350-401 Security Practice Test 8 — 15 Questions

Question 1

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs OSPF, BGP, SSH management, and SNMP polling. After applying a CoPP policy, the administrator notices that OSPF adjacencies flap intermittently while BGP and SSH remain stable. Which action should the administrator take to resolve the flapping while maintaining control plane protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the committed information rate (CIR) for the OSPF class in the CoPP policy.. OSPF adjacency flapping after applying CoPP indicates that the policer for the OSPF control plane class is dropping legitimate hello or LSA packets. Increasing the CIR for that class allows the required OSPF traffic to be punted to the route processor. This preserves control plane protection for other protocols while resolving the flapping, which is a common tuning step in CoPP deployments.

Answer

Remove the CoPP policy entirely and rely on interface ACLs for control plane protection.

Answer

Apply the CoPP policy only to the BGP and SSH classes, leaving OSPF unpoliced.

Answer

Configure OSPF authentication to reduce the number of OSPF packets processed by the route processor.

Question 2

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce access policy based on a device's role rather than its IP address, so that the enforced policy remains consistent even when endpoints move between VLANs or subnets. Which Cisco TrustSec component is responsible for assigning and carrying this role-based identity through the network?

Accepted Answer

Security Group Tag (SGT) applied at ingress and propagated via inline tagging or SXP.. Role-based enforcement in TrustSec depends on Security Group Tags that travel with the traffic. The ingress device classifies the packet and inserts the SGT; downstream devices enforce the Security Group ACL based on that tag. Because the tag, not the IP address, drives policy, endpoints keep the same access rights after moving between VLANs and subnets, satisfying the stated requirement.

Answer

IPsec tunnel established between the access switch and the Cisco DNA Center appliance.

Answer

MACsec encryption applied on the uplink between access and distribution switches.

Answer

Cisco Identity Services Engine (ISE) profiling the endpoint after DHCP and HTTP probes.

Question 3

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs. After applying a policer to the control plane, the BGP sessions tear down repeatedly while OSPF adjacencies stay stable. The administrator confirms CPU utilization is low. Which action should be taken to resolve the issue?

Accepted Answer

Increase the CIR of the policer class matching BGP traffic and permit the BGP class in the control-plane service policy.. CoPP policies inspect and police traffic punted to the route processor. When a policer for a critical routing protocol is too restrictive, protocol hellos and keepalives are dropped, causing peering failures even though CPU load is low. Adjusting the policer rate and ensuring the protocol class is permitted restores the required control-plane traffic while retaining protection against abuse.

Answer

Apply the CoPP policy to the data plane interfaces using the service-policy input command.

Answer

Disable CEF switching on the router so BGP packets are process-switched and bypass the policer.

Answer

Enable NetFlow on the WAN interfaces and export records to a collector for BGP traffic analysis.

Question 4

A network administrator at a small company wants to prevent users from plugging unauthorized switches into wall jacks and creating loops or bypassing security controls. The administrator decides to implement BPDU Guard on all access ports on a Cisco Catalyst switch. Which statement accurately describes the behavior of BPDU Guard when configured on an access port?

Accepted Answer

It places the port into err-disabled state if a BPDU is received on the port.. BPDU Guard protects access ports by err-disabling them when any BPDU is received. This prevents unauthorized switches from being connected and potentially disrupting the spanning tree topology. It is commonly deployed alongside PortFast on access ports to ensure that end-user devices cannot participate in STP.

Answer

It filters BPDUs from being forwarded out of the port while allowing the port to remain active.

Answer

It converts the access port into a trunk port when BPDUs are detected to allow proper spanning tree convergence.

Answer

It sends a syslog message and drops only the offending BPDU while keeping the port operational.

Question 5

A network engineer is deploying Cisco TrustSec in a campus network. The security team requires that the Security Group Tag (SGT) be carried inside the Ethernet frame so that switches in the path can enforce group-based policy without inline tagging. Which Cisco-proprietary protocol should be enabled on the uplinks between the access and distribution switches to achieve this?

Accepted Answer

Cisco TrustSec CMD (Cisco Meta Data). Inline SGT tagging between TrustSec-capable switches is accomplished with Cisco Meta Data, which places the Security Group Tag into the Ethernet frame so each hop can enforce Security Group ACLs. MACsec provides encryption rather than tag transport, SXP propagates IP-to-SGT mappings across non-TrustSec hops, and L2TP is unrelated to TrustSec tagging.

