350-601 practice questions 401–410

1. Question 401 · 504 in bank

   An engineer must automate the provisioning of Cisco ACI objects using the Terraform tool. The engineer must ensure that APIC counts the authentication login requests against the threshold to avoid a DOS attack. Which configuration must be used in Terraform to accomplish these goals?

   • Aresources with user ID and password
   • Bresources with signature-based authentication
   • Cprovider with user ID and password
   • Dprovider with signature-based authentication

   Show answer

   Answer: C

   Explanation

   The question states 'engineer must ensure APIC count the requests' https://registry.terraform.io/providers/CiscoDevNet/aci/latest/docs Authentication with user-id and password. In this method, it will obtain an authentication token from Cisco APIC and will use that token to authenticate. A limitation with this approach is APIC counts the request This is what the question asked for so I think it is C

   Source: Adapted from community discussion — gaz1978

   Next question

2. Question 402 · 504 in bank

   A customer needs a tool to take advantage of the CI/CD model to streamline its operations and optimize cost. The customer wants to integrate the solution with the Cisco products it currently uses, including Cisco ACI networking and Cisco UCS Series servers. The solution should also provide on-premises Kubernetes and AppDynamics performance monitoring. Because of the security requirements, the solution should not install a local client on products under management. Which orchestration solution meets these requirements?

   • ACisco UCS Director
   • BCisco CloudCenter
   • CCisco APIC
   • DCisco DCNM

   Show answer

   Answer: B

   Explanation

   With Cisco CloudCenter you can automate multicloud workload deployment and increase feature velocity, consistently enforce multicloud governance, and optimize cloud service consumption to reduce risk and cloud costs. Streamline consumption of cloud or on-premises services with the combination of CloudCenter with Cisco Container Platform for on-premises Kubernetes, and AppDynamics for business and application performance monitoring. Reference: https://www.cisco.com/c/en/us/products/cloud-systems-management/cloudcenter/index.html

   Next question

3. Question 403 · 504 in bank

   

   Refer to the exhibit. The Cisco NX-OS scheduler must run every day at 3:00 a.m. Which code snippet completes the script?

   • Atime start daily 3:00
   • Btime start weekly 7 3:00
   • Ctime weekly 7 3:00
   • Dtime daily 3:00

   Show answer

   Answer: D

   Next question

4. Question 404 · 504 in bank

   A network automation engineer must configure a Cisco NX-OS REST API on a Cisco 9000 Series Switch with these requirements: • NX-API REST and the DME database must be enabled. • The NX-API REST must listen for HTTP traffic on port 83. • The HTTPS certificate must be uploaded. Which configuration set must be used to accomplish these goals?

   • Afeature nxapi nxapi (tcp) port 83 nxapi certificate {httpscrt}
   • Bfeature nxapi nxapi (tcp) port 83 nxapi certificate {httpscrt} nxapi certificate enable
   • Cfeature nxapi nxapi (http) port 83 nxapi certificate {httpscrt}
   • Dfeature nxapi nxapi {http} port 83 nxapi certificate {httpscrt | httpskey} nxapi certificate enable

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

5. Question 405 · 504 in bank

   

   Refer to the exhibit. An engineer reported suspicious behavior in a server farm that is deployed on the 198.19.1.0/24 subnet. The traffic must be captured only from the server with the IP address of 198.19.1.19/24. The traffic analyzer is connected to the same switch as the server farm. Which configuration set captures the traffic?

   • Aswitch(config)# ip access-list match_Server_pkts switch(config-acl)# permit ip 198.19.1.19 0.0.0.0 any switch(config)# monitor session 1 switch(config-monitor)# filter access-group span_filter
   • Bswitch(config)# ip access-list match_Server_pkts switch(config-acl)# permit ip 198.19.1.19 0.0.0.0 any switch(config)# monitor session 1 switch(config-monitor)# filter access-group 5
   • Cswitch(config)# ip access-list match_Server_pkts switch(config-acl)# permit ip 198.19.1.19 255.255.255.255 any switch(config)# monitor session 1 switch(config-monitor)# filter access-group span_filter
   • Dswitch(config)# ip access-list match_Server_pkts switch(config-acl)# permit ip 198.19.1.19 255.255.255.0 any switch(config)# monitor session 1 switch(config-monitor)# filter access-group span_filter

   Show answer

   Answer: A

   Explanation

   in cisco access-lists you had to use the wildcard mask which is reverse to the subnet mask. example subnet mask 255.255.255.255 is specified as 0.0.0.0 in wildcard which is to match a host ip.

