67 of 142 questions · Page 2/2 · Security · Answers revealed
Order the steps to upgrade the software on a Cisco Nexus switch using ISSU.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
ISSU requires image copy, boot variable, compatibility check, upgrade command, and reload.
In Cisco TrustSec, which technology is used to enforce east-west traffic policies based on identity without relying on IP addresses?
SGACLs use SGTs for policy.
Why this answer
SGACLs enforce policies based on SGTs, not IP addresses.
Refer to the exhibit. The CoPP policy above is applied. Which traffic is most likely to be dropped?
The ICMP class drops packets that exceed the police rate.
Why this answer
The CoPP policy explicitly defines a class-map for ICMP traffic with a police rate of 1000 bps. Any ICMP traffic exceeding this rate is dropped due to the 'drop' action in the police command. The other classes (OSPF and class-default) have higher rates and are not as constrained, making ICMP the most likely to be dropped when exceeded.
Exam trap
Cisco often tests the misconception that all traffic exceeding its policed rate is equally likely to be dropped, but the trap here is that the lowest policed rate (ICMP at 1000 bps) is the most restrictive and thus the most likely to be exceeded and dropped, not the higher-rate classes.
How to eliminate wrong answers
Option A is wrong because the class-default traffic is policed at 20000 bps, which is a much higher rate than ICMP's 1000 bps, so class-default is less likely to be dropped unless it significantly exceeds its rate; ICMP is the primary concern. Option C is wrong because class-default traffic has a police rate of 20000 bps, which is 20 times higher than ICMP's rate, making it less likely to be dropped under typical traffic loads. Option D is wrong because OSPF traffic is policed at 5000 bps, which is 5 times higher than ICMP's rate, and OSPF control traffic is typically low-volume, so it is not the most likely to be dropped.
Two Cisco Nexus 9000 switches are connected via Ethernet interface 1/1. The engineer wishes to secure the link using MACsec (IEEE 802.1ae) with a pre-shared key for connectivity association key (CAK) protection. Both switches have the same hardware and software version supporting MACsec. The engineer configures the following on both switches: feature macsec macsec policy MACSEC_POLICY cipher-suite gcm-aes-128 security-mode no-encrypt mka sak-rekey-time 30 interface ethernet 1/1 macsec policy MACSEC_POLICY However, the link comes up without MACsec encryption (the port counter shows MACsec frames dropped). The engineer checks that the pre-shared key is configured correctly via 'macsec key-chain' but notices it was not explicitly applied. What is the most likely reason for MACsec failing to establish?
Correct. A key chain must be defined and linked to the policy, and the MKA policy must be explicitly applied under the interface.
Why this answer
MACsec on Cisco Nexus 9000 switches requires a key chain to be defined and explicitly referenced within the MACsec policy. Without the 'key-chain' command under the 'macsec policy', the pre-shared key (CAK) is not available for MKA (MACsec Key Agreement) to derive session keys. Additionally, the MKA policy must be applied to the interface using 'macsec mka policy' to enable the key agreement protocol; simply enabling MACsec on the interface without these steps leaves the link unsecured, causing MACsec frames to be dropped.
Exam trap
Cisco often tests the requirement that a key chain must be explicitly referenced in the MACsec policy and that an MKA policy must be applied to the interface, tricking candidates into thinking that simply enabling MACsec on the interface with a policy is sufficient.
How to eliminate wrong answers
Option A is wrong because the MACsec profile name does not need to match on both switches; only the key chain parameters (e.g., key string) must match for MKA to succeed. Option B is wrong because 'switchport macsec' is not a valid command on Nexus 9000; the interface is placed into MACsec mode by applying the MACsec policy directly with 'macsec policy' under the interface. Option D is wrong because 'feature macsec' is correctly enabled in the configuration, so MACsec is operational at the feature level; the failure is due to missing key chain and MKA policy application, not the feature being disabled.
Which THREE are characteristics of Cisco TrustSec? (Select exactly 3)
SGTs are central to TrustSec for classifying and enforcing access policies.
Why this answer
Cisco TrustSec uses Security Group Tags (SGTs) to enforce policy based on identity rather than IP addresses. It requires Cisco ISE as the policy server to assign SGTs and enforce access control. TrustSec operates at Layer 2 by embedding SGTs in Ethernet frames.
The CTS auth-proxy is a mechanism for legacy devices but is not a core characteristic; likewise, MACsec encryption is optional and not required.
Exam trap
A common mistake is to think TrustSec can work with any RADIUS server or that CTS auth-proxy is a core requirement. In fact, TrustSec mandates Cisco ISE, operates at Layer 2, and uses SGTs as its fundamental mechanism.
A UCS administrator needs to ensure that only the fabric interconnect management plane is accessible from the management network. Which feature should be implemented?
Management plane isolation restricts management access to dedicated interfaces.
Why this answer
Management plane isolation ensures that management traffic is separate from data traffic, often using dedicated management interfaces or VRFs.
A network administrator wants to prevent IP spoofing attacks on a data center access switch. The switch has IP Source Guard enabled on the client-facing ports. Which condition must be met for IP Source Guard to work properly?
IP Source Guard uses the DHCP snooping binding table on untrusted ports.
Why this answer
IP Source Guard uses a binding table created by DHCP snooping to validate the source IP address of packets received on a port. For IP Source Guard to work, DHCP snooping must be enabled on the VLAN, and the client-facing port must be configured as an untrusted port so that DHCP snooping can populate the binding table with valid DHCP lease information. Without this binding table, IP Source Guard has no source IP-to-MAC mapping to enforce.
Exam trap
Cisco often tests the dependency between IP Source Guard and DHCP snooping, specifically that DHCP snooping must be enabled on the VLAN and the port must be untrusted, leading candidates to incorrectly assume DHCP snooping must be disabled or that static IPs are unsupported.
How to eliminate wrong answers
Option A is wrong because DHCP snooping must be enabled on the VLAN to build the IP-to-MAC binding table that IP Source Guard relies on; disabling DHCP snooping would leave the binding table empty, causing IP Source Guard to drop all traffic. Option C is wrong because IP Source Guard supports static IP assignments if a static binding is manually configured using the 'ip source binding' command; it does not require all clients to use DHCP. Option D is wrong because Dynamic ARP Inspection (DAI) is a separate security feature that also depends on DHCP snooping, but IP Source Guard does not require DAI to be enabled first; both features can operate independently as long as DHCP snooping is active.
A network engineer is configuring VLAN ACLs on a Cisco Nexus 9000 switch to enforce traffic filtering between VLANs. Which configuration step is required to apply a VACL to a VLAN?
'vlan filter' applies the VACL to a specific VLAN.
Why this answer
VACLs on Cisco Nexus 9000 switches are applied using the 'vlan filter' command in global configuration mode, which references a VLAN access-map. This command binds the access-map to a specific VLAN, enabling Layer 2 traffic filtering between VLANs without requiring a Layer 3 interface.
Exam trap
Cisco often tests the distinction between applying an ACL to an interface versus applying a VACL to a VLAN, and the trap here is that candidates mistakenly think a VLAN access-map is applied directly under the VLAN configuration (like 'vlan 10' mode) rather than using the global 'vlan filter' command.
How to eliminate wrong answers
Option A is wrong because 'ip access-group' applies an IP ACL to a Layer 3 interface (SVI or routed port), not a VACL, and VACLs are not applied to Layer 3 interfaces. Option B is wrong because 'mac access-group' applies a MAC ACL to a physical port for Layer 2 traffic filtering on that port, not to a VLAN for inter-VLAN filtering. Option C is wrong because while defining a VLAN access-map is a necessary step, it must be applied using the 'vlan filter' command in global configuration mode, not under the VLAN configuration (the 'vlan' config mode does not support applying access-maps directly).
Which TWO features are used to validate ARP packets and prevent ARP spoofing attacks? (Select exactly 2)
DAI intercepts and validates ARP packets.
Why this answer
Dynamic ARP Inspection (DAI) is correct because it validates ARP packets by checking them against the DHCP snooping binding database, ensuring that only legitimate ARP replies and requests are forwarded. This prevents ARP spoofing attacks where an attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate device.
Exam trap
Cisco often tests the distinction between features that validate ARP packets (DAI) versus features that validate IP packets (IP Source Guard) or limit MAC addresses (Port Security), causing candidates to confuse the scope of each security mechanism.
