How should I use these Infrastructure Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Infrastructure Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Infrastructure Security domain.

350-401 · topic practice

Infrastructure Security practice questions

Practise ENCOR 350-401 Infrastructure Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Infrastructure Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Infrastructure Security

Infrastructure Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Infrastructure Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Infrastructure Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Infrastructure Security explanation →

A network engineer is configuring port security on a Cisco switch. The requirement is to allow only the first MAC address that appears on the port to be learned and to automatically disable the port if a violation occurs. The engineer configures 'switchport port-security mac-address sticky' but does not specify a maximum number of secure MAC addresses. After connecting a single host, the port works. However, when the host is replaced with a different device, the port is error-disabled. What is the most likely reason?

Trap 1: The sticky keyword requires the engineer to first manually…

Incorrect because sticky can be used without specifying a maximum; the default maximum is 1.

Trap 2: The violation mode is set to 'restrict' by default, which causes…

Incorrect because the default violation mode is 'shutdown', not 'restrict'.

Trap 3: The port security aging type is set to 'absolute' by default,…

Incorrect because aging is not enabled by default and does not cause error-disable on a new MAC.

Study all Infrastructure Security common traps →

A
The default maximum number of secure MAC addresses is 1, so the second MAC address triggers a violation.
Correct because the default maximum is 1, and sticky learning does not change that.
B
The sticky keyword requires the engineer to first manually configure a maximum number of MAC addresses.
Why wrong: Incorrect because sticky can be used without specifying a maximum; the default maximum is 1.
C
The violation mode is set to 'restrict' by default, which causes the port to error-disable after one violation.
Why wrong: Incorrect because the default violation mode is 'shutdown', not 'restrict'.
D
The port security aging type is set to 'absolute' by default, causing the sticky address to expire immediately.
Why wrong: Incorrect because aging is not enabled by default and does not cause error-disable on a new MAC.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Infrastructure Security explanation →

An enterprise network uses 802.1X for wired access. The authentication server is a Cisco ISE. Recently, some Windows 10 clients fail to authenticate, while others succeed. The engineer checks the switch configuration and finds 'authentication port-control auto' and 'dot1x pae authenticator' are configured. The failing clients show 'EAP failure' in the logs. The engineer suspects a mismatch in EAP method. Which EAP method is most likely causing the issue if the ISE is configured to require EAP-TLS but the Windows clients are configured for PEAP-MSCHAPv2?

Trap 1: EAP-FAST requires a PAC file that the Windows clients do not have.

Incorrect because the scenario describes a mismatch between EAP-TLS and PEAP, not EAP-FAST.

Trap 2: LEAP uses a shared secret that is not configured on the clients.

Incorrect because LEAP is not mentioned and is not the method in question.

Trap 3: EAP-MD5 does not support mutual authentication, causing the failure.

Incorrect because EAP-MD5 is not the method used by the clients or server.

Study all Infrastructure Security common traps →

A
EAP-TLS requires a client certificate, which the Windows clients do not have.
Correct because EAP-TLS requires client certificates, and PEAP-MSCHAPv2 does not provide them.
B
EAP-FAST requires a PAC file that the Windows clients do not have.
Why wrong: Incorrect because the scenario describes a mismatch between EAP-TLS and PEAP, not EAP-FAST.
C
LEAP uses a shared secret that is not configured on the clients.
Why wrong: Incorrect because LEAP is not mentioned and is not the method in question.
D
EAP-MD5 does not support mutual authentication, causing the failure.
Why wrong: Incorrect because EAP-MD5 is not the method used by the clients or server.

Full breakdown with real-world context →

Question 3mediummultiple choice

Study the full ACL explanation →

A network engineer is configuring CoPP on a Cisco router to protect the control plane from excessive traffic. The router experiences high CPU utilization due to SSH and SNMP traffic. The engineer creates a class-map to match SSH (TCP/22) and SNMP (UDP/161) and applies a policy-map that polices this traffic to 1 Mbps. After applying the policy, legitimate SSH sessions from the management station start dropping intermittently. What is the most likely cause?

