5.1 Apply Network Security 350-601 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A data center has a mix of NX-OS switches and ACI fabric. The security team requires centralized authentication for both, but the ACI fabric uses RADIUS for authentication and the NX-OS switches use TACACS+. The team also wants to enforce different authorization levels for network admins and network operators on the NX-OS switches. Which approach best meets these requirements?

   • AConfigure RADIUS on ACI and TACACS+ on NX-OS, and use TACACS+ attributes to map users to local NX-OS roles
   • BConfigure TACACS+ on both ACI and NX-OS for consistency
   • CConfigure LDAP on both ACI and NX-OS for centralized authentication
   • DConfigure RADIUS on both ACI and NX-OS for consistency
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In the AAA model for network device access, which component provides a record of user activity, such as commands executed and sessions started?

   • AAccess control
   • BAuthorization
   • CAuthentication
   • DAccounting
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a valid method to configure MACsec on Cisco switches?

   • AUsing a pre-shared key (PSK)
   • BUsing a RADIUS server for key management
   • CUsing a TACACS+ server for key management
   • DUsing a DHCP server for key distribution
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   When integrating RBAC with TACACS+ on Cisco NX-OS, what is the purpose of the 'tacacs+ server' configuration?

   • AIt defines the local user accounts and their roles.
   • BIt maps TACACS+ user groups to local roles.
   • CIt enables TACACS+ accounting for all commands.
   • DIt specifies the TACACS+ server address and shared secret for communication.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An engineer is configuring keychain authentication for EIGRP between two NX-OS switches. The keychain has two keys: key 1 with a send lifetime from 00:00 Jan 1 to 23:59 Dec 31, and key 2 with a send lifetime from 00:00 Jun 1 to 23:59 Dec 31. The engineer notices that the adjacency is flapping on June 1. What is the most likely cause?

   • AKey 1 and key 2 have overlapping send lifetimes, which is not allowed
   • BThe keychain is not configured on the correct interface
   • CKey 2 has a different key string than key 1, and the peer is not configured with key 2
   • DThe system clock on one of the switches is incorrect
   Reveal Solution Discussion Select an answer first