350-401 Security Practice Test 5 — 15 Questions

Question 1

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against a flood of malformed packets. After applying the policy, legitimate BGP keepalives from a directly connected peer are being dropped. The policy uses a class-map matching 'match access-group 101' where ACL 101 permits tcp any any eq 179. Which action should the engineer take to resolve the issue while preserving protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a higher-priority class-map that matches the BGP peer's source IP and permit it with a policer rate of 8000 bps and a higher burst, placed before the existing class in the policy-map.. CoPP class-maps are evaluated in order, and the first match wins. A broad ACL matching all TCP port 179 traffic cannot distinguish a trusted BGP peer from spoofed or malicious traffic, so a more specific class matching the peer must be inserted before it with sufficient rate and burst to accommodate keepalives. This refines classification without abandoning control-plane protection.

Answer

Remove ACL 101 from the class-map and rely on the default class to police all control-plane traffic equally.

Answer

Apply the existing policy-map to the data plane interface instead of the control plane to bypass policing of BGP.

Answer

Increase the policer rate in the existing BGP class-map to the maximum supported value on the platform.

Question 2

A network administrator configures an IPsec site-to-site VPN between two Cisco IOS routers using IKEv2. The administrator wants to ensure that the control plane traffic for the VPN is protected and that the routers can authenticate each other using certificates. Which statement correctly describes a characteristic of IKEv2 in this scenario?

Accepted Answer

IKEv2 supports MOBIKE, allowing the VPN to survive IP address changes on the endpoints.. IKEv2 introduces MOBIKE, which allows a VPN tunnel to remain established even when an endpoint's IP address changes. This is particularly useful for mobile users or dual-homed sites. The other options contain inaccuracies: IKEv2 does not use a single UDP port for all traffic, it supports certificates, and its exchange is not a single four-message exchange but two exchanges of two messages each.

Answer

IKEv2 uses a four-message exchange for the initial IKE_SA_INIT and IKE_AUTH phases, reducing latency compared to IKEv1.

Answer

IKEv2 uses a single UDP port 500 for both IKE and ESP traffic, simplifying firewall rules.

Answer

IKEv2 requires the use of preshared keys for authentication, as certificates are not supported.

Question 3

A network engineer is deploying a Cisco Catalyst 9300 switch stack at a branch office. The security policy requires that when an unauthorized device connects to an access port, the port must immediately stop forwarding traffic and generate a syslog message, but the port must automatically resume forwarding after the unauthorized device is removed without any manual intervention. Which port security violation mode should be configured on the interface?

Accepted Answer

restrict. The restrict violation mode drops traffic from violating MAC addresses while still generating log and trap notifications, and it leaves the port in an up state so that legitimate traffic resumes as soon as the offending device disconnects. This provides the automatic recovery and logging behavior the policy demands without requiring administrator action.

Answer

protect

Answer

err-disable recovery

Answer

shutdown

Question 4

A network administrator is configuring 802.1X on a Cisco Catalyst switch. The switch is connected to a Cisco ISE server for authentication. The administrator wants to allow a device to authenticate using MAC Authentication Bypass (MAB) if 802.1X is not supported. Which command must be configured on the switch interface to enable MAB?

Accepted Answer

dot1x mac-auth-bypass. MAC Authentication Bypass (MAB) is enabled on a switch interface with the command 'dot1x mac-auth-bypass'. This allows devices that do not support 802.1X to be authenticated based on their MAC address. The switch sends the MAC address to the RADIUS server as the username and password. Other commands like 'authentication port-control auto' and 'dot1x pae authenticator' are part of 802.1X configuration but do not enable MAB.

Answer

authentication port-control auto

Answer

dot1x pae authenticator

Answer

mab

Question 5

A network administrator is configuring 802.1X authentication on a Cisco Catalyst switch. The switch must authenticate users via RADIUS and, if the RADIUS server is unreachable, allow devices into a restricted VLAN. Which feature should be configured to meet this requirement?

Accepted Answer

Inaccessible authentication bypass. Inaccessible authentication bypass, often configured with the 'authentication critical' command, places the port into a critical VLAN when the RADIUS server is unreachable. This ensures devices get restricted access instead of being denied entirely. It is the correct feature for the scenario described.

Answer

Critical authentication

Answer

Guest VLAN

Answer

Authentication failure fallback

Question 6

A network engineer is configuring IPsec VPN on a Cisco IOS router. The router must establish a site-to-site tunnel with a remote peer. The engineer configures IKEv2 with a pre-shared key, but the tunnel fails to establish. The engineer verifies that the pre-shared key matches on both peers and that IKEv2 proposals are compatible. Which additional configuration is required for the IPsec tunnel to come up?

