A service provider is deploying MACsec between two PE routers over a dark fiber link. The security team requires encryption and integrity for all traffic on the link, and the link must recover automatically if the encryption keys are compromised. Which MACsec configuration approach should be used?

Configure a static pre-shared key (PSK) on both interfaces and enable MACsec with integrity-only mode.

Enable MACsec with a null cipher suite to provide integrity without encryption.

Configure MACsec with 802.1X authentication and a dynamic key exchange protocol.

Use a static PSK and enable MACsec with encryption and integrity.

A service provider edge router has strict uRPF enabled on a customer-facing interface. The customer has a /24 prefix that is announced via BGP, but the router also has a static route for a /32 within that /24 pointing to a different interface for a specific server. Legitimate traffic from that /32 is being dropped. What is the most effective way to resolve this while maintaining spoofing protection?

Apply an inbound ACL to permit the /32 source before the uRPF check.

Change uRPF to loose mode on the interface.

Add an allow-list entry for the /32 prefix in the uRPF configuration.

Remove the static /32 route and rely on the BGP /24 route for uRPF checks.

Where in the forwarding path are data plane ACLs typically applied on a Cisco router?

Only on the control plane to protect routing protocols.

On ingress or egress interfaces to filter traffic as it enters or leaves the router.

On the management plane to filter SNMP and SSH.

Only on loopback interfaces to filter management traffic.

A service provider has enabled strict uRPF on the customer-facing interface of a PE router. After deployment, legitimate customer traffic is being dropped. The customer uses two upstream providers and has a /24 prefix that is announced to both. What is the most likely cause of the drops?

The PE router has a default route that is being used for the customer's prefix.

The customer's prefix is not in the FIB because BGP is not advertising it.

The customer's return traffic is entering the PE via a different interface than the one used for the forward path.

The customer's traffic is using a source address that is not in the customer's assigned prefix.

What is the primary purpose of MACsec (IEEE 802.1AE)?

To provide encryption and integrity at Layer 2 for Ethernet frames.

To provide encryption at Layer 3 for IP packets.

To provide access control based on MAC addresses.

To provide authentication for network devices using certificates.

CiscoCertified Network Professional Service Provider

Domain 1Objective 7

1.7 Implement Data Plane Security 350-501 Practice Questions (Page 1)

Part of the Architecture domain, which accounts for 15% of the 350-501 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

15%of the exam

Questions 1–5

1application · medium
A service provider is deploying MACsec between two PE routers over a dark fiber link. The security team requires encryption and integrity for all traffic on the link, and the link must recover automatically if the encryption keys are compromised. Which MACsec configuration approach should be used?
Select an answer first
2expert · hard
A service provider edge router has strict uRPF enabled on a customer-facing interface. The customer has a /24 prefix that is announced via BGP, but the router also has a static route for a /32 within that /24 pointing to a different interface for a specific server. Legitimate traffic from that /32 is being dropped. What is the most effective way to resolve this while maintaining spoofing protection?
Select an answer first
3foundation · easy
Where in the forwarding path are data plane ACLs typically applied on a Cisco router?
Select an answer first
4application · medium
A service provider has enabled strict uRPF on the customer-facing interface of a PE router. After deployment, legitimate customer traffic is being dropped. The customer uses two upstream providers and has a /24 prefix that is announced to both. What is the most likely cause of the drops?
Select an answer first
5foundation · easy
What is the primary purpose of MACsec (IEEE 802.1AE)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-501

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-501” is a trademark of its owner, used for identification only.