350-401 Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show vrf brief

Name                             Default RD            Protocols   Interfaces
  CUSTOMER_A                       65000:100              ipv4        Gi0/0.100
  CUSTOMER_B                       65000:200              ipv4        Gi0/0.200
  MANAGEMENT                       65000:999              ipv4        Gi0/1

Based on this output, what can be concluded?

Accepted Answer

CUSTOMER_A and CUSTOMER_B are on the same physical interface but different subinterfaces.. The output shows three VRFs: CUSTOMER_A, CUSTOMER_B, and MANAGEMENT. Each has a route distinguisher and is associated with specific interfaces. The CUSTOMER_A and CUSTOMER_B VRFs are on subinterfaces of GigabitEthernet0/0, while MANAGEMENT is on a separate physical interface.

Answer

All VRFs are using the same route distinguisher.

Answer

The MANAGEMENT VRF is used for customer traffic.

Answer

The router is running MPLS L3VPN.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip bgp summary

BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 02:30:15       5
192.168.1.3     4        65003     500     498       10    0    0 00:15:20       3
10.0.0.2        4        65004       0       0        0    0    0 never    Active

Based on this output, what can be concluded?

Accepted Answer

The BGP session to 10.0.0.2 is down due to a TCP connection issue.. The output shows BGP neighbors. The first two neighbors are established (up/down time and prefixes received). The third neighbor (10.0.0.2) is in Active state, meaning it is trying to establish a TCP connection but failing. This could be due to a missing route, ACL blocking, or incorrect configuration.

Answer

All BGP neighbors are fully established.

Answer

The BGP session to 192.168.1.3 has been up for 2 hours 30 minutes.

Answer

The router is receiving prefixes from all neighbors.

Question 3

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0
	TCP connection: 10.0.0.2.646 - 10.0.0.1.49231
	State: Oper; Msgs sent/rcvd: 100/95; Downstream
	Up time: 01:23:45
	LDP discovery sources:
	  GigabitEthernet0/0, Src IP addr: 192.168.1.2
        	Addresses bound to peer LDP Ident:
        	  10.0.0.2        192.168.1.2

Based on this output, what can be concluded?

Accepted Answer

The LDP session is using TCP port 646.. The output shows an LDP neighbor with peer LDP identifier 10.0.0.2:0. The state is Operational, meaning the LDP session is established. The discovery source is GigabitEthernet0/0 with source IP 192.168.1.2. The peer's addresses include the LDP router ID and the interface IP.

Answer

The LDP session is not yet established.

Answer

The LDP neighbor is using a different router ID than 10.0.0.2.

Answer

The LDP session has been up for 1 hour 23 minutes.

Question 4

Examine the following interface configuration on a Cisco IOS-XE switch:
```
interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky
```
What is the effect of this configuration?

Accepted Answer

The port will dynamically learn MAC addresses, allow up to 2 addresses, and if a third MAC is seen, it will drop the traffic but keep the port up.. This configuration enables port security with sticky MAC learning, allowing up to 2 MAC addresses, and sets the violation mode to restrict (drops offending traffic but does not shut down the port).

Answer

The port will learn up to 2 MAC addresses and then shut down if a third is seen.

Answer

The port will allow only 2 MAC addresses and will generate a syslog message but continue forwarding traffic from the third MAC.

Answer

The port will learn MAC addresses dynamically and convert them to secure MAC addresses, but the maximum is 1 by default.

Question 5

Consider the following configuration on a Cisco IOS-XE router:
```
ip access-list extended BLOCK_SSH
 deny tcp any any eq 22
 permit ip any any
!
line vty 0 4
 access-class BLOCK_SSH in
```
Which statement is true about this configuration?

Accepted Answer

The ACL blocks all SSH traffic to the router, but permits other IP traffic.. The access-class applied to the VTY lines filters incoming Telnet/SSH sessions. The ACL denies TCP port 22 (SSH) and permits all other IP traffic. This blocks SSH access to the router.

Answer

The ACL blocks all traffic to the router because the deny statement is first.

Answer

The ACL only filters traffic going through the router, not destined to it.

Answer

The ACL permits SSH traffic because the permit statement overrides the deny.

Question 6

Examine the following CoPP configuration on a Cisco IOS-XE router:
```
class-map match-all CONTROL-PLANE
 match access-group name COPP-ACL
!
policy-map COPP-POLICY
 class CONTROL-PLANE
 police 1000000 200000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP-POLICY
```
What is the effect of this configuration?

Accepted Answer

Traffic matching the ACL is rate-limited to 1 Mbps; traffic exceeding the rate is dropped.. This applies a policy-map to the control plane that polices traffic matching the class-map. The police command limits traffic to 1 Mbps (1000000 bps) with a normal burst of 200000 bytes; conforming traffic is transmitted, exceeding traffic is dropped.

Answer

All control plane traffic is rate-limited to 1 Mbps.

Answer

Traffic exceeding 1 Mbps is marked down but still transmitted.