In an ACI fabric, an EPG is configured with a contract that allows HTTP traffic to an external network. The external network is reachable via a Layer 3 Outside. However, HTTP traffic from the EPG fails. What is the most likely cause?
ACI contracts only work within the same VRF. If the L3Out is in a different VRF, route leaking is required.
Why this answer
In Cisco ACI, communication between an EPG and an external network via a Layer 3 Outside requires both to be in the same VRF. If the EPG and the L3Out are in different VRFs, the contract cannot be enforced, and traffic will fail even if the contract allows HTTP. The VRF provides the routing and policy enforcement boundary for the contract.
Exam trap
Cisco often tests the misconception that a contract alone is sufficient for inter-VRF communication, but in ACI, contracts are VRF-scoped and cannot bridge different VRFs without additional configuration like a VRF route leak or a shared service contract.
How to eliminate wrong answers
Option A is wrong because if the subject action were set to deny, the contract would explicitly block HTTP traffic, but the question states the contract allows HTTP, so the action is not deny. Option C is wrong because the filter direction (e.g., from consumer to provider) is correctly configured in the contract; the issue is not about direction but about VRF mismatch preventing any policy application. Option D is wrong because applying the contract to the consumer EPG instead of the provider is a valid configuration; the consumer EPG typically consumes the contract, and the provider EPG provides the service, so this would not cause a failure if the contract is correctly applied to the consumer.
An organization wants to encrypt Fibre Channel traffic in-flight between storage and servers. Which standard should be used?
FC-SP-2 encrypts FC frames.
Why this answer
FC-SP-2 provides encryption for Fibre Channel data in transit.
Which control plane protection mechanism should be configured to limit the rate of BGP updates destined to the CPU of a Nexus 9000 switch to prevent CPU overload?
CoPP rate-limits control plane packets.
Why this answer
Control Plane Policing (CoPP) is the correct mechanism because it directly filters and rate-limits control plane traffic, such as BGP updates, before it reaches the CPU of a Nexus 9000 switch. By applying a CoPP policy, you can protect the CPU from being overwhelmed by excessive BGP updates, ensuring stability and preventing denial-of-service conditions.
Exam trap
Cisco often tests the distinction between data plane and control plane mechanisms, and the trap here is that candidates may confuse VACLs (data plane filtering) with CoPP (control plane policing), assuming any ACL can protect the CPU.
How to eliminate wrong answers
Option A is wrong because VLAN Access Control Lists (VACLs) filter traffic within the data plane at the VLAN level, not the control plane, and cannot rate-limit BGP updates destined to the CPU. Option C is wrong because EtherChannel load balancing distributes data traffic across aggregated links to improve bandwidth and redundancy, but it has no mechanism to police or limit control plane traffic like BGP updates. Option D is wrong because Switched Port Analyzer (SPAN) is used for port mirroring traffic to a monitoring device for analysis, not for filtering or rate-limiting control plane packets to the CPU.
A Cisco ACI fabric has contracts configured to allow traffic between two EPGs. After deployment, traffic between endpoints in these EPGs is being dropped, but contract statistics show no packets have been permitted. The administrator checks the contract configuration and it looks correct. What is the most likely cause?
The consumer EPG must also consume the contract; otherwise, traffic is denied.
Why this answer
The most likely cause is that the contract is configured on the provider EPG but the consumer EPG is not configured to consume it. In Cisco ACI, a contract must be explicitly provided by one EPG and consumed by another for traffic to be permitted. If the consumer EPG does not have the contract applied, the contract will not be enforced, and traffic will be dropped even if the contract configuration appears correct.
The contract statistics showing no permitted packets confirm that the contract is not being applied to the traffic flow.
Exam trap
Cisco often tests the misconception that configuring a contract on the provider EPG alone is enough to permit traffic, when in fact the consumer EPG must also explicitly consume the contract for the policy to take effect.
How to eliminate wrong answers
Option B is wrong because applying a contract to the wrong VRF would prevent any communication between EPGs in different VRFs, but the contract statistics would show no packets at all, and the administrator would likely notice the VRF mismatch during configuration review. Option C is wrong because an incorrect filter direction or filter would still result in some packets being counted in contract statistics (e.g., denied packets), but the question states no packets have been permitted, indicating the contract itself is not being consumed. Option D is wrong because endpoints in different VMM domains can still communicate if the EPGs are in the same VRF and a contract is properly configured; VMM domain mismatch affects endpoint discovery and policy enforcement but does not directly cause contract statistics to show zero permitted packets.
Which two statements are true about Cisco TrustSec? (Choose two.)
ISE is the policy server that defines and distributes SGT-based policies.
Why this answer
Cisco TrustSec relies on a Cisco ISE policy server to define and enforce security policies based on Security Group Tags (SGTs). ISE acts as the centralized policy decision point, dynamically assigning SGTs to authenticated endpoints and distributing the SGT-to-IP bindings to network devices via SXP or inline tagging.
Exam trap
Cisco often tests the misconception that TrustSec requires 802.1X or provides mandatory encryption, when in fact 802.1X is just one of several authentication methods and encryption (MACsec) is an optional enhancement.
In a UCS environment, which method provides management plane isolation for the fabric interconnects?
The management port is physically separate from data ports.
Why this answer
UCS fabric interconnects have a dedicated management interface that can be placed in a separate management VLAN for isolation.
An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?
DHCP snooping blocks rogue DHCP servers.
Why this answer
DHCP snooping filters DHCP server messages on untrusted ports.
Which TWO statements about Cisco TrustSec in a data center environment are true? (Choose two.)
ISE assigns SGTs as part of policy after authentication.
Why this answer
Cisco ISE can dynamically assign Security Group Tags (SGTs) to endpoints during authentication via 802.1X or MAB, enabling role-based access control. This is a core TrustSec feature where the SGT is propagated to the network infrastructure to enforce policies.
Exam trap
Cisco often tests the misconception that TrustSec requires MACsec or IP-based tagging, when in fact SGTs are identity-based and MACsec is optional; candidates may also incorrectly assume TrustSec is Layer 3 only, ignoring its Layer 2 enforcement capabilities.
A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?
DHCP snooping filters DHCP offers from untrusted ports.
Why this answer
DHCP snooping is the correct defense against rogue DHCP servers because it filters DHCP messages on untrusted ports and allows only DHCP replies from trusted uplink ports. By enabling DHCP snooping globally and configuring uplink ports as trusted, the switch will drop DHCPOFFER and DHCPACK messages received on access ports, preventing a rogue server from handing out malicious IP configurations.
Exam trap
Cisco often tests the distinction between DHCP snooping (which blocks rogue DHCP servers) and DAI or IPSG (which rely on DHCP snooping but address different threats), leading candidates to confuse the security feature with its prerequisite.
How to eliminate wrong answers
Option A is wrong because dynamic ARP inspection (DAI) validates ARP packets based on DHCP snooping bindings, but it does not directly prevent a rogue DHCP server from sending DHCP offers. Option B is wrong because IP source guard (IPSG) filters IP traffic based on the DHCP snooping binding table, but it does not block DHCP server messages; it only prevents IP spoofing on data traffic. Option D is wrong because MAC port security limits the number of MAC addresses per port and prevents MAC flooding, but it has no mechanism to detect or block unauthorized DHCP servers.
A data center engineer is configuring 802.1X authentication on Cisco Nexus switches for wired endpoints. The requirement is to allow traffic on the port even if no EAPOL packet is received from the endpoint (e.g., a printer). Which authentication method should be used?
MAB uses the device's MAC address to authenticate against the RADIUS server if no EAPOL is received.
Why this answer
MAC Authentication Bypass (MAB) is the correct method because it allows a port to authenticate endpoints that do not send EAPOL frames, such as printers or other legacy devices. When no EAPOL is received within a configurable timeout, the switch falls back to using the source MAC address of the first frame as the authentication credential, sending it to the RADIUS server for verification. This satisfies the requirement to permit traffic even without 802.1X supplicant capability.
Exam trap
Cisco often tests the distinction between authentication methods that require EAPOL (802.1X) and those that do not (MAB), and the trap here is that candidates confuse port security or local authentication with network access control, failing to recognize that MAB is the specific fallback for non-EAPOL endpoints.
