350-401 practice questions 281–290

1. Question 281 · 1003 in bank

   

   Refer to the exhibit. An engineer must deny HTTP traffic from host A to host B while allowing all other communication between the hosts. Drag and drop the commands into the configuration to achieve these results. Some commands may be used more than once. Not all commands are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The answer provided is correct, the first answer must permit: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/vlan_acls.pdf Router# show ip access-lists net_10Extended IP access list net_10 permit ip 10.0.0.0 0.255.255.255 any Router(config)# vlan access-map ganymede 10Router(config-access-map)# match ip address net_10Router(config-access-map)# action drop log

   Source: Adapted from community discussion — Adrenalina73

   References

   • Cisco documentation

   

   Next question

2. Question 282 · 1003 in bank

   DRAG DROP - Drag and drop the descriptions from the left onto the correct QoS components on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   not correct, both answer with delay and jitter must be swap... (from Policing to shaping) https://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html Shaping implies the existence of a queue and of sufficient memory to buffer delayed packets, while policing does not.

   Source: Adapted from community discussion — chris7411

   References

   • Cisco documentation

   

   Next question

3. Question 283 · 1003 in bank

   Which function does a fabric edge node perform in an SD-Access deployment?

   • AConnects endpoints to the fabric and forwards their traffic.
   • BEncapsulates end-user data traffic into LISP.
   • CConnects the SD-Access fabric to another fabric or external Layer 3 networks.
   • DProvides reachability between border nodes in the fabric underlay.

   Show answer

   Answer: A

   Explanation

   Answer is "A": https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx-os/vxlan/configuration/guide/b_NX-OS_VXLAN_Configuration_Guide/campus-fabric.pdf "Fabric Edge Node : Fabric edge nodes are responsible for admitting, encapsulating/decapsulating and forwarding traffic to and from endpoints connected to the fabric edge"

   Source: Adapted from community discussion — edg

   References

   • Cisco documentation

   Next question

4. Question 284 · 1003 in bank

   An engineer must configure the strongest password authentication to locally authenticate on a router. Which configuration must be used?

   • Ausername netadmin secret 5 $1$b1Ju$kZbBS1Pyh4QzwXyZ1kSZ2
   • Busername netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDAx1uV
   • Cusername netadmin secret $1$b1Ju$k406689705QzwXyZ1kSZ2
   • Dline Console 0 password $1$b1Ju$

   Show answer

   Answer: B

   Explanation

   Use Type 6, Type 8 and Type 9 wherever possible. Type 0, Type 5 and Type 7 should be migrated to other stronger methods. Type 5 These use a salted MD5 hashing algorithm. These should only be used if Type 6, 8, or 9 is not available on the IOS version you are running. Attempting to use Type 5 in modern IOS XE will throw an error as these will be depreciated soon. In the running config these start with $5$. Type 9 These use the SCRYPT hashing algorithm defined in the informational RFC 7914. SCRYPT uses 80-bit salt, 16384 iterations. It’s very memory expensive to run the algorithm and therefore difficult to crack. Running it once occasionally on a Cisco device is fine though, this is currently the Best Practice Type password to use. I have not proven it but I believe it is possible that the popular tool HashCat is able to decrypt these. In the running config standard Type 9 start with $9$. In the running config convoluted Type 9 start with $14$. https://community.cisco.com/t5/networking-knowledge-base/understanding-the-differences-between-the-cisco-password-secret/ta-p/3163238

   Source: Adapted from community discussion — CKL_SG

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

5. Question 285 · 1003 in bank

   What is a characteristic of MACsec?

   • A802.1AE is built between the host and switch using the MKA protocol, which negotiates encryption keys based on the primary session key from a successful 802.1X session.
   • B802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol.
   • C802.1AE is built between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode).
   • D802.1AE provides encryption and authentication services.

   Show answer

   Answer: A

   Explanation

   MACsec, defined in 802.1AE, provides MAC-layer encryption over wired networks by using out-ofband methods for encryption keying. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys. MKA and MACsec are implemented after successful authentication using the 802.1x Extensible Authentication Protocol (EAP-TLS) or Pre Shared Key (PSK) framework.

