350-401 Security — 40 Questions

Question 1

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The interface GigabitEthernet0/1 is not configured as a trusted port for DHCP snooping.. The scenario states that DHCP snooping is configured globally and on VLAN 10, and that GigabitEthernet0/1 is connected to the DHCP server. However, for DHCP snooping to allow DHCP server messages (OFFER, ACK) to be forwarded, the interface connected to the legitimate DHCP server must be explicitly configured as a trusted port using the 'ip dhcp snooping trust' interface command. Without this, the switch treats all DHCP server responses as untrusted and drops them, preventing clients from receiving IP addresses.

Answer

The switch has IP Source Guard enabled, blocking valid DHCP traffic.

Answer

The DHCP server is on a different subnet and the switch lacks an IP helper address.

Answer

The DHCP server is sending offers too quickly, exceeding the rate-limit on the switch.

Question 2

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

Accepted Answer

Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.. The DHCP snooping feature treats all ports as untrusted by default, which means DHCP server messages (DHCPOFFER, DHCPACK, DHCPNAK) are dropped on untrusted ports. Since the DHCP server is connected to a trunk port and DHCPACK messages are being dropped, that trunk port must be explicitly configured as a trusted port for DHCP snooping using the 'ip dhcp snooping trust' interface command. This allows legitimate DHCP server responses to reach clients, resolving the duplicate IP address issue caused by clients not receiving their assigned addresses.

Answer

Manually shut down the access ports that have unknown MAC addresses in the binding table.

Answer

Disable Dynamic ARP Inspection on VLAN 10.

Answer

Disable IP Source Guard on all access ports in VLAN 10.

Question 3

Match each Spanning Tree Protocol (STP) variant to its key characteristic.

Accepted Answer

STP (802.1D): Original standard with slow convergence (30-50 seconds). STP (802.1D) is the original slow-converging standard; RSTP (802.1w) provides rapid convergence; MSTP (802.1s) maps multiple VLANs to fewer spanning tree instances; PVST+ runs per-VLAN STP. Common confusions include equating STP with per-VLAN and RSTP with multiple instances.

Answer

STP (802.1D): Per-VLAN spanning tree

Answer

RSTP (802.1w): Multiple spanning tree instances

Question 4

A network administrator is deploying a Cisco Catalyst 9300 switch in a campus access layer. The security policy mandates that when an unauthorized device connects to an access port, the port must immediately shut down and generate a syslog message, and the administrator must manually re-enable the port. The administrator configures the interface with the command 'switchport port-security violation shutdown'. However, after an unauthorized device connects, the port goes into the 'err-disabled' state, but no syslog message is generated. What is the most likely reason for the missing syslog message?

Accepted Answer

The logging level on the switch is set to a level that suppresses port security violation messages.. Port security violations are logged at severity level 2 (critical). If the switch's logging level is configured to a higher severity (e.g., emergencies only), these messages are suppressed. The administrator should verify the logging level and ensure that critical messages are logged. The violation mode itself is correct for the requirement.

Answer

The 'switchport port-security violation shutdown' command does not generate syslog messages; the administrator must configure 'switchport port-security violation restrict' instead.

Answer

The switchport port-security violation shutdown command requires the 'logging synchronous' command on the console line to display messages.

Answer

The port security violation mode must be set to 'protect' to generate syslog messages.

Question 5

A network engineer is deploying 802.1X on a Cisco Catalyst 9200 switch. The authentication server is Cisco ISE. The help desk reports that some corporate Windows laptops fail authentication when they are first connected, but succeed after the user manually opens a browser. The switch port is configured with `authentication host-mode multi-auth` and `authentication open`. Which change should the engineer make to allow the laptops to authenticate without user interaction?

Accepted Answer

Enable the 802.1X supplicant on the Windows laptops using Group Policy.. The laptops fail initial authentication because the Windows 802.1X supplicant is not enabled or configured to start automatically. Without the supplicant, the switch port does not receive EAPOL-Start frames, so authentication never begins. Enabling the supplicant through Group Policy ensures the laptops initiate authentication as soon as they connect, allowing Cisco ISE to authenticate them without user intervention.

