350-401 Security Practice Test 10 — 15 Questions

Question 1

A network engineer configures Control Plane Policing on a Cisco IOS XE router acting as the BGP speaker for an ISP edge. The policy must protect the route processor from CPU exhaustion while still allowing BGP keepalives, SSH management, and SNMP polling from the NOC. Which CoPP design element is required to ensure BGP, SSH, and SNMP traffic is matched and rate-limited separately from transit traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A class-map that matches traffic with the 'control-plane' keyword and a policy-map applied with 'service-policy input' under the control-plane configuration mode.. CoPP protects the route processor by classifying traffic destined to the control plane and applying policers through an MQC policy attached under control-plane configuration mode. This allows BGP keepalives, SSH, and SNMP to be individually matched and rate-limited so that a flood of any one protocol cannot exhaust CPU resources while transit traffic is unaffected.

Answer

An access list applied outbound on all interfaces using 'ip access-group' to block unwanted traffic before it reaches the route processor.

Answer

An MQC policy attached to the WAN interface with 'service-policy input' so that all inbound traffic including BGP and SSH is policed at the interface level.

Answer

A route-map with 'match ip next-hop' applied to the BGP neighbor to limit the number of prefixes received from each peer.

Question 2

A network administrator is deploying a new Cisco Catalyst 9200 switch at a branch office. The security policy requires that when a device connected to a port is shut down or moved, the switch must immediately send a SNMP trap and place the port into an error-disabled state while also incrementing a violation counter. The administrator configures port security with the violation mode that meets these requirements. Which command must be applied to the interface to achieve this?

Accepted Answer

switchport port-security violation shutdown. The security policy requires the switch to send an SNMP trap and place the port into an error-disabled state when a violation occurs. The shutdown violation mode does exactly that: it error-disables the port, generates a syslog/SNMP notification, and increments the violation counter. The restrict mode only increments counters and sends notifications without disabling the port, while protect mode silently drops frames. Disable is not a valid keyword.

Answer

switchport port-security violation disable

Answer

switchport port-security violation restrict

Answer

switchport port-security violation protect

Question 3

A network engineer is deploying MACsec on a Cisco Catalyst switch to secure point-to-point links between the access and distribution layers. The design must ensure data confidentiality and integrity on the wire, and must use a key agreement mechanism that supports dynamic key exchange. Which TWO of the following are required to meet these requirements? (Choose two.)

Accepted Answer

Configure MACsec (802.1AE) on the point-to-point interfaces to provide data confidentiality and integrity.. MACsec (802.1AE) supplies Layer 2 encryption and integrity, while MKA provides the dynamic key agreement, peer discovery, and key rotation. Both must be configured on the point-to-point links to meet the confidentiality, integrity, and dynamic key exchange requirements. IPsec, 802.1X, and private VLANs do not deliver Layer 2 link encryption with MKA.

Answer

Configure a private VLAN between the access and distribution switches to isolate traffic.

Answer

Configure 802.1X with EAP-TLS on the inter-switch links to establish the encryption keys.

Answer

Configure IPsec transport mode between the switches to encrypt all Layer 2 traffic.

Question 4

A network administrator needs to secure management access to a Cisco IOS XE switch. The requirement is that only SSH version 2 with a 2048-bit RSA key be accepted, that Telnet be disabled, and that only the 'netadmin' user with privilege level 15 be allowed to log in via VTY lines 0 through 4. Which configuration accomplishes this?

Accepted Answer

crypto key generate rsa modulus 2048; ip ssh version 2; line vty 0 4; transport input ssh; login local; username netadmin privilege 15 secret <password>. The correct configuration generates a 2048-bit RSA key, forces SSH version 2, restricts VTY transport to SSH only (disabling Telnet), and uses local authentication with the netadmin user at privilege 15. Alternatives fail because they use a weak key size, allow Telnet, force SSHv1, or assign the wrong privilege level, each violating at least one stated requirement.

Answer

crypto key generate rsa modulus 2048; ip ssh version 1; line vty 0 4; transport input ssh; login local; username netadmin privilege 15 secret <password>

Answer

crypto key generate rsa modulus 2048; ip ssh version 2; line vty 0 4; transport input ssh; login local; username netadmin privilege 1 secret <password>

Answer

crypto key generate rsa modulus 1024; ip ssh version 2; line vty 0 4; transport input telnet ssh; login local; username netadmin privilege 15 secret <password>

Question 5

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has management SSH access, BGP peering, and SNMP monitoring. After applying a CoPP policy, the engineer notices that BGP sessions flap intermittently, but SSH and SNMP remain stable. Which action should the engineer take to resolve the BGP flapping while maintaining control plane protection?

Accepted Answer

Increase the rate limit for the BGP class in the CoPP policy.. When CoPP policers are too strict, protocols like BGP may experience drops leading to session flaps. Since SSH and SNMP are stable, the issue is isolated to the BGP class. Increasing the rate limit for that class allows BGP to operate within acceptable thresholds while still protecting the route processor. This maintains overall control plane security without sacrificing routing stability.

