Security (15%)

350-601 · 45 questions

• A game studio has web and app EPGs in the same ACI VRF. Web servers cannot open a single required port to the app servers, and no contract exists between the EPGs. Which change permits only that port?
• A government agency needs a Nexus account that can run show commands and cannot enter configuration mode. An engineer is searching for an IOS-style privilege level. Which NX-OS control enforces this limit?
• A logistics company's Nexus switch has Dynamic ARP Inspection enabled on a VLAN, and ARP from legitimate hosts is dropped. DHCP snooping is not enabled on that VLAN. Why is the valid ARP being dropped?
• A game studio uses TACACS+ for Nexus logins. When both TACACS+ servers are unreachable, operators can still sign in with a local username. Which AAA arrangement allows that?
• A regional hospital must isolate one imaging server with a tighter policy based on a VM attribute, without moving it to a new VLAN or opening every port across the application tier. Which ACI construct classifies that server?
• A game studio rotates an OSPF key chain at a planned time. One Nexus starts sending the new key and drops the old key at that instant. Its peer, whose clock is slightly behind, still sends the old key, and the adjacency drops. What avoids that gap?
• A government agency enabled DHCP snooping on a Nexus VLAN. Clients send discovers, but offers never arrive. The port that faces the DHCP server is untrusted. What should change?
• A government agency uses UCS Manager. An operator should manage service profiles in one organization and have no rights in the other organizations. Which controls create that limit?
• A regional hospital enables MACsec on the link between two access switches. An engineer expects the traffic to stay encrypted after it is routed across the core toward a far server. Those core links do not run MACsec. What does this MACsec session protect?
• A government agency enabled DHCP snooping on a Nexus VLAN, and hosts never receive addresses. The port toward the DHCP server is untrusted, and the host ports are untrusted as well. What should change?
• A regional hospital keeps every clinical workstation in one EPG, but only imaging virtual machines, matched by a VM attribute, may open one port to the PACS servers. Which change permits only those virtual machines?
• A game studio needs an MDS account that can build and activate zones but cannot create user accounts or change AAA. Which control enforces that split on the SAN switch?
• A regional hospital wants only one known host PWWN to complete FLOGI on a specific MDS F port. A different HBA plugged into that same port should be rejected before it gets a fabric address. What enforces that?
• A game studio's Nexus switches still accept a local network-admin login after both TACACS+ servers become unreachable. The AAA login method list names the TACACS+ group and then local. Why does that login succeed?
• A government agency's MDS fabric rejects a replacement switch that has a new switch WWN, even though the ISL cables are correct and fabric binding is enabled. What must be updated before that switch can join?
• A government agency SAN rejects a newly cabled MDS. Fabric binding is enabled, and the new switch WWN is not in the binding list. What must be added before that switch may join?
• A game studio needs an MDS account that can display the zone database and must not be able to activate a zoneset. Which control enforces that command limit?
• A regional hospital wants only one known HBA port name to complete FLOGI on a specific MDS F port. A different HBA cabled into that port should be rejected. Which feature enforces that?
• A government agency operator can edit service profiles in one UCS organization and cannot see a second organization at all. The operator's role already permits service profile changes. What is limiting the view?
• A regional hospital enabled MACsec on the link between a leaf and a firewall and expects those frames to stay encrypted across the routed WAN to a remote clinic. What does this MACsec session actually protect?
• A game studio rotates the OSPF key chain on a Nexus link, and the adjacency drops at each rotation. The new key lifetime starts only after the old key lifetime ends. What prevents that drop?
• A game studio Nexus switch cannot reach its TACACS servers. Operators can still log in with a local username. Which configuration explains that result?
• A regional hospital keeps every monitor in one endpoint group. Only the ICU subnet may open one port to the records group. Which construct limits the contract to that subnet?
• A government agency account in UCS Manager can change every organization, but this person should keep the same privileges and touch only one organization. Which control adds that boundary?
• A game studio rotates an OSPF authentication key. The new key becomes valid only after the old key has expired, and the adjacency drops in that gap. What would have kept the neighbors up through the change?
• A government agency enabled IP Source Guard on an access VLAN. DHCP clients pass traffic. A server with a static IP address cannot. Why is that server blocked?
• A regional hospital enables MACsec on the link between an access switch and a server. Frames captured on the uplink from that access switch toward the core are still readable. Why is the uplink clear?
• A regional hospital replaced a host bus adapter, and the new port WWN is rejected when it tries to log in on the same F port. Fibre Channel port security is enabled on that port. What change lets the new adapter log in?
• A game studio keeps production and beta virtual machines in one EPG, so those machines can communicate freely. The beta machines carry a distinct attribute and need their own contract policy. Which construct classifies them by that attribute?
• A game studio contractor on an MDS can edit zones and can also create local users and change SNMP. The contractor should be allowed to edit zoning and nothing beyond that. Which control enforces the limit?
• A regional hospital finds that hosts accepted an IPv6 default router from a router advertisement that arrived on an access port. Which first-hop feature drops those advertisements on untrusted access ports?
• A government agency can log in to Nexus only while the TACACS+ servers answer. When those servers are unreachable, valid local accounts are rejected because the login method list names only the TACACS+ group. What should that list include next?
• A government agency rotates an OSPF key chain. Neighbors drop when the old key lifetime ends, and the replacement key is set to start the next morning. What was missing from the key schedule?
• A game studio can log in to Nexus switches, and the team cannot tell which account entered a configuration command after an outage. Authentication already works. Which AAA function records those commands?
• A government agency's MDS switches authenticate administrators only against TACACS+. During a TACACS outage nobody can log in, including on the console. Local accounts exist and are unused. What should be added to the login method?
• A game studio must encrypt Ethernet frames on specific leaf-to-spine links so a tap on those fibers cannot read them. The traffic is bridged and routed beyond that single link. Which control encrypts the frames on the link itself?
• A regional hospital UCS domain has several organizations. One administrator should create service profiles only inside the imaging organization and should not see the others. The account already has a server-admin role. What else is required?
• A regional hospital keeps many virtual machines in one ACI EPG because they share a VLAN. Only the imaging VMs should be limited to a single port toward the archive. Those VMs can be identified by a vCenter attribute. What enforces that smaller group?
• A university replacement MDS is rejected when it joins the SAN. Fabric binding already lists that switch WWN, paired with a domain ID the switch is not running. What has to match before the switch is allowed in?
• A hospital UCS user can see only one organization, which is what the design wants. Inside that organization the user cannot associate a service profile. The assigned role is read-only. What has to change?
• A government access VLAN has DHCP snooping enabled, and the DHCP server port is trusted. Clients receive addresses. They cannot learn the gateway MAC. Dynamic ARP inspection is on, and the uplink toward the router is an untrusted DAI port. What is being dropped?
• A game studio rotates an OSPF key on a Nexus link. Both peers will accept the new key today, and the send lifetime of that key starts tomorrow. Authentication fails tonight. Why is the new key absent from the packets?
• A hospital host PWWN is a member of the active zoneset, but FLOGI fails on the MDS F port where the cable is plugged. Port security on that port allows a different PWWN. What is rejecting the login?
• A bank sets MACsec on a leaf-to-spine link with the security policy must-secure. The spine has no MACsec key agreement. User frames on that hop disappear. What does must-secure do with those frames?
• A government MDS accepts logins through RADIUS. Operators reach the CLI, and the agency cannot authorize or deny individual configuration commands for those sessions. RADIUS is only authenticating them. Which service adds per-command authorization?