350-401 practice questions 881–890

1. Question 881 · 1003 in bank

   Select 2

   Which two methods are used to assign security group tags to the user in a Cisco TrustSec. architecture? (Choose two.)

   • Aweb authentication
   • BIEEE 802.1x
   • CDHCP
   • Dmodular QoS
   • Epolicy routing

   Show answer

   Answer: AB

   Explanation

   A. Web authentication Used when a user logs in using a web browser. When a user accesses the network using this method, web authentication authenticates the user and assigns a security group tag. This is an effective authentication method when the client terminal does not have an 802.1X supplicant function. B. IEEE 802.1x A network access control protocol that provides authentication and authorization. It consists of three elements: an authentication server, an authenticator, and a supplicant. When a user connects to a network, they are authenticated using 802.1x and are granted permission to access the network. Through this authentication process, users are assigned the appropriate security group tag.

   Source: Adapted from community discussion — Exam12559

   Next question

2. Question 882 · 1003 in bank

   DRAG DROP - Drag and drop the automation characteristics from the left onto the corresponding tools on the right.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Ansible - Python (AP- Access Point) Chef - Ruby (CR - Cristiano Ronaldo) Saltstack - Python ( SP - Service Provider) maybe someone helps this mind bridges

   Source: Adapted from community discussion — PartOfIT

   

   Next question

3. Question 883 · 1003 in bank

   

   Refer to the exhibit. An engineer must configure a Cisco WLC with WPA2 Enterprise mode and avoid global server lists. Which action is required?

   • AEnable EAP parameters
   • BApply CISCO ISE default settings
   • CSelect a RADIUS authentication server
   • DDisable the RADIUS server accounting interim update

   Show answer

   Answer: C

   Explanation

   Answer C is correct To configure a Cisco WLC with WPA2 Enterprise mode and avoid global server lists, the engineer must perform the following action: 1. Set up a RADIUS server for authentication and authorization. 2. Configure the WLC to use the RADIUS server for client authentication. 3. Enable WPA2 Enterprise mode on the WLC. 4. Disable the use of global server lists on the WLC.

   Source: Adapted from community discussion — noxy93

   References

   • Cisco documentation

   Next question

4. Question 884 · 1003 in bank

   Select 2

   Which two mechanisms are used with OAuth 2.0 for enhanced validation? (Choose two.)

   • Aauthorization
   • Bcustom headers
   • Crequest management
   • Dauthentication
   • Eaccounting

   Show answer

   Answer: AD

   Explanation

   The two mechanisms used with OAuth 2.0 for enhanced validation are: A. Authorization OAuth 2.0 is primarily an authorization framework that allows applications to request limited access to user resources on behalf of a user. It ensures that the client has the right to perform actions on behalf of the resource owner. D. Authentication Although OAuth 2.0 is not directly an authentication protocol, it is often used in combination with other protocols (like OpenID Connect) to validate the identity of the user in the process of authorizing access. Why other options are incorrect: B. Custom headers: While headers may be part of the OAuth process (e.g., passing tokens in HTTP headers), they are not a core mechanism of OAuth validation itself. C. Request management: OAuth does not manage requests directly; it deals with access tokens and scopes for authorization. E. Accounting: This term is typically related to tracking usage or resource consumption, which is not directly part of OAuth 2.0's validation processes.

   Source: Adapted from community discussion — cjoyce1980

   Next question

5. Question 885 · 1003 in bank

   Which characteristic applies to the endpoint security aspect of the Cisco Threat Defense architecture?

   • Adetect and block ransomware in email attachments
   • Boutbound URL analysis and data transfer controls
   • Cuser context analysis
   • Dblocking of fileless malware in real time

   Show answer

   Answer: D

   Explanation

   A. detect and block ransomware in email attachments - ESA B. outbound URL analysis and data transfer controls - FirePOWER & FireSIGHT C. user context analysis - NetFlow & StealthWatch D. blocking of fileless malware in real time - AMP for Endpoints (one of the features of AMP - "The exploit prevention feature will defend endpoints from exploit-based, memory injection attacks." - where fileless malware is malicious code that works directly within a computer's memory. https://www.cisco.com/c/dam/en/us/td/docs/security/network_security/ctd/ctd2-0/design_guides/ctd_2-0_cvd_guide_jul15.pdf https://www.cisco.com/c/en/us/products/collateral/security/fireamp-endpoints/datasheet-c78-733181.html