Answer

Change the switch port to `authentication host-mode multi-domain`.

Answer

Enable MAC Authentication Bypass (MAB) on the switch port.

Answer

Configure the switch port as a trunk instead of an access port.

Question 6

A network administrator is deploying a Cisco Catalyst 9300 switch in a branch office. The security policy requires that when an unauthorized MAC address is detected on interface GigabitEthernet1/0/5, the interface must be placed into the err-disabled state and an SNMP trap must be generated. The administrator has configured 'switchport port-security' on the interface. Which additional command is required to meet the policy?

Accepted Answer

switchport port-security violation shutdown. Port security violation modes determine what happens when an unauthorized MAC address appears on a secured port. The shutdown mode is the only one that both places the interface into err-disabled state and generates an SNMP trap, satisfying the branch office security policy that requires immediate port disablement and notification.

Answer

switchport port-security violation restrict

Answer

switchport port-security maximum 1

Answer

switchport port-security violation protect

Question 7

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against CPU overload. The administrator wants to rate-limit ARP packets destined to the control plane to 100 packets per second, while allowing all other traffic to the control plane without rate limiting. Which CoPP configuration accomplishes this?

Accepted Answer

Create an ACL matching ARP, reference it in a class-map, create a policy-map with a police rate of 100 pps for that class and no police for the default class, then apply the policy-map globally with 'service-policy input CoPP'.. CoPP uses MQC to classify and police control-plane traffic. An ACL matches ARP, a class-map references it, and a policy-map applies policing. The policy-map is applied under the control-plane configuration with 'service-policy input' to affect ingress traffic to the CPU. The default class without policing ensures other traffic is not limited, meeting the requirement.

Answer

Apply an ACL directly to the control plane interface with 'ip access-group' to permit only ARP at 100 pps.

Answer

Configure a class-map matching ARP, create a policy-map with a police rate of 100 pps, and apply it to all physical interfaces with 'service-policy input CoPP'.

Answer

Use MQC to create a policy-map with a police rate of 100 pps for ARP and apply it to the control plane using 'service-policy output CoPP'.

Question 8

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against denial-of-service attacks. The router has a management interface and several data interfaces. The engineer wants to rate-limit SSH traffic destined to the router's control plane to 100 kbps, while allowing all other management traffic (SNMP, NTP) without rate limiting. The engineer creates a class map named 'SSH-CLASS' matching TCP port 22, and a policy map named 'COPP-POLICY' with a police action of 100000 bps. The policy is applied to the control plane using 'service-policy input COPP-POLICY'. After applying the policy, the engineer notices that SNMP traffic is also being rate-limited, even though it is not explicitly matched. What is the most likely cause?

Accepted Answer

The class map 'SSH-CLASS' is incorrectly configured with a 'match any' statement, causing all traffic to be classified as SSH.. The most likely cause is that the class map 'SSH-CLASS' is configured with 'match any', which matches all traffic, not just SSH. The engineer should verify the class map and use 'match access-group' with an ACL permitting TCP port 22 to ensure only SSH is matched. Unmatched traffic is not policed by default in CoPP.

Answer

The police action of 100000 bps is applied to all traffic because the policy map lacks a class-default configuration.

Answer

The policy map 'COPP-POLICY' has an implicit default class that matches all traffic and applies the same police action.

Answer

The control plane service policy requires an explicit permit statement for other traffic; otherwise, all traffic is policed by default.

Question 9

A network administrator is configuring a Cisco IOS router for IPsec site-to-site VPN with a peer that uses a dynamic public IP address. The administrator needs the router to accept IKE negotiations from any peer while still using pre-shared keys for authentication. Which configuration element is required on the local router?

