350-401 Security Practice Test 16 — 15 Questions

Question 1

A network administrator needs to securely manage a Cisco Catalyst switch remotely. The requirement is to encrypt all management traffic, including username and password, between the administrator's workstation and the switch. Which management protocol should be enabled on the switch to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSH version 2. SSH version 2 encrypts the full management session, protecting credentials and commands in transit, which is exactly what the policy requires. Telnet and HTTP send data in cleartext, and SNMPv2c is neither encrypted nor intended for interactive CLI management. Enabling SSHv2 and disabling insecure protocols satisfies the encrypted remote administration requirement.

Answer

Telnet

Answer

HTTP

Answer

SNMPv2c

Question 2

An engineer must secure the management plane of a Cisco IOS XE router so that only SSH version 2 is accepted for remote administration, while Telnet and SSHv1 are rejected. Which set of commands accomplishes this?

Accepted Answer

line vty 0 4
 transport input ssh
ip ssh version 2. Restricting VTY lines with 'transport input ssh' eliminates Telnet access, and 'ip ssh version 2' forces the SSH server to negotiate only version 2. Used together under the correct configuration modes, they enforce SSHv2-only remote management. Other combinations either leave Telnet enabled, use invalid syntax, or fail to restrict the transport protocol.

Answer

ip ssh server algorithm encryption aes128-ctr aes256-ctr
line vty 0 4
 transport input all

Answer

line vty 0 4
 transport input telnet ssh
ip ssh version 2

Answer

line vty 0 4
 transport input ssh
no ip ssh version 1

Question 3

A network security engineer is configuring Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. The engineer wants to rate-limit SSH traffic to 100 kbps with a burst of 8000 bytes, and ensure that any traffic exceeding the rate is dropped. The engineer applies the following policy:

policy-map COPP-POLICY
 class SSH-CLASS
  police 100000 8000 exceed-action drop

After applying the service-policy to the control plane, the engineer notices that SSH sessions intermittently disconnect during large file transfers over SCP. What is the most likely cause?

Accepted Answer

The police rate is configured in bits per second, but the burst size is too small for SCP transfers, causing packets to be dropped.. The police command uses bits per second for the rate and bytes for the burst. A 100 kbps rate with an 8000-byte burst is too restrictive for SCP file transfers, which generate bursts of SSH packets larger than 8000 bytes. The policer drops excess packets, causing SSH sessions to disconnect intermittently. Increasing the burst size or rate would resolve the problem.

Answer

Control Plane Policing does not support the exceed-action drop keyword; the correct action is transmit.

Answer

The service-policy must be applied to the control plane with the input keyword, otherwise SSH traffic is not policed.

Answer

The police rate is configured in kilobits per second, but the burst size is in kilobytes, causing a mismatch that drops all SSH packets.

Question 4

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and NTP. The requirement is to protect the route processor from excessive BGP keepalive traffic while still allowing all legitimate BGP peering. Which CoPP module should the administrator use to classify and police this traffic before the policy is applied to the control plane?

Accepted Answer

A class map that matches BGP traffic using an ACL or NBAR, referenced by a policy map, which is then applied with the service-policy command under control-plane configuration mode.. Control Plane Policing requires a modular QoS configuration: class maps to identify traffic, a policy map to define policer actions, and the service-policy command applied under control-plane configuration mode. This structure allows BGP keepalives to be matched and policed while other traffic is handled separately, directly protecting the route processor as the scenario requires.

Answer

A route map applied inbound on the BGP neighbor session that sets a lower precedence for keepalive packets.

Answer

A class map referenced by a policy map that is applied outbound on the WAN interface toward the BGP peer.

Answer

An access list applied directly to the physical interface facing the BGP peer using the ip access-group command.

Question 5

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive CPU utilization due to malicious traffic. The engineer wants to ensure that BGP, SSH, and SNMP traffic are rate-limited appropriately. After applying the CoPP policy, the engineer notices that BGP sessions are flapping. Which action should the engineer take to resolve the issue while maintaining protection?

Accepted Answer

Increase the rate limit for the class-map that matches BGP traffic.. BGP session flapping after applying CoPP typically occurs because the policer is dropping legitimate BGP control packets. The correct fix is to increase the rate limit for the BGP traffic class so that keepalives and updates are not dropped, while still protecting the control plane from excessive traffic. Other options either do not address the rate limit or suggest inappropriate mechanisms.

Answer

Remove the CoPP policy from the control plane and apply it only to the data plane.

Answer

Configure a separate class-map for BGP and assign it to a higher priority queue in the policy-map.

Answer

Enable BGP graceful restart to prevent session flapping during CoPP drops.

Question 6

A network administrator is configuring a Cisco IOS zone-based firewall (ZBFW) on a router that connects a LAN zone to an Internet zone. The administrator wants to allow outbound HTTP and HTTPS from the LAN to the Internet while blocking all other outbound traffic, and to allow return traffic for established sessions. Which two configuration elements are required to accomplish this? (Choose two.)

