350-601 practice questions 181–190

1. Question 181 · 504 in bank

   

   Refer to the exhibit. Which action is taken to ensure that the relay agent forwards the DHCP BOOTREQUEST packet to a DHCP server?

   • AConfigure the IP address of the DHCP server.
   • BVerify the DHCP snooping bindings.
   • CConfigure the interface of the DHCP server as untrusted.
   • DEnable the DHCP relay agent.

   Show answer

   Answer: A

   Explanation

   the answer is correct A you can configure a DHCP server IP address on a layer 3 ethernet or subinterface. when an inbound DHCP BOOTREQUEST packet arrives on a port that is member of the port channel, the relay agent forward the packet to the IP address https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_0/dcnm/security/configuration/guide/sec_dcnm_config/sec_dhcpsnoop.pdf

   Source: Adapted from community discussion — ikholidd

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 182 · 504 in bank

   

   Refer to the exhibit. A network engineer requires remote access via SSH to a Cisco MDS 9000 Series Switch. The solution must support secure access using the local user database when the RADIUS servers are unreachable from the switches. Which command meets these requirements?

   • Aaaa authentication none
   • Baaa authentication login default group radius
   • Caaa authentication login default fallback error local
   • Daaa authentication login default group local

   Show answer

   Answer: B

   Explanation

   It's "B". Fallback is on by default Disabling Fallback to Local Authentication By default, if remote authentication is configured for console or default login and all AAA servers are unreachable (resulting in an authentication error), the Cisco NX-OS device falls back to local authentication to ensure that users are not locked out of the device. However, you can disable fallback to local authentication in order to increase security. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_chapter_0111.html

   Source: Adapted from community discussion — subject10

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 183 · 504 in bank

   A network administrator must configure an extra keyring in Cisco UCS Manager. The key must provide a high level of encryption and secure authentication when users use the web interface. Which configuration command set must be applied to meet these requirements? A.

   

   B.

   

   C.

   

   D.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/ucs-manager/CLI-User-Guides/Admin-Management/3-1/ b_Cisco_UCS_Manager_CLI_Administration_Mgmt_Guide_3_1/b_Cisco_UCS_Manager_CLI_Administration_Mgmt_Guide_3_1_chapter_0110.html

   Source: Adapted from community discussion — designated

   References

   • Cisco documentation

   Next question

4. Question 184 · 504 in bank

   An engineer must configure HTTPS secure management for Cisco UCS Manager using a key ring named kr2016 and a key size of 1024 bits. The environment consists of a primary fabric interconnect named UCS-A and a secondary fabric interconnect named UCS-B. Which command sequence must be used to accomplish this goal? A.

   

   B.

   

   C.

   

   D.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/ucs-manager/CLI-User-Guides/Admin-Management/4-0/ b_Cisco_UCS_Manager_CLI_Administration_Mgmt_Guide_4-0/b_Cisco_UCS_Manager_CLI_Administration_Mgmt_Guide_4-0_chapter_0110.html

   References

   • Cisco documentation

   Next question

5. Question 185 · 504 in bank

   A network engineer needs to configure system logging on the Cisco MDS Series switch. The messages must be displayed with the severity level of `warning` and above. For security reasons, the users must be logged out of the console after 5 minutes of inactivity. Which configuration must be applied to meet these requirements?

   • AMDS-A(config)# logging console 5 MDS-A(config-console)# exec-timeout 300
   • BMDS-A(config)# line console MDS-A(config-console)# speed 38400 MDS-A(config-console)# exec-timeout 5 MDS-A(config)# logging console 4
   • CMDS-A(config)# logging line 4 MDS-A(config-console)# session-limit 300
   • DMDS-A(config)# console MDS-A(config-console)# speed 38400 MDS-A(config-console)# session-limit 5 MDS-A(config)# logging console 5

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/sw/6_2/configuration/guides/fundamentals/b_Cisco_MDS_9000_Series_NX- OS_Fundamentals_Configuration_Guide/b_Cisco_MDS_9000_Series_NX-OS_Fundamentals_Configuration_Guide_Release_6_chapter_0100.html

   Source: Adapted from community discussion — crooks_1988

   Next question

6. Question 186 · 504 in bank

   A network administrator must perform a system upgrade on a Cisco MDS 9000 Series Switch. Due to the recent changes by the security team: * The AAA server is unreachable. * All TCP communication between the MDS 9000 Series Switch and AAA servers is disabled. Which actions must be used to perform the upgrade?

   • ALog in locally to the MDS 9000 Series Switch using a network-admin role and download the upgrade files from the remote TFTP server.
   • BLog in locally to the MDS 9000 Series Switch using a server-admin role and download the upgrade files from the remote FTP server.
   • CLog in to a server storing the upgrade files remotely using a server-admin role and download the files to the MDS 9000 Series Switch using SFTP.
   • DLog in to a server storing the upgrade files remotely using a network-admin role and download the files to the MDS 9000 Series Switch using HTTP.