Answer

Remove the CoPP policy from the control plane interface.

Answer

Reclassify BGP traffic into the SNMP class to share its rate limit.

Answer

Enable QoS pre-classify on the BGP neighbor interface.

Question 6

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router has management SSH access, SNMP monitoring, and BGP peering. After applying the CoPP policy shown in the exhibit, the engineer notices that SNMP polling from the management station fails, while SSH and BGP remain operational. Which action should be taken to restore SNMP polling while maintaining control plane protection?

Accepted Answer

Add a class-map that matches SNMP traffic (UDP port 161) and include it in the CoPP policy with an appropriate policer rate.. CoPP policies must explicitly classify and police all desired control plane traffic. If SNMP is not classified, it falls into the default class, which typically has a low rate and may drop legitimate SNMP. Adding a dedicated class-map for SNMP with an appropriate policer restores connectivity while preserving protection.

Answer

Increase the policer rate for the default class to allow all unmatched traffic, including SNMP.

Answer

Remove the CoPP policy from the control plane and reapply it after verifying SNMP connectivity.

Answer

Configure an ACL to permit SNMP traffic and apply it to the management interface instead of the control plane.

Question 7

A network security team is evaluating Cisco TrustSec (CTS) for deployment in a campus network. The team wants to understand which components are essential for enforcing security group tags (SGTs) and providing role-based access control. Which two of the following are required to implement CTS with SGT enforcement? (Choose two.)

Accepted Answer

Cisco Identity Services Engine (ISE) for policy and SGT assignment. Implementing Cisco TrustSec requires a policy engine to assign SGTs and a method to propagate those tags. Cisco ISE provides the centralized policy and SGT assignment, while inline tagging or SXP ensures that SGTs are carried across network devices. Together, they enable enforcement of SGACLs. STP, DHCP snooping, and AnyConnect NAM are not essential for SGT-based access control, though they may be used in a broader security architecture.

Answer

Cisco AnyConnect Network Access Manager for endpoint posture

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Spanning Tree Protocol (STP) for loop prevention

Question 8

A network administrator is deploying a Cisco IOS-XE router as the WAN edge. The security policy requires that the router itself be protected against brute-force SSH attacks originating from the untrusted internet, without affecting transit traffic forwarded through the router. The administrator wants to use a feature that automatically blocks the offending source IP after repeated failed login attempts. Which Cisco IOS-XE feature should be configured?

Accepted Answer

Login Enhancements (login block-for) with an ACL triggered after failed attempts. The login block-for command, part of Cisco IOS Login Enhancements, watches failed authentication attempts against the device itself. When the configured failure threshold is crossed inside the observation window, the router installs a temporary access list that denies further login attempts from offending hosts for the quiet period. Because it only affects traffic destined to the router's management plane, transit forwarding is unaffected, which is precisely what the scenario demands.

Answer

Zone-Based Firewall with a policy dropping TCP port 22 inbound

Answer

IP Source Guard on the WAN interface

Answer

Control Plane Policing (CoPP) with a class-map matching TCP port 22

Question 9

A network administrator is deploying Cisco Identity Services Engine (ISE) for wired 802.1X authentication on a Cisco Catalyst 9200 switch. The RADIUS server is reachable at 10.10.10.50 with shared secret 'C1sco123'. The administrator wants the switch to authenticate users before granting access to the data VLAN, and to place unauthenticated devices into a restricted VLAN. Which command sequence correctly enables 802.1X on a switch port?

Accepted Answer

aaa new-model; radius server ISE; address ipv4 10.10.10.50 auth-port 1812 acct-port 1813; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control auto; dot1x pae authenticator. 802.1X on a Cisco switch requires enabling AAA, defining the RADIUS server with the correct ports and key, and configuring the interface as an authenticator with 'authentication port-control auto'. The switch acts as the authenticator, ISE as the authentication server, and the endpoint as the supplicant. Using 'force-authorized' bypasses authentication, TACACS+ is not used for 802.1X, and legacy ports 1645/1646 are incorrect.

Answer

aaa new-model; radius server ISE; address ipv4 10.10.10.50 auth-port 1812 acct-port 1813; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control force-authorized; dot1x pae authenticator

Answer

aaa new-model; tacacs server ISE; address ipv4 10.10.10.50; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control auto; dot1x pae supplicant

Answer

aaa new-model; radius server ISE; address ipv4 10.10.10.50 auth-port 1645 acct-port 1646; key C1sco123; interface GigabitEthernet1/0/1; authentication port-control auto; dot1x pae authenticator

Question 10

A network security team is deploying MACsec on Cisco Catalyst switches to protect Layer 2 traffic between two distribution switches. They want to ensure that the link is encrypted and that only authorized devices can participate in the secured session. Which two statements about MACsec operation on Cisco platforms are correct? (Choose two.)

