350-601 practice questions 171–180

1. Question 171 · 504 in bank

   A host in EPG Client wants to talk to a webserver in EPG Web. A contract with default settings is defined between EPG Client and EPG Web, which allows TCP communication initiated by the client toward the webserver with TCP destination port 80. Which statement describes this scenario?

   • AIf EPG Web is made a preferred group member, a contract between EPG Client and EPG Web is no longer required for the host in EPG Client to reach the webserver in EPG Web.
   • BIf vzAny is configured to consume and provide a "deny all" contract, traffic between EPG Client and EPG Web is no longer allowed.
   • CThe host in EPG Client is allowed to connect to TCP destination port 80 on the webserver in EPG Web. The webserver will not be allowed to initiate a separate TCP connection to a host port with TCP source port 80.
   • DThe host in EPG Client is allowed to connect to TCP destination port 80 on the webserver in EPG Web. The webserver is allowed to initiate a separate TCP connection to a host port with TCP source port 80.

   Show answer

   Answer: C

   Explanation

   D is correct : Apply Both Direction and Reverse Filter Port in the subject for the filter. These two options are by default enabled...This means that if the provider EPG initiates traffic toward the consumer EPG, the Cisco ACI fabric allows it for any destination ports if the source port is 80. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_01000.html

   Source: Adapted from community discussion — DC4000

   References

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

2. Question 172 · 504 in bank

   An engineer is running an ACI fabric, has VMM integration with VMware vCenter, and wants to enable microsegmentation based on vCenter VM attributes. Which statement describes microsegmentation in this scenario?

   • AACI does not support microsegmentation based on vCenter VM attributes. The network attributes should be used for microsegmentation.
   • BWhen enabled, microsegmentation performs distributed switching and routing on the ESXi hosts.
   • CMicrosegmentation is supported only using AVE or AVS.
   • DAn ACI microsegmented EPG automatically creates a port group with a private VLAN configured on a VMware vCenter distributed virtual switch.

   Show answer

   Answer: D

   Explanation

   D looks correct: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/virtualization/Cisco-ACI-Virtualization-Guide-42x/Cisco-ACI-Virtualization-Guide-421_chapter_0101.pdf "A Cisco ACI virtual machine manager (VMM) domain creates an isolatedPVLAN port group at the VMware VDS or Microsoft Hyper-V Virtual Switch for each EPG that has intra-EPG isolation enabled."

   Source: Adapted from community discussion — Alfi91

   References

   • Cisco documentation

   Next question

3. Question 173 · 504 in bank

   DRAG DROP - Drag and drop the technologies from the left onto the correct descriptions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

4. Question 174 · 504 in bank

   Select 2

   Which two authentication types does Cisco UCS Manager support when configuring authentication? (Choose two.)

   • APAM
   • Blocal
   • C802.1X
   • DKerberos
   • ELDAP

   Show answer

   Answer: BE

   Explanation

   Cisco UCS supports two methods to authenticate user logins: ✑ Through user accounts local to Cisco UCS Manager ✑ Remotely through one of the following protocols: LDAP - RADIUS - TACACS+ Reference: https://www.cisco.com/en/US/docs/unified_computing/ucs/sw/gui/config/guide/141/UCSM_GUI_Configuration_Guide_141_chapter7.html

   Source: Adapted from community discussion — RTL_dude

   Next question

5. Question 175 · 504 in bank

   Refer to the exhibit.

   

   What is the result of implementing this configuration?

   • AThe switch queries the TACACS+ server by using an encrypted text PAP login.
   • BThe TACACS+ server uses the type-6 encrypted format.
   • CThe switch queries the TACACS+ server by using a clear text PAP login.
   • DThe timeout value on the TACACS+ server is 10 seconds.

   Show answer

   Answer: A

   Explanation

   Answer is A tacacs-server key To configure a global TACACS+ shared secret key, use the tacacs-server key command. To remove a configured shared secret, use the no form of this command. tacacs-server key [0 | 7] shared-secret Syntax Description 7 (Optional) Configures a preshared key specified in encrypted text to authenticate communication between the TACACS+ client and server.