   Source: Adapted from community discussion — Gopz28

   Next question

6. Question 406 · 504 in bank

   DRAG DROP - All logins to a Cisco Nexus 9000 Series Switch must pass through the TACACS+ server at IP address 192.168.10.10. The configuration must meet these requirements: • The TACACS+ server must be used for SSH and Telnet. • The TACACS+ server key must be Cisco123!. • Management VRF must be used for connectivity. • The deployment must fail back to local credentials if the TACACS+ server fails to respond within 30 seconds. Drag and drop the code snippets from the right onto the blanks in the code on the left to complete the configuration. Not all code snippets are used.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   switch# configure terminal switch(config)# feature tacacs+ switch(config)# tacacs-server key 7 "ToIkLhPpG" switch(config)# tacacs-server host 10.10.2.2 key 7 "ShMoMhTl" switch(config)# aaa group server tacacs+ TacServer switch(config-tacacs+)# server 10.10.2.2 switch(config-tacacs+)# use-vrf management

   Source: Adapted from community discussion — crooks_1988

   

   Next question

7. Question 407 · 504 in bank

   The Cisco TACACS+ on a Cisco Nexus Series Switch must authenticate any user attempting to access the device and fail over to the local account if the TACACS+ sever becomes unavailable. Which command accomplishes these goals?

   • Aaaa authentication login default fallback error local
   • Baaa authentication login console group local
   • Caaa authentication login default local
   • Daaa authentication login default group ISE local

   Show answer

   Answer: D

   Explanation

   It cannot be C. command aaa authentication login default local Sets the login authentication to use the local username database. The default keyword applies the local user database authentication to all ports

   Source: Adapted from community discussion — camelw

   References

   • Cisco documentation

   Next question

8. Question 408 · 504 in bank

   A QoS policy on Cisco UCS must meet these requirements: • No-drop class must be configured. • Jumbo frames must be enabled without fragmentation. Which configuration must be implemented to mast these conditions?

   • AConfigure slow-drain timers and specify an MTU value of 9100 bytes.
   • BCreate a Flow Control Policy and specify an MTU value of 9000 bytes.
   • CCreate a QoS system class and specify an MTU value of 9216 bytes.
   • DConfigure Platinum system class and specify an MTU value of 9100 bytes.

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

9. Question 409 · 504 in bank

   Select 2

   An engineer must create a new Cisco UCS user account to perform these actions: • Modify systems logs, faults, and power management settings. • View access to all other configuration in the UCS domain. Which two roles must be assigned to the user to permit these actions? (Choose two.)

   • AServer Compute
   • BRead-Only
   • COperations
   • DFacility Manager
   • EAdministrator

   Show answer

   Answer: CD

   References

   • Cisco documentation

   Next question

10. Question 410 · 504 in bank

    

    Refer to the exhibit. A source is sending a multicast traffic stream to the receiver. How is the multicast traffic expected to flow through the network when it reaches a vPC peer?

    • A• The multicast traffic is not replicated to the ports that joined a multicast group (224.0.0.13) or the peer link. • The multicast traffic stream flows over the vPC link to ensure that orphan ports get the multicast stream in failure scenarios.
    • B• The multicast traffic is replicated to the ports that joined a given multicast group and the peer link. • The multicast traffic stream flows from Agg-1 to Agg-2 over the M1-to-M2 peer link and forwards the traffic over Layer 4 to Access-2.
    • C• The multicast traffic is replicated to the ports that joined a given multicast group and the peer link. • The multicast traffic stream flows over the peer link to ensure that orphan ports receive the multicast stream in failure scenarios.
    • D• The multicast traffic is not replicated to the ports that joined a multicast group (224.0.0.13) or the peer link. • The multicast traffic stream flows from Agg-1 to Agg-2 over the M1-to-M2 peer link and forwards the traffic over Layer 4 to Access-2.

    Show answer

    Answer: C

    Explanation

    Multicast data traffic flows down the source tree to active forwarding vPC peer device. vPC peer device 1 (7K1) sends a copy of the multicast traffic out of the vPC member port connected to access switch. One another copy is sent out of vPC peer-link. As there is no single-attached device (or orphan port) interested by this multicast traffic on the other side, vPC peer device 2 (7K2) will drop the multicast traffic

    Source: Adapted from community discussion — asd248402

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-601 practice, question 401. 504 questions available.