350-401 Security Practice Test 15 — 15 Questions

Question 1

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs BGP, OSPF, SSH management, and SNMP. After applying a CoPP policy that rate-limits all control-plane traffic to 1000 pps, BGP sessions flap and OSPF adjacencies reset during peak traffic. Which action should the engineer take to resolve the problem while maintaining control-plane protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create separate class-maps for BGP, OSPF, SSH, and SNMP, and apply protocol-specific rate limits within the policy-map.. CoPP uses a modular QoS CLI (MQC) structure with class-maps to identify traffic types and a policy-map to apply policers per class. A single policer for all control-plane traffic causes legitimate routing protocol updates to compete with management and monitoring traffic, leading to drops and session resets. The correct solution is to define separate class-maps for BGP, OSPF, SSH, and SNMP, then assign differentiated rate limits in the policy-map. This preserves control-plane protection while ensuring routing protocols receive adequate bandwidth.

Answer

Enable Control Plane Protection (CPPr) with the aggregate option to automatically prioritize routing protocols.

Answer

Increase the global CoPP rate limit to 5000 pps to accommodate all control-plane protocols.

Answer

Remove the CoPP policy from the control plane and rely on QoS policies on data interfaces instead.

Question 2

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive control-plane traffic. The engineer wants to rate-limit ARP and DHCP snooping-related traffic destined to the control plane while allowing routing protocol traffic without restriction. Which CoPP component must the engineer configure to classify and match this traffic before applying the policy?

Accepted Answer

A class map that matches traffic using ACLs and/or match protocol commands.. CoPP relies on the modular QoS CLI, where class maps classify control-plane traffic, policy maps apply policing actions, and the service-policy is attached to the control-plane interface. To rate-limit ARP and DHCP snooping traffic while leaving routing protocols unrestricted, the engineer must create class maps that match those specific protocols and reference them in a policy map, which is then applied to the control plane.

Answer

A policy map that references the control-plane host and matches all IP traffic by default.

Answer

An access list applied directly to the control-plane interface with the ip access-group command.

Answer

A route map applied to the control-plane interface with the service-policy command.

Question 3

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive SSH traffic. The engineer wants to classify SSH traffic destined to the router itself and apply a policer to it. Which mechanism is used by CoPP to classify traffic before the policer is applied?

Accepted Answer

Class maps that match on the control-plane interface and access control lists. CoPP is built on the modular QoS CLI, where class maps identify control-plane traffic using the control-plane keyword combined with ACLs or protocol matches. A policy map then applies a policer to those classes, and the policy is attached to the control plane with service-policy. This layered approach lets administrators rate-limit SSH and other punted traffic without affecting transit forwarding.

Answer

Policy maps that match on the ingress data-plane interface

Answer

Route maps that match on the management VRF and next-hop address

Answer

ACLs applied directly to the VTY lines with the access-class command

Question 4

A network administrator is configuring IPsec VPN on a Cisco IOS router. The administrator needs to ensure that the VPN traffic is encrypted and authenticated. Which two protocols are used in IPsec to provide encryption and authentication? (Choose two.)

Accepted Answer

AH. ESP and AH are the two core IPsec protocols. ESP provides encryption and optional authentication, while AH provides authentication and integrity but no encryption. Together or separately, they can secure VPN traffic. The other options are tunneling or security protocols not part of IPsec's native encryption and authentication mechanisms.

Answer

L2TP

Answer

SSL

Answer

GRE

Question 5

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor. The engineer wants to rate-limit ICMP echo requests destined to the router itself while ensuring that transit traffic passing through the router is not affected. Which classification approach should the engineer use in the CoPP policy?

Accepted Answer

Use a class map with match access-group referencing an ACL that permits ICMP echo to the router's interface addresses, then attach the policy map to the control-plane interface.. CoPP works by attaching a service policy to the control-plane interface, which only processes traffic destined to the route processor. Classifying ICMP echo requests to the router's own addresses and policing them there protects the CPU without affecting transit traffic. Interface-level policies or ACLs either affect transit traffic or block rather than rate-limit, so the control-plane attachment with an ACL-based class map is correct.

Answer

Apply a policy map with police rate to the management VRF interface only.

Answer

Match ICMP in a class map applied to the ingress interface with the service-policy command.

Answer

Configure an ingress ACL on all interfaces that denies ICMP echo requests to the router.

Question 6

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The engineer wants to ensure that BGP keepalives are not dropped during a control plane overload, while still rate-limiting SSH and SNMP. The engineer creates a class-map matching BGP, SSH, and SNMP traffic, then applies a policy-map with a single policer of 1000 pps to that class. After applying the service-policy to the control plane, BGP sessions flap during high CPU utilization. What is the most likely cause?

