350-401 Security Practice Test 3 — 15 Questions

Question 1

A network administrator is configuring a Cisco ASA firewall for a new DMZ. The DMZ web server at 192.168.10.10 must be accessible from the internet on TCP port 443. The outside interface is GigabitEthernet0/0 with IP 203.0.113.5. The administrator wants to use a static NAT with a public IP address 203.0.113.10. Which configuration accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

object network DMZ-WEB
 host 192.168.10.10
 nat (dmz,outside) static 203.0.113.10
access-list OUTSIDE-IN extended permit tcp any host 203.0.113.10 eq 443
access-group OUTSIDE-IN in interface outside. To publish an internal server, you need static NAT to map the private IP to a public IP, and an access list on the outside interface permitting traffic to the public IP. The NAT statement must be in the correct order (real interface, mapped interface). Dynamic NAT does not support inbound connections, and incorrect ACL placement or IP references will fail.

Answer

object network DMZ-WEB
 host 192.168.10.10
 nat (outside,dmz) static 203.0.113.10
access-list OUTSIDE-IN extended permit tcp any host 203.0.113.10 eq 443
access-group OUTSIDE-IN in interface outside

Answer

object network DMZ-WEB
 host 192.168.10.10
 nat (dmz,outside) static 203.0.113.10
access-list OUTSIDE-IN extended permit tcp any host 192.168.10.10 eq 443
access-group OUTSIDE-IN in interface dmz

Answer

object network DMZ-WEB
 host 192.168.10.10
 nat (dmz,outside) dynamic 203.0.113.10
access-list OUTSIDE-IN extended permit tcp any host 192.168.10.10 eq 443
access-group OUTSIDE-IN in interface outside

Question 2

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The policy must rate-limit SNMP and SSH traffic while allowing BGP and OSPF control traffic without restriction. After applying the service-policy to the control plane, the administrator notices that BGP adjacencies are flapping. What is the most likely cause?

Accepted Answer

The class-map matching BGP traffic is incorrectly configured, causing BGP packets to be dropped by a default deny action.. The most likely cause is that the class-map for BGP is incorrectly configured, causing BGP packets to be policed or dropped. CoPP uses class-maps to classify traffic and policy-maps to define actions. If BGP traffic is not properly matched and allowed, it may fall into a default class with a restrictive policer, leading to dropped keepalives and adjacency flapping. Ensuring BGP is matched and given sufficient bandwidth is critical.

Answer

The CoPP policy is missing a class-map for OSPF, causing OSPF to be dropped and indirectly affecting BGP.

Answer

The service-policy is applied in the wrong direction (output instead of input) on the control plane.

Answer

The CoPP policy is applied to the data plane interface instead of the control plane.

Question 3

A security architect is deploying MACsec on a Cisco Catalyst 9300 switch connecting to a Cisco IP phone that also provides a PC port. The requirement is to encrypt traffic between the switch and the phone, while allowing the PC behind the phone to communicate without MACsec. The switch port is configured as a trunk with voice VLAN 100 and data VLAN 200. Which configuration approach meets the requirement?

Accepted Answer

Enable MACsec globally with 'macsec' under global config, then configure 'macsec' on the switch port facing the phone and use MKA policy to authenticate the phone, leaving the PC port unencrypted.. MACsec is a hop-by-hop Layer 2 encryption technology. To encrypt the switch-to-phone link while leaving the PC unencrypted, MACsec must be enabled on the switch port facing the phone, with the phone acting as the MACsec peer. The phone's downstream PC port remains a normal clear-text port. Global 'macsec' and an MKA policy are required to negotiate keys and cipher suites.

Answer

Configure 'macsec' on the switch port and enable 'macsec replay-protection window 0' to allow the PC to bypass encryption.

Answer

Configure 'macsec' only on the phone's PC port and leave the switch-to-phone link unencrypted.

Answer

Enable MACsec globally and configure 'macsec' on the switch port, then configure 'macsec' on the phone's PC port as well.

Question 4

A network engineer is configuring 802.1X authentication on a Cisco Catalyst 9000 switch. The switch is connected to a Cisco ISE server for authentication and authorization. The engineer wants to ensure that if the ISE server becomes unreachable, the switch will allow devices to connect to a guest VLAN. Which command must be configured on the switch to achieve this?

Accepted Answer

authentication event server dead action authorize vlan 100. The command 'authentication event server dead action authorize vlan 100' configures the switch to place unauthenticated devices into VLAN 100 when the authentication server (ISE) is unreachable. This provides guest access while maintaining security. The 'fail' action is for authentication failures, not server dead events. The other commands do not provide a fallback VLAN for server unavailability.

Answer

authentication event fail action authorize vlan 100

Answer

authentication open

Answer

authentication host-mode multi-auth

Question 5

A network administrator is deploying Control Plane Policing on a Cisco IOS router to protect the route processor from excessive traffic. Which two statements correctly describe how CoPP behaves in this deployment? (Choose two.)