Accepted Answer

A crypto isakmp key with the address 0.0.0.0 0.0.0.0. For a peer with a dynamic IP address, the local router must accept IKE from any address. The pre-shared key must be configured with the wildcard address 0.0.0.0 0.0.0.0 so it applies regardless of the peer's source address. A dynamic crypto map is also used on the hub side, but the IKE authentication specifically requires the wildcard pre-shared key entry.

Answer

A crypto map with the peer address set to 0.0.0.0

Answer

A dynamic crypto map with no set peer and a match address ACL

Answer

A crypto isakmp key with the peer's hostname and no address

Question 10

A network security team is implementing 802.1X on Cisco Catalyst switches with Cisco ISE. The requirement is that if the RADIUS server is unreachable, endpoints should be placed into a restricted VLAN that only allows access to remediation servers. Which feature should be configured on the switch ports?

Accepted Answer

Restricted VLAN. In Cisco 802.1X deployments, when the RADIUS server is unreachable, the switch can place the port into a restricted VLAN that provides limited connectivity, often to remediation or guest services. This is distinct from guest VLAN (for non-802.1X clients) and auth fail VLAN (for failed authentication). The restricted VLAN ensures that endpoints are not granted full access when authentication cannot be performed.

Answer

Guest VLAN

Answer

Critical VLAN

Answer

Auth Fail VLAN

Question 11

A network engineer is deploying MACsec on a Cisco Catalyst 9000 switch to secure Layer 2 traffic between two switches. The engineer wants to ensure that MACsec is enabled on the link and that the switches use MKA for key management. Which command is required to enable MKA on the interface?

Accepted Answer

mka. To enable MACsec Key Agreement (MKA) on a Cisco switch interface, the 'mka' command must be issued in interface configuration mode. MKA handles key management for MACsec, including key server election and key derivation. Without MKA, MACsec cannot establish secure sessions. The 'macsec' command enables MACsec itself, but MKA is required for dynamic key exchange.

Answer

macsec mka

Answer

mka key-server priority 1

Answer

macsec

Question 12

A network engineer is deploying Cisco TrustSec in a campus network. The engineer needs to enable Security Group Tagging (SGT) on a Cisco Catalyst 9000 switch. Which two actions are required to support SGT propagation and enforcement? (Choose two.)

Accepted Answer

Enable CTS on the switch interfaces that will carry tagged traffic.. To support SGT propagation and enforcement on a Catalyst 9000 switch, CTS must be enabled globally and on the interfaces that carry tagged traffic. Global CTS activation enables the TrustSec feature, and interface-level CTS enables tagging and enforcement on the link. Other components such as SXP, 802.1X, and SGACLs are optional or enforcement-specific and are not required for basic SGT propagation.

Answer

Configure a security group ACL (SGACL) on the switch to filter traffic based on SGT.

Answer

Configure 802.1X with MAB on all access ports to assign SGTs dynamically.

Answer

Configure the switch to use SXP (SGT Exchange Protocol) to share SGTs with non-TrustSec devices.

Question 13

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two service providers over the same WAN interface. The engineer notices that during BGP session flaps, the router's CPU spikes and management SSH sessions become unresponsive. Which CoPP configuration change most directly protects the CPU during these events without disrupting legitimate BGP updates?

Accepted Answer

Apply a class-map matching 'match protocol bgp' with a police rate of 8000 pps, conform-action transmit, exceed-action transmit, and pair it with a separate class policing unknown control-plane traffic.. Effective CoPP design allows normal protocol reconvergence traffic while strictly policing abnormal floods. Setting the BGP class exceed-action to transmit prevents legitimate UPDATE bursts from being dropped during session re-establishment, and adding a catch-all policer for unknown control-plane traffic ensures the CPU remains protected from malicious or malformed floods. Simply dropping excess BGP packets or removing the default policy fails to meet both halves of the requirement.

Answer

Apply a class-map matching 'match access-group name BGP_PEERS' with a police rate of 8000 pps, conform-action transmit, exceed-action transmit, and remove the default CoPP policy.