   Show answer

   Answer: A

   Explanation

   Of all the answer choices, only TFTP does not use TCP. TFTP is a UDP based protocol.

   Source: Adapted from community discussion — Smoothey

   Next question

7. Question 187 · 504 in bank

   A network engineer must enable port security on all Cisco MDS Series Switches in the fabric. The requirement is to avoid the extensive manual configuration of the switch ports. Which action must be taken to meet these requirements?

   • AEnable the auto-learning port security feature.
   • BEnable the auto-learning port security feature on a per-VSAN basis.
   • CActivate CFS distribution and the auto-learning port security feature.
   • DActivate CFS distribution and the auto-learning port security feature on a per-VSAN basis.

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

8. Question 188 · 504 in bank

   An engineer must configure the HSRP protocol between two Cisco Nexus 9000 Series Switches. This configuration is present on Nexus A.

   

   The final HSRP configuration must meet these requirements: * The HSRP communication must be secured on both switches. * Both switches must support more than 300 groups. Which two commands must be added to the HSRP configuration on Nexus A to complete these requirements? (Choose two.)

   • Aauthentication text 1020
   • Bhsrp version 1
   • Cauthenticate md5 key-chain NHRP-KEYS
   • Dhsrp version 2
   • Eauthentication text 1010

   Show answer

   Answer: C

   Explanation

   Cisco NX-OS supports HSRP version 1 by default. You can configure an interface to use HSRP version 2. HSRP version 2 has the following enhancements to HSRP version 1: ✑ Expands the group number range. HSRP version 1 supports group numbers from 0 to 255. HSRP version 2 supports group numbers from 0 to 4095. ✑ For IPv4, uses the IPv4 multicast address 224.0.0.102 or the IPv6 multicast address FF02::66 to send hello packets instead of the multicast address of 224.0.0.2, which is used by HSRP version 1. ✑ Uses the MAC address range from 0000.0C9F.F000 to 0000.0C9F.FFFF for IPv4 and 0005.73A0.0000 through 0005.73A0.0FFF for IPv6 addresses. HSRP version 1 uses the MAC address range 0000.0C07.AC00 to 0000.0C07.ACFF. ✑ Adds support for MD5 authentication. This example shows how to configure MD5 authentication for HSRP on Ethernet 1/2 after creating the key chain: switch# configure terminal switch(config)# key chain hsrp-keys switch(config-keychain)# key 0 switch(config-keychain-key)# key-string 7 zqdest switch(config-keychain-key) accept-lifetime 00:00:00 Jun 01 2013 23:59:59 Sep 12 2013 switch(config-keychain-key) send-lifetime 00:00:00 Jun 01 2013 23:59:59 Aug 12 2013 switch(config-keychain-key) key 1 switch(config-keychain-key) key-string 7 uaeqdyito switch(config-keychain-key) accept-lifetime 00:00:00 Aug 12 2013 23:59:59 Dec 12 2013 switch(config-keychain-key) send-lifetime 00:00:00 Sep 12 2013 23:59:59 Nov 12 2013 switch(config-keychain-key)# interface ethernet 1/2 switch(config-if)# hsrp 2 switch(config-if-hsrp)# authentication md5 key-chain hsrp-keys switch(config-if-hsrp)# copy running-config startup-config Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/unicast/configuration/guide/l3_cli_nxos/l3_hsrp.html

   Next question

9. Question 189 · 504 in bank

   An engineer must implement Strict Unicast Reverse Path Forwarding mode for IPv4 packets on the Etnerret1/1 interface on the Cisco Nexus 9500 Series Switch. Which configuration achieves this goal?

   • Ainterlace Ethernet1/1 ip address 172.16.10.1/24 ip verify unicast source reachable-via rx
   • Binterface Ethernet1/1 ip address 172.16.10.1/24 ip verify unicast source any
   • Cinterface Ethernet1/1 ip address 172.16.10.1/24 ip verify unicast source reachable-via any
   • Dinterface Ethernet1/1 ip address 172.16.10.1/24 ip verify unicast source rx

   Show answer

   Answer: A

   Explanation

   The following example shows how to configure strict unicast RPF for IPv4 packets on a Cisco Nexus 9300 platform switch: no system urpf disable interface Ethernet2/2 ip address 172.23.231.240/23 ip verify unicast source reachable-via rx Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX- OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_010111.html

   Next question

10. Question 190 · 504 in bank

    Which MAC address is an HSRP version 2?

    • A3842.4250.0000
    • B0000.0C07.AC1H
    • C0000.0C9F.F0C8
    • D0100.5E7F.FFFF

    Show answer

    Answer: C

    Explanation

    Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/xe-3s/fhp-xe-3s-book/fhp-hsrp-v2.html

    Source: Adapted from community discussion — designated

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-601 practice, question 181. 504 questions available.