350-401 Security Practice Test 13 — 15 Questions

Question 1

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The requirement is that the VPN must support dynamic routing protocol updates across the tunnel and allow multicast traffic between the sites. Which IPsec configuration mode should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GRE over IPsec using a tunnel interface protected by IPsec. GRE over IPsec creates a virtual tunnel interface that supports multicast and broadcast, enabling dynamic routing protocols to run across the VPN. IPsec then protects the GRE-encapsulated packets. This design satisfies both the routing update and multicast requirements that standard IPsec tunnel mode with a crypto map cannot deliver.

Answer

IPsec tunnel mode with a crypto map applied to the physical interface

Answer

IPsec transport mode with an access list matching only protocol 47

Answer

DMVPN phase 1 with only mGRE and no IPsec protection

Question 2

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The requirement is that the VPN must support dynamic routing protocol updates across the tunnel and allow multicast traffic between the sites. Which IPsec configuration mode should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure 'webvpn' with 'enable' and set up a context with a gateway and a port-forward or URL list.. Clientless SSL VPN on Cisco IOS is configured using the 'webvpn' feature. Enabling 'webvpn' and creating a context with a gateway, along with URL lists or port-forwarding, allows users to access internal web applications through a browser without a client. Other options either require a client or do not provide VPN functionality.

Answer

Configure 'ip http server' and 'ip http secure-server' to allow web access to internal applications.

Answer

Configure 'crypto ssl server' and 'crypto ssl client' policies for the SSL VPN.

Answer

Configure 'crypto isakmp policy' and 'crypto ipsec transform-set' for remote access.

Question 3

An engineer is configuring 802.1X on a Cisco Catalyst switch port where a PC is connected. The requirement is that if the authentication server becomes unreachable, the port should still allow the PC to send traffic in a restricted VLAN rather than being shut down. Which configuration meets this requirement?

Accepted Answer

authentication event server dead action authorize vlan 999. When RADIUS becomes unreachable, the switch needs an explicit policy for the resulting dead-server condition. The authentication event server dead action authorize vlan command places the port into a designated restricted VLAN, allowing limited connectivity while the outage persists. Other commands address failed credentials, host count, or pre-authentication access, none of which provide the required restricted-VLAN fallback.

Answer

authentication open

Answer

authentication host-mode multi-auth

Answer

authentication event fail action authorize vlan 999

Question 4

A security architect is designing a network where endpoint identity and group membership must follow users and devices across both wired and wireless networks, and policy enforcement must be consistent regardless of VLAN or IP subnet. Which Cisco solution provides this identity-based, group-based access control?

Accepted Answer

Cisco TrustSec with Security Group Tags and Cisco ISE. Cisco TrustSec uses Security Group Tags derived from identity and group information, typically populated by Cisco ISE, to enforce policy independent of IP addresses and VLANs. Because the tags travel with the traffic, consistent access control is maintained across wired and wireless networks, which matches the architect's requirements.

Answer

Cisco AnyConnect with posture assessment only

Answer

Cisco Umbrella with DNS-layer security and SIG

Answer

Cisco Stealthwatch with NetFlow analytics

Question 5

A network security architect is designing a Zero Trust architecture for a campus network using Cisco Identity Services Engine (ISE) and Cisco TrustSec. The requirement is to enforce segmentation based on user identity and device posture, and to apply policy dynamically as users move between wired and wireless access points. Which Cisco TrustSec component is responsible for tagging packets with a Security Group Tag (SGT) at the access layer?

Accepted Answer

The access layer switch or wireless controller that supports Cisco TrustSec.. In Cisco TrustSec, the access layer device performs classification and tagging by inserting the SGT into the packet after authentication and authorization. ISE nodes define and evaluate policy, but they do not tag packets. This design allows dynamic segmentation to follow users as they move between wired and wireless access points.

Answer

The Policy Administration Node (PAN) in Cisco ISE.

Answer

The Policy Enforcement Node (PEN) in Cisco ISE.

Answer

The Cisco DNA Center appliance.

Question 6

A security architect is evaluating MACsec on a Cisco Catalyst switch uplink between two buildings. The requirement is to encrypt all Layer 2 traffic on the link with minimal configuration and use a standards-based key agreement. Which statement correctly describes how MACsec should be deployed on this link?