Answer

Layer 2 Tunneling Protocol (L2TP)

Answer

802.1AE MACsec

Answer

Cisco TrustSec SXP

Question 6

A security team wants to protect a campus network from MAC flooding attacks that could overflow the CAM table on access switches. The requirement is to limit the number of source MAC addresses learned per switch port and to automatically err-disable a port when the limit is exceeded, while still allowing a VoIP phone and a PC on the same port. Which configuration approach meets these requirements?

Accepted Answer

Configure port security with the maximum parameter, sticky learning, and violation shutdown on each access port.. Port security limits the source MAC addresses that can be learned on a switch port. Setting a maximum value caps how many MACs are accepted, sticky learning stores dynamically learned addresses in the configuration, and the shutdown violation mode err-disables the port upon violation. Together these features neutralize MAC flooding while permitting a phone and PC by allowing at least two MACs.

Answer

Configure storm control for unicast traffic at a low threshold on each access port.

Answer

Configure port security with the maximum parameter, sticky learning, and violation restrict on each access port.

Answer

Enable BPDU Guard and Root Guard on all access ports to block MAC flooding attempts.

Question 7

A network engineer is configuring control plane policing (CoPP) on a Cisco IOS XE router that peers BGP with two service providers and is managed over SSH from a jump host. After applying a new policy-map, the engineer notices that BGP sessions remain up but SSH logins intermittently time out during traffic spikes. Which action should the engineer take to resolve the SSH timeouts while preserving the CoPP protection model?

Accepted Answer

Add a class-map matching TCP port 22 traffic and attach it to the policy-map with an appropriate rate and conform/exceed actions.. CoPP works by classifying punted control-plane traffic into classes and applying per-class policers. If SSH is not explicitly matched, it is handled by class-default, which is often policed conservatively. Creating a dedicated class matching TCP port 22 with an adequate rate and a conform action of transmit ensures interactive management traffic survives bursts while BGP and other protocols stay protected.

Answer

Remove the service-policy from the control plane and rely on QoS on the data plane instead.

Answer

Increase the BGP class rate and move the SSH class into the BGP class-map.

Answer

Configure an ACL that permits only the jump host's IP and apply it as the match for the class-default class.

Question 8

A network security team is deploying Cisco TrustSec in a data center environment. They want to assign Security Group Tags (SGTs) to traffic based on user identity and device type without relying on IP addresses or VLANs. The team plans to use inline tagging on Cisco Nexus switches that support hardware-based SGACL enforcement. Which statement correctly describes how inline tagging propagates SGT information?

Accepted Answer

The SGT is inserted into the Layer 2 frame using Cisco Metadata (CMD) fields, allowing downstream devices to enforce SGACLs without reclassification.. Inline tagging in Cisco TrustSec inserts the SGT directly into the Ethernet frame using Cisco Metadata fields. This allows downstream devices to enforce SGACLs based on the original classification without needing to reclassify traffic, preserving security group integrity across the network path.

Answer

The SGT is encoded in the DSCP field of the IP header, enabling enforcement at any Layer 3 device along the path.

Answer

The SGT is stored in the ARP cache of each device, and devices query a central server to resolve SGTs for enforcement decisions.

Answer

The SGT is propagated through a proprietary GRE tunnel between all TrustSec-capable devices, encapsulating the original frame.

Question 9

A network administrator is configuring IPsec VPN on a Cisco IOS router. The administrator wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which configuration element is required to define this traffic?

Accepted Answer

A crypto ACL that permits IP traffic from 10.1.1.0/24 to 10.2.2.0/24.. IPsec uses a crypto ACL to define which traffic is protected. This ACL is referenced in a crypto map, which is applied to the interface. Traffic matching the ACL is encrypted; other traffic is not. The crypto ACL must permit the specific source and destination subnets. Other options do not correctly identify interesting traffic for IPsec.

Answer

An ACL applied to the outside interface with 'ip access-group' to permit the traffic and enable encryption.

Answer

A prefix list that permits the source and destination subnets, applied to the crypto map.

Answer

A route map that matches the source and destination subnets and sets the next-hop to the VPN peer.

Question 10

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which IPsec configuration component defines this traffic?