Answer

The policy-map is applied to the data plane, not the control plane.

Question 7

Consider the following DHCP snooping configuration on a Cisco IOS-XE switch:
```
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
 ip dhcp snooping trust
!
interface GigabitEthernet0/2
 ip dhcp snooping limit rate 10
```
Which statement is true?

Accepted Answer

Gi0/1 is trusted for DHCP snooping, and Gi0/2 will drop DHCP packets exceeding 10 per second.. DHCP snooping is enabled globally and for VLAN 10. Gi0/1 is trusted (typically uplink to DHCP server). Gi0/2 is untrusted and has a rate limit of 10 packets per second to prevent DHCP starvation.

Answer

Gi0/2 is trusted and will forward all DHCP packets without rate limiting.

Answer

The switch will only snoop DHCP on VLAN 10, but rate limiting applies to all VLANs.

Answer

Gi0/1 will rate-limit DHCP packets to 10 per second.

Question 8

Examine the following BGP configuration on a Cisco IOS-XE router:
```
router bgp 65000
 bgp default local-preference 150
 neighbor 10.1.1.1 remote-as 65001
 neighbor 10.1.1.1 password cisco123
 neighbor 10.1.1.1 route-map SET-MED out
!
route-map SET-MED permit 10
 set metric 50
```
What is the effect of the route-map on outbound updates to 10.1.1.1?

Accepted Answer

The MED value of routes advertised to 10.1.1.1 is set to 50.. The route-map SET-MED is applied outbound to neighbor 10.1.1.1. It sets the MED (multi-exit discriminator) to 50 for all routes advertised to that neighbor.

Answer

The local preference of routes received from 10.1.1.1 is set to 150.

Answer

The route-map filters routes; only those with metric 50 are advertised.

Answer

The password is applied to the BGP session, but the route-map is ignored due to the password.

Question 9

Consider the following IPv6 access-list on a Cisco IOS-XE router:
```
ipv6 access-list PERMIT_ICMP
 permit icmp any any echo-request
 permit icmp any any echo-reply
 deny ipv6 any any
!
interface GigabitEthernet0/0
 ipv6 traffic-filter PERMIT_ICMP in
```
What is the effect of this configuration?

Accepted Answer

Only IPv6 ping (echo-request and echo-reply) is allowed inbound on Gi0/0; all other IPv6 traffic is dropped.. The IPv6 ACL permits only ICMP echo-request and echo-reply (ping) and denies all other IPv6 traffic. It is applied inbound on Gi0/0.

Answer

All ICMPv6 traffic is permitted inbound on Gi0/0.

Answer

The ACL is applied outbound, so it filters traffic leaving Gi0/0.

Answer

The ACL permits all IPv6 traffic because the deny statement is at the end.

Question 10

What is the default OSPF hello interval on an Ethernet link in a Cisco router?

Accepted Answer

10 seconds. By default, OSPF sends hello packets every 10 seconds on broadcast and point-to-point links (e.g., Ethernet).

Answer

30 seconds

Answer

5 seconds

Answer

40 seconds

Question 11

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

Accepted Answer

Local preference. BGP uses the local preference attribute as the second tie-breaker (after weight). Higher local preference is preferred.

Answer

AS path length

Answer

MED

Answer

Origin code

Question 12

What is the maximum hop count for EIGRP?

Accepted Answer

255. EIGRP uses a maximum hop count of 255 to prevent routing loops, though the default is 100.

Answer

100

Answer

15

Answer

16

Question 13

Drag and drop the steps of Cisco IBNS 2.0 policy configuration into the correct order, from first to last.

Accepted Answer

Define authentication template with method. IBNS 2.0 uses a modular policy framework. First, define the authentication template to specify the method (e.g., dot1x, MAB). Second, create the policy map that references the template and defines the behavior. Third, apply the policy map to the interface. Fourth, enable authentication on the interface. Finally, verify the configuration using show commands.

Question 14

Drag and drop the steps of configuring a Cisco IOS Zone-Based Firewall (ZBFW) into the correct order, from first to last.

Accepted Answer

Create zones for source and destination. ZBFW configuration begins by defining zones to group interfaces. Next, create a class-map to classify traffic of interest. Then, create a policy-map to specify actions (inspect, drop, pass) for each class. After that, assign the policy-map to a zone-pair between source and destination zones. Finally, assign interfaces to their respective zones to activate the firewall.

Question 15

Drag and drop the steps of configuring Control Plane Policing (CoPP) on a Cisco IOS router into the correct order, from first to last.

Accepted Answer

Create access-list to match control plane traffic. CoPP protects the control plane by filtering traffic. First, define an access-list to match the traffic of interest (e.g., SSH, BGP). Second, create a class-map to reference the access-list. Third, create a policy-map that assigns a police action (rate-limit) to the class. Fourth, apply the policy-map to the control plane in the inbound direction. Finally, verify the policy with show commands to ensure correct operation.