Trap 1: The CoPP policy is applied to the wrong interface, affecting…

Incorrect because CoPP is applied to the control plane, not an interface.

Trap 2: The class-map should match on DSCP values instead of port numbers…

Incorrect because matching port numbers is valid; the issue is the police rate.

Trap 3: The policy-map should use the 'drop' action instead of 'police' to…

Incorrect because 'police' is the correct action; 'drop' would drop all matched traffic.

Study all Infrastructure Security common traps →

A
The police rate of 1 Mbps is too low for the combined SSH and SNMP traffic from the management station.
Correct because the police rate is insufficient, causing drops of legitimate control plane traffic.
B
The CoPP policy is applied to the wrong interface, affecting transit traffic instead of control plane traffic.
Why wrong: Incorrect because CoPP is applied to the control plane, not an interface.
C
The class-map should match on DSCP values instead of port numbers to be effective.
Why wrong: Incorrect because matching port numbers is valid; the issue is the police rate.
D
The policy-map should use the 'drop' action instead of 'police' to protect the control plane.
Why wrong: Incorrect because 'police' is the correct action; 'drop' would drop all matched traffic.

Full breakdown with real-world context →

Question 4hardmultiple choice

Open the full VLAN trunking answer →

A network engineer is implementing DHCP snooping on a Cisco switch to prevent rogue DHCP servers. The switch has multiple VLANs, and the DHCP server is connected to interface GigabitEthernet0/1 in VLAN 10. The engineer enables DHCP snooping globally and for VLAN 10, then configures 'ip dhcp snooping trust' on GigabitEthernet0/1. However, clients in VLAN 10 are not receiving IP addresses. The engineer checks the DHCP snooping binding table and sees no entries. What is the most likely cause?

Trap 1: The interface GigabitEthernet0/1 should be configured as an…

Incorrect because the server port must be trusted to allow DHCP replies.

Trap 2: The switch has DHCP snooping rate limiting enabled, which is…

Incorrect because rate limiting is not mentioned and would not prevent all DHCP packets.

Trap 3: The DHCP server is connected to a port in a different VLAN, and…

Incorrect because DHCP snooping works across VLANs with a helper address.

Study all Infrastructure Security common traps →

A
The switch does not have an 'ip helper-address' configured to forward DHCP requests to the server.
Correct because the DHCP server is in VLAN 10, but clients may be in a different VLAN, requiring a helper address.
B
The interface GigabitEthernet0/1 should be configured as an untrusted port for DHCP snooping.
Why wrong: Incorrect because the server port must be trusted to allow DHCP replies.
C
The switch has DHCP snooping rate limiting enabled, which is dropping all DHCP packets.
Why wrong: Incorrect because rate limiting is not mentioned and would not prevent all DHCP packets.
D
The DHCP server is connected to a port in a different VLAN, and DHCP snooping only works within the same VLAN.
Why wrong: Incorrect because DHCP snooping works across VLANs with a helper address.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is configuring dynamic ARP inspection (DAI) on a Cisco switch to prevent ARP spoofing. The switch has DHCP snooping enabled and the DHCP server is trusted. The engineer enables DAI on VLAN 10 and configures 'ip arp inspection trust' on the port connected to the DHCP server. After enabling DAI, some legitimate ARP replies from hosts are being dropped. The engineer checks the DAI statistics and sees 'ARP ACL drops' incrementing. What is the most likely reason?

Trap 1: The port connected to the DHCP server should be untrusted for DAI…

Incorrect because the DHCP server port must be trusted to allow its ARP traffic.

Trap 2: The DHCP server is in a different VLAN, and DAI cannot validate…

Incorrect because DAI operates per VLAN and can validate ARP from any source if the binding exists.