Accepted Answer

The policer rate is too low for BGP keepalives, and all matched traffic is treated equally.. CoPP requires granular classification to protect critical protocols. When BGP, SSH, and SNMP are matched in the same class and policed together, BGP keepalives compete with other traffic and may be dropped during high CPU. BGP should be placed in its own class with a higher rate or priority to prevent flapping. The single policer approach lacks the necessary differentiation.

Answer

CoPP cannot be applied to BGP traffic; it only supports management protocols like SSH and SNMP.

Answer

The service-policy must be applied to the data plane instead of the control plane for BGP to be protected.

Answer

The policer should be configured with 'police cir' instead of 'police pps' to properly rate-limit BGP.

Question 7

A security architect is designing a Cisco TrustSec deployment for a campus network. The architect needs to ensure that security group tags (SGTs) are propagated across a Layer 2 trunk between two Catalyst switches that do not support SGACL enforcement. Which technology should be used to carry SGT information inline within the Ethernet frame?

Accepted Answer

Cisco Meta Data (CMD). Cisco Meta Data (CMD) is the inline tagging mechanism in Cisco TrustSec that inserts the SGT into the Ethernet frame. It enables SGT propagation across switches that may not enforce SGACLs, allowing downstream devices to apply policies. This satisfies the requirement for inline SGT carriage over a Layer 2 trunk.

Answer

MACsec

Answer

SXP

Answer

802.1Q tunneling (QinQ)

Question 8

A network administrator is configuring a site-to-site VPN between two Cisco IOS routers using IPsec. The security policy requires that the VPN use IKEv2 with certificate-based authentication. Which command must be configured on both routers to specify the trustpoint that will be used for IKEv2 authentication?

Accepted Answer

crypto ikev2 profile and then pki trustpoint under the profile.. IKEv2 certificate-based authentication requires a PKI trustpoint to be associated with the IKEv2 profile. The 'pki trustpoint' command under the IKEv2 profile binds the trustpoint, enabling the router to use certificates for authentication. This must be configured on both peers. Other commands like 'match certificate' are used for certificate map matching, and keyrings are for PSK authentication, neither of which satisfies the certificate requirement.

Answer

crypto ikev2 proposal <name> and then encryption aes-cbc-256 under the proposal.

Answer

crypto ikev2 profile and then match certificate under the profile.

Answer

crypto ikev2 keyring and then pre-shared-key under the keyring.

Question 9

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The design requires that only traffic from specific subnets be encrypted and that the routers use a preshared key for authentication. Which combination of configuration elements must the administrator define to match the interesting traffic and establish the tunnel?

Accepted Answer

An ACL defining interesting traffic, an ISAKMP policy, a preshared key, and a crypto map applied to the WAN interface.. A Cisco IOS site-to-site IPsec VPN requires an extended ACL to identify interesting traffic, an ISAKMP policy to define Phase 1 parameters, a preshared key for peer authentication, and a crypto map that ties the ACL and transform set together and is applied to the WAN interface. All of these elements work together to negotiate and encrypt traffic between the peers.

Answer

An ISAKMP policy, a preshared key, and a crypto map applied to the WAN interface without an ACL for interesting traffic.

Answer

A route map defining interesting traffic, a crypto map, and a transform set applied to the LAN interface.

Answer

An ACL defining interesting traffic, a transform set, and a crypto map applied to the LAN interface without an ISAKMP policy.

Question 10

A network security team is deploying MACsec on a Cisco Catalyst 9300 switch connecting to a partner's Catalyst 9200 over a metro Ethernet link. The team wants to encrypt all traffic on the link and ensure that the switches mutually authenticate before any frames are forwarded. Which IEEE standard defines the key agreement and encryption used by MACsec, and which component performs the key exchange?

Accepted Answer

IEEE 802.1AE for encryption and IEEE 802.1X-2010 with MKA for key agreement. MACsec encryption is standardized in IEEE 802.1AE, while the key agreement and mutual authentication between peers are handled by MACsec Key Agreement as defined in IEEE 802.1X-2010. Together they ensure that the Catalyst 9300 and 9200 mutually authenticate and encrypt every frame before any user traffic is forwarded across the metro Ethernet link.

Answer

IEEE 802.1AE for encryption and IKEv2 for key agreement

Answer

IEEE 802.1X for encryption and IEEE 802.1AE for key agreement

Answer

IEEE 802.1Q for tagging and IEEE 802.1AE for key agreement

Question 11

A network security team is hardening a Cisco IOS XE router that terminates IPsec tunnels to remote branch offices. The team wants to use zone-based firewall (ZBFW) to inspect traffic between the inside, outside, and VPN zones. Which two statements correctly describe zone-based firewall behavior on this platform? (Choose two.)

