350-401 Security Practice Test 11 — 15 Questions

Question 1

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against control plane overload. The router has management traffic (SSH, SNMP) and routing protocol traffic (OSPF, BGP). After applying the CoPP policy, the engineer notices that OSPF adjacencies are flapping. Which action should the engineer take to resolve this issue while maintaining control plane protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the rate limit for the OSPF class in the CoPP policy.. OSPF adjacency flapping after CoPP deployment indicates that OSPF hello packets are being dropped by the policer. The CoPP policy likely has a rate limit for OSPF that is too low for the network's requirements. Increasing the rate limit for the OSPF class allows OSPF traffic to pass while still enforcing a policer to protect against excess traffic. This maintains control plane protection and resolves the flapping.

Answer

Configure OSPF to use a different DSCP value so it matches a higher-priority class in the CoPP policy.

Answer

Remove the CoPP policy from the control plane and reapply it after OSPF stabilizes.

Answer

Apply the CoPP policy only to the management plane interface instead of the control plane.

Question 2

A network administrator needs to secure management access to a Cisco IOS XE switch. The requirement is to ensure that only SSH version 2 is used for remote CLI access, and that Telnet is disabled. Which configuration achieves this?

Accepted Answer

Configure 'transport input ssh' on the VTY lines and set 'ip ssh version 2' globally.. Restricting VTY access to SSH with 'transport input ssh' and forcing SSH version 2 with 'ip ssh version 2' ensures that only secure SSHv2 sessions are accepted. This combination disables Telnet and prevents fallback to the weaker SSH version 1, satisfying the management access hardening requirement.

Answer

Configure 'transport input telnet ssh' on the VTY lines and set 'ip ssh version 2' globally.

Answer

Configure 'transport output ssh' on the VTY lines and set 'ip ssh version 1' globally.

Answer

Configure 'line vty 0 4' with 'login local' and 'password cisco', then set 'ip ssh version 2' globally.

Question 3

A network engineer configures a Cisco IOS router to authenticate administrative SSH logins against a Cisco ISE server using TACACS+. After applying the configuration, a valid ISE user can log in but receives no privilege level and cannot enter privileged EXEC mode. The relevant configuration is:

aaa new-model
 aaa authentication login default group tacacs+ local
 aaa authorization exec default group tacacs+ local
 tacacs server ISE
  address ipv4 10.10.10.50
  key Cisco123

Which action most directly resolves the problem?

Accepted Answer

Configure the ISE TACACS+ device to return the cisco-av-pair shell:priv-lvl=15 attribute for authorized users.. Successful TACACS+ authentication only proves the user's identity; the privilege level comes from authorization AV pairs. Because the router shows the user authenticated but stuck at unprivileged EXEC, the ISE authorization policy must be returning no shell:priv-lvl value. Adding the cisco-av-pair shell:priv-lvl=15 attribute to the matching authorization rule gives the router the privilege level to apply after login.

Answer

Enable AAA accounting with the aaa accounting exec default start-stop group tacacs+ command so ISE records the session.

Answer

Add the aaa authorization commands 15 default group tacacs+ local command to the router.

Answer

Change the aaa authentication login method list to use the local database before the tacacs+ group.

Question 4

A network administrator is deploying a new branch office with a Cisco Catalyst 9200 switch. The security policy requires that any endpoint connecting to access ports must be authenticated before being granted network access, and unauthenticated devices must be placed into a restricted VLAN. The administrator wants to minimize configuration on the switch and rely on the authentication server to assign the VLAN dynamically. Which 802.1X feature should be configured on the switch to meet these requirements?

Accepted Answer

Configure 802.1X with VLAN assignment via RADIUS attributes.. The requirement is to authenticate endpoints and dynamically assign VLANs based on authentication server response. 802.1X with RADIUS attributes allows the switch to act as an authenticator, passing credentials to a RADIUS server, which can then return VLAN assignment attributes. This ensures only authenticated devices gain access, and unauthenticated devices can be placed in a restricted VLAN. Other options either do not authenticate or do not provide dynamic VLAN assignment based on user identity.

Answer

Configure port security with sticky MAC addresses and a violation action of restrict.

Answer

Configure Web Authentication (WebAuth) with a guest VLAN.

Answer

Configure MAC Authentication Bypass (MAB) with a fallback VLAN.

Question 5

A network security engineer is configuring an IPsec site-to-site VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) and that the encryption is AES-256. Which combination of commands achieves this?

Accepted Answer

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac, then crypto map CM 10 ipsec-isakmp with set pfs group14. To achieve AES-256 encryption and perfect forward secrecy, the transform-set must specify esp-aes 256 and esp-sha256-hmac, and the crypto map must include set pfs with a strong Diffie-Hellman group such as group14. This ensures that each new IPsec SA uses a unique key derived from a fresh Diffie-Hellman exchange, providing forward secrecy. The combination of these commands meets the security requirements.