Trap 3: DAI is checking the destination MAC address, which does not match…

Incorrect because DAI checks source MAC and IP, not destination.

Study all Infrastructure Security common traps →

A
The hosts have static IP addresses, so their MAC-IP bindings are not in the DHCP snooping database.
Correct because DAI relies on the DHCP snooping binding table; static hosts require an ARP ACL.
B
The port connected to the DHCP server should be untrusted for DAI to work correctly.
Why wrong: Incorrect because the DHCP server port must be trusted to allow its ARP traffic.
C
The DHCP server is in a different VLAN, and DAI cannot validate cross-VLAN ARP.
Why wrong: Incorrect because DAI operates per VLAN and can validate ARP from any source if the binding exists.
D
DAI is checking the destination MAC address, which does not match the expected value.
Why wrong: Incorrect because DAI checks source MAC and IP, not destination.

Full breakdown with real-world context →

Question 6hardmultiple choice

Study the full IPv6 explanation →

A network engineer is configuring IPv6 First Hop Security on a Cisco switch to mitigate rogue RA attacks. The engineer enables RA guard on the switch and applies a policy that allows only the default gateway to send RAs. After configuration, hosts are unable to obtain IPv6 addresses via SLAAC. The engineer checks the switch and sees that RA guard is dropping all RAs. What is the most likely cause?

Trap 1: The switch has DHCPv6 snooping enabled, which conflicts with RA…

Incorrect because DHCPv6 snooping and RA guard can coexist; they address different threats.

Trap 2: SLAAC requires the host to send a router solicitation first, which…

Incorrect because RA guard filters RAs, not router solicitations.

Trap 3: RA guard is configured in 'block' mode, which drops all RAs…

Incorrect because RA guard uses a policy; 'block' mode is not a standard configuration.

Study all Infrastructure Security common traps →

A
The RA guard policy does not include the IPv6 address or MAC address of the legitimate default gateway.
Correct because RA guard drops RAs from devices not matching the policy, so the gateway's RAs are dropped.
B
The switch has DHCPv6 snooping enabled, which conflicts with RA guard.
Why wrong: Incorrect because DHCPv6 snooping and RA guard can coexist; they address different threats.
C
SLAAC requires the host to send a router solicitation first, which is being blocked by RA guard.
Why wrong: Incorrect because RA guard filters RAs, not router solicitations.
D
RA guard is configured in 'block' mode, which drops all RAs regardless of the policy.
Why wrong: Incorrect because RA guard uses a policy; 'block' mode is not a standard configuration.

Full breakdown with real-world context →

Question 7mediummultiple choice

Review the full routing breakdown →

A network engineer is configuring a zone-based firewall (ZBF) on a Cisco router to allow traffic from the inside zone to the outside zone while blocking traffic from outside to inside. The engineer creates zones, assigns interfaces, and configures a policy-map with a class-map that matches all traffic from inside to outside. The engineer applies the policy to the zone-pair inside-to-outside. However, traffic from inside to outside is being dropped. What is the most likely reason?

Trap 1: The zone-pair should be configured as outside-to-inside instead.

Incorrect because the zone-pair direction is correct for inside-to-outside traffic.

Trap 2: The class-map must also match return traffic for the firewall to…

Incorrect because inspection automatically allows return traffic.

Trap 3: The policy-map is applied to the wrong zone-pair; it should be…

Incorrect because policies are applied to zone-pairs, not zones.

Study all Infrastructure Security common traps →

A
The policy-map does not include an 'inspect' or 'pass' action for the matched traffic.
Correct because without an explicit action, ZBF drops all traffic.
B
The zone-pair should be configured as outside-to-inside instead.
Why wrong: Incorrect because the zone-pair direction is correct for inside-to-outside traffic.
C
The class-map must also match return traffic for the firewall to allow the session.
Why wrong: Incorrect because inspection automatically allows return traffic.
D
The policy-map is applied to the wrong zone-pair; it should be applied to the inside zone.
Why wrong: Incorrect because policies are applied to zone-pairs, not zones.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Infrastructure Security explanation →

A network engineer is implementing MACsec on a Cisco switch-to-switch link to provide encryption. Both switches support MACsec and are configured with the same pre-shared key (PSK). The engineer configures 'mka' and 'macsec' on the interfaces. After configuration, the link does not come up, and the engineer sees 'MKA not operational' in the show macsec status. What is the most likely cause?

