350-401 practice questions 271–280

1. Question 271 · 1003 in bank

   What is a VPN in a Cisco SD-WAN deployment?

   • Acommon exchange point between two different services
   • Battribute to identify a set of services offered in specific places in the SD-WAN fabric
   • Cvirtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric
   • Dvirtual channel used to carry control plane information

   Show answer

   Answer: C

   Explanation

   C - From Cisco: [...] VPN Segmentation: Traffic isolation is key to any security strategy. Traffic that enters the router is assigned to a VPN, which not only isolates user traffic, but also provides routing table isolation. This ensures that a user in one VPN cannot transmit data to another VPN unless explicitly configured to do so. When traffic is transmitted across the WAN, a label is inserted after the ESP header to identify the VPN that the user’s traffic belongs to when it reaches the remote destination. >>>> Cisco SD-WAN Design Guide SOURCE: https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html

   Source: Adapted from community discussion — SheldonC

   References

   • Cisco documentation

   Next question

2. Question 272 · 1003 in bank

   

   Refer to the exhibit. What step resolves the authentication issue?

   • Ause basic authentication
   • Bchange the port to 12446
   • Ctarget 192.168.100.82 in the URI
   • Drestart the vsmart host

   Show answer

   Answer: C

   Explanation

   the #show control connections output demonstrated the connection to the vManage isn't up, not that vManage is not running, hence why rebooting won't help, certainly because the only reboot answer refers to vSmart so another component again. Postman needs to point to the vManage IP to establish a connection, therefore answe C is the correct answer.

   Source: Adapted from community discussion — FrameRelay

   Next question

3. Question 273 · 1003 in bank

   Refer to the exhibit.

   

   Security policy requires all idle exec sessions to be terminated in 600 seconds. Which configuration achieves this goal?

   • Aline vty 0 15 absolute-timeout 600
   • Bline vty 0 15 no exec-timeout
   • Cline vty 0 15 exec-timeout 10 0
   • Dline vty 0 4 exec-timeout 600

   Show answer

   Answer: C

   Explanation

   Tested on real device: WS-C3850(config)#line vty 0 15 WS-C3850(config-line)#exec-timeout ? Timeout in minutes WS-C3850(config-line)#exec-timeout 10 ? Timeout in seconds WS-C3850(config-line)#exec-timeout 10 0 ?

   Source: Adapted from community discussion — H3kerman

   Next question

4. Question 274 · 1003 in bank

   Refer to the exhibit.

   

   An engineer must block all traffic from a router to its directly connected subnet 209.165.200.0/24. The engineer applies access control list EGRESS in the outbound direction on the GigabitEthernet0/0 interface of the router. However, the router can still ping hosts on the 209.165.200.0/24 subnet. What explains this behavior?

   • AAccess control lists that are applied outbound to a router interface do not affect traffic that is sourced from the router.
   • BAfter an access control list is applied to an interface, that interface must be shut and no shut for the access control list to take effect.
   • COnly standard access control lists can block traffic from a source IP address.
   • DThe access control list must contain an explicit deny to block traffic from the router.

   Show answer

   Answer: A

   Explanation

   Locally (control plane) generated traffic goes from control plane directly to "tx-ring". That is different from processing/forwarding of Transit traffic. Please see the platform's "packet journey" session of Cisco Live or other documentation to see the different internal path & processing for: Transit, forus, exception, locally generated.

   Source: Adapted from community discussion — Jheax

   References

   • cisco.com documentation

   Next question

5. Question 275 · 1003 in bank

   What is a characteristic of a next-generation firewall?

   • Aonly required at the network perimeter
   • Brequired in each layer of the network
   • Cfilters traffic using Layer 3 and Layer 4 information only
   • Dprovides intrusion prevention

   Show answer

   Answer: D

   Next question

6. Question 276 · 1003 in bank

   

   Refer to the exhibit. An engineer is investigating why guest users are able to access other guest user devices when the users are connected to the customer guest WLAN. What action resolves this issue?

   • Aimplement P2P blocking
   • Bimplement MFP client protection
   • Cimplement Wi-Fi direct policy
   • Dimplement split tunneling

   Show answer

   Answer: A

   Explanation

   This control determines whether the Wireless LAN Controller is configured to prevent clients connected to the same Wireless Local Area Controller from communicating with each other. Wireless Client Isolation prevents wireless clients from communicating with each other over the RF. Packets that arrive on the wireless interface are forwarded only out the wired interface of an Access Point. One wireless client could potentially compromise another client sharing the same wireless network. https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_01001111.html

   Source: Adapted from community discussion — AlbertoStu

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 277 · 1003 in bank

   

   Refer to the exhibit. An engineer has configured Cisco ISE to assign VLANs to clients based on their method of authentication, but this is not working as expected. Which action will resolve this issue?

   • Aenable AAA override
   • Bset a NAC state
   • Cutilize RADIUS profiling
   • Drequire a DHCP address assignment

   Show answer

   Answer: A

   Explanation

   I strongly suggest Enable AAA Override: https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html#anc16 From the Advance tab, enable the Allow AAA Override check box to override the WLC configuration when the RADIUS server returns the attributes needed to place the client on the proper VLAN as shown in the image

   Source: Adapted from community discussion — Adrenalina73

   References

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 278 · 1003 in bank

   

   Refer to the exhibit. Which single security feature is recommended to provide Network Access Control in the enterprise?

   • AMAB
   • B802.1X
   • CWebAuth
   • Dport security sticky MAC

   Show answer

   Answer: B

   Explanation

   IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. The given answer is correct

   Source: Adapted from community discussion — Nhan

   Next question

9. Question 279 · 1003 in bank

   

   Refer to the exhibit. After configuring an IPsec VPN, an engineer enters the show command to verify the ISAKMP SA status. What does the status show?

   • AVPN peers agreed on parameters for the ISAKMP SA.
   • BPeers have exchanged keys, but ISAKMP SA remains unauthenticated.
   • CISAKMP SA is authenticated and can be used for Quick Mode.
   • DISAKMP SA has been created, but it has not continued to form.

   Show answer

   Answer: C

   Explanation

   Provided answer is correct. (C) The ISAKMP negotiations are complete. Phase 1 successfully completed. It remains authenticated with its peer and may be used for subsequent Quick mode exchanges. https://www.tunnelsup.com/isakmp-ike-phase-1-status-messages/

   Source: Adapted from community discussion — Dreket

   Next question

10. Question 280 · 1003 in bank

    Select 2

    Which two threats does AMP4E have the ability to block? (Choose two.)

    • Aemail phishing
    • BDDoS
    • CMicrosoft Word macro attack
    • DSQL injection
    • Eransomware

    Show answer

    Answer: CE

    Explanation

    C and E are correct: when you see AMP4E aka Advanced malware protection for endpoints, think of the end devices directly something that could happen on the PC directly for example. like in this case you get a word document with macro in it, or run a file that contains ransomware. DDos mainly targets your network accessibility and you can't prevent it directly from the endpoint email phishing is related to user awareness and can pe prevented by the firewall for example SQL injection as I know attacks the database backend not endpoints and preventing it has nothing to do with the endpoint where the database is, it should be protected within the code

    Source: Adapted from community discussion — [Removed]

    References

    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 271. 1003 questions available.