15:20       3
10.0.0.2        4        65004       0       0        0    0    0 never    Active

Based on this output, what can be concluded?

Accepted Answer

The BGP session to 10.0.0.2 is down due to a TCP connection issue.. The output shows BGP neighbors. The first two neighbors are established (up/down time and prefixes received). The third neighbor (10.0.0.2) is in Active state, meaning it is trying to establish a TCP connection but failing. This could be due to a missing route, ACL blocking, or incorrect configuration.

Answer

All BGP neighbors are fully established.

Answer

The BGP session to 192.168.1.3 has been up for 2 hours 30 minutes.

Answer

The router is receiving prefixes from all neighbors.

Question 18

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
	TCP connection: 10.0.0.2.646 - 10.0.0.1.49231
	State: Oper; Msgs sent/rcvd: 100/95; Downstream
	Up time: 01:23:45
	LDP discovery sources:
	  GigabitEthernet0/0, Src IP addr: 192.168.1.2
        	Addresses bound to peer LDP Ident:
        	  10.0.0.2        192.168.1.2

Based on this output, what can be concluded?

Accepted Answer

The LDP session is using TCP port 646.. The output shows an LDP neighbor with peer LDP identifier 10.0.0.2:0. The state is Operational, meaning the LDP session is established. The discovery source is GigabitEthernet0/0 with source IP 192.168.1.2. The peer's addresses include the LDP router ID and the interface IP.

Answer

The LDP session is not yet established.

Answer

The LDP neighbor is using a different router ID than 10.0.0.2.

Answer

The LDP session has been up for 1 hour 23 minutes.

Question 19

Examine the following interface configuration on a Cisco IOS-XE switch:
```
interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
```
What is the effect of this configuration?

Accepted Answer

The port will dynamically learn MAC addresses, allow up to 2 addresses, and if a third MAC is seen, it will drop the traffic but keep the port up.. This configuration enables port security with sticky MAC learning, allowing up to 2 MAC addresses, and sets the violation mode to restrict (drops offending traffic but does not shut down the port).

Answer

The port will learn up to 2 MAC addresses and then shut down if a third is seen.

Answer

The port will allow only 2 MAC addresses and will generate a syslog message but continue forwarding traffic from the third MAC.

Answer

The port will learn MAC addresses dynamically and convert them to secure MAC addresses, but the maximum is 1 by default.

Question 20

Consider the following configuration on a Cisco IOS-XE router:
```
ip access-list extended BLOCK_SSH
 deny tcp any any eq 22
 permit ip any any
!
line vty 0 4
 access-class BLOCK_SSH in
```
Which statement is true about this configuration?

Accepted Answer

The ACL blocks all SSH traffic to the router, but permits other IP traffic.. The access-class applied to the VTY lines filters incoming Telnet/SSH sessions. The ACL denies TCP port 22 (SSH) and permits all other IP traffic. This blocks SSH access to the router.

Answer

The ACL blocks all traffic to the router because the deny statement is first.

Answer

The ACL only filters traffic going through the router, not destined to it.

Answer

The ACL permits SSH traffic because the permit statement overrides the deny.