Accepted Answer

Configure a crypto ACL to define interesting traffic that should be encrypted.. For a site-to-site IPsec VPN using crypto maps, a crypto ACL is mandatory to define which traffic is interesting and should be encrypted. Without it, the router cannot match traffic to the crypto map, and the tunnel will not establish. Even with correct IKEv2 and pre-shared key configuration, the absence of a crypto ACL prevents the IPsec SA from being triggered, so the tunnel fails.

Answer

Apply the crypto map to the outside interface using the 'crypto map' command.

Answer

Enable 'crypto ipsec profile' and apply it to the tunnel interface.

Answer

Configure 'crypto isakmp key' with the peer address and pre-shared key.

Question 7

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that traffic from a specific subnet is encrypted and sent to a remote peer, while all other traffic is sent unencrypted. The engineer configures an extended ACL to match the interesting traffic and applies it to a crypto map. However, after applying the configuration, all traffic to the remote peer is being dropped. What is the most likely reason?

Accepted Answer

The crypto map is applied to the wrong interface, or the ACL is referenced in the wrong order, causing traffic to be dropped by the implicit deny at the end of the ACL.. Crypto ACLs have an implicit deny at the end, meaning that any traffic not explicitly permitted is dropped. If the ACL is misconfigured or applied to the wrong interface, traffic that should be encrypted may be dropped. The engineer must ensure the ACL correctly matches the intended subnet and is applied to the correct interface in the correct direction. Other options are less likely given the symptom of all traffic being dropped.

Answer

The ACL is configured with the wrong source and destination addresses, causing the router to drop traffic that does not match the IPsec policy.

Answer

The crypto map is missing the 'set peer' command, so the router does not know where to send the encrypted traffic.

Answer

The ACL for IPsec must be a standard ACL, not an extended ACL.

Question 8

A security team wants to inspect traffic between two VLANs on a Cisco Catalyst 9000 switch using a traffic mirroring session that copies packets to a monitoring appliance. The requirement is that the mirrored traffic preserve original VLAN tags and that only traffic matching a specific ACL is copied. Which configuration element is required to meet the ACL filtering requirement?

Accepted Answer

A local SPAN source configured with 'monitor session 1 source interface Gi1/0/1 both filter access-group 100' and 'encapsulation replicate' on the destination.. Local SPAN on Catalyst 9000 supports ACL filtering through the 'filter access-group' keyword attached to the source session, which restricts mirrored traffic to packets permitted by the ACL. Pairing this with 'encapsulation replicate' on the destination preserves the original VLAN tags. VLAN-based SPAN and MQC approaches cannot deliver the required ACL-scoped, tag-preserving capture.

Answer

A VLAN-based SPAN session using 'monitor session 1 source vlan 10 both' with a destination of the monitor port.

Answer

A source session with 'source interface Gi1/0/1 both' and a destination session pointing to the monitor port, using 'encapsulation replicate'.

Answer

A class-map matching 'match access-group 100' referenced by a policy-map with a monitor action, applied to the source interface.

Question 9

A security architect is designing a campus network where endpoints must be authenticated before being placed into a VLAN. The design requires that the switch relay authentication requests to a Cisco ISE server and that the endpoint be dynamically assigned to a quarantine VLAN if posture assessment fails. The endpoint uses a supplicant that supports EAP-TLS. Which protocol combination should be configured on the switch port to meet these requirements?

Accepted Answer

802.1X with MAC Authentication Bypass and RADIUS Change of Authorization. Dynamic VLAN reassignment after a posture failure requires RADIUS Change of Authorization so Cisco ISE can push a new authorization result to the switch without forcing reauthentication. Combining 802.1X with EAP-TLS for supplicant authentication and MAB for non-supplicant devices covers all endpoint types while enabling the required quarantine behavior.

Answer

802.1X with EAP-TLS and local web authentication

Answer

802.1X with EAP-TLS and TACACS+ command authorization

Answer

MAC Authentication Bypass only with TACACS+ authorization

Question 10

An engineer must secure a Cisco IOS-XE router that peers BGP with an ISP. The requirement is to cryptographically authenticate every BGP update so that a rogue peer cannot inject routes. The solution must not require an external AAA server. Which action accomplishes this?

Accepted Answer

Configure 'neighbor x.x.x.x password <secret>' under the BGP routing process on both peers to enable TCP MD5 signature authentication.. TCP MD5 signature authentication is enabled per BGP neighbor with the 'password' command, using a shared secret on both peers. It cryptographically authenticates each TCP segment so a rogue peer cannot establish the session or inject updates, and it requires no external AAA server. Key chains and IPsec profiles are not valid BGP neighbor authentication options.

