A switch port is configured with port security and a maximum MAC address count of 2. What happens when a third device attempts to connect to that port?

The third device is allowed but its traffic is encrypted

The third device is allowed and the oldest MAC address is removed

The port is shut down or the frame is dropped, depending on the violation mode

The switch automatically increases the MAC address limit

A network administrator is hardening a Cisco switch that is used for management. The switch is accessible from the corporate network. The administrator wants to ensure that management traffic is encrypted and that only authorized administrators can access the device. Which set of actions should be taken?

Enable SNMPv2c with a community string and restrict access to the management VLAN.

Disable all management protocols and use the console port only.

Enable SSH, disable Telnet, configure local authentication with strong passwords, and restrict management access to specific source IPs using an ACL.

Enable Telnet and configure a VTY password.

A hospital network has a medical devices VLAN and a guest Wi-Fi VLAN. The security team wants to ensure that devices in the guest VLAN cannot initiate connections to the medical devices VLAN, but the medical devices VLAN must be able to send responses to the guest VLAN if needed. What should be implemented on the Layer 3 device interconnecting the VLANs?

A VLAN ACL applied to the medical VLAN that permits all traffic

Port security on the guest VLAN access ports

A standard ACL on the guest VLAN interface that denies all traffic from the medical VLAN

An extended ACL that permits established and related traffic from the medical VLAN to the guest VLAN and denies all other traffic from guest to medical

A network administrator wants to isolate the finance department's workstations from the rest of the corporate network to reduce the risk of lateral movement. Which network segmentation technique is most appropriate for this task?

Applying IP Source Guard to the finance workstations

Configuring DHCP snooping on the finance VLAN

Enabling port security on all switch ports

Implementing a VLAN for the finance department and applying inter-VLAN ACLs

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 9

2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 3)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

30%of the exam

Questions 11–15

11foundation · easy
Which feature must be enabled for IP Source Guard to function effectively?
Select an answer first
12foundation · easy
A switch port is configured with port security and a maximum MAC address count of 2. What happens when a third device attempts to connect to that port?
Select an answer first
13application · medium
A network administrator is hardening a Cisco switch that is used for management. The switch is accessible from the corporate network. The administrator wants to ensure that management traffic is encrypted and that only authorized administrators can access the device. Which set of actions should be taken?
Select an answer first
14application · medium
A hospital network has a medical devices VLAN and a guest Wi-Fi VLAN. The security team wants to ensure that devices in the guest VLAN cannot initiate connections to the medical devices VLAN, but the medical devices VLAN must be able to send responses to the guest VLAN if needed. What should be implemented on the Layer 3 device interconnecting the VLANs?
Select an answer first
15foundation · easy
A network administrator wants to isolate the finance department's workstations from the rest of the corporate network to reduce the risk of lateral movement. Which network segmentation technique is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 3)

Questions 11–15

Which feature must be enabled for IP Source Guard to function effectively?

A switch port is configured with port security and a maximum MAC address count of 2. What happens when a third device attempts to connect to that port?

A network administrator wants to isolate the finance department's workstations from the rest of the corporate network to reduce the risk of lateral movement. Which network segmentation technique is most appropriate for this task?

Keep studying — Techniques