350-401 Security Practice Test 14 — 15 Questions

Question 1

A network security team is implementing Cisco TrustSec in a campus network. The team wants to enforce access based on a tag carried in the packet rather than by IP address, and wants the tag to be propagated across the network without per-hop reclassification. Which Cisco TrustSec component assigns and inserts the Security Group Tag (SGT) at the ingress point?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ingress device performing classification and tagging of the packet.. Cisco TrustSec relies on the ingress device to classify traffic and insert the Security Group Tag, which is then carried inline so downstream devices can enforce policy without reclassification. ISE defines the tags and policies but does not insert them, SXP propagates mappings to non-inline devices, and egress devices enforce rather than assign tags.

Answer

The egress device reclassifying the packet and applying the SGT before forwarding.

Answer

The Cisco Identity Services Engine (ISE) inserting the SGT into every packet.

Answer

The Security Group Tag Exchange Protocol (SXP) on the egress device.

Question 2

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch uplink between two buildings to protect Layer 2 traffic. The team wants to ensure that the link encrypts traffic and that the peer is authenticated before secure communication begins. Which configuration approach meets these requirements?

Accepted Answer

Enable MACsec with MKA using a pre-shared key or 802.1X-derived CAK, and set the switchport to macsec desired or must.. MACsec provides Layer 2 hop-by-hop encryption and integrity using 802.1AE, with the MACsec Key Agreement protocol handling key exchange and peer authentication. On Catalyst 9000, the supported design uses MKA with a connectivity association key from a pre-shared key or 802.1X, plus an interface mode of macsec desired or macsec must to enforce encrypted, authenticated links.

Answer

Enable IPsec transport mode on the switch uplink with a crypto map and IKEv2 pre-shared key.

Answer

Enable port security with sticky MAC addresses and storm control on the uplink to secure the connection.

Answer

Enable 802.1AE without MKA and manually configure static secure associations on both ends.

Question 3

A security team is deploying Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. They notice that after applying a CoPP policy, OSPF adjacency with a directly connected neighbor flaps intermittently. Which action should the engineer take to resolve the issue while maintaining control plane protection?

Accepted Answer

Add a class-map matching OSPF traffic and associate it with a policer that has a higher committed information rate.. CoPP uses class-maps and policy-maps to rate-limit traffic destined to the control plane. If the default policer for routing protocols is too low, OSPF hellos can be dropped, causing adjacency flaps. Creating a dedicated class for OSPF and assigning a policer with a higher committed information rate allows legitimate routing traffic while still protecting the route processor.

Answer

Configure OSPF authentication on the interface to reduce the volume of OSPF packets processed.

Answer

Remove the CoPP policy from the control plane and rely on ACLs on the management interface.

Answer

Change the CoPP policy to use a police rate of 8000 pps for all traffic classes.

Question 4

A network administrator is configuring a Cisco IOS router to terminate a site-to-site IPsec VPN with a remote peer that uses dynamic public IP addressing. The administrator wants the router to accept IKE negotiations from any peer that presents a valid pre-shared key and matches a specific protected subnet. Which configuration element is required to support this?

Accepted Answer

A dynamic crypto map entry referenced by a static crypto map, with the remote peer address set to 0.0.0.0.. To accept IPsec negotiations from a peer whose IP address is not known in advance, the headend uses a dynamic crypto map entry that has no configured peer address. A static crypto map references it, so incoming IKE negotiations can be matched, the peer address learned, and the appropriate transform set and ACL applied to build the tunnel.

Answer

A static crypto map with set peer 0.0.0.0 and a wildcard pre-shared key on the local router.

Answer

An IKEv2 profile with match identity remote address 0.0.0.0 and a certificate map for peer authentication.

Answer

A GRE tunnel with IPsec transport mode protecting the tunnel endpoints and dynamic routing over the tunnel.

Question 5

A network security team is implementing Cisco TrustSec in a campus network. The team wants to enforce access based on a tag carried in the packet rather than by IP address, and wants the tag to be propagated across the network without per-hop reclassification. Which Cisco TrustSec component assigns and inserts the Security Group Tag (SGT) at the ingress point?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SGT Exchange Protocol (SXP) is used to propagate SGTs to devices that do not support hardware-based tagging.. SGTs can be propagated inline using Cisco Metadata on supported hardware, and SXP is used for devices that cannot do inline tagging. These two methods allow flexible deployment in mixed environments. SGACLs can be enforced at various points, not just ingress, and SGTs are not carried in DSCP. SXP does not mandate IPsec.

Answer

SXP requires the use of IPsec for secure communication between peers.

Answer

SGACLs are enforced only on the ingress interface where the SGT is assigned.