Trap 1: MACsec requires a RADIUS server for key distribution, which is not…

Incorrect because MACsec can use PSK without a RADIUS server.

Trap 2: The interfaces are configured with different VLANs, causing MACsec…

Incorrect because MACsec operates at Layer 2 and does not depend on VLAN configuration.

Trap 3: The interfaces must be configured as trunk ports for MACsec to work.

Incorrect because MACsec works on both access and trunk ports.

Study all Infrastructure Security common traps →

A
The pre-shared key (PSK) configured on both switches does not match.
Correct because MKA requires matching keys to establish a secure channel.
B
MACsec requires a RADIUS server for key distribution, which is not configured.
Why wrong: Incorrect because MACsec can use PSK without a RADIUS server.
C
The interfaces are configured with different VLANs, causing MACsec to fail.
Why wrong: Incorrect because MACsec operates at Layer 2 and does not depend on VLAN configuration.
D
The interfaces must be configured as trunk ports for MACsec to work.
Why wrong: Incorrect because MACsec works on both access and trunk ports.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full NAT/PAT explanation →

A network engineer is configuring uRPF (unicast Reverse Path Forwarding) on a Cisco router to prevent spoofed IP traffic. The engineer enables uRPF in strict mode on the ingress interface connected to the internal network. After enabling uRPF, legitimate traffic from internal hosts is being dropped. The engineer checks the routing table and sees that the routes for the internal subnets are present. What is the most likely cause?

Trap 1: uRPF is checking the destination IP address, which is not reachable.

Incorrect because uRPF checks the source IP, not the destination.

Trap 2: The router does not have a default route, so uRPF drops all traffic.

Incorrect because uRPF only checks for a matching route, not a default route.

Trap 3: uRPF cannot be used with static routes; it requires a dynamic…

Incorrect because uRPF works with any type of route.

Study all Infrastructure Security common traps →

A
The return route for the source IP points to a different interface than the one where the packet arrived.
Correct because strict uRPF requires the source IP to have a route back out the same interface.
B
uRPF is checking the destination IP address, which is not reachable.
Why wrong: Incorrect because uRPF checks the source IP, not the destination.
C
The router does not have a default route, so uRPF drops all traffic.
Why wrong: Incorrect because uRPF only checks for a matching route, not a default route.
D
uRPF cannot be used with static routes; it requires a dynamic routing protocol.
Why wrong: Incorrect because uRPF works with any type of route.

Full breakdown with real-world context →

Question 10mediummultiple choice

Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2         1   FULL/DR         00:00:38    192.168.1.2     GigabitEthernet0/0
10.0.0.3         1   2WAY/DROTHER   00:00:32    192.168.1.3     GigabitEthernet0/0
10.0.0.4         1   FULL/BDR        00:00:35    192.168.1.4     GigabitEthernet0/0

Based on this output, what can be concluded?

Trap 1: Router R1 is the DR on this segment.

R1 is not the DR; the DR is 10.0.0.2.

Trap 2: Router R1 is the BDR on this segment.

R1 is not the BDR; the BDR is 10.0.0.4.

Trap 3: Router R1 has no OSPF neighbors.

The output shows three neighbors, so R1 has OSPF neighbors.

