350-401 Security Practice Test 12 — 15 Questions

Question 1

A network administrator is configuring a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the data transmitted between the sites is encrypted and authenticated. Which IPsec protocol should be used to provide both confidentiality and integrity for the data payload?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encapsulating Security Payload (ESP). ESP is the IPsec protocol that provides both confidentiality (encryption) and integrity/authentication for the data payload. AH only provides integrity and authentication, while IKE is for key exchange and GRE is a tunneling protocol without built-in security. Therefore, ESP is the correct choice for encrypting and authenticating VPN traffic.

Answer

Generic Routing Encapsulation (GRE)

Answer

Internet Key Exchange (IKE)

Answer

Authentication Header (AH)

Question 2

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP. After applying a CoPP policy, BGP peering drops intermittently during route churn, but SSH and SNMP remain reachable. Which action should be taken to correct the issue while preserving control plane protection?

Accepted Answer

Increase the policer rate for the BGP class-map in the CoPP policy.. CoPP policers are applied per class, so a too-low rate for the BGP class causes legitimate BGP traffic to be dropped during churn while other classes remain unaffected. Raising the BGP policer rate restores BGP stability without removing control plane protection, whereas disabling CoPP or altering class-maps would either expose the router or misclassify traffic.

Answer

Change the BGP class-map match to include only SSH and SNMP traffic.

Answer

Remove the CoPP policy from the control plane and reapply it after convergence.

Answer

Disable BGP route churn by setting the BGP scanner interval to a higher value.

Question 3

A network administrator is configuring a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the data transmitted between the sites is encrypted and authenticated. Which IPsec protocol should be used to provide both confidentiality and integrity for the data payload?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure 'authentication local rsa-sig' and 'authentication remote eap query-identity' under the IKEv2 profile.. IKEv2 profiles separate local and remote authentication methods. To use a certificate for the headend, 'authentication local rsa-sig' is required. To authenticate peers with EAP-MSCHAPv2, 'authentication remote eap query-identity' is used, which triggers EAP negotiation and allows the peer to respond with EAP-MSCHAPv2 credentials.

Answer

Configure 'authentication local pre-share' and 'authentication remote pre-share' under the IKEv2 profile.

Answer

Configure 'authentication local eap query-identity' and 'authentication remote rsa-sig' under the IKEv2 profile.

Answer

Configure 'authentication local rsa-sig' and 'authentication remote rsa-sig' under the IKEv2 profile.

Question 4

A network security team is hardening a Cisco IOS-XE router that terminates a site-to-site VPN to the internet. They want to ensure that the router itself cannot be managed from untrusted networks and that its management protocols are protected. Which two configuration actions achieve these goals? (Choose two.)

Accepted Answer

Apply an access list to the VTY lines that permits only trusted management subnets and add the transport input ssh command. Hardening the management plane requires restricting who can reach the management interfaces and how. Limiting VTY access with an ACL to trusted subnets and forcing SSH eliminates cleartext and unauthorized remote logins, while an interface ACL that blocks SNMP and NETCONF from untrusted sources prevents those services from being exploited from the internet. Together these actions protect the router's management plane without disrupting the site-to-site VPN traffic.

Answer

Enable the exec-timeout 0 0 command on all VTY lines to prevent session lockouts during maintenance

Answer

Configure a local username with privilege level 15 and no password to ensure emergency access is always available

Answer

Enable the ip http server command to allow web-based management as a backup access method

Question 5

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has a single physical interface Gi0/0/0 that carries both management SSH traffic and transit data traffic. The administrator wants the CoPP policy to apply only to traffic destined to the router's control plane, not to transit traffic. Which CoPP configuration element must be applied to achieve this?

Accepted Answer

Apply the policy-map to the control-plane global configuration using the service-policy command under control-plane.. CoPP protects the route processor by policing traffic that is punted to the control plane. The policy-map must be attached to the control-plane interface with the service-policy command under the control-plane global configuration. Applying a policy to a physical interface or in the output direction would affect transit or outbound traffic, not the control-plane path.

Answer

Apply the policy-map to the Gi0/0/0 interface in the input direction using the service-policy command.

Answer

Apply the policy-map to the Gi0/0/0 interface in the output direction using the service-policy command.

Answer

Apply the policy-map to the management VRF using the service-policy command under vrf definition.

Question 6

A company runs a Cisco IOS router as the WAN edge. The security team wants to detect and log traffic that matches a set of known malicious signatures without blocking legitimate traffic, while still dropping clearly malformed packets. Which technology should be deployed on the router?

