A security auditor needs to review all configuration changes made by administrators on a Cisco Nexus switch over the past month. The switch is configured to send logs to a central syslog server. What is the best way to ensure the audit trail is complete and tamper-proof?

Use the 'show logging' command to review the logs.

Configure the switch to send logs to a remote syslog server with write-only access.

Enable SNMP traps and send them to a network management system.

Enable local logging on the switch and review the logs directly.

A data center administrator needs to ensure that a group of users can only manage virtual machines on a specific Cisco UCS server, but not on any other servers in the domain. The administrator is using RBAC. What should be configured to achieve this?

Create a locale that includes only the specific server and assign the users to that locale.

Create a new domain for the specific server and assign the users to that domain.

Create a role with the 'VM' privilege and assign it to the users.

Assign the users to the 'admin' role and then restrict their access via the server's local policy.

A data center team is implementing RBAC on a Cisco Nexus switch. They want to ensure that a network operator can only execute 'show' commands and cannot modify any configuration. They have created a custom role called 'net-operator'. What is the correct way to configure this role?

Assign the 'network-operator' default role to the user.

Assign the 'admin' role and then remove the 'config' permission.

Use the 'vdc-admin' role and restrict it to the default VDC.

Create a rule that permits only 'show' commands and denies all others.

A network administrator needs to grant a user permission to configure VLANs on a Cisco Nexus switch, but the user should not be able to configure any other features. The administrator is using RBAC. What is the correct way to achieve this?

Use the 'vdc-admin' role and restrict it to the default VDC.

Create a custom role with a rule that permits only VLAN configuration commands.

Assign the user to the 'network-admin' role.

Assign the user to the 'admin' role and then remove the 'VLAN' permission.

CiscoCertified Network Professional Data Center

Domain 5Objective 2

5.2 Apply Compute Security 350-601 Practice Questions (Page 4)

Part of the Security domain, which accounts for 15% of the 350-601 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 3–4 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

15%of the exam

Questions 16–20

16application · medium
A security auditor needs to review all configuration changes made by administrators on a Cisco Nexus switch over the past month. The switch is configured to send logs to a central syslog server. What is the best way to ensure the audit trail is complete and tamper-proof?
Select an answer first
17foundation · easy
Which AAA component provides the data needed to generate an audit trail that shows who accessed a compute resource and what commands they executed?
Select an answer first
18application · medium
A data center administrator needs to ensure that a group of users can only manage virtual machines on a specific Cisco UCS server, but not on any other servers in the domain. The administrator is using RBAC. What should be configured to achieve this?
Select an answer first
19application · medium
A data center team is implementing RBAC on a Cisco Nexus switch. They want to ensure that a network operator can only execute 'show' commands and cannot modify any configuration. They have created a custom role called 'net-operator'. What is the correct way to configure this role?
Select an answer first
20application · medium
A network administrator needs to grant a user permission to configure VLANs on a Cisco Nexus switch, but the user should not be able to configure any other features. The administrator is using RBAC. What is the correct way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-601

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-601” is a trademark of its owner, used for identification only.