Study all Infrastructure Security common traps →

A
Router R1 is the DR on this segment.
Why wrong: R1 is not the DR; the DR is 10.0.0.2.
B
Router R1 is the BDR on this segment.
Why wrong: R1 is not the BDR; the BDR is 10.0.0.4.
C
Router R1 is a DROTHER on this segment.
R1 has a FULL adjacency with DR and BDR, but only 2WAY with another DROTHER, indicating R1 is also a DROTHER.
D
Router R1 has no OSPF neighbors.
Why wrong: The output shows three neighbors, so R1 has OSPF neighbors.

Full breakdown with real-world context →

Question 11mediummultiple choice

Open the full VLAN trunking answer →

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 0011.2233.4455 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0011.2233.4466 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec

Interface           Role Sts Cost      Prio.Nbr Type

------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Gi0/3 Desg FWD 19 128.3 P2p

Based on this output, what can be concluded?

Trap 1: SW1 is the root bridge for VLAN 10.

The root bridge has address 0011.2233.4455, not SW1's address 0011.2233.4466.

Trap 2: Gi0/3 is a root port.

Gi0/3 is a designated port (Desg), not a root port.

Trap 3: The root bridge has a higher priority than SW1.

Both have the same priority (32768 + 10 = 32778), so the root is chosen by lower MAC address.

Study all Infrastructure Security common traps →

A
SW1 is the root bridge for VLAN 10.
Why wrong: The root bridge has address 0011.2233.4455, not SW1's address 0011.2233.4466.
B
Gi0/2 is in blocking state due to loop prevention.
Gi0/2 is an alternate port in blocking state, which is normal STP behavior to prevent loops.
C
Gi0/3 is a root port.
Why wrong: Gi0/3 is a designated port (Desg), not a root port.
D
The root bridge has a higher priority than SW1.
Why wrong: Both have the same priority (32768 + 10 = 32778), so the root is chosen by lower MAC address.

Full breakdown with real-world context →

Question 12easymultiple choice

Review the full routing breakdown →

A network engineer runs the following command on Router R1:

R1# show ip access-lists 101

Extended IP access list 101

10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (100 matches)
    
20 deny tcp any any eq 23 (50 matches)
    
30 permit ip any any (200 matches)

Based on this output, what can be concluded?

Trap 1: Telnet traffic from 192.168.1.0/24 is permitted.

The first entry only permits HTTP, not Telnet. The second entry denies Telnet from any source, including 192.168.1.0/24.

Trap 2: HTTP traffic from any source is permitted.

HTTP is only permitted from 192.168.1.0/24, not from any source.

Trap 3: All traffic is permitted because of the last entry.

The last entry permits all IP traffic, but Telnet is still denied because ACLs are processed sequentially and the deny entry is hit first for Telnet.

Study all Infrastructure Security common traps →

A
Telnet traffic from 192.168.1.0/24 is permitted.
Why wrong: The first entry only permits HTTP, not Telnet. The second entry denies Telnet from any source, including 192.168.1.0/24.
B
Telnet traffic from any source is denied.
Entry 20 denies TCP port 23 (Telnet) from any source to any destination.
C
HTTP traffic from any source is permitted.
Why wrong: HTTP is only permitted from 192.168.1.0/24, not from any source.
D
All traffic is permitted because of the last entry.
Why wrong: The last entry permits all IP traffic, but Telnet is still denied because ACLs are processed sequentially and the deny entry is hit first for Telnet.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full NAT/PAT explanation →

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 203.0.113.10 192.168.1.10 --- --- --- 203.0.113.11 192.168.1.11 --- --- tcp 203.0.113.10:1024 192.168.1.10:1024 198.51.100.5:80 198.51.100.5:80

Based on this output, what can be concluded?

Trap 1: The router is performing dynamic NAT for all translations.

The first two entries are static, not dynamic. Only the third entry is dynamic.

Trap 2: The router is performing Port Address Translation (PAT) for all…

The first two entries do not use port numbers, so they are not PAT. The third entry uses a port, but it is only one translation.

Trap 3: The router is translating outside global addresses to inside local…

NAT translates inside local to inside global, not the other way around. The outside addresses remain unchanged.