   Source: Adapted from community discussion — Horsefeathers

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 886 · 1003 in bank

   SIMULATION -

   

   Guidelines - This is a lab item in which tasks will be performed on virtual devices. • Refer to the Tasks tab to view the tasks for this lab item. • Refer to the Topology tab to access the device console(s) and perform the tasks. • Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window. • All necessary preconfigurations have been applied. • Do not change the enable password or hostname for any device. • Save your configurations to NVRAM before moving to the next item. • Click Next at the bottom of the screen to submit this lab and move to the next question. • When Next is clicked, the lab closes and cannot be reopened. Topology -

   

   Tasks - The operations team started configuring network devices for a new site. R10 and R20 are preconfigured with the CORP VRF. R10 has network connectivity to R20. Complete the configurations to achieve these goals: 1. Extend the CORP VRF between R10 and R20 using Tunnel0. 2. Protect Tunnel0 using the preconfigured profile 3. Configure static routing on R10 and R20 so that users in VLANs100 and 101 that belong to the CORP VRF are able to communicate with each other. Tunnel0 should be the only interface used to route traffic for the CORP VRF

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   do a 'show ip int brief' to find IP of e0/1 of R1 and e0/2 of R20 (10.10.1.10 and 10.10.2.20 in this case) R1#conf t interface Tunnel0 vrf forwarding CORP ip address 10.100.100.1 255.255.255.0 Tunnel source e0/1 Tunnel destination 10.10.2.20 Tunnel protection ipsec profile MyProfile exit ip route vrf CORP 10.101.2.0 255.255.255.0 tunnel0 do wr R20#conf t interface tunnel0 vrf forwarding CORP ip address 10.100.100.2 255.255.255.0 Tunnel source e0/2 Tunell destination 10.10.1.10 Tunnel protection ipsec profile MyProfile exit ip route vrf CORP 10.100.1.0 255.255.255.0 tunnel0 do wr

   Source: Adapted from community discussion — AzraelOmbrixa

   References

   • Cisco documentation
   • Cisco documentation

   

   Next question

7. Question 887 · 1003 in bank

   

   Refer to the exhibit. An administrator writes a script to fetch the list of devices that are registered with Cisco DNA Center. Why does the execution abort?

   • AThe TLS certificate of DNA Center is invalid
   • BThe username or the password is incorrect
   • CThe “dna-center” hostname cannot be resolved to an IP address
   • DThe authentication URL is incorrect

   Show answer

   Answer: B

   Explanation

   B is correct 200 OK 201 Created 204 No Content 301 Moved Permanently 302 Found 304 Not Modified 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 405 Method Not Allowed 408 Request Timeout 409 Conflict 500 Internal Server Error 501 Not Implemented 502 Bad Gateway 503 Service Unavailable 504 Gateway Timeout

   Source: Adapted from community discussion — [Removed]

   Next question

8. Question 888 · 1003 in bank

   What is a benefit of using a Type 2 hypervisor instead of a Type 1 hypervisor?

   • Abetter application performance
   • Bimproved security because the underlying OS is eliminated
   • Cimproved density and scalability
   • Dability to operate on hardware that is running other OSs

   Show answer

   Answer: D

   Next question

9. Question 889 · 1003 in bank

   When is GLBP preferred over HSRP?

   • AWhen the gateway routers are a mix of Cisco and non-Cisco routers.
   • BWhen encrypted hellos are required between gateways in a single group.
   • CWhen the traffic load needs to be shared between multiple gateways using a single virtual IP.
   • DWhen clients need the gateway MAC address to be the same between multiple gateways.

   Show answer

   Answer: C

   Explanation

   GLBP works by making use of a single virtual IP address, which is configured as the default gateway on the hosts. The different routers that assume the forwarding role use different virtual MAC addresses for the same virtual IP address to which packets are forwarded by the hosts. www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html

   Source: Adapted from community discussion — supershysherlock

   Next question

10. Question 890 · 1003 in bank

    Which TLV value must be added to Option 43 when DHCP is used to ensure that APs join the WLC?

    • A0x77
    • BAAA
    • C0xf1
    • D642

    Show answer

    Answer: C

    Explanation

    C The following is the format of the TLV block: • Type: 0xf1 (decimal 241) • Length: Number of controller IP addresses * 4 • Value: List of WLC management interfaces

    Source: Adapted from community discussion — Calinserban

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 881. 1003 questions available.