A service provider is consolidating its management plane security. The provider currently uses RADIUS for device authentication and a separate REST API for automated provisioning. The security team wants to reduce the number of credentials and ensure that all management access is centrally logged. The provider also wants to protect the management plane from DDoS attacks. Which solution best meets these goals?

Keep RADIUS for device authentication and use a separate API key for the REST API

Deploy a separate AAA server for the API and use ACLs to protect the management plane

Migrate to TACACS+ for device authentication and integrate the REST API with TACACS+, and implement control-plane policing

Use local usernames on each device and rely on the API's own authentication

A network engineer notices that a core router's CPU is spiking due to a flood of ICMP packets. The packets appear to come from a spoofed source address. The engineer wants to identify the actual source of the traffic and mitigate the impact on the management plane. Which two actions should the engineer take?

Enable NetFlow on the router and increase the ICMP rate-limit on the interfaces

Use IP Source Guard and disable ICMP on the management interface

Configure an ACL to block all ICMP and enable SNMP traps

Enable traceback on the router and apply control-plane policing to rate-limit ICMP

A network administrator is configuring management access to a set of routers. The company policy requires that each administrator has a unique username and that all configuration commands are logged with the administrator's identity. The administrator also wants to use a REST API for some automated tasks, but the API must use the same authentication source as the CLI. Which solution should be implemented?

Use RADIUS for CLI authentication and a separate API key for the REST API

Use TACACS+ for CLI authentication and accounting, and integrate the REST API with the same TACACS+ server

Use LDAP for CLI authentication and OAuth for the API

Use local usernames on each router and enable syslog for command logging

CiscoCertified Network Professional Service Provider

Domain 1Objective 6

1.6 Describe Management Plane Security 350-501 Practice Questions (Page 7)

Part of the Architecture domain, which accounts for 15% of the 350-501 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

15%of the exam

Questions 31–33

31expert · hard
A service provider is consolidating its management plane security. The provider currently uses RADIUS for device authentication and a separate REST API for automated provisioning. The security team wants to reduce the number of credentials and ensure that all management access is centrally logged. The provider also wants to protect the management plane from DDoS attacks. Which solution best meets these goals?
Select an answer first
32application · medium
A network engineer notices that a core router's CPU is spiking due to a flood of ICMP packets. The packets appear to come from a spoofed source address. The engineer wants to identify the actual source of the traffic and mitigate the impact on the management plane. Which two actions should the engineer take?
Select an answer first
33application · medium
A network administrator is configuring management access to a set of routers. The company policy requires that each administrator has a unique username and that all configuration commands are logged with the administrator's identity. The administrator also wants to use a REST API for some automated tasks, but the API must use the same authentication source as the CLI. Which solution should be implemented?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 350-501

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-501” is a trademark of its owner, used for identification only.

1.6 Describe Management Plane Security 350-501 Practice Questions (Page 7)

Questions 31–33

Keep studying — Architecture