350-401 practice questions 851–860

1. Question 851 · 1003 in bank

   Which security option protects credentials from sniffer attacks in a basicAPI authentication?

   • Anext-generation firewall
   • BTLS or SSL for communication
   • CVPN connection between client and server
   • DAAA services to authenticate the API

   Show answer

   Answer: B

   Next question

2. Question 852 · 1003 in bank

   DRAG DROP - Drag and drop the descriptions of the VSS technology from the left to the right. Not all options are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Lets talk about the difference between both the technology Switch Stacking uses proprietary cabling and is limited in distance while in the case of Cisco VSS, It uses 10 GE interfaces and so it can be geographically separated In the case of stacking, no configuration required if switch supports stacking while in the case of Cisco VSS concept, you need to configure about the VSS and VSL on the switches. You can have stack upto 9 switches via stack cabling, while in the Cisco VSS, only two switches can be the part of VSS. For Cisco portfolio, Cisco switches like 2960 or 3750,3850 will be the part of the cisco stack switching while Cisco 4500 catalysts, Cisco 6500 and Cisco 6800 catalysts are using the concept of Cisco VSS. Another thing like Cisco stack switching generally used at Access layer while Cisco VSS can be used at distribution or core layers.

   Source: Adapted from community discussion — Summo

   References

   • cisco.com documentation

   

   Next question

3. Question 853 · 1003 in bank

   Which mechanism can be used to enforce network access authentication against an AAA server if the endpoint does not support the 802.1X supplicant functionality?

   • AWebAuth
   • BMACsec
   • Cprivate VLANs
   • Dport security

   Show answer

   Answer: A

   Explanation

   MAC Authentication Bypass (MAB) is an access control technique that enables port-based access control using the MAC address of an endpoint, and it is typically used as a fallback mechanism to 802.1x. A MAB-enabled port can be dynamically enabled or disabled based on the MAC address of the endpoint that connects to it WebAuth, like MAB, can be used as a fallback authentication mechanism for 802.1x. If both MAB and WebAuth are configured as fallbacks for 802.1x, when 802.1x times out, a switch first attempts to authenticate through MAB, and if it fails, the switch attempts to authenticate with WebAuth Extracted from Secure Network Access Control, Chapter 25 of the OCG

   Source: Adapted from community discussion — joseromerogarci

   Next question

4. Question 854 · 1003 in bank

   An engineer must configure router R1 to validate user logins via RADIUS and fall back to the local user database if the RADIUS server is not available. Which configuration must be applied?

   • Aaaa authentication exec default radius local
   • Baaa authentication exec default radius
   • Caaa authorization exec default radius local
   • Daaa authorization exec default radius

   Show answer

   Answer: A

   Explanation

   The commands are wrong. They should have been: a) aaa authentication login default group radius local b) aaa authentication login default group radius c) aaa authorization exec default group radius local d) aaa authorization exec default group radius We can eliminate B & D because without "local" keyword, if the AAA server does not reply to the authentication/authorization request, the authentication/authorization fails. The reason I selected A is: "Authentication allows administrators to identify who can connect to a router by including the user's username and password." "Authorization comes into play after authentication. Authorization allows administrators to control the level of access users have after they successfully gain access to the router." Validate user logins - authentication. https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/10384-security.html https://www.ciscopress.com/articles/article.asp?p=422947&seqNum=2

   Source: Adapted from community discussion — Horsefeathers

   References

   • Cisco documentation

   Next question

5. Question 855 · 1003 in bank

   What does the Cisco WLC Layer 3 roaming feature allow clients to do?

   • Amaintain their IP address when roaming to an AP or controller with a different client VLAN assignment
   • Bmaintain their connection between APs even when the AP management VLANs are different
   • Cmaintain their connection even if the client IP address changes when roaming
   • Droam seamlessly between controllers even when the controller management VLANs are different

   Show answer

   Answer: A

   Explanation

   When a client initiates an L3 intercontroller roam, the two controllers involved can compare the VLAN numbers that are assigned to their respective WLAN interfaces If the two VLAN IDs differ, the controllers arrange a Layer 3 roam (also known as a local-to-foreign roam) that will allow the client to keep using its IP address. D: wrong -> talks about management VLAN of the controller

   Source: Adapted from community discussion — riktammenaars

   References

   • Cisco documentation

   Next question

6. Question 856 · 1003 in bank

   What is the function of Cisco DNA Center in a Cisco SD-Access deployment?

   • AIt is responsible for the design, management, deployment, provisioning, and assurance of the fabric network devices
   • BIt is responsible for routing decisions inside the fabric
   • CIt provides integration and automation for all nonfabric nodes and their fabric counterparts
   • DIt possesses information about all endpoints, nodes, and external networks related to the fabric

   Show answer

   Answer: A

   Explanation

   Cisco DNA Center serves as a centralized management platform for SD-Access deployments. It provides a single pane of glass for designing, deploying, managing, and troubleshooting the fabric network infrastructure. With Cisco DNA Center, administrators can define policies, provision network devices, monitor network performance, and ensure compliance across the fabric. It plays a crucial role in automating and simplifying network operations in SD-Access deployments.

   Source: Adapted from community discussion — slacker_at_work

   Next question

7. Question 857 · 1003 in bank

   How do the MAC address table and TCAM differ?

   • ATCAM is populated from the ARP file, and the MAC address table is populated from the switch configuration file
   • BTCAM stores Layer 2 forwarding information, and the MAC address table stores QoS information
   • CTCAM lookups can match only 1s and 0s, and MAC address lookups can match 1s, 0s and a third "care/don't care" state
   • DTCAM is a type of memory and the MAC address table is a logical structure

   Show answer

   Answer: D

   Explanation

   TCAM: 1. A special type of memory for high-speed lookups. 2. Dedicated to packet classification and forwarding. 3. Stores complex forwarding information, such as Layer 2/Layer 3 forwarding, ACLs, and QoS. 4. Three possible results: true (0), false (1), and don’t care (X). 5. High speed and flexibility, suitable for complex packet processing. MAC Address Table: 1. A data structure that stores MAC addresses and their port information. 2. Typically implemented using RAM. 3. Stores MAC addresses and their associated ports for Layer 2 forwarding. 4. Two results: true (0) and false (1). 5. Slower speed and less flexibility.

   Source: Adapted from community discussion — chiacche

   Next question

8. Question 858 · 1003 in bank

   Which technology provides an overlay fabric to connect remote locations utilizing commodity data paths and improves network performance, boosts security, and reduces costs?

   • AInfiniBand
   • BVTEP
   • CSD-WAN
   • DVXLAN

   Show answer

   Answer: C

   Next question

9. Question 859 · 1003 in bank

   Select 2

   Which two actions are recommended as security best practices to protect REST API? (Choose two.)

   • AEnable dual authentication of the session
   • BUse a password hash
   • CUse SSL for encryption
   • DUse TACACS+ authentication
   • EEnable out-of-band authentication

   Show answer

   Answer: BC

   Explanation

   Agreed. And considering the overwhelming majority of API calls in automation are "machine to machine", how exactly would the 2FA even work...

   Source: Adapted from community discussion — TheGorn

   Next question

10. Question 860 · 1003 in bank

    DRAG DROP - Drag and drop the code snippets from the bottom onto the blanks in the PHP script to convert a PHP array into JSON format. Not all options are used.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Answer is correct. // first configure array $InputArray = array(......); // json_encode function... the format is json_encode(name of the array) $encodedJSON = json_encode($InputArray, JSON_PRETTY_PRINT); //Finally print Print ($encodedJSON)

    Source: Adapted from community discussion — studying_1

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 851. 1003 questions available.