How to eliminate wrong answers
Option B is wrong because 802.1X using a RADIUS server requires the endpoint to send EAPOL frames to initiate authentication; if no EAPOL is received, the port remains unauthorized and blocks traffic. Option C is wrong because port security with sticky MAC addresses is a Layer 2 access control mechanism that limits the number of learned MAC addresses but does not integrate with RADIUS-based authentication or handle the absence of EAPOL. Option D is wrong because local authentication with a predefined list of users is used for device administration (e.g., SSH or console login), not for port-based network access control of wired endpoints.
A company runs a multi-tenant data center using Cisco ACI with multiple tenants. Each tenant has its own VRF and EPGs. The security policy requires that tenant A's web servers (EPG web_tenantA) be accessible from tenant B's application servers (EPG app_tenantB) only via HTTPS (TCP 443). The ACI fabric is configured with contracts. The administrator has created a contract with a filter for HTTPS (tcp dstPort 443) and applied it as a provider contract on EPG web_tenantA and as a consumer contract on EPG app_tenantB. However, traffic from tenant B's app servers to tenant A's web servers is being dropped. The administrator has verified that the contracts are applied correctly and the filter is correct. What is the most likely cause of the traffic drop?
ACI requires shared contracts for cross-tenant communication, and the EPGs must be in the same VRF or use a shared VRF.
Why this answer
In Cisco ACI, contracts are local to a VRF by default. For inter-tenant communication where each tenant has its own VRF, the contract must be explicitly marked as 'shared' and both EPGs must either be in the same VRF or use a shared VRF that allows cross-VRF policy enforcement. Without this, the contract filter is not applied across VRFs, causing traffic to be dropped even though the contract and filter are correctly configured.
Exam trap
Cisco often tests the misconception that contracts work across VRFs by default, when in fact they require explicit sharing configuration, leading candidates to overlook the 'shared contract' requirement.
How to eliminate wrong answers
Option A is wrong because EPGs do not need to be in the same bridge domain to communicate; ACI uses contracts to enable communication across different bridge domains and even across VRFs when properly configured. Option B is wrong because route leaking is not required for inter-VRF communication in ACI; contracts with a shared VRF handle the routing and policy enforcement between VRFs without explicit route leaking. Option D is wrong because the filter for HTTPS only needs to specify the destination port (tcp dstPort 443); source ports are ephemeral and automatically allowed by ACI's stateful nature, so specifying a source port range is unnecessary and would not cause traffic drops.
Which THREE are best practices for securing a data center network? (Choose three.)
Hardening reduces attack surface.
Why this answer
Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.
Exam trap
Cisco often tests the concept that security best practices must never sacrifice security for performance or convenience, so traps like 'disable logging' or 'use default strings' are designed to lure candidates who prioritize operational simplicity over security.
Refer to the exhibit. What is the effect of this configuration on traffic in VLAN 10?
Correct. The ACL denies Telnet (port 23) and permits all other traffic via an explicit permit ip any any.
Why this answer
The ACL applied to VLAN 10 contains two entries: the first denies TCP traffic destined for port 23 (Telnet), and the second permits all IP traffic (permit ip any any). As a result, Telnet packets are denied by the first entry, while all other traffic (including other TCP, UDP, ICMP, etc.) is permitted by the second entry. Option C correctly states this behavior.
Option A incorrectly says Telnet is permitted. Option B incorrectly says all except telnet is denied; actually all other traffic is permitted. Option D incorrectly says all traffic is permitted; telnet is denied.
Exam trap
Cisco often tests the implicit deny any any at the end of an ACL, leading candidates to forget that a permit statement must be explicitly added to allow other traffic; here the trap is that the ACL includes a permit ip any any, so the effect is selective denial rather than blanket denial.
How to eliminate wrong answers
Option A is wrong because it states Telnet traffic is permitted, but the ACL explicitly denies Telnet (TCP port 23), so Telnet is blocked. Option B is wrong because it claims all traffic is denied except Telnet, which is the opposite of the ACL's effect—Telnet is denied and other traffic is permitted. Option D is wrong because it says all traffic is permitted, but the ACL specifically denies Telnet traffic, so not all traffic is permitted.
A company uses Cisco TrustSec in its data center to enforce segmentation. Servers in VLAN 10 (Finance) should only communicate with servers in VLAN 20 (ERP) via an application gateway. Which TrustSec component is used to assign a Security Group Tag (SGT) to traffic from the Finance servers?
ISE assigns SGTs based on user or device identity.
Why this answer
In Cisco TrustSec, the Identity Services Engine (ISE) acts as the authentication and policy server that assigns Security Group Tags (SGTs) to endpoints or traffic based on identity and policy. ISE uses 802.1X, MAB, or web authentication to identify the Finance servers and then dynamically assigns the appropriate SGT, which is then used for segmentation enforcement.
Exam trap
Cisco often tests the distinction between the authentication mechanism (802.1X) and the policy server (ISE) that actually assigns the SGT, leading candidates to mistakenly select 802.1X as the component that assigns the tag.
How to eliminate wrong answers
Option B is wrong because MACsec provides link-layer encryption and integrity, not SGT assignment; it is used to secure TrustSec links after SGTs are already assigned. Option C is wrong because 802.1X is an authentication method that can be used by ISE to identify endpoints, but it does not directly assign SGTs—ISE is the component that maps the authenticated identity to an SGT. Option D is wrong because VLAN ACLs (VACLs) filter traffic based on Layer 2/3/4 fields, not SGTs; they are not part of the TrustSec SGT assignment process.
A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?
Contracts in ACI define allowed communication with filters for specific protocols/ports.
Why this answer
In Cisco ACI, contracts are the primary mechanism for enforcing policy-based communication between EPGs. By creating a contract between the web and app EPGs with a filter that permits HTTP (TCP/80), and another contract between management and web EPGs with a filter that denies SSH (TCP/22), the architect can precisely meet both requirements. Contracts allow granular control over which protocols and ports are allowed or denied, making them the correct construct for this access control scenario.
Exam trap
Cisco often tests the misconception that VRFs or bridge domains alone can provide security isolation, but in ACI, traffic filtering is always enforced via contracts, regardless of VRF or BD boundaries.
How to eliminate wrong answers
Option B is wrong because tenants are used for administrative and policy isolation between different customers or organizations, not for defining traffic rules between EPGs within the same tenant. Option C is wrong because VRFs (private L3 contexts) provide routing and forwarding isolation but do not enforce security policies like permitting or denying specific application traffic; contracts are still needed within a VRF. Option D is wrong because bridge domains define Layer 2 forwarding boundaries and subnets, not access control policies; they do not filter traffic based on protocols or ports.
A Nexus administrator wants to apply an IPv4 ACL to filter traffic on a specific VLAN. Which command is correct?
The correct syntax is applied to the VLAN interface.
Why this answer
ACLs on Nexus switches can be applied to VLANs using the 'ip access-group' command under the VLAN interface.
A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?
The DHCP server port must be trusted to permit DHCP server messages such as OFFER and ACK.
Why this answer
DHCP snooping uses the concept of trusted and untrusted ports. By default, all ports are untrusted. Setting Ethernet 1/1, where the legitimate DHCP server is connected, as a trusted port allows DHCP server messages (OFFER, ACK, etc.) from that port to be forwarded.
All other ports, including Ethernet 1/2, remain untrusted, so any DHCP server messages received on them are dropped, effectively blocking the unauthorized DHCP server.
Exam trap
Cisco often tests the common misconception that you must set the port connected to the unauthorized server as untrusted (which is the default) rather than explicitly setting the legitimate server's port as trusted, leading candidates to incorrectly select option B or C.
How to eliminate wrong answers
Option A is wrong because enabling the DHCP snooping information option (option 82) inserts circuit-id and remote-id information into DHCP packets, but it does not control which ports are allowed to send DHCP server messages; it is used for DHCP relay and security auditing, not for blocking unauthorized servers. Option B is wrong because setting Ethernet 1/2 as a trusted port would allow the unauthorized DHCP server's messages to be forwarded, which is the opposite of the desired action. Option C is wrong because disabling DHCP snooping globally would remove all protection, allowing both legitimate and unauthorized DHCP servers to operate freely, which does not prevent the unauthorized server from offering IP addresses.
Which Nexus security feature validates the source IP address of packets on a per-port basis and drops packets with invalid source IPs?
IP Source Guard prevents IP spoofing.
Why this answer
IP Source Guard uses DHCP snooping binding to validate source IP.
Which TWO statements are true about Control Plane Policing (CoPP) on a Cisco Nexus 9000 switch? (Choose two.)
ICMP unreachable messages can be rate-limited with CoPP to prevent DoS.