Answer

SGTs are always carried in the IP header using the DSCP field.

Question 6

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect against DoS attacks. The router has a management plane that must remain accessible via SSH and SNMP, and a control plane that must process BGP and OSPF routing updates. The administrator applies a CoPP policy that rate-limits all traffic destined to the control plane to 1000 pps, except for traffic from trusted management subnets. After applying the policy, BGP sessions flap intermittently. What is the most likely cause?

Accepted Answer

The CoPP policy is rate-limiting BGP keepalives and updates, causing session timeouts.. CoPP policies must be carefully designed to avoid throttling critical control plane protocols. A blanket rate limit of 1000 pps may be insufficient for BGP, especially if there are many peers or frequent updates. BGP keepalives are sent every 60 seconds by default, but updates and other messages can burst. If the policer drops these, sessions can flap. The correct approach is to create granular class-maps that match BGP and other routing protocols, and assign appropriate rates or exempt them from policing.

Answer

The CoPP policy is applied to the data plane instead of the control plane, causing routing updates to be dropped.

Answer

The CoPP policy is incorrectly classifying SSH traffic as BGP, leading to rate limiting of SSH.

Answer

The CoPP policy is dropping SNMP traps, causing BGP to lose its peer state.

Question 7

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The administrator needs to verify which traffic classes are being matched and how many packets are being dropped by the policy. Which command should be used to display the CoPP policy statistics and class-map information?

Accepted Answer

show policy-map control-plane. The show policy-map control-plane command is specifically designed to display the CoPP policy configuration and per-class statistics, including matched and dropped packets. It allows the administrator to verify which traffic classes are being matched and how many packets are being dropped by the policy. The other commands either show only class-map definitions or interface-level policy statistics, which are not relevant to the control plane.

Answer

show policy-map interface

Answer

show class-map

Answer

show control-plane host open-ports

Question 8

A Cisco Catalyst 9500 switch in a data center is configured with IP Source Guard on an access port where a server is connected. The server has a static IP address of 10.10.10.50 and MAC address 00:11:22:33:44:55. The network administrator has configured a static IP source binding using the command 'ip source binding 0011.2233.4455 vlan 10 10.10.10.50 interface GigabitEthernet1/0/1'. However, the server cannot communicate through the switch. What is the most likely cause?

Accepted Answer

IP Source Guard requires DHCP snooping to be enabled on the VLAN even when static bindings are used.. IP Source Guard uses the DHCP snooping binding table to validate source IP and MAC addresses on a port. Static bindings can be added manually, but DHCP snooping must still be enabled on the VLAN to activate the binding table and allow IP Source Guard to filter traffic. Without DHCP snooping, the static binding is not effective, and the switch may drop legitimate traffic.

Answer

IP Source Guard only works on trunk ports, not access ports.

Answer

The static IP source binding must be configured with the MAC address in the format xx:xx:xx:xx:xx:xx.

Answer

The server must use DHCP to obtain its IP address for IP Source Guard to permit traffic.

Question 9

A network security administrator is configuring a Cisco IOS Zone-Based Firewall on a branch router. The inside zone and outside zone are defined, and the administrator wants to allow inside hosts to initiate sessions to outside servers while preventing outside hosts from initiating sessions to inside hosts. Which configuration accomplishes this?

Accepted Answer

A zone pair from inside to outside with a policy that inspects the relevant traffic, and no zone pair from outside to inside.. Zone-Based Firewall policy is directional and defined by zone pairs. An inside-to-outside zone pair with an inspect action permits inside-initiated sessions and statefully allows return traffic, while the absence of an outside-to-inside zone pair causes traffic initiated from the outside to be dropped by the default inter-zone policy, achieving the required asymmetry.

Answer

A zone pair from outside to inside with an inspect action and no zone pair from inside to outside.

Answer

A single zone pair from inside to outside with a drop action, and a class-map matching return traffic.

Answer

A zone pair from outside to inside with a policy that inspects traffic, plus a zone pair from inside to outside with a pass action.

Question 10

A network security engineer is deploying Cisco TrustSec in a campus network. The engineer wants to implement Security Group Tagging (SGT) and enforce policies based on SGTs. Which two mechanisms can be used to propagate SGTs between network devices? (Choose two.)

Accepted Answer

Native tagging (inline tagging) within the Ethernet frame. SGTs can be propagated between network devices using two primary mechanisms: native tagging (inline tagging) where the SGT is embedded in the Ethernet frame, and SXP where the SGT bindings are exchanged via a control-plane protocol. These methods allow enforcement points to apply Security Group ACLs based on the source SGT.