Accepted Answer

Access control list (ACL). In Cisco IPsec configuration, the ACL (often called the crypto ACL) specifies the traffic that should be protected. The crypto map then references this ACL. Traffic that matches the ACL is encrypted; traffic that does not match is sent in clear text. Therefore, the ACL is the component that defines the interesting traffic.

Answer

Transform set

Answer

Crypto map

Answer

IKE policy

Question 11

A network engineer is implementing MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two campus distribution switches. Which two statements accurately describe MACsec operation on Cisco platforms? (Choose two.)

Accepted Answer

MACsec uses the MACsec Key Agreement (MKA) protocol to negotiate and distribute session keys between peers.. MACsec is a Layer 2 hop-by-hop security standard that encrypts Ethernet frames and validates integrity between directly connected devices. The MKA protocol handles key negotiation and distribution, electing a key server and refreshing keys. It does not provide end-to-end protection across Layer 3 hops and does not rely on IKEv2, which belongs to the IPsec suite.

Answer

MACsec can secure traffic end-to-end between two hosts separated by multiple Layer 3 hops.

Answer

MACsec requires the use of IKEv2 to establish the security association between switches.

Answer

MACsec encrypts the entire IP packet including the original source and destination IP addresses.

Question 12

A network administrator is hardening a Cisco IOS switch that connects to user workstations. The security policy requires that when an unauthorized MAC address appears on an access port, the port must drop only the offending frames, generate a syslog message, and increment a counter, without shutting down the port or requiring administrative intervention. Which port security violation mode meets these requirements?

Accepted Answer

restrict. Port security offers three violation modes. Restrict drops unauthorized frames while sending SNMP traps, syslog messages, and incrementing the violation counter, and it leaves the port operational. Because the policy forbids err-disable and requires logging plus counters, restrict is the only mode that satisfies all conditions simultaneously.

Answer

shutdown

Answer

protect

Answer

drop-and-log

Question 13

A security architect is designing a campus network where all access-layer switch ports must authenticate endpoints before granting any Layer 2 connectivity. The design requires the switch to communicate with Cisco ISE using EAP over RADIUS, and the endpoint must be validated before any VLAN assignment occurs. Which 802.1X component role must the access-layer switch perform in this design?

Accepted Answer

Authenticator. In 802.1X, the three roles are supplicant, authenticator, and authentication server. The access-layer switch controls the physical port and relays EAP messages between the endpoint and Cisco ISE, so it functions as the authenticator. It also enforces the authorization result, such as a dynamic VLAN or downloadable ACL, which satisfies the requirement that the endpoint be validated before Layer 2 access is granted.

Answer

Authentication server

Answer

RADIUS proxy

Answer

Supplicant

Question 14

A network engineer is deploying 802.1X on a Cisco switch with Cisco ISE as the RADIUS server. The engineer wants to allow devices that do not support 802.1X supplicant to connect to a guest VLAN. Which feature should be configured on the switch port to accomplish this?

Accepted Answer

Enable MAB (MAC Authentication Bypass) on the port.. MAC Authentication Bypass (MAB) enables non-802.1X devices to authenticate using their MAC address. The switch sends the MAC to ISE, which can authorize the device and assign it to a guest VLAN via RADIUS attributes. This allows devices like printers or legacy IP phones to gain network access without supplicant software, while still enforcing policy.

Answer

Configure the port as a trunk port with native VLAN set to the guest VLAN.

Answer

Set the port to force-authorized mode.

Answer

Configure the port as a multi-auth port with an authentication open mode.

Question 15

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote users. The requirement is to use a protocol that supports both IKEv2 and native IPv6 transport, and that can provide per-user policy enforcement. Which technology should the administrator implement?

Accepted Answer

FlexVPN with IKEv2 and per-user attributes.. FlexVPN is the correct choice because it is built on IKEv2 and supports IPv6 transport. It also provides per-user policy enforcement through authorization attributes, making it ideal for a remote access VPN headend. Other options either do not support IKEv2, are designed for site-to-site topologies, or lack per-user policy enforcement.

Answer

Dynamic Multipoint VPN (DMVPN) with mGRE and NHRP.

Answer

GET VPN with Group Domain of Interpretation (GDOI).

Answer

SSL VPN with Cisco AnyConnect.