350-601 Security Practice Question
Which TWO of the following are valid methods to enforce security on a Cisco Nexus switch? (Choose two.)
⚠ Common exam trap
Cisco often tests the distinction between security enforcement mechanisms (like CoPP and Private VLANs) and management protocols (like SSH) or monitoring tools (like NetFlow), leading candidates to mistakenly select SSHv2 as a security enforcement method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Control Plane Policing (CoPP)
Control Plane Policing (CoPP) is a valid security enforcement method on Cisco Nexus switches because it protects the control plane from excessive or malicious traffic by applying QoS policies that rate-limit packets destined for the supervisor module. By filtering traffic such as routing protocols, SSH, or ICMP, CoPP prevents CPU overload and DoS attacks, directly enforcing security at the control plane level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSHv2
Why it's wrong here
SSH is for secure management, not traffic enforcement.
- ✗
NetFlow
Why it's wrong here
NetFlow is for traffic monitoring, not enforcement.
- ✓
Control Plane Policing (CoPP)
Why this is correct
CoPP protects the control plane by rate-limiting traffic.
- ✗
FabricPath
Why it's wrong here
FabricPath is a switching technology, not a security feature.
- ✓
Private VLANs
Why this is correct
Private VLANs provide Layer 2 isolation between ports.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-601 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.