Accepted Answer

Cisco IOS Intrusion Prevention System with signature categories set to alert. Cisco IOS IPS inspects packets against a signature database and can be tuned to alert on matching traffic instead of dropping it, which meets the detection-and-logging requirement while preserving legitimate flows. Malformed packets can be handled by specific drop signatures, giving the security team both visibility and selective enforcement on the WAN edge router.

Answer

Zone-Based Policy Firewall with inspect actions

Answer

IPsec VPN with AES-256 encryption between peers

Answer

Control Plane Policing with a rate limit on management traffic

Question 7

A network administrator is configuring 802.1X authentication on a Cisco switch port. The port is connected to a VoIP phone that then connects to a PC. The administrator wants to authenticate both the phone and the PC separately, with the phone using MAB and the PC using 802.1X. Which feature should be configured on the switch port to support this?

Accepted Answer

Multi-Domain Authentication (MDA). MDA is specifically designed to allow a voice device and a data device to authenticate separately on the same switch port. The phone can use MAB while the PC uses 802.1X, and they are placed in different VLANs. Multi-Auth and Multi-Host do not provide this voice/data separation, and WebAuth is a different authentication method. Thus, MDA is the correct feature.

Answer

Web Authentication (WebAuth)

Answer

Multi-Host

Answer

Multi-Auth

Question 8

A network engineer is implementing a Zone-Based Firewall (ZBFW) on a Cisco IOS XE router. The router has three interfaces: inside (GigabitEthernet0/0), outside (GigabitEthernet0/1), and DMZ (GigabitEthernet0/2). The security policy requires that traffic from the inside zone to the outside zone be inspected, traffic from the outside zone to the DMZ be allowed only for HTTP and HTTPS, and all other traffic between zones be denied by default. Which configuration step is essential to achieve this policy?

Accepted Answer

Assign interfaces to zones and create zone pairs with inspect policies for inside-to-outside and outside-to-DMZ.. Zone-Based Firewall requires interfaces to be assigned to zones, and traffic between zones is controlled by zone pairs. Each zone pair has a policy that defines actions like inspect, pass, or drop. By default, inter-zone traffic is dropped, so explicit policies are needed for allowed traffic. The correct configuration involves creating zones, assigning interfaces, and defining zone pairs with appropriate inspect policies for inside-to-outside and outside-to-DMZ, ensuring the default deny posture.

Answer

Configure a single zone pair from inside to outside with an inspect policy and rely on implicit permit for other traffic.

Answer

Create a class map that matches HTTP and HTTPS traffic and apply it as a policy to the outside interface.

Answer

Apply an ACL to the outside interface to permit HTTP and HTTPS to the DMZ and deny all other traffic.

Question 9

A network administrator is implementing Dynamic ARP Inspection (DAI) on a Cisco Catalyst switch. The network uses DHCP for most endpoints, but a few servers have static IP addresses. Which two actions are required to ensure DAI allows legitimate traffic while blocking ARP spoofing? (Choose two.)

Accepted Answer

Configure static ARP ACLs for hosts with statically assigned IP addresses.. DAI validates ARP packets against the DHCP snooping binding table, so DHCP snooping must be enabled on the same VLANs. Static hosts are not in that table, so an ARP ACL must be configured to permit their specific IP-to-MAC bindings. Together, these actions allow legitimate DHCP and static traffic while blocking spoofed ARP packets.

Answer

Enable port security with sticky MAC addresses on all access ports.

Answer

Configure DAI to trust all access ports.

Answer

Disable IP Source Guard on all access ports.

Question 10

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that runs BGP, SSH management, and SNMP monitoring. The engineer must ensure that BGP keepalives are never dropped even during a control-plane flood, while SSH and SNMP traffic should be rate-limited. Which CoPP configuration element accomplishes this requirement?

Accepted Answer

Create a class-map matching BGP traffic and reference it in the control-plane policy-map without applying any police action.. CoPP works by classifying control-plane traffic and applying actions, most commonly 'police'. Any class that has no police action is effectively passed without rate limiting, which is exactly what is needed for BGP keepalives that must never be dropped. SSH and SNMP classes can then receive 'police' actions with appropriate conform/exceed handling. This design isolates critical routing protocol traffic from the effects of a control-plane flood.

Answer

Create a class-map matching BGP traffic with a 'police' action and assign it to the control-plane policy-map.

Answer

Create a class-map matching BGP traffic and apply a 'police' action with a conform-action of 'transmit' and an exceed-action of 'transmit'.

Answer

Create a class-map matching BGP traffic and apply a 'police' action with a very high committed information rate (CIR).