   Source: Adapted from community discussion — ciscochick

   References

   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

6. Question 176 · 504 in bank

   Refer to the exhibit.

   

   Which setting must be configured to prevent the reuse of passwords?

   • AChange Interval
   • BNo Change Interval
   • CHistory Count
   • DChange Count

   Show answer

   Answer: C

   Explanation

   Configuring the Password History Count You must have admin or aaa privileges to change the password profile properties. Reference: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/ucs-manager/GUI-User-Guides/Admin-Management/4-1/ b_Cisco_UCS_Admin_Mgmt_Guide_4-1/m_password_management.html

   

   Next question

7. Question 177 · 504 in bank

   Select 2

   Port security is statically configured on a Cisco Nexus 7700 Series switch and F3 line card. The switch is configured with an Advanced Services license. Which two actions delete secured MAC addresses from the interface? (Choose two.)

   • AThe address must be removed from the configuration.
   • BShutdown and then no shutdown must be run on the interface.
   • CThe device must be restarted manually.
   • DThe address must reach the age limit that is configured for the interface.
   • EThe interface must be converted to a routed port.

   Show answer

   Answer: AE

   Explanation

   Removing a Static Secure MAC Address on an Interface: You can remove a static secure MAC address on a Layer 2 interface. Switched port to routed port: When you change an interface from a Layer 2 interface to a Layer 3 interface, the device disables port security on the interface and discards all port security configuration for the interface. The device also discards all secure MAC addresses for the interface, regardless of the method used to learn the address. Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX- OS_Security_Configuration_Guide__Release_6-x/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6-x_chapter_010001.html

   Source: Adapted from community discussion — malkovitch

   References

   • Cisco documentation

   Next question

8. Question 178 · 504 in bank

   An engineer is configuring AAA authentication on a Cisco MDS 9000 Series switch. The LDAP server is located under the IP 10.10.2.2. The data sent to the LDAP server should be encrypted. Which command should be used to meet these requirements?

   • Aldap-server 10.10.2.2 port 443
   • Bldap-server 10.10.2.2 key SSL_KEY
   • Cldap-server host 10.10.2.2 key SSL_KEY
   • Dldap-server host 10.10.2.2 enable-ssl

   Show answer

   Answer: D

   Next question

9. Question 179 · 504 in bank

   An engineer must configure a Nexus 7000 series switch for HSRP on VLAN 100. When fully functional, the router must be the active master. Which set of commands must be used to implement the scenario?

   • Afeature hsrp interface vlan100 ip address 10.1.1.2 255.255.255.0 priority 255 preempt hsrp version 2 hsrp 1000 ip 10.1.1.1
   • Bfeature-set hsrp interface vlan100 ip address 10.1.1.2 255.255.255.0 priority 20 preempt hsrp version 2 hsrp 1000 ip 10.1.1.1
   • Cfeature-set hsrp interface vlan100 ip address 10.1.1.2 255.255.255.0 priority 80 preempt hsrp version 2 hsrp 1000 ip 10.1.1.1
   • Dfeature hsrp interface vlan100 ip address 10.1.1.2 255.255.255.0 priority 240 preempt hsrp version 2 hsrp 1000 ip 10.1.1.1

   Show answer

   Answer: A

   Explanation

   The correct answer is A since the highest priority will become the active device into HSRP cluster. The priority range is 1 - 255.

   Source: Adapted from community discussion — designated

   Next question

10. Question 180 · 504 in bank

    

    Refer to the exhibit. What is the result of implementing the configuration?

    • AThe RADIUS server timeout value is 15 milliseconds.
    • BRADIUS traffic is sourced from the VLAN 200 interface.
    • CUsers specify the RADIUS server when they log in.
    • DOnly the RADIUS server is used for authentication.

    Show answer

    Answer: D

    Explanation

    A: the configured timeout is 15 seconds, not 15 milliseconds B: the mgmt0 interface is used as source C: No, because the "directed-request" function is not configured D: CORRECT, since by default, NX-OS will fallback to local when remote authentication fails. Therefore, answer D is correct.

    Source: Adapted from community discussion — Annielover007

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-601 practice, question 171. 504 questions available.