Accepted Answer

MACsec can be configured in switch-to-host mode where the host runs an 802.1X supplicant that supports MACsec key agreement, allowing encryption to the endpoint.. MACsec secures Ethernet frames using MKA to negotiate keys, supporting both pre-shared CAK and 802.1X-based key derivation. It can be deployed switch-to-switch or switch-to-host when the endpoint has a MACsec-capable supplicant. These two facts address the requirement for encryption and authorized participation on the Layer 2 link.

Answer

MACsec is only supported on routed ports and cannot be enabled on switch access ports or EtherChannel member links.

Answer

MACsec encryption keys are exchanged in clear text during the MKA handshake, so the link is only protected against physical taps after the session is established.

Answer

MACsec operates at Layer 3 and encrypts IP packets between routers, requiring IPsec configuration on the participating interfaces.

Question 11

A network engineer is implementing 802.1X authentication on a Cisco switch. The engineer wants to ensure that the switch dynamically assigns a VLAN to the port based on the user's identity, and that the VLAN assignment is enforced by the authentication server. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Configure the authentication server to return the appropriate RADIUS attributes, such as Tunnel-Type and Tunnel-Private-Group-ID.. Dynamic VLAN assignment requires the switch to authenticate users via RADIUS and receive VLAN information from the RADIUS server. The server must return the appropriate tunnel attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) in the Access-Accept message. These two components together allow the switch to place the user into the correct VLAN automatically.

Answer

Enable MACsec on the switch port to encrypt the authentication exchange.

Answer

Enable DHCP snooping on the switch to validate the user's IP address.

Answer

Configure the switch port as a trunk port to allow multiple VLANs.

Question 12

A network administrator is configuring a Cisco IOS XE router to protect against spoofed source addresses on an internal interface facing user subnets. The requirement is to drop packets whose source address does not match the routing table entry for the incoming interface. Which feature should be enabled?

Accepted Answer

Unicast Reverse Path Forwarding (uRPF) in strict mode on the interface. Unicast RPF in strict mode checks the routing table for the source address of each incoming packet and verifies that the source is reachable via the same interface the packet arrived on. If not, the packet is dropped, which prevents source address spoofing. This is the standard IOS XE feature for validating source addresses on an interface against the routing table.

Answer

Access Control List with the log keyword applied to the interface

Answer

IP Source Guard on the interface

Answer

Dynamic ARP Inspection on the interface

Question 13

A network administrator is configuring a Cisco Catalyst switch to prevent unauthorized devices from connecting to an access port. The administrator wants to ensure that only one MAC address is allowed on the port, and if a violation occurs, the port should be shut down and an SNMP trap sent. Which port security violation mode should be configured?

Accepted Answer

shutdown. The shutdown violation mode meets both requirements: it shuts down the port (error-disabled) and sends an SNMP trap. Protect mode only drops traffic, restrict mode drops and sends traps but does not shut down the port. Errdisable is a state, not a mode. Thus, shutdown is the correct configuration for this security policy.

Answer

protect

Answer

restrict

Answer

errdisable

Question 14

A network engineer is configuring an IPsec site-to-site VPN between two Cisco IOS-XE routers. The design requires that the data payload be encrypted and that the two peers authenticate each other using pre-shared keys without any certificate infrastructure. Which combination of IKEv2 parameters must be configured on both peers to establish the tunnel?

Accepted Answer

An IKEv2 proposal, an IKEv2 policy, an IKEv2 keyring, and an IKEv2 profile. IKEv2 on Cisco IOS-XE separates concerns: proposals define algorithms, policies select proposals based on match criteria, keyrings store pre-shared keys, and profiles bind identities, keyrings, and policies together. All four are required to negotiate the IKEv2 security association using PSK authentication with no PKI. The data-plane IPsec configuration (transform set and profile or map) is separate and layered on top of this control-plane configuration.

Answer

An IKEv2 profile alone with inline pre-shared-key configuration

Answer

An IKEv2 proposal, a transform set, and a dynamic crypto map

Answer

An ISAKMP policy, a crypto keyring with RSA signatures, and a crypto map

Question 15

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against excessive ARP traffic. The engineer applies the following policy:

policy-map COPP-POLICY
 class ARP-CLASS
  police 8000 conform-action transmit exceed-action drop

After applying the service-policy to the control-plane, the engineer notices that legitimate ARP requests are being dropped during peak hours. Which action should the engineer take to resolve this issue while maintaining protection?

Accepted Answer

Increase the police rate to a higher value that accommodates peak ARP traffic while still limiting excessive bursts.. CoPP police rates must be tuned to allow legitimate control-plane traffic while blocking excess. A rate of 8000 bps is insufficient for ARP during peak hours, so increasing the rate to a realistic peak value resolves drops while preserving protection. Changing exceed-action to transmit removes protection, moving the policy to the data plane is ineffective, and splitting classes without raising the rate does not fix the underlying issue.

Answer

Add a class-map that matches ARP replies and apply a separate police rate to that class.

Answer

Remove the service-policy from the control-plane and apply it to the data plane instead.

Answer

Change the exceed-action to transmit so that all ARP packets are allowed through.