Answer

RADIUS Change of Authorization (CoA) with SGT attributes

Answer

Inline tagging using Cisco Metadata (CMD) in the Ethernet frame

Answer

IPsec Encapsulating Security Payload (ESP) with SGT extension

Question 11

A network administrator is deploying a Cisco Wireless LAN Controller (WLC) running AireOS in a branch office. The security policy requires that guest wireless clients be isolated from internal corporate clients and that guest traffic be tunneled back to a DMZ interface on the WLC. Which WLAN configuration element should the administrator use to meet these requirements?

Accepted Answer

Configure a dynamic interface mapped to the guest VLAN and assign it to the guest WLAN.. Guest wireless traffic on an AireOS WLC is isolated and tunneled by mapping the guest WLAN to a dynamic interface whose VLAN resides in a DMZ. The dynamic interface defines the VLAN and IP subnet for that WLAN, and the WLC forwards guest client traffic through that interface rather than the management interface. This design keeps guest clients off corporate VLANs and allows a firewall to enforce policy in the DMZ.

Answer

Configure the guest WLAN with AP group VLAN tagging and enable FlexConnect local switching.

Answer

Configure the guest WLAN to use the management interface with a separate SSID.

Answer

Configure the guest WLAN to use the virtual interface and enable Web Auth.

Question 12

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to secure wireless client traffic. The requirement is to encrypt all wireless traffic between the client and the access point using a pre-shared key, without requiring a separate authentication server. Which security policy should the administrator configure on the WLC?

Accepted Answer

WPA2 Personal with AES. WPA2 Personal with AES uses a pre-shared key for authentication and AES for encryption, providing strong security without the need for an external RADIUS server. This aligns with the requirement to encrypt traffic using a PSK and no separate authentication server. Enterprise modes require a server, and open authentication lacks encryption.

Answer

WPA2 Enterprise with 802.1X

Answer

Open authentication with Web Policy

Answer

WPA3 Enterprise with 192-bit mode

Question 13

A network engineer is deploying Control Plane Policing on a Cisco IOS-XE router that runs OSPF, BGP, and SSH management. The engineer wants to rate-limit routing protocol traffic while ensuring that SSH management traffic is never dropped, even during a routing protocol flood. The router uses a single physical interface for all control plane traffic. Which CoPP design approach best meets these requirements?

Accepted Answer

Create separate class-maps for OSPF, BGP, and SSH, then apply individual policers to each class in the policy-map, with SSH assigned a higher rate or set to conform-action transmit.. Separate class-maps for OSPF, BGP, and SSH allow individual policing actions. Assigning SSH a higher rate or conform-action transmit ensures management access is preserved during routing protocol floods. This granular CoPP design protects both routing stability and administrative access, which is the core goal of control plane policing.

Answer

Use a single class-map for OSPF and BGP, and rely on SSH being exempt because it is TCP-based and not subject to CoPP.

Answer

Configure CoPP only on the management interface and leave the data interfaces unprotected.

Answer

Apply a single class-map matching all control plane traffic and set a single policer with a high rate limit.

Question 14

A network administrator is deploying a Cisco Catalyst 9300 switch stack at the access layer. The security policy requires that when an unauthorized device connects to an access port, the port must immediately stop forwarding traffic, generate a syslog message, and increment the violation counter, while allowing the administrator to manually re-enable the port after investigation. Which port security violation mode should be configured?

Accepted Answer

shutdown. Port security shutdown mode is the only violation action that immediately err-disables the interface, halts forwarding, logs a syslog message, increments the violation counter, and requires manual recovery. Protect and restrict leave the port up, and err-disable recovery is a global timer feature rather than a violation mode. The stated need for manual re-enablement after investigation confirms shutdown is correct.

Answer

err-disable recovery

Answer

protect

Answer

restrict

Question 15

A network administrator is deploying a Cisco Catalyst 9300 switch stack at the access layer. The security policy requires that when an endpoint device is connected to a port and later replaced by a different device, the port must automatically learn the new MAC address without administrative intervention, but a violation must generate a syslog message and increment a counter. The administrator configures the interface with the command 'switchport port-security violation restrict'. Which additional command is required to meet the requirement that the new device is learned automatically?

Accepted Answer

switchport port-security mac-address sticky. Sticky learning allows the switch to dynamically learn MAC addresses and add them to the running configuration, so when a device is replaced, the new MAC can be learned without manual reconfiguration. Combining sticky with violation restrict ensures a syslog and counter increment on violation. Maximum, static MAC, and aging do not provide the required automatic learning behavior.

Answer

switchport port-security aging time 2

Answer

switchport port-security maximum 1

Answer

switchport port-security mac-address 0011.2233.4455