Accepted Answer

Traffic between two interfaces assigned to the same zone is implicitly permitted and not inspected by the zone policy.. ZBFW permits intra-zone traffic without inspection and denies inter-zone traffic by default unless a zone pair with a policy exists. Zone pairs are unidirectional, inspection handles return traffic for established sessions, and unassigned interfaces use classic ACL behavior rather than joining the self zone. These behaviors drive how the branch router's inside, outside, and VPN zones must be paired and inspected.

Answer

Applying an inspect action to a zone pair automatically creates a reverse zone pair for return traffic.

Answer

Interfaces not assigned to any zone are treated as members of the self zone and inspected.

Answer

A zone pair must be configured bidirectionally; a single zone pair covers traffic in both directions automatically.

Question 12

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch series to secure Layer 2 traffic between two switches. Which two statements about MACsec operation are true? (Choose two.)

Accepted Answer

MACsec uses MKA (MACsec Key Agreement) to negotiate session keys between peers.. MACsec is an IEEE 802.1AE standard that provides hop-by-hop encryption and integrity on Ethernet links. It uses GCM-AES-128 for encryption and MKA for key agreement. It does not encrypt MAC addresses, and it does not use IKEv2. It is deployed on switchports, not routed interfaces. Therefore, the two true statements are that it provides hop-by-hop encryption with GCM-AES-128 and that it uses MKA to negotiate session keys.

Answer

MACsec encrypts the entire Ethernet frame including the source and destination MAC addresses.

Answer

MACsec requires the use of IKEv2 to establish the secure channel between switches.

Answer

MACsec can only be deployed on routed interfaces, not on switchports.

Question 13

A network engineer is configuring MACsec on a point-to-point link between two Cisco Catalyst switches to provide Layer 2 encryption. The engineer wants to use a pre-shared key for authentication and ensure that the key is rotated periodically. Which MACsec component must be configured to specify the pre-shared key and the key rotation timer?

Accepted Answer

A MACsec key chain with a key string and a lifetime configured under the interface.. MACsec on Cisco switches uses a key chain to store the connectivity association key and its lifetime, which controls key rotation. The key chain is referenced under the interface with the mka key-chain command. This configuration provides the preshared key and periodic rotation required by the scenario, unlike IPsec mechanisms such as IKEv2 or crypto maps.

Answer

An IKEv2 profile with a preshared key and a rekey timer applied to the interface.

Answer

A RADIUS server configuration with a shared secret and a session timeout applied to the interface.

Answer

A crypto map with a preshared key and a lifetime applied to the switch port.

Question 14

A network engineer is configuring a Zone-Based Firewall on a Cisco IOS XE router. The design requires that traffic from the inside zone to the outside zone be inspected, that return traffic be permitted, and that traffic from the outside zone to the inside zone be dropped unless it matches an existing session. Which configuration element is required to achieve this behavior?

Accepted Answer

A zone pair with a service policy that applies inspect to inside-to-outside traffic. Zone-Based Firewall policies are applied to zone pairs and are directional. Inspecting traffic from the inside zone to the outside zone creates session state, which allows return traffic from outside to inside automatically. Without the inspect action on that zone pair, the default inter-zone deny would block return traffic, so the inspect policy is the essential element.

Answer

A class map that matches on the outside interface and an ACL that permits established sessions

Answer

A policy map with the pass action applied to the outside-to-inside zone pair

Answer

A zone pair with a service policy that applies drop to the outside-to-inside zone pair

Question 15

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS-XE router that also runs OSPF, BGP, and SSH management. The engineer needs to protect the control plane while ensuring that routing protocol traffic and management sessions are not disrupted. Which CoPP design approach best meets these requirements?

Accepted Answer

Create multiple granular classes (for example, routing protocols, management, and exception traffic) and apply class-specific policers, while ensuring control plane traffic is not dropped by the default class.. CoPP protects the route processor by classifying and policing traffic destined to the control plane. Granular classes allow routing protocols and management traffic to receive enough bandwidth, while the default class should be configured not to drop so that legitimate unclassified traffic survives. This design balances protection with operational stability for OSPF, BGP, and SSH.

Answer

Configure a CoPP policy that only rate-limits ICMP and Telnet, leaving all other control plane traffic unclassified and unpolished.

Answer

Apply a single CoPP policy that classifies all control plane traffic into one class and rate-limits it to a conservative value.

Answer

Apply the CoPP policy to all data plane interfaces in the inbound direction, which will indirectly protect the control plane.