Study all Infrastructure Security common traps →

A
The router is performing static NAT for two internal hosts.
The first two entries show a one-to-one mapping between inside local and inside global addresses without any protocol or outside address, which is characteristic of static NAT.
B
The router is performing dynamic NAT for all translations.
Why wrong: The first two entries are static, not dynamic. Only the third entry is dynamic.
C
The router is performing Port Address Translation (PAT) for all translations.
Why wrong: The first two entries do not use port numbers, so they are not PAT. The third entry uses a port, but it is only one translation.
D
The router is translating outside global addresses to inside local addresses.
Why wrong: NAT translates inside local to inside global, not the other way around. The outside addresses remain unchanged.

Full breakdown with real-world context →

Question 14hardmultiple choice

Study the full QoS explanation →

A network engineer runs the following command on Router R1:

R1# show policy-map interface GigabitEthernet0/0

GigabitEthernet0/0

Service-policy input: QOS_POLICY

Class-map: VOICE (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 police cir 1000000 bc 31250 be 31250 conformed 0 bytes; actions: transmit exceeded 0 bytes; actions: drop violated 0 bytes; actions: drop

Class-map: class-default (match-any) 100 packets, 12000 bytes 5 minute offered rate 8000 bps, drop rate 0 bps Match: any Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 100/12000

Based on this output, what can be concluded?

Trap 1: The policy is applied in the output direction.

The output says 'Service-policy input', so it is applied inbound.

Trap 2: All traffic is being policed at 8 kbps.

Only the VOICE class has policing; class-default does not have a police command.

Trap 3: The policy is shaping traffic to 1 Mbps.

The policy uses policing (police command), not shaping.

Study all Infrastructure Security common traps →

A
The policy is applied in the output direction.
Why wrong: The output says 'Service-policy input', so it is applied inbound.
B
Voice traffic is being policed at 1 Mbps and any excess is dropped.
The VOICE class has a police statement with CIR 1 Mbps, and actions for exceed and violate are drop.
C
All traffic is being policed at 8 kbps.
Why wrong: Only the VOICE class has policing; class-default does not have a police command.
D
The policy is shaping traffic to 1 Mbps.
Why wrong: The policy uses policing (police command), not shaping.

Full breakdown with real-world context →

Question 15mediummultiple choice

Study the full AAA explanation →

A network engineer runs the following command on Router R1:

R1# show aaa sessions

Total sessions since last reset: 10

Session Id: 5 Unique Id: 5 User Name: admin

IP Address: 192.168.1.100

Idle Time: 0:00:05 Timeout: 0:10:00 Type: SSH Method: local

Session Id: 6 Unique Id: 6 User Name: neteng

IP Address: 10.0.0.2

Idle Time: 0:02:30 Timeout: 0:10:00 Type: SSH Method: tacacs+

Based on this output, what can be concluded?

Trap 1: Both sessions are authenticated using TACACS+.

Session 5 uses local authentication, not TACACS+.

Trap 2: Session 6 will be disconnected due to idle timeout.

The idle time is 2:30, less than the timeout of 10:00, so it is not yet disconnected.

Trap 3: Both sessions are using RADIUS for authentication.

Neither session uses RADIUS; one uses local, the other TACACS+.

Study all Infrastructure Security common traps →

A
Both sessions are authenticated using TACACS+.
Why wrong: Session 5 uses local authentication, not TACACS+.
B
Session 5 is authenticated locally.
The Method field for session 5 is 'local', indicating local authentication.
C
Session 6 will be disconnected due to idle timeout.
Why wrong: The idle time is 2:30, less than the timeout of 10:00, so it is not yet disconnected.
D
Both sessions are using RADIUS for authentication.
Why wrong: Neither session uses RADIUS; one uses local, the other TACACS+.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full VRF explanation →

A network engineer runs the following command on Router R1:

R1# show vrf brief

Name Default RD Protocols Interfaces CUSTOMER_A 65000:100 ipv4 Gi0/0.100 CUSTOMER_B 65000:200 ipv4 Gi0/0.200 MANAGEMENT 65000:999 ipv4 Gi0/1

Based on this output, what can be concluded?