Why this answer
CoPP can rate-limit control-plane traffic such as ICMP unreachable messages. By applying a policy-map in the 'control-plane' sub-mode, you can define class-maps that match specific control-plane protocols (e.g., ICMP) and then police their rate to prevent CPU overload from floods of such packets.
Exam trap
Cisco often tests the misconception that CoPP is only for management IP traffic or that it can prioritize traffic, when in fact it is a policing mechanism for all control-plane traffic and does not provide prioritization.
An engineer notices that AAA authentication using RADIUS is failing, and the RADIUS server logs show no incoming authentication requests. Which of the following is the most likely cause?
Without a configured server host, no RADIUS requests are generated, so no logs appear.
Why this answer
If the RADIUS server logs show no incoming authentication requests, the issue is that the device is not sending any traffic to the server. This occurs when no RADIUS server host is configured on the device, meaning the device has no IP address or hostname to which it can send authentication packets. Without a configured server host, the device will not attempt any RADIUS communication, resulting in zero requests reaching the server.
Exam trap
Cisco often tests the distinction between configuration errors that prevent packet generation (like missing server host) versus errors that cause packet rejection or timeout (like wrong secret or firewall), and the trap here is assuming that any authentication failure must involve network-level issues rather than a missing fundamental configuration element.
How to eliminate wrong answers
Option B is wrong because if the device were using TACACS+ instead of RADIUS, the RADIUS server would still not see requests, but the device would be sending TACACS+ traffic to a different server or port, and the question states RADIUS authentication is failing, implying RADIUS is configured but not working. Option C is wrong because if the RADIUS server were unreachable due to a firewall, the device would still send authentication requests (which would be dropped), and the server logs would show incoming requests that are blocked or not responded to, not zero requests. Option D is wrong because an incorrect shared secret would cause authentication failures (e.g., Access-Reject or no response), but the device would still send RADIUS Access-Request packets to the server, which would appear in the server logs.
Two data center switches are connected via a fiber link. They need to encrypt all traffic at Layer 2. Which configuration is required on both switches to establish MACsec?
MACsec must be enabled and a security key configured (PSK or CA) to establish secure links.
Why this answer
MACsec (IEEE 802.1AE) provides hop-by-hop Layer 2 encryption between directly connected switches. To establish a MACsec session, both switches must enable MACsec on the interface and either configure a pre-shared key (PSK) or use a CA (Connectivity Association) key agreement protocol like MKA (MACsec Key Agreement, IEEE 802.1X-2010). This ensures all Ethernet frames are encrypted at the data link layer.
Exam trap
Cisco often tests the distinction between Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec), and candidates mistakenly choose IPsec because they associate 'encryption' with IPsec, forgetting that MACsec is the correct solution for Layer 2 traffic.
How to eliminate wrong answers
Option A is wrong because configuring the interface as a trunk (802.1Q) is unrelated to encryption; trunking allows multiple VLANs but does not provide any security or encryption. Option C is wrong because IPsec operates at Layer 3 (Network layer) and is used for encrypting IP packets, not Layer 2 Ethernet frames; MACsec is the correct Layer 2 encryption protocol. Option D is wrong because 802.1X is a port-based network access control (NAC) protocol used for authentication, not encryption; while 802.1X can be used in conjunction with MKA for key exchange, simply enabling 802.1X does not enable MACsec encryption.
Two Nexus switches are configured for MACsec using MKA. The link between them is up, but MKA does not establish. Which issue is most likely?
MACsec requires the same cipher suite on both ends for MKA to succeed.
Why this answer
MKA (MACsec Key Agreement) requires both endpoints to agree on a cipher suite during the CAK (Connectivity Association Key) exchange. If the cipher suites are mismatched (e.g., one switch uses GCM-AES-128 and the other uses GCM-AES-256), the MKA negotiation will fail, and the link will remain up but unsecured. This is the most common cause of MKA not establishing on an otherwise functional Layer 2 link.
Exam trap
Cisco often tests the distinction between MKA not establishing (cipher suite mismatch) versus MKA establishing but failing authentication (key string mismatch), leading candidates to incorrectly choose the key string option when the question specifically says 'does not establish'.
How to eliminate wrong answers
Option A is wrong because different MTU sizes can cause fragmentation or packet drops at Layer 2, but MKA control frames are small and MTU mismatch does not prevent MKA from establishing; the link would still be up and MKA would attempt to negotiate. Option C is wrong because MKA operates at Layer 2 and is not dependent on VLAN membership; switches in different VLANs can still communicate via trunk links, and MKA frames are tagged appropriately. Option D is wrong because mismatched MKA key strings (pre-shared keys) would cause MKA to fail at the authentication step, but the question states MKA does not establish at all; a key string mismatch typically results in MKA being established but then failing to authenticate, not a complete failure to establish the protocol.
An organization is deploying Cisco Nexus 9000 switches with NX-OS and needs to prevent ARP spoofing attacks. The network engineer enables Dynamic ARP Inspection (DAI) on all VLANs. However, some legitimate hosts are unable to obtain IP addresses via DHCP. What is the most likely reason?
DAI validates ARP against DHCP snooping database; without it, DAI drops all ARP on untrusted ports.
Why this answer
DAI relies on the DHCP snooping binding table to validate ARP packets. Without DHCP snooping enabled, the binding table is empty, so DAI cannot determine which ARP packets are legitimate, causing it to drop all ARP packets, including DHCP discovery and request messages. This prevents hosts from obtaining IP addresses via DHCP.
Exam trap
Cisco often tests the dependency of DAI on DHCP snooping, and the trap here is that candidates assume DAI can function independently without understanding that it requires the DHCP snooping binding table for validation.
How to eliminate wrong answers
Option A is wrong because the ARP rate limit on the port would cause excessive ARP packets to be dropped, not all ARP requests, and it would not specifically prevent DHCP address acquisition. Option B is wrong because IP Source Guard blocks IP traffic based on the DHCP snooping binding table, not ARP packets directly; it does not interfere with ARP unless combined with DAI. Option D is wrong because an ARP ACL is used to permit or deny ARP packets for static IP hosts, but it is not required for DHCP-based hosts; the core issue is the missing DHCP snooping binding table.
A network administrator must enforce security policies for east-west traffic in a Cisco TrustSec-enabled data center without using IP-based ACLs. Which technology should be used?
SGACLs enforce policy based on SGTs, avoiding IP dependencies.
Why this answer
TrustSec uses SGTs for identity-based tagging and SGACLs to enforce policy without IP addresses.
Refer to the exhibit. Two Nexus switches are connected via Ethernet1/1. MKA does not initiate. What is the issue?
The interface must have 'macsec policy MACSEC' to associate the policy.
Why this answer
The exhibit shows that the MACsec policy is defined but not applied to interface Ethernet1/1. Without applying the policy using the `macsec policy` command under the interface configuration, MKA (MACsec Key Agreement) cannot initiate because the switch does not know which security policy to enforce on that link.
Exam trap
Cisco often tests the distinction between defining a MACsec policy globally and applying it to an interface, knowing that candidates may assume a defined policy is automatically active on all interfaces.
How to eliminate wrong answers
Option A is wrong because the interface is administratively up (state is 'up/up'), so the issue is not administrative shutdown. Option C is wrong because the cipher-suite 'GCM-AES-128' is a standard and supported cipher for MACsec on Nexus switches; unsupported ciphers would cause a configuration rejection, not a silent MKA failure. Option D is wrong because MACsec key chains are used for pre-shared key authentication but are not required for MKA initiation; MKA can use a fallback key or EAP-based authentication, and the absence of a key chain would not prevent MKA from starting.
An engineer wants to enforce security policies in a data center based on user identity rather than IP addresses. Which Cisco technology enables identity-based tagging and policy enforcement?
TrustSec uses SGTs for identity-based tagging and policy.
Why this answer
Cisco TrustSec uses SGTs to tag traffic based on user/device identity, and SGACLs enforce policies.
A data center switch is experiencing high CPU due to excessive BGP updates. Which action can mitigate this without affecting legitimate BGP traffic?
CoPP can rate-limit specific control plane protocols, protecting CPU while allowing legitimate BGP updates.
Why this answer
Control Plane Policing (CoPP) protects the control plane by rate-limiting specific traffic classes. Applying a CoPP policy that rate-limits BGP traffic (option A) reduces CPU load from excessive BGP updates while still allowing legitimate BGP sessions to function, as the rate-limit only drops packets exceeding a configured threshold. This preserves BGP neighbor reachability and route exchange, unlike dropping all BGP traffic.