Answer

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac, then crypto map CM 10 ipsec-isakmp without set pfs

Answer

crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac, then crypto map CM 10 ipsec-isakmp with set pfs group5

Answer

crypto ipsec transform-set TS esp-3des esp-md5-hmac, then crypto map CM 10 ipsec-isakmp with set pfs group2

Question 6

A security architect is designing segmentation for a data center using Cisco TrustSec. The requirement is that classification of traffic into Security Group Tags (SGTs) occur at the access layer based on the identity of the user or device, and that enforcement occur at the data center core where the SGT-to-SGACL matrix is applied. Which statement describes the correct deployment approach?

Accepted Answer

SGTs are assigned by the access switch using 802.1X or SXP, propagated in the SGT Exchange Protocol or inline tagging, and enforced by SGACLs on the core device.. TrustSec's strength is the separation of classification from enforcement. Identity-based classification happens as close to the source as possible at the access layer, using 802.1X, MAB, or SXP to assign SGTs. Tags then travel across the fabric via inline tagging or SXP propagation. Enforcement devices, typically in the distribution or core, apply SGACLs derived from the SGT matrix, allowing consistent policy regardless of IP addressing or topology changes.

Answer

SGTs are assigned by Cisco ISE to the core switch, and enforcement is performed by the access switch using downloadable ACLs.

Answer

SGTs are assigned at the core based on destination subnet, and enforcement occurs at the access layer using PACLs.

Answer

SGTs are carried in IPsec ESP headers across the data center, and enforcement is performed by the Cisco ASA using the SGT matrix.

Question 7

A campus switch connects to an IP phone that has a PC daisy-chained behind it. The engineer wants the phone to reside in VLAN 100 and the PC in VLAN 200, with the phone tagging its own voice traffic. Which interface configuration accomplishes this?

Accepted Answer

switchport mode access, switchport access vlan 200, switchport voice vlan 100. Cisco's voice VLAN feature allows a single access port to serve two devices in different VLANs. The PC, which sends untagged frames, is placed in the access VLAN, while the IP phone, which tags its traffic with 802.1Q, is placed in the voice VLAN. Setting the access VLAN to 200 for the PC and the voice VLAN to 100 for the phone matches the requirement exactly.

Answer

switchport mode access, switchport access vlan 100, switchport voice vlan 200

Answer

switchport mode access, switchport access vlan 200, switchport trunk encapsulation dot1q

Answer

switchport mode trunk, switchport trunk native vlan 200, switchport trunk allowed vlan 100,200

Question 8

A network engineer is implementing IPsec VPN on a Cisco IOS XE router. The design requires that traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet be encrypted, while all other traffic should be sent unencrypted. The engineer creates a crypto ACL. Which action must be taken to ensure the crypto ACL correctly identifies the traffic to protect?

Accepted Answer

Configure the crypto ACL with 'permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255' and ensure there is an implicit deny or an explicit deny for other traffic.. The crypto ACL must permit only the specific source and destination subnets that require encryption. Because ACLs have an implicit deny, traffic not matching the permit is not considered interesting and is sent unencrypted. This precisely implements the requirement to encrypt only traffic between 10.1.1.0/24 and 10.2.2.0/24.

Answer

Configure the crypto ACL with 'permit ip any any' to ensure all traffic is encrypted, then use a route-map to exclude the non-interesting traffic.

Answer

Configure the crypto ACL with 'deny ip any any' followed by 'permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255'.

Answer

Configure the crypto ACL with 'permit ip 10.1.1.0 0.0.0.255 any' to cover all destinations from the source subnet, then rely on the VPN peer to filter.

Question 9

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on the port and to automatically shut down the port if a violation occurs. Which command set should be used?

Accepted Answer

switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown. Port security is configured by enabling it on the interface, setting the maximum number of allowed MAC addresses, and specifying the violation action. To allow two MAC addresses and shut down on violation, the commands switchport port-security, switchport port-security maximum 2, and switchport port-security violation shutdown are required. This ensures that only two devices can connect and any additional device causes the port to enter err-disabled state.

Answer

switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict

Answer

switchport port-security
switchport port-security violation protect

Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown

Question 10

A network administrator is configuring 802.1X on a Cisco Catalyst switch. The switch is connected to a Cisco IP phone with a PC attached to the phone's data port. The requirement is to authenticate both the phone and the PC separately, with the phone in the voice VLAN and the PC in the data VLAN. Which 802.1X feature should be enabled?