   Source: Adapted from community discussion — Jheax

   References

   • cisco.com documentation

   Next question

6. Question 286 · 1003 in bank

   Refer to the exhibit.

   

   A network engineer must configure a password expiry mechanism on the gateway router for all local passwords to expire after 60 days. What is required to complete this task?

   • AAdd the username admin privilege 15 common-criteria-policy Administrators password 0 Cisco13579! command.
   • BThe password expiry mechanism is on the AAA server and must be configured there.
   • CAdd the aaa authentication enable default Administrators command.
   • DNo further action is required. The configuration is complete.

   Show answer

   Answer: A

   Explanation

   Device> enable Device# configure terminal Device(config)# aaa new-model Device(config)# aaa common-criteria policy policy1 Device(config-cc-policy)# char-changes 4 Device(config-cc-policy)# max-length 20 Device(config-cc-policy)# min-length 6 Device(config-cc-policy)# numeric-count 2 Device(config-cc-policy)# special-case 2 Device(config-cc-policy)# exit Device(config)# username user1 common-criteria-policy policy1 password password1 Device(config)# end https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/xe-16-10/sec-usr-aaa-xe-16-10-book/sec-aaa-comm-criteria-pwd.html

   Source: Adapted from community discussion — nushadu

   References

   • Cisco documentation

   Next question

7. Question 287 · 1003 in bank

   Refer to the exhibit.

   

   Which privilege level is assigned to VTY users?

   • A1
   • B7
   • C13
   • D15

   Show answer

   Answer: A

   Explanation

   The answer is letter "A": 1. https://www.oreilly.com/library/view/hardening-cisco-routers/0596001665/ch04.html "Default Privilege Levels The bottom and least privileged level is level 0. This is the only other level besides 1 and 15 that is configured by default on Cisco routers. Next is level 1, the default user level. This level provides the user with many more commands that allow the user to display router information, telnet to other systems, and test network connectivity with ping and traceroute. Level 2, which is not enabled by default, adds a few additional show and clear commands, but provides no opportunity for a user to reconfigure the router. Finally, level 15 allows full access to all router commands."

   Source: Adapted from community discussion — edg

   References

   • cisco.com documentation

   Next question

8. Question 288 · 1003 in bank

   Which statements are used for error handling in Python?

   • Atry/catch
   • Bcatch/release
   • Cblock/rescue
   • Dtry/except

   Show answer

   Answer: D

   Explanation

   OCG CCNA Devnet What if you wanted Python to tell the users what they did wrong and let them try again or perform some other task to recover from the error? That’s where the try-except-else-finally code blocks come into play.

   Source: Adapted from community discussion — eww_cybr

   Next question

9. Question 289 · 1003 in bank

   How do agent-based versus agentless configuration management tools compare?

   • AAgentless tools use proxy nodes to interface with slave nodes.
   • BAgentless tools require no messaging systems between master and slaves.
   • CAgent-based tools do not require a high-level language interpreter such as Python or Ruby on slave nodes.
   • DAgent-based tools do not require installation of additional software packages on the slave nodes.

   Show answer

   Answer: B

   Explanation

   Agentless tool means that no software or agent needs to be installed on the client machines that are to be managed. Ansible is such an agentless tool. In contrast to agentless tool, agent-based tool requires software or agent to be installed on the client. Therefore the master and slave nodes can communicate directly without the need of high-level language interpreter. An agentless tool uses standard protocols, such as SSH, to push configurations down to a device (and it can be considered a “messaging system”).

   Source: Adapted from community discussion — Audi87

   Next question

10. Question 290 · 1003 in bank

    Refer to the exhibit.

    

    Which HTTP JSON response does the Python code output give?

    • A7.0(3)|7(4)
    • B7.61
    • CNameError: name 'json' is not defined
    • DKeyError: 'kickstart_ver_str'

    Show answer

    Answer: A

    Explanation

    A is correct look at the end of the Python script where Print is follow the steps to the key path, python will output the value of it ins_api > outputs > output > body > kickstart_ver_str Python will print the value of kickstart_ver_str which you can see on the right side ...................

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 281. 1003 questions available.