Exam trap
Cisco often tests the distinction between 'rate-limit' and 'drop' in CoPP policies, where candidates mistakenly choose to drop all BGP traffic (option B) thinking it solves the CPU issue, but this breaks routing entirely.
How to eliminate wrong answers
Option B is wrong because dropping all BGP traffic would terminate all BGP sessions, causing complete loss of routing updates and potentially isolating the router. Option C is wrong because disabling BGP route filtering would increase the number of BGP updates processed, worsening the CPU issue by allowing all routes without any filtering. Option D is wrong because increasing BGP timers globally (e.g., keepalive and hold timers) reduces the frequency of updates but does not mitigate a flood of updates from external sources; it may also cause neighbor timeouts if timers are set too high.
Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?
The 'ip dhcp snooping trust' command on the interface makes it trusted for all snooped VLANs.
Why this answer
When a DHCP server is connected to a switch port and clients in different VLANs (like VLAN 10) obtain IP addresses, the switch must trust the DHCP server port for all VLANs. This is typically achieved by configuring the port as a DHCP snooping trusted port or by using an IP helper address on the VLAN interface. Without trust, DHCP snooping would drop server responses on untrusted ports, preventing the client from obtaining an address.
Exam trap
Cisco often tests the misconception that a DHCP server must be in the same VLAN as the client, when in fact a trusted port or IP helper address allows cross-VLAN DHCP communication.
How to eliminate wrong answers
Option A is wrong because the DHCP server is connected to Ethernet1/1, which is not necessarily in VLAN 20; the client in VLAN 10 obtains an IP address, implying the server can communicate with VLAN 10, likely via an IP helper address or trunk, not that the server itself is in VLAN 20. Option B is wrong because the client obtains an IP address via DHCP, which contradicts the use of a static IP address; a static IP would not require DHCP. Option D is wrong because the DHCP client MAC address is verified by DHCP snooping by default on untrusted ports; the fact that the client obtains an IP address suggests the MAC address is verified and not spoofed, or the port is trusted.
Which two mechanisms are used by Dynamic ARP Inspection to prevent ARP spoofing? (Choose two.)
DAI compares ARP packet MAC-IP pair with the binding table to detect spoofing.
Why this answer
Dynamic ARP Inspection (DAI) validates ARP packets by comparing the sender MAC and IP addresses against the DHCP snooping binding table. If an ARP packet's MAC-IP binding does not match an entry in the binding table, DAI drops the packet, preventing ARP spoofing attacks. Additionally, DAI can use ARP access lists (ARP ACLs) to statically define valid MAC-IP bindings for hosts that do not use DHCP, providing an alternative validation mechanism.
Exam trap
The trap here is that candidates often confuse the enabling configuration (ARP inspection VLAN configuration) with the actual validation mechanism, or they mistakenly think port security or rate limiting directly prevent ARP spoofing, when in fact they serve different security purposes.
A data center switch port is configured for 802.1X with MAB as fallback. A device that does not support 802.1X is connected. Which method will allow the device to authenticate?
MAB is the fallback method for devices that do not support 802.1X.
Why this answer
When a device that does not support 802.1X is connected to a port configured for 802.1X with MAB as fallback, the switch detects that no EAPOL frames are received from the device. It then initiates MAC authentication bypass (MAB), which uses the device's MAC address as the identity for authentication against the RADIUS server. If the MAC address is allowed, the port is authorized, providing a seamless fallback authentication method for non-802.1X-capable devices.
Exam trap
The trap here is that candidates often confuse MAB with web authentication or assume that any non-802.1X device will automatically trigger web authentication, but Cisco tests that MAB is the first fallback method when configured, and it uses the MAC address, not a pre-shared key or certificate.
How to eliminate wrong answers
Option A is wrong because EAP-TLS is an 802.1X authentication method that requires the device to support 802.1X and present a client certificate, which the non-802.1X-capable device cannot do. Option B is wrong because web authentication (WebAuth) is a separate fallback method that redirects HTTP traffic to a captive portal for user credentials, but it is not the default or automatic fallback when MAB is configured; MAB is tried first before WebAuth. Option C is wrong because local authentication using a pre-shared key is not a standard 802.1X or MAB mechanism; MAB relies on RADIUS server authentication using the MAC address, not a locally configured pre-shared key.
An engineer is deploying data encryption in a SAN environment. Which two methods provide at-rest encryption? (Choose two.)
SED provides at-rest encryption on the drive.
Why this answer
SED encrypts data on the drive; SAN array encryption encrypts data at the storage level.
A large enterprise data center uses Cisco ACI with a spine-leaf architecture. The security team requires that all traffic between the Web and App tiers be inspected by a firewall, but traffic within the same tier should be allowed directly. The Web EPG is in VRF PROD with Bridge Domain WEB-BD, and App EPG is in VRF PROD with Bridge Domain APP-BD. The firewall is connected as a service graph device in a different VRF (FW-VRF). The administrator configures a contract between Web and App EPGs that redirects traffic through the firewall. However, after implementation, traffic from Web to App is not passing through the firewall; instead, it is forwarded directly. The contract is applied correctly. What is the most likely cause?
ACI service graph redirection typically works within the same VRF or with PBR; different VRFs break the redirection.
Why this answer
In Cisco ACI, service graphs redirect traffic through firewall devices by inserting the firewall as a Layer 4-Layer 7 device in the traffic path. However, the service graph device must reside in the same VRF as the consumer and provider EPGs, or a shared VRF with proper route leaking must be configured, because ACI uses VRF isolation to enforce policy-based redirect (PBR). Since the firewall is in FW-VRF while both EPGs are in VRF PROD, the leaf switches cannot redirect traffic to the firewall without a common routing context, causing the contract to bypass the firewall and forward traffic directly.
Exam trap
Cisco often tests the misconception that a service graph device can be in any VRF as long as the contract is applied correctly, but in reality, the VRF alignment is mandatory for the redirect to function.
How to eliminate wrong answers
Option B is wrong because the question states the contract is applied correctly and the firewall is connected as a service graph device; a routing issue would typically manifest as unreachability or packet drops, not as direct forwarding without redirection. Option C is wrong because the contract filter controls which traffic is permitted or denied, not the redirection path; the service graph redirection is configured separately in the contract's service graph template. Option D is wrong because the contract is explicitly configured between Web and App EPGs, which is inter-EPG traffic, and intra-EPG traffic within the same tier is allowed directly by default without a contract.
A security engineer is deploying IP Source Guard on a Nexus switch. Which two components must be operational for IP Source Guard to function correctly?
Dynamic ARP Inspection is required to validate ARP packets and ensure IP-MAC bindings are consistent with the DHCP snooping database.
Why this answer
IP Source Guard on Nexus switches relies on both DHCP snooping and Dynamic ARP Inspection. DHCP snooping builds the binding table that IP Source Guard uses to validate source IP addresses, while Dynamic ARP Inspection prevents ARP spoofing attacks and ensures IP integrity. Without both, IP Source Guard cannot function correctly.
In Cisco TrustSec, what is used to tag traffic based on identity or group membership?
SGTs carry identity information.
Why this answer
Security Group Tags (SGTs) are used to classify traffic by identity.
Which TWO of the following are valid methods to enforce security on a Cisco Nexus switch? (Choose two.)
CoPP protects the control plane by rate-limiting traffic.
Why this answer
Control Plane Policing (CoPP) is a valid security enforcement method on Cisco Nexus switches because it protects the control plane from excessive or malicious traffic by applying QoS policies that rate-limit packets destined for the supervisor module. By filtering traffic such as routing protocols, SSH, or ICMP, CoPP prevents CPU overload and DoS attacks, directly enforcing security at the control plane level.
Exam trap
Cisco often tests the distinction between security enforcement mechanisms (like CoPP and Private VLANs) and management protocols (like SSH) or monitoring tools (like NetFlow), leading candidates to mistakenly select SSHv2 as a security enforcement method.
An engineer is configuring AAA on a Cisco Nexus switch to authenticate management access via TACACS+. The switch is reachable, but login attempts repeatedly fail. Which action should the engineer take to isolate the issue?
This command directly tests the AAA authentication process.
Why this answer
The 'test aaa authentication login' command with the 'legacy' keyword directly validates the AAA authentication configuration against the TACACS+ server without requiring a full login session. This isolates whether the issue is with the AAA configuration itself versus network connectivity or server reachability, as the command simulates the exact authentication flow the switch uses.