Trap 1: All VRFs are using the same route distinguisher.

Each VRF has a different RD: 65000:100, 65000:200, and 65000:999.

Trap 2: The MANAGEMENT VRF is used for customer traffic.

MANAGEMENT is likely for out-of-band management, not customer traffic.

Trap 3: The router is running MPLS L3VPN.

While VRFs are used in MPLS L3VPN, the output does not show any MPLS protocols or BGP VPNv4, so it could be for other purposes like VRF-lite.

Study all Infrastructure Security common traps →

A
All VRFs are using the same route distinguisher.
Why wrong: Each VRF has a different RD: 65000:100, 65000:200, and 65000:999.
B
The MANAGEMENT VRF is used for customer traffic.
Why wrong: MANAGEMENT is likely for out-of-band management, not customer traffic.
C
CUSTOMER_A and CUSTOMER_B are on the same physical interface but different subinterfaces.
Both are on Gi0/0 with different subinterfaces (.100 and .200), indicating they share the same physical port.
D
The router is running MPLS L3VPN.
Why wrong: While VRFs are used in MPLS L3VPN, the output does not show any MPLS protocols or BGP VPNv4, so it could be for other purposes like VRF-lite.

Full breakdown with real-world context →

Question 17hardmultiple choice

Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show ip bgp summary

BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 10, main routing table version 10

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 02:30:15       5
192.168.1.3     4        65003     500     498       10    0    0 00:15:20       3
10.0.0.2        4        65004       0       0        0    0    0 never    Active

Based on this output, what can be concluded?

Trap 1: All BGP neighbors are fully established.

The third neighbor is in Active state, not established.

Trap 2: The BGP session to 192.168.1.3 has been up for 2 hours 30 minutes.

The up/down time for 192.168.1.3 is 00:15:20, not 2:30:15.

Trap 3: The router is receiving prefixes from all neighbors.

The third neighbor has 0 prefixes received because the session is not established.

Study all Infrastructure Security common traps →

A
All BGP neighbors are fully established.
Why wrong: The third neighbor is in Active state, not established.
B
The BGP session to 10.0.0.2 is down due to a TCP connection issue.
The Active state indicates the router is trying to open a TCP connection but has not succeeded.
C
The BGP session to 192.168.1.3 has been up for 2 hours 30 minutes.
Why wrong: The up/down time for 192.168.1.3 is 00:15:20, not 2:30:15.
D
The router is receiving prefixes from all neighbors.
Why wrong: The third neighbor has 0 prefixes received because the session is not established.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full MPLS explanation →

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0; Local LDP Ident 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.49231 State: Oper; Msgs sent/rcvd: 100/95; Downstream Up time: 01:23:45 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 192.168.1.2 Addresses bound to peer LDP Ident:

10.0.0.2        192.168.1.2

Based on this output, what can be concluded?

Trap 1: The LDP session is not yet established.

The state is 'Oper', which means Operational, so the session is established.

Trap 2: The LDP neighbor is using a different router ID than 10.0.0.2.

The peer LDP Ident is 10.0.0.2:0, so the router ID is 10.0.0.2.

Trap 3: The LDP session has been up for 1 hour 23 minutes.

The up time is 01:23:45, which is 1 hour, 23 minutes, and 45 seconds, not just 1 hour 23 minutes.