Accepted Answer

MACsec must be configured with a pre-shared CAK/CKN pair on both switches, and MKA uses this pair to derive session keys.. MACsec secures point-to-point Ethernet links using MKA to negotiate encryption keys. A static CAK and CKN configured on both ends lets MKA derive the SAK that encrypts each frame, requiring no external authentication server. This is the standard, minimal-configuration approach for a switch uplink, and MACsec encrypts the full Ethernet frame, not just IP payloads.

Answer

MACsec can be enabled only on routed ports and is incompatible with switch-to-switch trunk links carrying multiple VLANs.

Answer

MACsec encrypts only the payload of IP packets, leaving the Ethernet header visible for switching.

Answer

MACsec requires 802.1X EAP-TLS authentication of both switches before any frame encryption can occur.

Question 7

A network security engineer is configuring 802.1X on a Cisco Catalyst switch with Cisco ISE as the RADIUS server. The switch is configured with 'dot1x system-auth-control' and the interface is set to 'authentication port-control auto'. The engineer wants to allow a printer that does not support 802.1X to connect to the network by using MAC Authentication Bypass (MAB). Which additional configuration is required on the switch interface to enable MAB?

Accepted Answer

Configure 'mab' under the interface configuration mode.. MAC Authentication Bypass (MAB) is enabled on a switch interface with the 'mab' command. This allows the switch to use the connecting device's MAC address as credentials for RADIUS authentication when 802.1X is not supported. The other commands either control host mode, set the authenticator role, or define authentication order, but none enable MAB.

Answer

Configure 'authentication host-mode multi-auth' under the interface configuration mode.

Answer

Configure 'dot1x pae authenticator' under the interface configuration mode.

Answer

Configure 'authentication order dot1x mab' under the interface configuration mode.

Question 8

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The requirement is that the VPN must support dynamic routing protocol updates across the tunnel and allow multicast traffic between the sites. Which IPsec configuration mode should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

authentication rsa-sig. In an ISAKMP policy for IKEv1, the 'authentication rsa-sig' command enables RSA signature authentication, which relies on digital certificates. The other options are incorrect: pre-share uses pre-shared keys, rsa-encr uses encrypted nonces, and eap is used for EAP authentication, typically in IKEv2. The policy requires certificate-based authentication, so rsa-sig is the correct command.

Answer

authentication rsa-encr

Answer

authentication eap

Answer

authentication pre-share

Question 9

A network administrator is deploying 802.1X on Cisco Catalyst access switches with Cisco ISE as the RADIUS server. The design requires that devices failing authentication be placed into a restricted VLAN, and that IP phones be authenticated before the attached PC. Which two features must be configured to meet these requirements? (Choose two.)

Accepted Answer

Configure an authentication failure VLAN using the authentication event fail action authorize vlan command.. Placing failed authentications into a restricted VLAN is accomplished with the authentication event fail action authorize vlan command, which defines failure handling. Supporting an IP phone and a PC on one port with independent authentication requires multi-domain authentication, which creates separate voice and data sessions. Together these two features meet both design requirements.

Answer

Enable port security with sticky MAC addresses on the access port.

Answer

Configure a guest VLAN on the switch port for hosts that do not support 802.1X.

Answer

Configure MAC Authentication Bypass (MAB) as the primary authentication method instead of 802.1X.

Question 10

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The requirement is that the VPN must support dynamic routing protocol updates across the tunnel and allow multicast traffic between the sites. Which IPsec configuration mode should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IKEv2 profile is not referencing the correct trustpoint for certificate authentication.. For IKEv2 certificate-based authentication, the IKEv2 profile must reference a trustpoint that contains the router's identity certificate and the CA certificate to validate peer certificates. If the trustpoint is missing or incorrect, the router cannot authenticate the client's certificate, resulting in failure. Ensuring the correct trustpoint is referenced and that the CA chain is complete resolves the issue.

Answer

The pre-shared key is not configured on the IKEv2 profile.

Answer

The remote clients are using IKEv1 instead of IKEv2.

Answer

The router's certificate has expired.

Question 11

A network engineer is configuring IPsec VPN on a Cisco IOS XE router. The requirement is to protect traffic between two sites using ESP with AES-256 encryption and SHA-256 authentication, and to ensure that the tunnel is rekeyed every 3600 seconds. Which configuration element directly controls the rekey interval?