Accepted Answer

Multi-Domain Authentication (MDA). Multi-Domain Authentication (MDA) is designed for scenarios where a voice device and a data device share a switch port. It allows both to authenticate independently and assigns them to their respective VLANs, meeting the requirement for separate authentication and VLAN segmentation.

Answer

Multi-Authentication (Multi-Auth)

Answer

MAC Authentication Bypass (MAB)

Answer

Web Authentication (WebAuth)

Question 11

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against DoS attacks. The router has a management plane that includes SSH and SNMP, and a control plane that includes routing protocols like OSPF and BGP. The engineer wants to rate-limit traffic destined to the route processor while ensuring that management traffic is not dropped during high CPU load. Which CoPP configuration approach is most appropriate?

Accepted Answer

Configure separate classes for management traffic (SSH, SNMP) and control plane traffic (OSPF, BGP), and assign higher rate limits to management traffic.. CoPP allows granular control over traffic destined to the route processor. By separating management and control plane traffic into different classes, the engineer can assign higher rate limits to management traffic to ensure administrative access is maintained, while still protecting the route processor from excessive control plane traffic. This approach balances security and availability, preventing both DoS attacks and administrator lockout.

Answer

Use a single class that matches all IP traffic and set a high rate limit to avoid dropping any packets.

Answer

Apply a single CoPP policy that classifies all traffic to the route processor and sets a low rate limit for all classes.

Answer

Configure CoPP only for routing protocols and rely on QoS for management traffic.

Question 12

A network administrator is configuring a zone-based firewall on a Cisco IOS XE router. The requirement is to allow HTTP traffic from the INSIDE zone to the OUTSIDE zone while blocking all other traffic initiated from INSIDE. Which action must be taken to define the traffic that is permitted?

Accepted Answer

Create a class-map that matches HTTP, then reference it in a policy-map and apply the policy-map to the zone pair.. Zone-based firewall policy is built with class-maps for traffic identification and policy-maps for action. The policy-map is attached to a zone pair, and traffic not explicitly permitted is dropped by default, which matches the requirement to allow only HTTP from INSIDE to OUTSIDE.

Answer

Configure a route-map that matches HTTP and apply it to the zone pair.

Answer

Apply an ACL directly to the INSIDE zone interface with the ip access-group command.

Answer

Enable NAT with an overload statement matching HTTP on the OUTSIDE interface.

Question 13

A network administrator is implementing Control Plane Policing on a Cisco IOS-XE router to protect the route processor from excessive BGP, SSH, and SNMP traffic. After applying the policy, legitimate BGP keepalives are being dropped, causing peer resets. Which action should the administrator take to resolve this while still protecting the control plane?

Accepted Answer

Raise the conform-action rate for the BGP class and verify BGP is classified before the default class. CoPP classifies control-plane traffic and applies policers per class. BGP keepalives are small and periodic; if the BGP class rate is too low or BGP is not matched before the default class, keepalives get dropped and peers reset. Increasing the conform rate for the BGP class and ensuring correct classification order restores keepalive delivery while continuing to protect the route processor from abusive traffic in other classes.

Answer

Remove the BGP class from the policy map so BGP is not policed at all

Answer

Apply the policy to the data plane interfaces instead of the control plane

Answer

Change the policy map to use priority queuing instead of policing for the BGP class

Question 14

A security team wants to protect a web application hosted behind a Cisco IOS router from cross-site scripting and SQL injection attacks without modifying the application itself. Which Cisco IOS feature is designed for this purpose?

Accepted Answer

Cisco IOS IPS with signature-based inspection. Detecting and blocking application-layer attacks like cross-site scripting and SQL injection requires payload inspection, which is what Cisco IOS IPS provides through its signature set. Firewalls, CoPP, and IPsec operate at other layers and cannot identify malicious HTTP content, so signature-based IPS is the appropriate feature when the application itself cannot be modified.

Answer

Zone-Based Policy Firewall

Answer

IPsec VPN with AES encryption

Answer

Control Plane Policing

Question 15

A network administrator must secure management access to a Cisco Catalyst 9300 switch so that only encrypted sessions are accepted and any Telnet attempt is refused. The administrator wants to enforce this with the fewest configuration lines on the VTY lines. Which configuration accomplishes this?

Accepted Answer

line vty 0 15 followed by transport input ssh. Restricting inbound VTY access to SSH is done by entering line configuration mode and issuing transport input ssh, which permits only SSH and denies Telnet by default. Because Telnet is implicitly excluded, no ACL is needed, making this the most concise and reliable way to enforce encrypted-only management access on the switch.

Answer

line vty 0 15 followed by transport output ssh

Answer

line vty 0 15 followed by login local and transport input telnet ssh

Answer

line vty 0 15 followed by transport input all then access-class 10 in with an ACL denying TCP port 23