Study all Infrastructure Security common traps →

A
The LDP session is not yet established.
Why wrong: The state is 'Oper', which means Operational, so the session is established.
B
The LDP session is using TCP port 646.
The TCP connection shows port 646, which is the well-known port for LDP.
C
The LDP neighbor is using a different router ID than 10.0.0.2.
Why wrong: The peer LDP Ident is 10.0.0.2:0, so the router ID is 10.0.0.2.
D
The LDP session has been up for 1 hour 23 minutes.
Why wrong: The up time is 01:23:45, which is 1 hour, 23 minutes, and 45 seconds, not just 1 hour 23 minutes.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full Infrastructure Security explanation →

Examine the following interface configuration on a Cisco IOS-XE switch: ```

interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky

``` What is the effect of this configuration?

Trap 1: The port will learn up to 2 MAC addresses and then shut down if a…

Incorrect. Shutdown behavior requires 'violation shutdown'.

Trap 2: The port will allow only 2 MAC addresses and will generate a syslog…

Incorrect. 'restrict' drops the traffic, it does not forward it.

Trap 3: The port will learn MAC addresses dynamically and convert them to…

Incorrect. The maximum is explicitly set to 2.

Study all Infrastructure Security common traps →

A
The port will dynamically learn MAC addresses, allow up to 2 addresses, and if a third MAC is seen, it will drop the traffic but keep the port up.
Correct. 'violation restrict' drops frames from unknown MACs without disabling the port.
B
The port will learn up to 2 MAC addresses and then shut down if a third is seen.
Why wrong: Incorrect. Shutdown behavior requires 'violation shutdown'.
C
The port will allow only 2 MAC addresses and will generate a syslog message but continue forwarding traffic from the third MAC.
Why wrong: Incorrect. 'restrict' drops the traffic, it does not forward it.
D
The port will learn MAC addresses dynamically and convert them to secure MAC addresses, but the maximum is 1 by default.
Why wrong: Incorrect. The maximum is explicitly set to 2.

Full breakdown with real-world context →

Question 20mediummultiple choice

Review the full routing breakdown →

Consider the following configuration on a Cisco IOS-XE router: ```

ip access-list extended BLOCK_SSH
 deny tcp any any eq 22
 permit ip any any

line vty 0 4

access-class BLOCK_SSH in ``` Which statement is true about this configuration?

Trap 1: The ACL blocks all traffic to the router because the deny statement…

Incorrect. The permit ip any any allows all other traffic.

Trap 2: The ACL only filters traffic going through the router, not destined…

Incorrect. An access-class on VTY lines filters traffic destined to the router.

Trap 3: The ACL permits SSH traffic because the permit statement overrides…

Incorrect. The deny is processed first and blocks SSH.

Study all Infrastructure Security common traps →

A
The ACL blocks all SSH traffic to the router, but permits other IP traffic.
Correct. The ACL is applied inbound on VTY lines, so SSH (TCP/22) is denied.
B
The ACL blocks all traffic to the router because the deny statement is first.
Why wrong: Incorrect. The permit ip any any allows all other traffic.
C
The ACL only filters traffic going through the router, not destined to it.
Why wrong: Incorrect. An access-class on VTY lines filters traffic destined to the router.
D
The ACL permits SSH traffic because the permit statement overrides the deny.
Why wrong: Incorrect. The deny is processed first and blocks SSH.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Infrastructure Security sessions

Start a Infrastructure Security only practice session

Every question in these sessions is drawn from the Infrastructure Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Infrastructure Security questions →Mixed 350-401 session

Frequently asked questions

What does the 350-401 exam test about Infrastructure Security?: Infrastructure Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Infrastructure Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Infrastructure Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-401 topics?: Use the topic links above to move to related areas, or go back to the 350-401 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-401 exam covers. They are not copied from any real exam or dump site.

Infrastructure Security only

10 questions 20 questions 30 questions 50 questions

Mixed 350-401 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-401 questions Infrastructure Security domain overview 350-401 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Infrastructure Security practice questions

What to know about Infrastructure Security

Common Infrastructure Security exam traps

Infrastructure Security questions

Track your progress over time

Start a Infrastructure Security only practice session

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid