350-601 practice questions 191–200

1. Question 191 · 504 in bank

   A network engineer is configuring the Cisco UCS service profile template with Ansible using this code: hostname: 192.168.10.23 username: cisco password: f718c4329405726531f6247ff982 name: DCE-CTRL template_type: updating-template uuid_pool: UUID-POOL storage_pronte: DCE-StgProf maintenance_policy: default server_pool: Container-Pool host_firmware_package: 4.1(1a) bios_policy: Docker Which attribute must be used to apply the iSCSI initiator identifiers to all iSCSI vNICs for the service profiles derived from the service template?

   • Asan_connectivity_policy
   • Blan_connectivity_policy
   • Cboot_policy
   • Diqn_pool

   Show answer

   Answer: D

   Explanation

   An IQN pool is a collection of iSCSI Qualified Names (IQNs) for use as initiator identifiers by iSCSI vNICs in a Cisco UCS domain. IQN pools created in Cisco UCS Central can be shared between Cisco UCS domains. Reference: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/ucs-central/GUI-User-Guides/Server-Mgmt/1-5/ b_CiscoUCSCentral_Server_Management_Guide_1-5/b_CiscoUCSCentral_Server_Management_Guide_1-5_chapter_0101.html

   Next question

2. Question 192 · 504 in bank

   DRAG DROP - A network engineer must implement RBAC on Cisco MDS 9000 Series Multilayer Switches. Drag and drop the Cisco MDS 9000 Series roles from the left onto the categories they belong to on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/ucs-manager/GUI-User-Guides/Admin-Management/3-1/ b_Cisco_UCS_Admin_Mgmt_Guide_3_1/b_UCSM_Admin_Mgmt_Guide_chapter_01.html

   Source: Adapted from community discussion — Smoothey

   References

   • Cisco documentation
   • Cisco documentation

   

   Next question

3. Question 193 · 504 in bank

   Select 2

   An engineer must configure RBAC in Cisco UCS Manager in an existing data center environment. Which two roles are suitable for configuring LAN connectivity policies? (Choose two.)

   • Aserver-profile
   • Bnetwork-admin
   • Coperations
   • Denable
   • Eadmin

   Show answer

   Answer: BE

   Explanation

   The system contains the following default user roles: AAA Administrator - Read-and-write access to users, roles, and AAA configuration. Read access to the rest of the system. Administrator - Complete read-and-write access to the entire system. The default admin account is assigned this role by default and it cannot be changed. Facility Manager - Read-and-write access to power management operations through the power-mgmt privilege. Read access to the rest of the system. Network Administrator - Read-and-write access to fabric interconnect infrastructure and network security operations. Read access to the rest of the system. Operations - Read-and-write access to systems logs, including the syslog servers, and faults. Read access to the rest of the system. Read-Only - Read-only access to system configuration with no privileges to modify the system state. Server Equipment Administrator - Read-and-write access to physical server related operations. Read access to the rest of the system. Server Profile Administrator - Read-and-write access to logical server related operations. Read access to the rest of the system. Server Security Administrator - Read-and-write access to server security related operations. Read access to the rest of the system. Storage Administrator - Read-and-write access to storage operations. Read access to the rest of the system. Reference: https://www.cisco.com/en/US/docs/unified_computing/ucs/sw/gui/config/guide/141/UCSM_GUI_Configuration_Guide_141_chapter9.html

   Source: Adapted from community discussion — poy4242

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 194 · 504 in bank

   An engineer is enabling port security on a Cisco MDS 9000 Series Switch. Which feature of enabling port security on a Cisco MDS 9000 Series Switch must be considered?

   • AIt is distributed by using Cisco Fabric Services.
   • BIt authorizes only the configured sWWN to participate in the fabric.
   • CIt always learns about switches that are logging in.
   • DIt binds the fabric at the switch level.

   Show answer

   Answer: A

   Explanation

   It's A. Configuration distribution uses the CFS infrastructure, and is limited to those switches that are CFS capable. Distribution is disabled by default. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/sw/8_x/config/security/cisco_mds9000_security_config_guide_8x/configuring_port_security.html#con_1002501

   Source: Adapted from community discussion — MaxG

   References

   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 195 · 504 in bank

   DRAG DROP - An engineer is implementing security on the Cisco MDS 9000 switch. Drag and drop the descriptions from the left onto the correct security features on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer seems to be wrong. It should be like this: Fabric Binding: - Uses the Exchange Fabric Membership Data Protocol - Prevent unauthorized switches from joining the fabric or disrupting current fabric operations Port Security: - Can be distributed via fabric services - Allows a preconfigured set of Fibre Channel devices to logically connect to a SAN ports. Reference: https://www.cisco.com/en/US/docs/switches/datacenter/nexus5500/sw/san_switching/7x/b_5500_SAN_Switching_Config_7x_chapter_010010.html#con_1170967 Also, in the official 350-601 guide we can see a table called "Fabric Binding and Port Security Comparison" in which the differences are mentioned.

   Source: Adapted from community discussion — john350601

   References

   • Cisco documentation
   • Cisco documentation

   

   Next question

6. Question 196 · 504 in bank

   An engineer has a primary fabric that is named UCS-A and a secondary fabric that is named UCS-B. A certificate request that has a subject name of sjc2016 for a keyring that is named kr2016 needs to be created. The cluster IP address is 10.68.68.68. Which command set creates this certificate request?

   • AUCS-A # scope keyring kr2016 UCS-A /keyring # create certreq 10.68.68.68 sjc2016 UCS-A /keyring* # commit-buffer
   • BUCS-B # scope keyring kr2016 UCS-B /keyring # create certreq ip 10.68.68.68 subject-name sjc2016 UCS-B /keyring* # commit-both
   • CUCS-B# scope security UCS-B /security # scope keyring kr2016 UCS-B /security/keyring # set certreq 10.68.68.68 sjc2016 UCS-B /security/keyring* # commit-both
   • DUCS-A# scope security UCS-A /security # scope keyring kr2016 UCS-A /security/keyring # create certreq ip 10.68.68.68 subject-name sjc2016 UCS-A /security/keyring* # commit-buffer

   Show answer

   Answer: D

   Explanation

   UCS-A# scope security UCS-A /security # scope keyring kr220 UCS-A /security/keyring # create certreq ip 192.168.200.123 subject-name sjc04 Certificate request password: Confirm certificate request password: UCS-A /security/keyring* # commit-buffer UCS-A /security/keyring # show certreq

   Source: Adapted from community discussion — designated

   References

   • Cisco documentation

   Next question

7. Question 197 · 504 in bank

   A company provides applications and database hosting services to multiple customers using isolated infrastructure-as-a-service services within the same data center environment. The environment is based on Cisco MDS 9000 Series Switches. The requirement is to manage the environment by using Fibre Channel Security Protocol and to enable user authentication when the centralized AAA server is unreachable. All communication between the MDS switches and the remote servers must be encrypted. Which command set must be used to meet these requirements?

   • Aaaa group server radius RadiusServer1 aaa authentication login default RadiusServer1
   • Baaa group server tacacs+ TacacsServer1 aaa authentication dhchap default group TacacsServer1
   • Caaa group server radius RadiusServer1 aaa authentication dhchap default group RadiusServer1
   • Daaa group server tacacs+ TacacsServer1 aaa authentication login console TacacsServer1

   Show answer

   Answer: B

   Explanation

   It has to be B. FC-SP uses DHCHAP protocol for authenticating authentication between MDS9000 and other devices could potencially use both tacacs and radius. However, bcs it tells us all communication between them should be encrypted, only TACACS provides full AAA encryption. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/mds9000/sw/8_x/config/security/cisco_mds9000_security_config_guide_8x/configuring_fcsp_dhchap.html#con_1247118

   Source: Adapted from community discussion — mauchi

   References

   • Cisco documentation

   Next question

8. Question 198 · 504 in bank

   A customer undergoes an IT security review assessment. The auditor must have read-only access to the Cisco Nexus 9000 Series Switch to perform the configuration review. The customer implements this security role for the auditor: role name audit rule 1 permit command * rule 2 - Output omitted -- username auditor password C4SAFF1B05EB1968$c0 role audit Which configuration snippet must complete the configuration?

   • Adeny command configure terminal
   • Bdeny command write *
   • Cpermit command show *
   • Dpermit command enable

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX- OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_chapter_01001.html

   Next question

9. Question 199 · 504 in bank

   An engineer must implement a solution that prevents untrusted DHCP servers from compromising the network. The feature must be configured on a Cisco Nexus 7000 Series Switch and applied to VLAN 10. The legitimate DHCP servers are connected to interface Ethernet 2/4. Which configuration set must be used to meet these requirements?

   • An7k-1(config)# ip dhcp snooping vlan 10 n7k-1(config)# interface Ethernet2/4 n7k-1(config-if)# ip dhcp snooping verify vlan 10
   • Bn7k-1(config)# ip dhcp snooping verify n7k-1(config)# interface Ethernet2/4 n7k-1(config-if)# ip dhcp snooping verify vlan 10
   • Cn7k-1(config)# ip dhcp snooping vlan 10 n7k-1(config)# interface Ethernet2/4 n7k-1(config-if)# ip dhcp snooping trust
   • Dn7k-1(config)# ip dhcp snooping verify n7k-1(config)# vlan configuration 10 n7k-1(config-vlan)# ip dhcp snooping trust

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX- OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_01100.html

   References

   • Cisco documentation

   Next question

10. Question 200 · 504 in bank

    An engineer implements a Cisco UCS C-Series Server that must adhere to these security requirements: ✑ Unencrypted communication must be disabled. ✑ The session timeout must not exceed 15 minutes. ✑ Unencrypted traffic must be automatically diverted. ✑ CLI-based management must use nondefault ports. Which configuration set meets these requirements?

    • ASSH Enabled SSH Port: 8022 SSH Timeout: 1200 IPMI over LAN Enabled
    • BHTTP Port: 80 / HTTPS Port: 443 Session Timeout: 900 Redirect HTTP to HTTPS Enabled SSH Port: 2022
    • CRedfish Enabled checked Redfish Port: 443 SSH Enabled checked HTTPS Port: 8443
    • DXML API Enabled HTTP Port: 8080 / HTTPS Port: 8443 IPMI over LAN Enabled Randomized Encryption Key

    Show answer

    Answer: B

    Explanation

    Only choice B meets all the requirements given of timing out in 15 minutes (900 seconds). Redirecting HTTP to HTTPS, and using a non-default SSH port.

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-601 practice, question 191. 504 questions available.