Answer

Apply a class-map matching 'match protocol bgp' with a police rate of 8000 pps and a conform-action transmit, exceed-action drop.

Answer

Apply a class-map matching 'match access-group name BGP_PEERS' with a police rate of 8000 pps and a conform-action transmit, exceed-action drop.

Question 14

A network administrator is configuring a Cisco IOS Zone-Based Policy Firewall (ZPF) on a router. The inside zone contains the LAN interface, and the outside zone contains the WAN interface. The administrator wants to allow inside-to-outside traffic, deny outside-to-inside traffic, and allow the router itself to initiate SSH to the outside for management. Which configuration is required to meet these requirements?

Accepted Answer

Create a zone-pair for inside-to-outside with a service-policy that inspects traffic, and a zone-pair for outside-to-inside with a service-policy that drops traffic. Apply a policy to the self zone for SSH.. Zone-Based Policy Firewall uses zone-pairs to define traffic policy between zones. Inside-to-outside needs an inspect action to allow and track sessions. Outside-to-inside needs a drop action to deny unsolicited inbound. Router-originated SSH is from the self zone to the outside zone, so a self-to-outside zone-pair with a policy permitting SSH is required. The combination of these three elements meets the stated requirements.

Answer

Create a zone-pair for inside-to-outside with an inspect policy, and apply an ACL to the outside interface to deny all inbound traffic.

Answer

Create a zone-pair for inside-to-outside with an inspect policy, and configure the router to use the outside interface as the source for SSH.

Answer

Create a zone-pair for inside-to-outside with an inspect policy, and a zone-pair for self-to-outside with an inspect policy, and rely on the implicit drop for outside-to-inside.

Question 15

A network administrator is hardening a Cisco IOS XE switch against DHCP starvation attacks. The requirement is to limit the number of DHCP requests that can be processed on an untrusted access port to 10 per second and to err-disable the port if the rate is exceeded. Which configuration accomplishes this?

Accepted Answer

ip dhcp snooping limit rate 10 under interface configuration, with errdisable recovery cause dhcp-rate-limit configured globally. DHCP snooping rate limiting is applied per interface with ip dhcp snooping limit rate, and exceeding it triggers the dhcp-rate-limit err-disable condition. Configuring errdisable recovery for that cause provides controlled recovery. This combination limits DHCP requests on the untrusted access port and protects against starvation attacks.

Answer

ip dhcp snooping trust on the access port and ip dhcp snooping limit rate 10 on the uplink

Answer

ip dhcp snooping information option allow-untrusted combined with a DHCP snooping rate limit of 10

Answer

ip dhcp snooping limit rate 10 configured globally under ip dhcp snooping configuration mode

Question 16

A network security engineer is implementing 802.1X authentication on a Cisco Catalyst switch. The switch is configured with RADIUS server 10.1.1.10 and a shared secret. The engineer wants to ensure that if the RADIUS server is unreachable, authenticated devices remain connected and unauthenticated devices are placed in a guest VLAN. The engineer configures 'authentication event server dead action authorize vlan 100' on the interface. However, when the RADIUS server goes down, authenticated devices are disconnected. What is the most likely cause?

Accepted Answer

The RADIUS server is not configured with the 'radius-server dead-criteria' command, so the switch does not detect the server as dead.. For the server dead action to trigger, the switch must detect that the RADIUS server is dead. This is controlled by the 'radius-server dead-criteria' command, which defines the conditions (e.g., number of timeouts) for marking a server as dead. If not configured, the switch may not mark the server as dead, and authenticated devices may be disconnected when reauthentication fails.

Answer

The 'authentication event server dead action authorize vlan 100' command only applies to unauthenticated devices; authenticated devices require 'authentication event server dead action reinitialize'.

Answer

The interface is missing the 'authentication event server dead action authorize' command for authenticated devices, or the command is not supported on the platform.

Answer

The 'authentication event server dead action authorize vlan 100' command requires the 'authentication event fail action authorize vlan 100' command to be configured as well.