Accepted Answer

CoPP uses a modular QoS CLI policy map applied to the control-plane interface to classify and police traffic destined to the route processor.. CoPP works by applying a modular QoS service policy to the control-plane interface, where class maps select control-plane traffic and police actions rate-limit it. Out-of-profile packets are dropped unless an exceed or conform action changes that behavior. It protects only traffic punted to the route processor, requires manual classification, and supports per-class policy, making the two statements about its MQC implementation and default drop behavior correct.

Answer

CoPP can only be applied globally to the entire router and cannot be scoped to individual control-plane protocol classes.

Answer

CoPP classifies and polices all transit traffic that passes through the router toward downstream networks.

Answer

Enabling CoPP automatically discovers and classifies all legitimate control-plane protocols without any manual class map configuration.

Question 6

A network engineer is implementing MACsec on a Cisco Catalyst 9000 switch series to secure Layer 2 traffic between two switches. The engineer configures MKA (MACsec Key Agreement) with a pre-shared key and applies the configuration to the uplink interface. However, the MACsec session fails to establish, and the interface remains in a down state. Which of the following is the most likely reason for the failure?

Accepted Answer

The switches are using different cipher suites for MACsec encryption.. MACsec requires both peers to use the same cipher suite for encryption. If one switch is configured with GCM-AES-128 and the other with GCM-AES-256, the MKA session will fail, and the interface will not pass traffic. The pre-shared key must also match, but cipher suite mismatch is a common oversight. Ensuring both sides use identical cipher suites resolves the issue.

Answer

The pre-shared key is configured with a different key server priority on each switch.

Answer

The MKA key server is not configured with a valid lifetime value.

Answer

The MACsec configuration is applied to a switched virtual interface (SVI) instead of a physical interface.

Question 7

A network administrator is deploying a new Cisco Catalyst 9300 switch at a branch office. The security policy requires that when an unauthorized device is connected to an access port, the port must be placed into the error-disabled state and an SNMP trap must be sent. The administrator configures the following on interface GigabitEthernet1/0/1: switchport mode access, switchport port-security, switchport port-security maximum 1, switchport port-security mac-address sticky. Which additional command is required to meet the policy requirement?

Accepted Answer

switchport port-security violation shutdown. The shutdown violation mode is the only port security mode that places the interface into the error-disabled state when a violation occurs. It also triggers an SNMP trap if SNMP trap generation for port security is enabled. The restrict mode only drops and logs, while protect drops silently. Configuring the violation mode as shutdown ensures the port is disabled and the required trap is sent, satisfying the branch office security policy.

Answer

switchport port-security violation log

Answer

switchport port-security violation restrict

Answer

switchport port-security violation protect

Question 8

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS-XE router that runs OSPF, BGP, and SSH management. The router is experiencing high CPU utilization due to excessive ARP requests from a misbehaving host on the LAN. The administrator wants to rate-limit ARP traffic without affecting OSPF and BGP. Which class-map match condition should be used in the CoPP policy to specifically match ARP traffic?

Accepted Answer

match protocol arp. ARP is a Layer 2 protocol and does not have an IP header, so it cannot be matched with an IP ACL or IP precedence. The match protocol arp condition uses NBAR to identify ARP packets, enabling the administrator to apply a specific policer to ARP while leaving OSPF, BGP, and SSH traffic untouched.

Answer

match access-group name ARP_ACL, where ARP_ACL is an extended ACL permitting ip any any

Answer

match access-group name ARP_ACL, where ARP_ACL is a MAC ACL permitting any any

Answer

match ip precedence 6

Question 9

A network administrator is configuring 802.1X on a Cisco Catalyst switch port. The port must allow only one supplicant to authenticate, and after successful authentication the port should be placed in the data VLAN. The authentication server is Cisco ISE. Which command correctly enables 802.1X authentication on the access port?

Accepted Answer

authentication port-control auto. On Cisco IOS XE, 802.1X on a switch port is enabled with 'authentication port-control auto' under the interface. This command puts the port in auto mode, meaning it starts unauthorized and only passes traffic after successful authentication with the RADIUS server (Cisco ISE). The global 'dot1x system-auth-control' and interface 'dot1x pae authenticator' commands are also typically required, but the port-control command is what enforces authentication on that specific port.

Answer

authentication host-mode multi-auth

Answer

dot1x system-auth-control

Answer

dot1x port-control auto

Question 10

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor. The router runs OSPF, BGP, SSH management, and SNMP monitoring. The engineer needs to apply a class-map that matches all management traffic and ensure that OSPF and BGP control traffic is not dropped during a DoS attack. Which CoPP action should be configured on the class-map for management traffic to rate-limit it while preserving routing protocol adjacencies?

Accepted Answer

police 8000 conform-action transmit exceed-action drop, and apply a separate class-map for OSPF and BGP with a higher rate or no policing. Control Plane Policing protects the route processor by rate-limiting traffic destined to it. To avoid disrupting routing protocols during an attack, management traffic must be policed separately from OSPF and BGP. A strict police action with exceed drop on management traffic, combined with a separate class-map for routing protocols that allows sufficient bandwidth, preserves adjacencies while mitigating the DoS impact.