Exam trap
Cisco often tests the distinction between connectivity verification (ping, port checks) and actual AAA authentication validation, trapping candidates who assume that reachability implies correct AAA operation, when in fact the shared secret, server configuration, or authentication method may be misconfigured.
How to eliminate wrong answers
Option A is wrong because enabling 'debug tacacs' generates verbose output that can overwhelm the console and impact performance, and it is a reactive troubleshooting step that should be used after confirming basic configuration and connectivity, not as the first isolation action. Option C is wrong because while IP connectivity is necessary, the switch is already reachable per the scenario, and ping only tests ICMP reachability, not whether the TACACS+ service is properly responding to authentication requests. Option D is wrong because using Telnet to test port 49 is not a valid method; Telnet uses TCP port 23, and testing a TACACS+ server port requires a TACACS+ client or a tool like 'telnet <server> 49' to check if the port is open, but this only verifies TCP connectivity, not the AAA authentication logic or shared secret correctness.
A data center administrator is implementing Cisco TrustSec on a Nexus 7000 switch to enforce role-based access control. After configuring a security group tag (SGT) classification policy, users report that traffic between two servers is not being tagged. What is the most likely cause?
Ingress interface must have 'sgt' or 'ip policy' to assign SGTs.
Why this answer
Cisco TrustSec requires the ingress interface to be explicitly configured with either the 'sgt' command (for static SGT assignment) or an 'ip policy' command (for dynamic SGT classification via a security group ACL). Without this, the switch cannot classify traffic and apply the SGT tag. The scenario describes a classification policy that is not being applied, which directly points to a missing ingress classification command.
Exam trap
The trap here is that candidates often assume SGT classification is automatic once a policy is defined, but Cisco explicitly tests that the ingress interface must have the 'sgt' or 'ip policy' command to trigger classification.
How to eliminate wrong answers
Option A is wrong because DHCP snooping is unrelated to SGT classification; it is a security feature to prevent rogue DHCP servers and does not affect SGT tagging. Option C is wrong because the Nexus 7000 series switches (with the appropriate line cards, e.g., F2e, M3) support TrustSec in hardware; the question does not indicate a hardware limitation, and the issue is configuration-based. Option D is wrong because SGTs are assigned on the ingress interface, not egress; egress interfaces enforce policies based on the SGT but do not assign the tag.
In a UCS environment, an administrator needs to restrict access to the UCS Manager so that only specific users can configure server policies. Which feature should be used?
RBAC in UCS Manager defines roles and privileges for users.
Why this answer
UCS Manager role-based access control (RBAC) allows granular assignment of privileges to users.
A VACL is configured to capture traffic between hosts in the same VLAN. The capture port is configured and the VACL is applied to the VLAN. However, no traffic is being captured. What is a likely reason?
Without the capture action, the VACL will not copy packets to the capture port.
Why this answer
A VACL (VLAN Access Control List) must explicitly include a capture action to forward matched traffic to a capture port. Without the capture action, the VACL only permits or denies traffic within the VLAN but does not trigger packet replication to the configured capture port. The capture action is configured using the `capture` keyword in the VACL configuration, and its absence is the most common reason for no traffic being captured.
Exam trap
The trap here is that candidates often assume a VACL applied to a VLAN will automatically send all matched traffic to a capture port, overlooking the explicit `capture` action required in the VACL configuration.
How to eliminate wrong answers
Option A is wrong because VACLs are applied to VLANs, not to interfaces, and they operate on traffic within the VLAN regardless of direction; direction-based ACLs are for router ACLs, not VACLs. Option B is wrong because a SPAN destination port cannot be used as a capture port for VACL capture; VACL capture requires a dedicated capture port configured with the `switchport capture` command, and SPAN and VACL capture are mutually exclusive on the same port. Option D is wrong because the capture port does not need to be in the same VLAN as the traffic being captured; VACL capture replicates traffic to the capture port regardless of its VLAN membership, as long as the capture port is configured correctly.
An engineer needs to deny all traffic between two EPGs in ACI while allowing other EPG communications. Which construct should be used?
Taboo contracts enforce a deny-all policy between EPGs.
Why this answer
Taboo contracts are used to explicitly deny traffic between EPGs.
An engineer is hardening a Nexus switch. Which THREE actions should be taken? (Choose three.)
Reduces attack surface.
Why this answer
Disabling unused services, enabling SSH only, and configuring CoPP are standard hardening practices.
In an ACI fabric, a security policy requires that traffic from EPG1 to EPG2 be denied, but all other inter-EPG traffic is permitted by default. Which type of contract should be used?
Taboo contracts explicitly deny specified traffic between EPGs.
Why this answer
Taboo contracts are used to explicitly deny traffic between EPGs, overriding the default permit of a contract? Actually, by default, no traffic is permitted between EPGs unless a contract is applied. A taboo contract denies traffic, even if a regular contract exists? In ACI, the default is no communication; contracts permit traffic. To deny specific traffic, you use a taboo contract that explicitly denies.
In a private VLAN configuration, a host in a community VLAN needs to communicate with a host in the primary VLAN. What configuration is required on the switch?
The primary VLAN host must be on a promiscuous port to allow communication from community VLAN.
Why this answer
In a private VLAN configuration, a host in a community VLAN can communicate with a host in the primary VLAN only if the host in the primary VLAN is on a promiscuous port. The promiscuous port can communicate with all other ports in the private VLAN, including community and isolated ports, enabling inter-VLAN traffic through a Layer 3 gateway or a server connected to that port.
Exam trap
Cisco often tests the misconception that a community VLAN host can directly communicate with a primary VLAN host without a promiscuous port, or that the primary VLAN host must be on a community port, confusing the roles of promiscuous and community ports in private VLANs.
How to eliminate wrong answers
Option A is wrong because an isolated port can only communicate with promiscuous ports, not with community ports, so placing the community VLAN host on an isolated port would break its ability to communicate with the primary VLAN host. Option C is wrong because a community port can only communicate with other community ports in the same community VLAN and with promiscuous ports, but placing the community VLAN host on a promiscuous port would incorrectly allow it to communicate with all ports, violating the community VLAN's intended isolation. Option D is wrong because a primary VLAN host on a community port would restrict it to communicating only with other community ports in the same community VLAN and promiscuous ports, but it would not be able to communicate with hosts in other community VLANs or isolated ports, which is not the required behavior for a primary VLAN host.
A data center engineer is troubleshooting high CPU utilization on a Cisco Nexus 9000 switch. The engineer suspects a distributed denial-of-service (DDoS) attack targeting the switch. To mitigate the attack, the engineer configures a Control Plane Policing (CoPP) policy that drops all ICMP packets destined to the switch. The policy is applied to the control-plane using the 'service-policy input COPP' command. After applying the policy, the switch CPU utilization remains high, and ICMP traffic is still reaching the switch. The engineer verifies that the CoPP policy is applied and that the class-map matches ICMP. The policy-map has the correct police and drop actions. No other CoPP policies are applied. What is the most likely cause of the issue?
Management interfaces have separate control plane contexts; CoPP policies do not apply unless specifically configured for the management VRF.
Why this answer
The management interface (mgmt0) on Cisco Nexus 9000 switches operates in a separate management VRF and is not subject to Control Plane Policing (CoPP) policies applied to the default control-plane. CoPP only polices traffic that ingresses through data-plane interfaces (e.g., Ethernet, port-channel). If the DDoS attack is arriving via the management interface, the CoPP policy will not filter it, leaving CPU utilization high.
This is a common oversight when troubleshooting control-plane protection.
Exam trap
Cisco often tests the distinction between control-plane policing (CoPP) and management-plane protection, leading candidates to forget that the management interface operates in a separate VRF and is not subject to CoPP policies.
How to eliminate wrong answers
Option A is wrong because CoPP policies on Cisco Nexus switches take effect immediately upon application; no reload is required. Option C is wrong because CoPP is applied to the control-plane of the default VRF, not to the management VRF; the management interface has its own dedicated control-plane context and is not affected by CoPP policies applied to the main control-plane. Option D is wrong because the engineer verified that the class-map matches ICMP, and the question states the policy is correctly matching ICMP traffic; the issue is not a protocol mismatch.
Which THREE of the following must be enabled to implement 802.1X authentication with MAB fallback on a Cisco Nexus switch for a mixed environment of 802.1X-capable and non-802.1X endpoints? (Choose three.)