Accepted Answer

A class map that matches HTTP and HTTPS traffic and a policy map that applies an inspect action.. Zone-based firewall on Cisco IOS requires class maps to identify traffic and policy maps to apply actions like inspect. The policy map must be applied to a zone pair that defines the direction of traffic, in this case LAN to Internet. The inspect action allows return traffic for established sessions, and any traffic not explicitly permitted is implicitly denied by the zone pair policy.

Answer

A NAT configuration that translates LAN addresses to the Internet-facing interface address.

Answer

A parameter map that defines inspection parameters for HTTP and HTTPS.

Answer

An extended ACL applied inbound on the LAN interface to permit HTTP and HTTPS.

Question 7

A network engineer is configuring a Cisco ASA firewall with a site-to-site VPN to a remote peer. The engineer wants to ensure that only specific subnets are encrypted and that traffic from other subnets is not sent through the tunnel. Which configuration element defines the traffic that will be protected by the VPN?

Accepted Answer

The crypto ACL (access list) referenced in the crypto map.. In a site-to-site VPN on Cisco ASA, the crypto ACL (also called the interesting traffic ACL) defines which source and destination subnets are encrypted and sent through the tunnel. Only traffic matching this ACL is protected; other traffic is sent in clear text or dropped based on interface ACLs. The tunnel-group, group-policy, and IKEv2 proposals handle peer authentication and encryption parameters, but not traffic selection.

Answer

The IKEv2 proposal and policy settings.

Answer

The tunnel-group configuration for the remote peer.

Answer

The group-policy applied to the VPN connection.

Question 8

A network administrator is deploying 802.1X on Cisco Catalyst switches with Cisco ISE as the RADIUS server. The administrator wants to allow devices that do not support 802.1X, such as printers, to connect to the network. Which feature should be configured on the switch ports to support these devices while maintaining security?

Accepted Answer

Enable MAC Authentication Bypass (MAB) on the switch ports so that the MAC address of non-802.1X devices is sent to ISE for authentication.. MAC Authentication Bypass allows devices that lack 802.1X supplicant software to be authenticated by their MAC address against Cisco ISE. The switch sends the MAC address as both username and password, and ISE applies the appropriate authorization policy. This enables printers and similar devices to connect while still enforcing centralized access control.

Answer

Configure the switch ports as 802.1X supplicants so they can authenticate on behalf of connected devices.

Answer

Implement 802.1X with EAP-TLS and install certificates on the printers.

Answer

Disable 802.1X on the ports and rely on port security to restrict access based on MAC addresses.

Question 9

A network security team is hardening a Cisco IOS-XE router that terminates IPsec VPN tunnels. They want to protect the control plane from CPU-intensive IKE and management traffic without dropping legitimate tunnel establishment packets. They decide to apply a Control Plane Policing (CoPP) policy. Which statement best describes how CoPP interacts with the forwarding plane and the control plane on this router?

Accepted Answer

CoPP uses MQC to classify traffic destined to the route processor and applies a policer in the control-plane host path, so it can rate-limit IKE and SSH without affecting transit traffic that is forwarded in hardware.. CoPP applies MQC classification and policing to packets destined for the route processor via the control-plane host path, protecting the CPU from floods of IKE, SSH, or SNMP without touching hardware-forwarded transit traffic. It is configured once under 'control-plane', not per interface, and does not require distributed CEF or NBAR2 to match common control-plane protocols.

Answer

CoPP can only classify traffic using NBAR2 deep packet inspection, so it cannot match IKE or SSH and requires a separate Zone-Based Firewall policy to protect the control plane.

Answer

CoPP requires enabling 'ip cef distributed' and a PFC on the supervisor to offload policed control traffic to hardware, otherwise it cannot rate-limit IKE packets.

Answer

CoPP classifies and polices all packets entering any interface, including transit traffic, so it must be applied with 'service-policy input' on every physical interface to be effective.

Question 10

A security team wants to deploy MACsec on a Cisco Catalyst switch uplink between two buildings to protect Layer 2 traffic. The switches are Cisco Catalyst 9300 series running IOS XE, and the link must encrypt all frames between them. Which statement accurately describes a requirement for this deployment?

Accepted Answer

MACsec requires that both switches support the MACsec feature and that a connectivity association key be configured or negotiated before encrypted traffic can flow.. MACsec secures Layer 2 links by encrypting frames using keys derived from a connectivity association. Both endpoints must support MACsec and share matching key material, either pre-shared or via MKA. This allows the uplink between the Catalyst switches to carry encrypted traffic, meeting the requirement to protect all frames on that link.

Answer

MACsec can only be enabled on routed ports, so the uplink must be converted from a switchport to a no switchport interface.

Answer

MACsec encrypts only control plane traffic, so data frames between the switches would remain in clear text.

Answer

MACsec requires that 802.1X authentication be completed on the link before any encryption keys can be generated.

Question 11

A network administrator is implementing IP Source Guard (IPSG) on a Cisco Catalyst 3850 switch to prevent IP spoofing. The administrator enables DHCP snooping and IPSG on VLAN 10. A user connects a laptop with a statically assigned IP address 10.10.10.50/24 and gateway 10.10.10.1. The laptop cannot reach any network resources. What is the most likely reason?

Accepted Answer

IP Source Guard requires that the IP address be learned via DHCP snooping or be statically configured in an IP source binding.. IP Source Guard relies on the DHCP snooping binding table to validate source IP and MAC addresses. When a device uses a static IP address, no dynamic binding exists, so the switch drops its traffic. To allow the static address, an IP source binding must be manually configured with the ip source binding command, which populates the binding table.

Answer

DHCP snooping must be disabled for IP Source Guard to function with static addresses.

Answer

IP Source Guard only works with IPv6 addresses, so IPv4 static addresses are not supported.

Answer

The laptop must be configured with a DHCP address even if a static IP is desired, because IPSG blocks all non-DHCP traffic.

Question 12

A network engineer is configuring IPsec site-to-site VPNs on a Cisco IOS XE router. The design requires that the router authenticate peers using certificates issued by an internal PKI rather than pre-shared keys, and that IKEv2 be used for the key exchange. Which configuration element is required to support certificate-based authentication for IKEv2 on this router?

Accepted Answer

A crypto pki trustpoint configuration with enrollment and an RSA key pair, referenced in the IKEv2 profile.. IKEv2 certificate authentication requires an enrolled PKI trustpoint, an RSA key pair, and an IKEv2 profile that references RSA signature authentication with that trustpoint. Pre-shared keys and ISAKMP policies belong to the alternative authentication method or the older IKEv1 framework, and a crypto map only defines IPsec policy and peer identity. The trustpoint is the essential element enabling certificate-based peer authentication.

Answer

A pre-shared key configured under the IKEv2 keyring with the peer's address.

Answer

An ISAKMP policy with authentication pre-share under the crypto isakmp configuration.

Answer

A crypto map with the set peer command specifying the remote peer's hostname.

Question 13

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to use 802.1X authentication for wireless clients. The administrator wants to ensure that the WLC communicates with the RADIUS server securely. Which protocol should be used to encrypt the RADIUS communication between the WLC and the RADIUS server?

Accepted Answer

RADIUS over TLS (RadSec). RadSec (RADIUS over TLS) is the correct protocol to encrypt RADIUS communication between a WLC and a RADIUS server. It uses TLS to secure the entire RADIUS packet, ensuring confidentiality and integrity. Other options either refer to authentication methods or do not provide native encryption for RADIUS.

Answer

RADIUS with IPsec

Answer

RADIUS with MS-CHAPv2

Answer

RADIUS with EAP-TLS

Question 14

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that traffic from a specific subnet is encrypted and sent to a remote peer, while all other traffic is sent unencrypted. The engineer has configured an extended ACL for the crypto map. Which additional configuration is required to ensure that the crypto map is applied to the correct interface and that the VPN tunnel is established?

Accepted Answer

Apply the crypto map to the outbound interface using the crypto map command under interface configuration.. The crypto map defines the IPsec policy and must be applied to the outbound interface facing the remote peer. This application is what causes the router to inspect outbound packets, match the ACL, and initiate the IPsec tunnel. Other elements like ISAKMP policies and static routes are supporting configurations but do not activate the crypto map.

Answer

Configure a static route to the remote peer's public IP address pointing to the next-hop router.

Answer

Enable NAT on the interface to translate the private subnet to a public address before encryption.

Answer

Configure an ISAKMP policy with a matching pre-shared key on both peers.

Question 15

A network engineer must protect the OSPF adjacency between two Cisco routers from spoofed hello packets injected by a rogue device on the same broadcast segment. The engineer wants to use a cryptographic authentication method that is natively supported by OSPFv2 and does not rely on plain-text key exchange. Which configuration should be applied to the interfaces?

Accepted Answer

ip ospf authentication message-digest and ip ospf message-digest-key 1 md5 <key>. OSPFv2 supports two authentication types: simple password and message-digest (MD5). Only message-digest provides cryptographic protection, because it hashes the packet with a shared key rather than transmitting the key. Enabling ip ospf authentication message-digest on the interface plus defining ip ospf message-digest-key with an MD5 key ensures hellos are authenticated and spoofed packets from a rogue host are rejected before the adjacency can be affected.

Answer

ip ospf authentication-key <key>

Answer

ip ospf authentication key-chain <name>

Answer

ip ospf authentication null