Answer

police 8000 conform-action transmit exceed-action drop

Answer

police 8000 conform-action transmit exceed-action transmit

Answer

police 8000 conform-action set-dscp-transmit af31 exceed-action drop

Question 11

A network technician is configuring a Cisco IOS router to act as a VPN headend. The security policy requires that all remote access VPN users be authenticated using digital certificates issued by a corporate PKI. Which command must be configured to enable certificate-based authentication for IKEv2?

Accepted Answer

crypto ikev2 profile PROF match identity remote address 0.0.0.0 authentication rsa-sig. To enable certificate-based authentication for IKEv2, you must configure the IKEv2 profile with the authentication rsa-sig command. This instructs the router to use RSA signatures and digital certificates. Other commands like trustpoint enrollment or pre-shared keys do not fulfill the certificate authentication requirement.

Answer

crypto pki trustpoint TP enroll url http://pki.example.com

Answer

crypto ikev2 profile PROF authentication pre-share

Answer

crypto isakmp key secret address 0.0.0.0

Question 12

A network engineer is configuring 802.1X authentication on a Cisco Catalyst switch port. The port is connected to a PC running the Cisco AnyConnect Network Access Manager supplicant. The authentication server is Cisco ISE. The engineer wants the port to authenticate the user and then dynamically assign the user to a specific VLAN based on the user's identity. Which feature must be enabled on the switch to allow the dynamic VLAN assignment?

Accepted Answer

IEEE 802.1X authentication with VLAN assignment. Dynamic VLAN assignment during 802.1X authentication requires the switch to support and enable 802.1X VLAN assignment. The RADIUS server returns tunnel attributes that the switch uses to place the port in the appropriate VLAN. This is a core feature of 802.1X and does not require CoA for the initial assignment.

Answer

RADIUS Change of Authorization (CoA)

Answer

MAC Authentication Bypass (MAB)

Answer

Web Authentication (WebAuth)

Question 13

A network administrator is configuring 802.1X authentication on a Cisco Catalyst switch port. The port is connected to a Cisco IP phone with a PC attached to the phone's PC port. The administrator wants to authenticate both the phone and the PC separately, allowing the phone to be authenticated via MAB and the PC via 802.1X. Which feature must be enabled on the switch port to support multiple devices and authentication methods?

Accepted Answer

Multi-Domain Authentication (MDA). Multi-Domain Authentication (MDA) is designed for IP telephony deployments where a phone and a PC share a switch port. It creates two logical domains: voice for the phone and data for the PC. Each domain can use a different authentication method and be assigned to a different VLAN, allowing the phone to use MAB and the PC to use 802.1X, with separate security policies.

Answer

Multi-Auth

Answer

802.1X with MAC Authentication Bypass (MAB) fallback

Answer

Flexible Authentication

Question 14

A network engineer is configuring a Zone-Based Firewall (ZBFW) on a Cisco IOS router. The internal network is in zone INSIDE, and the external network is in zone OUTSIDE. The engineer wants to allow HTTP traffic from INSIDE to OUTSIDE, but block all other traffic from INSIDE to OUTSIDE. Additionally, traffic from OUTSIDE to INSIDE should be blocked except for return traffic. Which configuration is required to achieve this?

Accepted Answer

Create a zone-pair INSIDE-to-OUTSIDE with a service-policy that inspects HTTP and drops all other traffic. Do not create a zone-pair for OUTSIDE-to-INSIDE.. ZBFW uses stateful inspection, so return traffic for an inspected session is automatically allowed without a reverse zone-pair. To allow only HTTP from INSIDE to OUTSIDE and block everything else, you create a zone-pair INSIDE-to-OUTSIDE with a service-policy that inspects HTTP and drops other traffic. Because no OUTSIDE-to-INSIDE zone-pair exists, all other inbound traffic is implicitly dropped.

Answer

Create a zone-pair INSIDE-to-OUTSIDE with a service-policy that inspects HTTP and drops all other traffic. Create a zone-pair OUTSIDE-to-INSIDE with a service-policy that drops all traffic.

Answer

Create a zone-pair INSIDE-to-OUTSIDE with a service-policy that permits HTTP and drops all other traffic. Create a zone-pair OUTSIDE-to-INSIDE with a service-policy that permits HTTP return traffic.

Answer

Create a zone-pair INSIDE-to-OUTSIDE with a service-policy that permits all traffic. Create a zone-pair OUTSIDE-to-INSIDE with a service-policy that inspects HTTP and drops all other traffic.

Question 15

A network engineer is deploying 802.1X on a Cisco Catalyst switch. The authentication server is Cisco ISE. The engineer wants to ensure that if the ISE server becomes unreachable, endpoints already authenticated remain connected, but new endpoints are placed in a restricted VLAN. Which feature should be configured on the switch?

Accepted Answer

Inaccessible authentication bypass. Inaccessible authentication bypass is the feature that allows existing authenticated sessions to remain connected when the authentication server is unreachable, while new endpoints are placed in a restricted VLAN. This is configured on the switch with commands like 'authentication critical recovery delay' and 'authentication event server dead action authorize vlan'. It ensures business continuity during server outages.

Answer

Flexible authentication ordering

Answer

Critical authentication

Answer

MAC Authentication Bypass (MAB)