AAA is required to authenticate users and devices.
Why this answer
802.1X authentication requires AAA to communicate with a RADIUS server. The RADIUS server validates the credentials (EAP over RADIUS) and returns an Accept or Reject, which the switch uses to authorize the port. Without AAA and a RADIUS server, the switch has no external authentication authority to process 802.1X requests or MAB fallback.
Exam trap
Cisco often tests the misconception that MACsec or VLAN ACLs are prerequisites for 802.1X with MAB, when in fact they are optional features that can be layered on top of the authentication process.
A large financial institution has a Cisco ACI fabric with multiple tenants. The security team requires that all management access to the APIC controllers be authenticated via multi-factor authentication (MFA) using a RADIUS server. The RADIUS server is configured to send a One-Time Password (OTP) challenge during authentication. The current configuration uses local authentication. The engineer needs to implement RADIUS authentication with MFA for APIC GUI and CLI access. The RADIUS server is reachable at 10.10.10.10, shared secret 'SecureSecret123'. The APIC is running software version 4.2(3). The engineer must ensure that local authentication is used as fallback if the RADIUS server is unreachable. Which of the following actions should the engineer take?
Correct: RADIUS with PAP is used for MFA and fallback to local.
Why this answer
It follows the required steps to configure RADIUS authentication with MFA on Cisco APIC: adding a RADIUS provider with the correct IP and shared secret, creating a login domain with realm 'radius', setting fallback to 'local', and assigning the domain to users. This ensures that the APIC sends authentication requests to the RADIUS server, which can issue an OTP challenge for MFA, and falls back to local authentication if the RADIUS server is unreachable.
Exam trap
Cisco often tests the requirement to create a login domain and assign it to users, as many candidates mistakenly think simply adding a RADIUS provider is sufficient without configuring the domain and fallback.
How to eliminate wrong answers
Option A is wrong because TACACS+ is not supported for APIC authentication; APIC only supports RADIUS, LDAP, and local authentication for management access. Option B is wrong because enabling only local authentication with strong passwords does not implement MFA via RADIUS, which is a specific requirement. Option D is wrong because LDAP authentication cannot use a RADIUS server as an LDAP proxy; LDAP and RADIUS are separate protocols with different purposes and configurations.
In ACI, which model is used for micro-segmentation to allow traffic between EPGs?
Correct: ACI contracts define permitted traffic.
Why this answer
ACI uses a whitelist model via contracts to permit traffic between EPGs.
A Cisco MDS 9000 switch is used in a storage network. The security policy requires that a junior administrator named 'user1' can view zone configurations but cannot make any changes. Currently, 'user1' is assigned the default 'network-operator' role, which allows read-only access to most configuration, but the engineer wants to ensure that zone modification is explicitly denied. The engineer creates a custom role named 'zone-viewer' and assigns it to 'user1'. The role should permit viewing of the running configuration related to zones but deny any command that modifies zone or zoneset configurations. Which configuration best achieves this objective?
Permits show commands for zone and zoneset, denying configuration commands by default.
Why this answer
It uses the 'permit command' statements with wildcard patterns ('show zone*' and 'show zoneset*') to explicitly allow only show commands related to zones and zonesets. By not including any 'permit' or 'deny' statements for configuration commands (like 'configure terminal', 'zone', or 'zoneset'), the role implicitly denies all other commands, including those that modify zone or zoneset configurations. This matches the requirement to allow viewing but deny modifications.
Exam trap
Cisco often tests the implicit deny behavior of RBAC, where candidates mistakenly think they must explicitly deny modification commands, when in fact only permitting the desired show commands is sufficient to block all other commands.
How to eliminate wrong answers
Option A is wrong because it includes 'permit command configure terminal' and 'zone name etc.' which would allow the user to enter configuration mode and potentially modify zone configurations, violating the security policy. Option C is wrong because 'rule 1 permit read-write' grants full read-write access to the zone feature, allowing modifications, and does not restrict to read-only. Option D is wrong because it permits 'zone', 'zoneset', and 'zone-create' commands, which are used to create and modify zones and zonesets, directly contradicting the requirement to deny modifications.
A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?
This command displays the 802.1X authentication details for the specified interface on Nexus switches, making it the correct choice for verifying a specific interface's authentication status.
Why this answer
The correct command on Cisco Nexus switches to verify 802.1X authentication status on a specific interface is 'show dot1x interface ethernet 1/1'. This command displays the 802.1X state, authorized status, and other details for the specified interface. Option B, 'show dot1x interface ethernet 1/1', is correct.
Option C is incorrect because 'show authentication interface' is not a valid command on Nexus NX-OS; it is used on IOS-based switches. Option A is unrelated to 802.1X, and option D shows port security, not authentication status.
Exam trap
Cisco often tests the distinction between the legacy 'show dot1x' command and the modern unified 'show authentication interface' command, trapping candidates who memorize the older command without realizing that newer IOS versions (e.g., IOS-XE 16.x+) consolidate all authentication status under the 'show authentication' hierarchy.
How to eliminate wrong answers
Option A is wrong because 'show aaa authentication' displays the global AAA authentication method lists and their order, not the per-interface authentication status or 802.1X state. Option B is wrong because 'show dot1x' without an interface keyword shows global 802.1X parameters, not the detailed per-interface status; even 'show dot1x interface ethernet 1/1' is deprecated in favor of the unified 'show authentication interface' command in newer IOS versions. Option D is wrong because 'show port-security interface ethernet 1/1' shows port security violation counts and secure MAC addresses, which is unrelated to 802.1X authentication state machines or EAPOL exchanges.
An engineer is configuring Cisco ACI to secure inter-tenant traffic. Tenants 'TenantA' and 'TenantB' need to communicate via a shared service, such as a DNS server in TenantA. How should the contract be configured?
Standard shared service design: provider's tenant contains the contract.
Why this answer
In Cisco ACI, inter-tenant communication via a shared service requires the contract to be created in the tenant that owns the shared service (provider). The provider EPG (DNS server in TenantA) is set as the provider, and the consumer EPG (in TenantB) consumes the contract from TenantA. This allows TenantB to access the DNS service without exposing its own EPGs, maintaining security isolation while enabling necessary traffic.
Exam trap
Cisco often tests the misconception that the contract must be created in the consumer's tenant or applied to the VRF, but the correct approach is to create the contract in the provider's tenant and explicitly define the provider EPG.
How to eliminate wrong answers
Option A is wrong because applying a contract to the VRF shared between tenants does not define the provider/consumer relationship; contracts must be applied to EPGs, not VRFs, and the provider EPG must be explicitly set. Option C is wrong because the contract should be created in the tenant that owns the shared service (TenantA), not TenantB, and the DNS EPG should be the provider, not the consumer. Option D is wrong because setting both EPGs as providers would create a symmetric relationship, which is incorrect for a shared service scenario where one EPG provides and the other consumes; this would also break the intended unidirectional traffic flow.
A network engineer is configuring device access control for Cisco NX-OS switches. The requirement is to use a protocol that separates authentication, authorization, and accounting, and encrypts all communication except the header. Which solution meets this requirement?
TACACS+ encrypts entire packet except header and separates AAA functions.
Why this answer
TACACS+ is the correct choice because it separates authentication, authorization, and accounting (AAA) into distinct processes, and it encrypts the entire packet body, leaving only the standard TACACS+ header unencrypted. This meets the requirement for a protocol that provides granular AAA control with encrypted communication, unlike RADIUS which does not encrypt the full payload.
Exam trap
Cisco often tests the misconception that RADIUS encrypts all communication because it uses a shared secret, but in reality RADIUS only encrypts the password field, not the entire payload, making TACACS+ the correct choice for full-packet encryption beyond the header.
How to eliminate wrong answers
Option A (RADIUS) is wrong because it combines authentication and authorization into a single process, does not separate them, and only encrypts the password field in the Access-Request packet, leaving other attributes like username and accounting data in cleartext. Option B (LDAP) is wrong because it is a directory access protocol used for querying and modifying directory services, not a AAA protocol; it does not natively separate authentication, authorization, and accounting, nor does it encrypt all communication beyond the header by default. Option C (SSH) is wrong because it is a secure transport protocol for remote CLI access and file transfer, not a AAA protocol; it does not provide separate authentication, authorization, and accounting functions as a service.
An administrator configures 'aaa authentication login default group tacacs+ local'. What happens if the TACACS+ server is unreachable?
