350-401 Security Practice Test 2 — 15 Questions

Question 1

A network security engineer is implementing 802.1X authentication on a Cisco Catalyst switch. The switch is configured with RADIUS server 10.1.1.10 and a shared secret. The engineer wants to ensure that if the RADIUS server is unreachable, authenticated devices remain connected and unauthenticated devices are placed in a guest VLAN. The engineer configures 'authentication event server dead action authorize vlan 100' on the interface. However, when the RADIUS server goes down, authenticated devices are disconnected. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The RADIUS server is not configured with the 'radius-server dead-criteria' command, so the switch does not detect the server as dead.. For the server dead action to trigger, the switch must detect that the RADIUS server is dead. This is controlled by the 'radius-server dead-criteria' command, which defines the conditions (e.g., number of timeouts) for marking a server as dead. If not configured, the switch may not mark the server as dead, and authenticated devices may be disconnected when reauthentication fails.

Answer

The 'authentication event server dead action authorize vlan 100' command only applies to unauthenticated devices; authenticated devices require 'authentication event server dead action reinitialize'.

Answer

The interface is missing the 'authentication event server dead action authorize' command for authenticated devices, or the command is not supported on the platform.

Answer

The 'authentication event server dead action authorize vlan 100' command requires the 'authentication event fail action authorize vlan 100' command to be configured as well.

Question 2

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs OSPF, receives SNMP polling from the NMS, and terminates SSH management sessions. The administrator needs to ensure that OSPF hellos are never dropped by the CoPP policy while still rate-limiting SNMP and SSH. Which CoPP action should be applied to the OSPF class to meet this requirement?

Accepted Answer

police 8000 conform-action transmit exceed-action transmit is not used; instead, apply the class-map without a police action using a 'pass' or no police statement. To guarantee OSPF hellos are never dropped by CoPP, the OSPF class must be exempted from policing rather than policed with a high rate. Configuring the class without a police action, or with an explicit pass, lets the traffic bypass rate limiting. The other choices all apply policers that can drop or remark excess OSPF traffic, which violates the requirement.

Answer

police 8000 conform-action transmit exceed-action drop

Answer

police 8000 conform-action transmit exceed-action transmit

Answer

police 8000 conform-action transmit exceed-action set-dscp-transmit af31

Question 3

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to secure corporate Wi-Fi access. The requirement is to use 802.1X authentication with EAP-TLS, where both the client and the authentication server present certificates. The administrator has configured the WLAN with WPA2 Enterprise and selected 802.1X as the security policy. Which additional configuration is required on the WLC to support EAP-TLS?

Accepted Answer

Upload a valid server certificate to the WLC and configure the RADIUS server with a certificate trusted by the clients.. EAP-TLS requires mutual certificate-based authentication. The WLC must have a server certificate installed to present to clients during the TLS handshake, and the RADIUS server must also have a trusted certificate. Clients must possess their own certificates. Without these certificates, the EAP-TLS handshake cannot complete.

Answer

Configure the WLC to use LEAP as the EAP type and enable CCKM for fast roaming.

Answer

Enable MAC filtering on the WLC and add all corporate client MAC addresses to the local database.

Answer

Configure a preshared key on the WLC and distribute it to all corporate clients through Group Policy.

Question 4

A network administrator is deploying Cisco TrustSec in a campus network. The security policy requires that all traffic from the employee VLAN (VLAN 10) to the server VLAN (VLAN 20) be encrypted and authenticated at Layer 2, without relying on IPsec or any overlay tunneling. Which TrustSec component should be implemented to meet this requirement?

Accepted Answer

MACsec (802.1AE) with 802.1X EAP-TLS authentication. MACsec (802.1AE) with 802.1X EAP-TLS provides Layer 2 hop-by-hop encryption and authentication, exactly matching the requirement to encrypt and authenticate traffic between VLANs without IPsec or overlay tunnels. SXP, SGACLs, and DAI are TrustSec or security features but none of them encrypt user traffic at Layer 2.

Answer

Cisco TrustSec SGACLs enforced at the distribution layer

Answer

Dynamic ARP Inspection (DAI) with DHCP snooping binding table

Answer

Security Group Tag Exchange Protocol (SXP) with IPsec transport mode

Question 5

A security team is reviewing a Cisco IOS router configuration and finds that an ACL applied inbound on the WAN interface permits TCP port 179 from any source. The team wants to restrict BGP peering to only the two known service provider addresses while keeping the ACL efficient. Which ACL entry should be used to replace the overly permissive statement?

Accepted Answer

permit tcp host 203.0.113.1 eq bgp host <local address> and a matching entry for the second provider's address.. The least-privilege replacement pins both the source peer address and the destination local address on TCP port 179, which is the exact tuple used by a BGP session. One entry per provider covers both peers without permitting arbitrary sources. This preserves the peering sessions while eliminating the wide exposure created by the original any-source statement.

Answer

permit tcp host 203.0.113.1 eq bgp host 198.51.100.1 and a second entry for the other provider, both with the established keyword.

Answer

permit tcp any eq bgp host <local address> with a log keyword to record unexpected peers.

Answer

permit tcp 203.0.113.0 0.0.0.255 eq bgp any and a second entry for the other provider's subnet.

Question 6

A network engineer is hardening a Cisco IOS switch against Layer 2 attacks. The security policy requires mitigating MAC address spoofing, preventing a single port from learning an unlimited number of MAC addresses, and ensuring that a rogue DHCP server cannot hand out addresses. Which two features, when configured together, best address these requirements? (Choose two.)

Accepted Answer

Port security with a maximum MAC count. DAI validates ARP packets against the DHCP snooping binding table, which mitigates MAC and ARP spoofing, while port security with a maximum MAC count limits the number of addresses a port can learn. Together they address the spoofing and MAC flooding requirements. BPDU Guard, storm control, and Root Guard protect the spanning-tree topology or limit broadcast traffic but do not meet the stated goals.

Answer

Root Guard

Answer

Storm control for broadcast traffic

Answer

BPDU Guard

Question 7

A network administrator is deploying a new Cisco Catalyst 9300 switch stack in a campus IDF. The security policy requires that any device connecting to access ports be authenticated before receiving a VLAN assignment, and that if the RADIUS server becomes unreachable, only the voice VLAN should remain accessible while data VLAN access is denied. The administrator enables 802.1X with MAB fallback. Which command sequence correctly configures the fallback behavior on the access ports?

Accepted Answer

interface range GigabitEthernet 1/0/1-24
 authentication host-mode single-host
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication event server dead action authorize voice
 authentication event server alive action reinitialize. The correct configuration must use single-host mode for one device per port, attempt 802.1X before MAB, and apply the server dead action to authorize the voice VLAN while leaving data VLAN unauthorized. The server alive action reinitialize ensures the port re-authenticates when the RADIUS server recovers, satisfying the fallback and recovery requirements.

Answer

interface range GigabitEthernet 1/0/1-24
 authentication host-mode single-host
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication event server dead action reinitialize vlan 20
 authentication event server alive action reinitialize

Answer

interface range GigabitEthernet 1/0/1-24
 authentication host-mode multi-domain
 authentication order mab dot1x
 authentication priority mab dot1x
 authentication event server dead action authorize vlan 10
 authentication event server alive action reinitialize

Answer

interface range GigabitEthernet 1/0/1-24
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication event server dead action authorize voice
 authentication event server alive action reinitialize

Question 8

A network administrator is configuring a Cisco IOS router to allow remote management access via SSH. The administrator wants to ensure that only SSH version 2 is used and that the router's RSA key pair is generated with a modulus of 2048 bits. Which set of commands accomplishes this?

Accepted Answer

crypto key generate rsa modulus 2048, then ip ssh version 2. To enable SSHv2 with a 2048-bit RSA key, the administrator must generate the RSA key pair with the correct modulus size and then restrict SSH to version 2. The crypto key generate rsa modulus 2048 command creates the necessary key, and ip ssh version 2 ensures only SSHv2 is accepted. This combination provides secure remote management as required.

Answer

crypto key generate rsa general-keys modulus 1024, then ip ssh version 1

Answer

ip ssh version 2, then crypto key generate rsa usage-keys modulus 2048

Answer

ip ssh version 2, then crypto key generate rsa modulus 1024

Question 9

A network engineer is implementing MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches connected via a point-to-point link. The engineer wants to ensure that the link encrypts all traffic and that the switches mutually authenticate before forwarding data. Which configuration element is required to establish the MACsec session?

Accepted Answer

Configure a connectivity association key (CAK) and CKN using the mka key-server and key-string commands.. MACsec relies on MKA to negotiate encryption keys between peers. Configuring a matching CAK and CKN on both switches allows MKA to authenticate the peers and derive the secure association key, enabling encryption of all traffic on the link.

Answer

Configure IPsec with IKEv2 on the routed interface between the switches.

Answer

Enable 802.1X with EAP-TLS on the switch-to-switch link.

Answer

Configure a pre-shared key under the interface with the mka key-server priority command.

Question 10

A network architect is designing a Cisco SD-Access fabric. The security policy requires that endpoints be authenticated before being allowed into the fabric, and that their traffic be segmented based on user role, with enforcement at the fabric edge. Which combination of components is required to achieve this?

Accepted Answer

Cisco ISE for 802.1X authentication and Cisco DNA Center for fabric provisioning and SGT assignment. In Cisco SD-Access, Cisco ISE provides 802.1X authentication and assigns SGTs based on user role. Cisco DNA Center provisions the fabric, including edge nodes that enforce SGACLs. This combination delivers authentication and role-based segmentation at the fabric edge.

Answer

Cisco ISE for authentication and Cisco Stealthwatch for traffic segmentation

Answer

Cisco ASA with TrustSec and Cisco Prime Infrastructure for fabric management

Answer

Cisco DNA Center for authentication and Cisco Identity Services Engine for fabric provisioning

Question 11

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The switch must authenticate users against a Cisco ISE server and also allow MAB for devices that do not support 802.1X. Which configuration is required on the switch port to enable both 802.1X and MAB, with 802.1X attempted first?

Accepted Answer

authentication order dot1x mab and mab. To enable both 802.1X and MAB with 802.1X attempted first, the interface needs 'authentication order dot1x mab' to define the sequence and 'mab' to enable MAC authentication bypass. The other options either omit MAB, reverse the order, or omit the order command, so they do not meet both requirements.

Answer

authentication order dot1x mab

Answer

authentication order mab dot1x

Answer

mab and authentication port-control auto

Question 12

A network engineer is configuring Control Plane Policing on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The goal is to rate-limit SSH traffic destined to the router's own control plane to 100 kbps without affecting BGP or SNMP. The engineer applies a class-map matching 'access-group SSH-ACL' and a policy-map with a police rate of 100000 bps. After applying the service-policy to the control-plane, the engineer notices that SSH sessions are still allowed at higher rates and BGP remains unaffected. Which action should the engineer take to correctly enforce the rate limit?

Accepted Answer

Apply the service-policy to the control-plane with 'service-policy input COPP-POLICY' under 'control-plane' configuration mode.. CoPP protects the route processor by rate-limiting punted traffic. The policy-map must be attached to the control-plane attachment point using 'service-policy input' under 'control-plane' configuration mode. This ensures only the classified SSH traffic is policed while other control-plane protocols such as BGP and SNMP continue unthrottled. Attaching the policy elsewhere does not affect the correct traffic path.

Answer

Apply the service-policy to the data plane with 'service-policy input COPP-POLICY' under the 'data-plane' configuration mode.

Answer

Apply the service-policy globally with 'service-policy input COPP-POLICY' under global configuration mode.

Answer

Apply the service-policy to the management interface with 'service-policy input COPP-POLICY' under the GigabitEthernet management interface.

Question 13

An administrator is configuring a Cisco IOS router to act as a VPN headend for remote workers. The requirement is to use a protocol that provides strong encryption, supports NAT traversal, and can dynamically establish secure tunnels with minimal configuration. Which technology should be implemented?

Accepted Answer

Cisco AnyConnect SSL VPN. Cisco AnyConnect SSL VPN is designed for remote access, offering strong encryption, NAT traversal, and dynamic tunnel establishment. It requires minimal configuration on the client side and is supported on Cisco IOS routers and ASA firewalls. The other options are more suited for site-to-site or hub-and-spoke topologies and require more manual configuration, making them less appropriate for dynamic remote worker scenarios.

Answer

Site-to-site IPsec VPN with IKEv1

Answer

DMVPN Phase 3 with IPsec

Answer

GRE over IPsec

Question 14

A network security team is deploying 802.1X on Catalyst switches using Cisco ISE. The requirement is that the switch must forward EAPoL frames from supplicants to the authentication server even before the port is authorized, and must relay authentication messages without terminating the EAP conversation. Which host mode and configuration should be applied to the switch port?

Accepted Answer

Configure the port as an access port with 802.1X and use the default host mode (single-host) so EAPoL frames are relayed.. Standard 802.1X on a Catalyst access port acts as an authenticator that forwards EAPoL frames between the supplicant and the RADIUS server, and the default single-host mode supports this relay behavior. Enabling authentication open or changing to multi-domain is not necessary for EAPoL pass-through and would alter the intended security posture of the port.

Answer

Configure the port with authentication open and host mode multi-domain.

Answer

Configure the port as a trunk with 802.1X and enable MACsec.

Answer

Configure the port as a single-host access port with MAB enabled and no 802.1X.

Question 15

A network security engineer is implementing Dynamic ARP Inspection (DAI) on a Cisco Catalyst switch to mitigate ARP spoofing attacks. The engineer has enabled DHCP snooping globally and on the relevant VLANs. Which two additional steps are required to ensure DAI operates correctly on a VLAN that includes both DHCP and statically addressed hosts? (Choose two.)

Accepted Answer

Configure an ARP ACL to permit ARP packets from statically addressed hosts.. DAI requires DHCP snooping to build the binding database, and it must be explicitly enabled on the VLAN with the 'ip arp inspection vlan' command. For statically addressed hosts, an ARP ACL is needed to permit their ARP packets, as they lack DHCP snooping entries. Trusted interfaces are recommended but not mandatory for basic operation. Thus, the two required steps are enabling DAI on the VLAN and configuring an ARP ACL for static hosts.

Answer

Configure trusted interfaces for uplinks and DHCP server ports.

Answer

Enable DHCP snooping on the VLAN.

Answer

Enable IP Source Guard on the VLAN.