Answer

Enable 'bgp authentication-key' under the global BGP configuration and reference it with 'neighbor x.x.x.x authentication-key'.

Answer

Configure a key chain and apply it under the BGP neighbor with 'neighbor x.x.x.x password' using the key chain name.

Answer

Apply an IPsec transport-mode profile to the BGP peer and reference it with 'neighbor x.x.x.x ipsec-profile'.

Question 11

A network engineer is deploying MACsec (802.1AE) on a Cisco Catalyst 9000 series switch to secure Layer 2 traffic between two switches. The engineer wants to ensure that the MACsec session is established with strong encryption and that key management is handled by the switch without manual key entry. Which two statements are correct about MACsec configuration on Cisco Catalyst 9000 switches? (Choose two.)

Accepted Answer

MACsec requires the use of MKA (MACsec Key Agreement) protocol for key management when using pre-shared keys or 802.1X.. MACsec on Catalyst 9000 can use Cisco TrustSec and 802.1X for dynamic key exchange, and it relies on the MKA protocol for key management regardless of whether pre-shared keys or 802.1X is used. These two statements accurately describe the key management and integration aspects of MACsec in enterprise deployments.

Answer

MACsec encrypts the entire Ethernet frame including the source and destination MAC addresses.

Answer

MACsec on Catalyst 9000 supports only 128-bit encryption and cannot use 256-bit keys.

Answer

MACsec can only be configured on routed ports, not on switch ports.

Question 12

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote users. The administrator wants to use IKEv2 with certificate-based authentication. The router must validate client certificates against a trusted certificate authority (CA). Which command is required to specify the trustpoint that the router will use for certificate authentication?

Accepted Answer

pki trustpoint TP-NAME. In an IKEv2 profile, certificate authentication requires specifying the trustpoint that contains the CA certificates for validation. The 'pki trustpoint TP-NAME' command within the IKEv2 profile configuration sets this. It ensures the router uses the correct CA to verify client certificates. Without this, the router cannot authenticate the remote peer using certificates, and the VPN tunnel will not establish.

Answer

crypto pki certificate chain TP-NAME

Answer

crypto ikev2 profile PROFILE-NAME

Answer

crypto pki trustpoint TP-NAME

Question 13

An engineer is configuring a Cisco IOS XE router to secure SNMP access. The requirement is to use SNMPv3 with authentication and encryption, and to ensure that management stations can retrieve data but not modify configuration. Which SNMPv3 configuration element should the engineer set to enforce authentication and privacy?

Accepted Answer

Configure the snmp-server group with the priv keyword and assign the view to the group, then create a user with auth and priv passwords.. SNMPv3 security is enforced through groups and users. The group specifies the security level, such as authPriv, and the view defines accessible MIB objects. The user is configured with authentication and privacy passwords. Together, these elements ensure that management stations authenticate and encrypt their requests while being restricted to read-only access.

Answer

Configure the snmp-server enable traps command with the auth keyword to enforce authentication.

Answer

Configure the snmp-server host command with the version 3 keyword and specify the username.

Answer

Configure the snmp-server community string with the ro keyword and apply an ACL to restrict access.

Question 14

A network engineer is deploying a Cisco Identity Services Engine (ISE) for wired 802.1X authentication. The engineer needs to ensure that the switch port transitions to the authorized state only after successful authentication. Which two commands are required on the Cisco switch to enable 802.1X authentication and control the port state? (Choose two.)

Accepted Answer

authentication port-control auto. To enable 802.1X authentication on a Cisco switch, you must globally enable it with 'dot1x system-auth-control' and then configure the interface with 'authentication port-control auto' to control the port state based on authentication. The AAA command is also needed for RADIUS communication but is not directly responsible for enabling 802.1X or controlling the port state.

Answer

dot1x pae authenticator

Answer

authentication host-mode multi-auth

Answer

dot1x system-auth-control

Question 15

A network administrator is configuring a Cisco IOS router to act as a VPN endpoint for remote users. The administrator wants to use IKEv2 for the VPN and needs to ensure that the router can authenticate users with certificates. Which command is required to specify the trustpoint that the router will use for certificate-based authentication?

Accepted Answer

pki trustpoint TP-NAME under the IKEv2 profile. In IKEv2, certificate authentication is configured within an IKEv2 profile. The pki trustpoint command under the profile specifies which trustpoint to use, thereby linking the certificate to the IKEv2 authentication. This allows the router to use the correct certificate for authentication with remote peers.

Answer

authentication local rsa-sig under the IKEv2 profile

Answer

crypto pki trustpoint TP-NAME

Answer

crypto ikev2 profile PROFILE-NAME