The config includes 'local' as a fallback method after group tacacs+.
Why this answer
The command 'aaa authentication login default group tacacs+ local' configures a method list where the first method is TACACS+ and the second is local. If the TACACS+ server is unreachable (not responding, not rejecting), the switch falls back to the next method in the list, which is local authentication using the local username database. This fallback behavior is defined by Cisco IOS/IOS-XE authentication method lists, where 'local' acts as a backup when the primary method is unavailable.
Exam trap
Cisco often tests the distinction between a server being unreachable (fallback occurs) versus a server rejecting credentials (authentication fails immediately), causing candidates to incorrectly assume that any TACACS+ issue results in authentication failure.
How to eliminate wrong answers
Option A is wrong because the switch does not use 'no authentication'; the 'default' method list requires authentication, and fallback to local ensures authentication still occurs. Option B is wrong because authentication does not fail outright; failure only occurs if all methods in the list are exhausted or if the server explicitly rejects the credentials (e.g., via a 'DENIED' response). Option C is wrong because 'group tacacs+' is a single method group; the switch does not try 'the next method in the group'—it tries the next method in the list, which is 'local', not another server within the same group.
An engineer needs to ensure that only authorized servers can connect to a specific switch port in a data center. The port connects to a critical database server with fixed MAC address 00:1a:2b:3c:4d:5e. Which configuration is most appropriate?
Statically configures the authorized MAC, exactly meeting the requirement.
Why this answer
It explicitly binds the specific MAC address 001a.2b3c.4d5e to the port using port security, and sets the violation mode to shutdown, which disables the port if any unauthorized device attempts to connect. This ensures only the authorized database server can use the port, meeting the requirement precisely.
Exam trap
Cisco often tests the distinction between specifying a static MAC address versus relying on dynamic learning with a maximum count, where candidates mistakenly think limiting to one MAC is sufficient without binding the specific authorized address.
How to eliminate wrong answers
Option B is wrong because it only limits the maximum number of MAC addresses to 1 without specifying the allowed MAC address, so the port will learn the first MAC it sees, which could be an unauthorized device if it connects first. Option C is wrong because it disables port security entirely and enables spanning-tree portfast, which provides no MAC-based access control and allows any device to connect. Option D is wrong because it sets the maximum to 2, allowing two MAC addresses, and uses the protect violation mode, which simply drops frames from unauthorized sources without alerting or disabling the port, failing to ensure only the authorized server can connect.
A server team reports that after connecting a new server to a switchport, the server can receive traffic but cannot send traffic. The port is configured with port security. What is the most likely cause?
Protect mode drops offending frames silently, allowing the server to receive but not send traffic from an unknown MAC.
Why this answer
When port security violation mode is set to 'protect', the switch drops traffic from unauthorized MAC addresses without generating a syslog message or incrementing the violation counter. In this scenario, the server can receive traffic because the switch still forwards broadcast and unknown unicast frames to the port, but the server's transmitted frames are silently dropped because the switch does not learn the server's MAC address or forward its frames. This matches the symptom of one-way communication where the server can receive but not send.
Exam trap
Cisco often tests the distinction between the three port security violation modes (protect, restrict, shutdown) by presenting a symptom of one-way traffic, which candidates mistakenly attribute to a shutdown or restrict mode rather than the silent dropping behavior of protect.
How to eliminate wrong answers
Option A is wrong because an errdisable state would cause the port to be completely shut down, preventing both sending and receiving traffic, not just one-way communication. Option C is wrong because if the maximum MAC count is set to 1 and another device is connected, the violation action would trigger based on the configured mode (shutdown, restrict, or protect), but the symptom described (receive but not send) is specific to the protect mode, not a simple count limit. Option D is wrong because port security does not use an 'allowed list' of MAC addresses by default; it learns MAC addresses dynamically unless a static secure MAC address is configured, and even then, a mismatch would trigger the violation mode, not result in one-way traffic.
A data center engineer is troubleshooting connectivity issues between two EPGs in the same tenant on a Cisco ACI fabric. The first EPG 'web_epg' is in VLAN 100 and the second EPG 'db_epg' is in VLAN 200. The contract 'web_to_db' allows TCP port 3306 from web_epg to db_epg. The EPGs are in the same VRF. The engineer has verified that the physical connectivity is correct and the endpoints are learning their IP addresses. However, traffic from web_epg to db_epg is not reaching the destination. The engineer checks the contract and sees that the subject 'mysql_access' has filter 'mysql' with direction 'both'. The provider is db_epg and consumer is web_epg. The engineer also notices that the default action in the contract is 'deny'. What is the most likely cause of the issue?
In ACI, the provider offers a service; the consumer initiates. Here web_epg initiates, so web_epg should be provider.
Why this answer
In Cisco ACI, the provider EPG is the one that offers a service (the destination of the traffic), and the consumer EPG is the one that initiates the connection. Since web_epg initiates TCP traffic to db_epg, db_epg should be the provider and web_epg the consumer. The contract is reversed, so the default deny action blocks the traffic because the consumer (web_epg) is not allowed to initiate toward the provider (db_epg) under the reversed roles.
Exam trap
Cisco often tests the provider/consumer directionality in ACI contracts, and the trap here is that candidates assume the provider is the source (initiator) of traffic, when in fact the provider is the destination (service offerer).
How to eliminate wrong answers
Option B is wrong because the VRF association is correct—both EPGs are in the same VRF, and the endpoints are learning IP addresses, indicating the VRF is properly configured. Option C is wrong because an L3Out is only needed for communication with external networks (outside the fabric), not between EPGs in the same VRF; intra-VRF communication uses contracts directly. Option D is wrong because the filter 'mysql' is a predefined filter that matches TCP port 3306, so it correctly permits the required traffic.
A Nexus switch experiences high CPU utilization due to excessive ICMP traffic. An engineer applies a CoPP policy that includes a class matching ICMP with a drop action. After applying, legitimate OSPF hello packets are also being dropped. What is the most likely cause?
If the default class action is drop, any traffic not explicitly matched (including OSPF) will be dropped. This is a common misconfiguration.
Why this answer
When a CoPP policy is applied, traffic that does not match any explicit class-map falls into the default class. If the default class has a drop action, all unmatched traffic—including OSPF hello packets (which use IP protocol 89)—will be dropped. The class-map matching ICMP (typically based on protocol or DSCP) does not match OSPF, so OSPF packets are handled by the default class, causing the observed behavior.
Exam trap
Cisco often tests the concept that the default class in CoPP is not automatically 'permit' and must be explicitly configured; the trap here is assuming that only the matched class (ICMP) is affected, while forgetting that unmatched traffic falls to the default class, which can have a drop action.
How to eliminate wrong answers
Option A is wrong because CoPP policies are applied globally to the control plane (via 'control-plane' and 'service-policy input'), not to individual interfaces; applying to the wrong interface would not affect control-plane traffic. Option B is wrong because the policy explicitly drops ICMP traffic, not rate-limits it; OSPF packets are not rate-limited but dropped entirely due to the default class action, not because of insufficient rate. Option D is wrong because the class-map matches only ICMP (e.g., match protocol icmp or match ip dscp cs0), and OSPF uses IP protocol 89, which is distinct; the class-map does not include OSPF.
Which protocol is recommended by Cisco for network device administration AAA due to its separation of authentication, authorization, and accounting?
Cisco recommends TACACS+ for device admin.
Why this answer
TACACS+ encrypts the entire packet and separates AAA functions.
An engineer observes that ARP packets are being dropped. Based on the exhibit, what is the drop rate percentage for ARP packets?
Half of the packets exceed the police rate and are dropped.
Why this answer
The exhibit shows that out of 1000 total ARP packets, 500 were dropped. The drop rate percentage is calculated as (dropped packets / total packets) * 100, which is (500/1000)*100 = 50%. Therefore, option C is correct.
Exam trap
Cisco often tests the ability to correctly compute a percentage from raw drop and total counts, where candidates might misread the exhibit or confuse drop rate with success rate, leading to incorrect answers like 25% or 75%.
How to eliminate wrong answers
Option A is wrong because 75% would require 750 dropped packets out of 1000, not 500. Option B is wrong because 25% would require 250 dropped packets out of 1000, not 500. Option D is wrong because 100% would require all 1000 packets to be dropped, but only 500 were dropped.
Ready to test yourself?
Try a timed practice session using only Security questions.