350-601 Security Practice Question
Which THREE are best practices for securing a data center network? (Choose three.)
⚠ Common exam trap
Cisco often tests the concept that security best practices must never sacrifice security for performance or convenience, so traps like 'disable logging' or 'use default strings' are designed to lure candidates who prioritize operational simplicity over security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply device hardening, such as disabling unused services.
Device hardening, such as disabling unused services, is a fundamental best practice for securing a data center network. By reducing the attack surface, you eliminate potential entry points for exploits, which is a core principle of Cisco's secure network design. This aligns with the Cisco Nexus and IOS-XE hardening guidelines, where services like HTTP, Telnet, or CDP are disabled to prevent unauthorized access or reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply device hardening, such as disabling unused services.
Why this is correct
Hardening reduces attack surface.
- ✓
Use encryption (e.g., MACsec, IPsec) for sensitive traffic.
Why this is correct
Encryption protects data in transit.
- ✓
Implement role-based access control (RBAC) for management access.
Why this is correct
RBAC limits administrative privileges.
- ✗
Disable logging to reduce CPU load.
Why it's wrong here
Logging is essential for security monitoring.
- ✗
Use default SNMP community strings for simplicity.
Why it's wrong here
Default strings are well-known and insecure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.