Question 17

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs OSPF, receives SNMP polling from the NMS, and terminates SSH management sessions. The administrator needs to ensure that OSPF hellos are never dropped by the CoPP policy while still rate-limiting SNMP and SSH. Which CoPP action should be applied to the OSPF class to meet this requirement?

Accepted Answer

police 8000 conform-action transmit exceed-action transmit is not used; instead, apply the class-map without a police action using a 'pass' or no police statement. To guarantee OSPF hellos are never dropped by CoPP, the OSPF class must be exempted from policing rather than policed with a high rate. Configuring the class without a police action, or with an explicit pass, lets the traffic bypass rate limiting. The other choices all apply policers that can drop or remark excess OSPF traffic, which violates the requirement.

Answer

police 8000 conform-action transmit exceed-action drop

Answer

police 8000 conform-action transmit exceed-action transmit

Answer

police 8000 conform-action transmit exceed-action set-dscp-transmit af31

Question 18

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to secure corporate Wi-Fi access. The requirement is to use 802.1X authentication with EAP-TLS, where both the client and the authentication server present certificates. The administrator has configured the WLAN with WPA2 Enterprise and selected 802.1X as the security policy. Which additional configuration is required on the WLC to support EAP-TLS?

Accepted Answer

Upload a valid server certificate to the WLC and configure the RADIUS server with a certificate trusted by the clients.. EAP-TLS requires mutual certificate-based authentication. The WLC must have a server certificate installed to present to clients during the TLS handshake, and the RADIUS server must also have a trusted certificate. Clients must possess their own certificates. Without these certificates, the EAP-TLS handshake cannot complete.

Answer

Configure the WLC to use LEAP as the EAP type and enable CCKM for fast roaming.

Answer

Enable MAC filtering on the WLC and add all corporate client MAC addresses to the local database.

Answer

Configure a preshared key on the WLC and distribute it to all corporate clients through Group Policy.

Question 19

A network administrator is deploying Cisco TrustSec in a campus network. The security policy requires that all traffic from the employee VLAN (VLAN 10) to the server VLAN (VLAN 20) be encrypted and authenticated at Layer 2, without relying on IPsec or any overlay tunneling. Which TrustSec component should be implemented to meet this requirement?

Accepted Answer

MACsec (802.1AE) with 802.1X EAP-TLS authentication. MACsec (802.1AE) with 802.1X EAP-TLS provides Layer 2 hop-by-hop encryption and authentication, exactly matching the requirement to encrypt and authenticate traffic between VLANs without IPsec or overlay tunnels. SXP, SGACLs, and DAI are TrustSec or security features but none of them encrypt user traffic at Layer 2.

Answer

Cisco TrustSec SGACLs enforced at the distribution layer

Answer

Dynamic ARP Inspection (DAI) with DHCP snooping binding table

Answer

Security Group Tag Exchange Protocol (SXP) with IPsec transport mode

Question 20

A security team is reviewing a Cisco IOS router configuration and finds that an ACL applied inbound on the WAN interface permits TCP port 179 from any source. The team wants to restrict BGP peering to only the two known service provider addresses while keeping the ACL efficient. Which ACL entry should be used to replace the overly permissive statement?

Accepted Answer

permit tcp host 203.0.113.1 eq bgp host <local address> and a matching entry for the second provider's address.. The least-privilege replacement pins both the source peer address and the destination local address on TCP port 179, which is the exact tuple used by a BGP session. One entry per provider covers both peers without permitting arbitrary sources. This preserves the peering sessions while eliminating the wide exposure created by the original any-source statement.

Answer

permit tcp host 203.0.113.1 eq bgp host 198.51.100.1 and a second entry for the other provider, both with the established keyword.

Answer

permit tcp any eq bgp host <local address> with a log keyword to record unexpected peers.

Answer

permit tcp 203.0.113.0 0.0.0.255 eq bgp any and a second entry for the other provider's subnet.