Accepted Answer

crypto ipsec security-association lifetime seconds 3600. The IPsec SA lifetime, configured with 'crypto ipsec security-association lifetime seconds 3600', determines when the data tunnel is rekeyed. This is distinct from the IKE SA lifetime, which governs the control plane. The transform-set defines the algorithms (AES-256, SHA-256), the crypto map ties the policy together, and the pre-shared key authenticates the peers, but only the security-association lifetime command controls the rekey interval.

Answer

crypto ipsec transform-set <name> esp-aes 256 esp-sha256-hmac

Answer

crypto map <name> 10 ipsec-isakmp

Answer

crypto isakmp key address

Question 12

A network engineer is configuring a Cisco Catalyst switch to mitigate VLAN hopping attacks. The switch has multiple access ports assigned to VLAN 10 and trunk ports connecting to other switches. The engineer wants to ensure that an attacker cannot send double-tagged frames to hop into another VLAN. Which action should the engineer take on all access ports?

Accepted Answer

Configure the access ports with the switchport mode access command and disable Dynamic Trunking Protocol (DTP) on them.. To mitigate VLAN hopping, access ports should be explicitly configured as access ports and DTP should be disabled to prevent trunk negotiation. Attackers can use DTP to negotiate a trunk and then send tagged frames to access other VLANs. Disabling DTP with 'switchport nonegotiate' on access ports prevents this. The other options either do not address the attack or are misconfigurations.

Answer

Configure the access ports with the switchport mode access command and enable BPDU Guard.

Answer

Configure the access ports with the switchport mode trunk command and set the native VLAN to an unused VLAN.

Answer

Configure the access ports with the switchport mode access command and assign them to the native VLAN.

Question 13

A network engineer needs to provide secure remote-access VPN connectivity for employees using Cisco AnyConnect. The requirement is to use digital certificates issued by the corporate PKI for both server and client authentication. Which component must be configured on the Cisco ASA to validate client certificates presented during the VPN session?

Accepted Answer

A trustpoint containing the CA certificate that signed the client certificates.. Certificate-based client authentication requires the ASA to trust the CA that issued the client certificates. Configuring a trustpoint with the CA certificate allows the ASA to validate the chain presented by AnyConnect. Pre-shared keys, local user accounts, and LDAP attribute maps do not perform certificate validation and therefore cannot fulfill the PKI-based authentication requirement.

Answer

A local user account with the privilege level 15 assigned.

Answer

An IKEv2 pre-shared key configured under the tunnel group.

Answer

An LDAP attribute map for group policy assignment.

Question 14

A network administrator is deploying a Cisco Catalyst switch with DHCP snooping. The switch is configured with DHCP snooping globally and on VLAN 10. A DHCP server is connected to GigabitEthernet1/0/5, and client devices are connected to GigabitEthernet1/0/6 through 1/0/20. The administrator notices that DHCP offers from the server are being dropped. What is the most likely cause?

Accepted Answer

The DHCP server port is not configured as trusted.. DHCP snooping treats all ports as untrusted by default and drops DHCP server messages received on untrusted ports. To allow legitimate DHCP server responses, the port connected to the DHCP server must be configured with 'ip dhcp snooping trust'. In this scenario, the server port GigabitEthernet1/0/5 is untrusted, so offers are dropped. Trusting the server port resolves the issue while maintaining protection against rogue DHCP servers on client ports.

Answer

The DHCP snooping database agent is not configured.

Answer

The client ports are configured as trusted.

Answer

DHCP snooping is not enabled on the VLAN of the client ports.

Question 15

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The engineer applies a CoPP policy-map to the control plane with a class that matches BGP traffic and sets police rate 8000 conform-action transmit exceed-action drop. After applying the policy, BGP sessions intermittently flap during route convergence. Which action should the engineer take to resolve the issue while maintaining control plane protection?

Accepted Answer

Increase the police rate for the BGP class or change the exceed-action to transmit, after verifying the offered rate.. BGP session flapping immediately after applying a policer that drops exceeded traffic points to legitimate BGP control packets being dropped because the configured rate is too low for convergence bursts. The correct remediation is to right-size the policer for the BGP class, either by raising the rate or by permitting excess traffic, after confirming the actual offered rate from the control plane.

Answer

Apply the CoPP policy to all router interfaces as an input service policy instead of to the control plane.

Answer

Remove the CoPP policy from the control plane interface and rely on interface ACLs instead.

Answer

Change the CoPP policy to use priority queuing instead of policing for the BGP class.