Question 11

A network engineer is deploying MACsec on a Catalyst switch uplink between two buildings to protect Layer 2 traffic. Which two statements about MACsec operation on Cisco Catalyst switches are true? (Choose two.)

Accepted Answer

MACsec requires an MKA session and a connectivity association key to establish secure associations between peers.. MACsec secures individual Ethernet links using 802.1AE encryption and integrity, and it relies on MKA with a connectivity association key to negotiate secure associations between peers. Because it operates hop by hop, each device along the path must participate, and it does not replace 802.1X or provide end-to-end encryption across a routed network.

Answer

MACsec encrypts traffic end to end from the originating host to the final destination host across all intermediate routers.

Answer

MACsec replaces 802.1X and removes the need for any authentication server in the network.

Answer

MACsec can be deployed only on routed ports and is incompatible with switch access ports.

Question 12

A network engineer is implementing IPsec VPN on a Cisco IOS XE router to connect a branch office to headquarters. The engineer must ensure that the IKEv2 negotiation uses strong authentication and that the data plane is protected with integrity and encryption. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Configure an IKEv2 keyring or PKI trustpoint to authenticate the peers.. IKEv2 requires peer authentication, provided by a keyring with pre-shared keys or a PKI trustpoint. The data plane is protected by an IPsec transform set that specifies ESP encryption and authentication algorithms. Both elements must be configured and referenced correctly in the IPsec profile or crypto map. The other options either apply to IKEv1 or do not provide the required security functions.

Answer

Configure 'crypto isakmp policy' with pre-shared key authentication for IKEv1.

Answer

Configure 'crypto ipsec profile' with 'set security-association lifetime seconds 3600' only.

Answer

Configure a crypto ACL with 'permit ip any any' to match all traffic.

Question 13

A network engineer is configuring IPsec VPN on a Cisco IOS router. The requirement is to encrypt traffic between two sites using IKEv2. The engineer wants to ensure that the IKEv2 proposal uses AES-256 for encryption, SHA-256 for integrity, and Diffie-Hellman group 14. Which command correctly defines the IKEv2 proposal with these parameters?

Accepted Answer

crypto ikev2 proposal PROP encryption aes-cbc-256 integrity sha256 group 14. The correct command to define an IKEv2 proposal with specific encryption, integrity, and DH group is under crypto ikev2 proposal, using the encryption, integrity, and group keywords. The policy command only references a proposal, and ISAKMP policy is for IKEv1. The keyring is for authentication, not proposal parameters.

Answer

crypto ikev2 keyring KEYRING peer SITE address 1.1.1.1 pre-shared-key local secret

Answer

crypto isakmp policy 10 encryption aes 256 hash sha256 group 14

Answer

crypto ikev2 policy POLICY proposal PROP encryption aes-256 integrity sha256 group 14

Question 14

A network engineer must protect the Cisco IOS control plane from an excessive volume of ARP traffic generated by a compromised host in VLAN 20. The engineer wants to limit ARP packets that are punted to the CPU, while allowing normal data forwarding to continue unaffected. Which feature should be configured to accomplish this goal?

Accepted Answer

Control Plane Policing (CoPP). Protecting the CPU from excessive punted ARP traffic requires a mechanism that polices traffic destined to the control plane. Control Plane Policing provides exactly this by allowing class-based rate limiting of specific protocols such as ARP. DAI, storm control, and IP Source Guard operate at the access or data plane and address spoofing or broadcast volume, not CPU-bound exception traffic.

Answer

Storm control configured for broadcast traffic on the host-facing port

Answer

IP Source Guard on the host-facing port

Answer

Dynamic ARP Inspection (DAI) on VLAN 20

Question 15

A network engineer needs to secure management access to a Cisco IOS XE router. The requirement is to encrypt all management traffic, including SNMP, and to authenticate administrators against a centralized server. Which combination of features should be implemented?

Accepted Answer

SSH for CLI access, SNMPv3 with authPriv, and TACACS+ for authentication.. SSH, SNMPv3 authPriv, and TACACS+ together provide encrypted CLI access, authenticated and encrypted SNMP, and centralized administrator authentication. The other options either use clear-text protocols like Telnet or SNMPv2c, or rely on local authentication, failing the encryption and centralization requirements.

Answer

HTTPS for CLI access, SNMPv3 with noAuthNoPriv, and TACACS+ for authentication.

Answer

SSH for CLI access, SNMPv2c with an ACL, and local authentication.

Answer

Telnet for CLI access, SNMPv2c with a community string, and RADIUS for authentication.