A security incident occurred, and the team needs to determine who made a specific configuration change on a Nexus switch. The switch is configured with TACACS+ for authentication and syslog for logging. What should the team use to identify the user and the exact command?

Use the 'show users' command to see who is currently logged in.

Review the TACACS+ accounting logs, which record the username and commands executed.

Review the syslog messages on the switch, which may include command logs if 'logging' is enabled.

Check the 'archive' log, which records configuration changes.

A change management policy requires that all configuration changes be approved and logged. The network team uses a ticketing system, and the switches are configured with TACACS+ for authentication. The team wants to enforce that only approved changes are made. Which approach should be used?

Integrate the ticketing system with the network automation platform so that changes are only pushed after approval, and log all changes with the ticket ID.

Require engineers to submit a ticket after making a change.

Use TACACS+ to restrict configuration commands to only approved engineers.

Use the 'archive log config' feature to log all changes and manually review them.

Two Nexus 9000 switches are deployed as a vPC pair. The engineer needs to ensure that the configuration is consistent across both switches, especially for vPC-related parameters. The engineer wants to automate the process to run daily and alert on any discrepancies. Which approach should the engineer use?

Enable the 'config-sync' feature on both switches to automatically replicate all configuration changes.

Use the 'show vpc consistency-parameters' command manually on both switches and compare the output.

Write an Ansible playbook that runs 'show running-config' on both switches, diffs the outputs, and reports any differences.

Configure the switches to automatically sync their running configurations using the 'sync' command in vPC domain.

A security audit reveals that unauthorized changes were made to a switch's configuration, but the team cannot determine when or by whom. The switch has NTP configured and syslog is being sent to a central server. What should the team implement to improve auditability of configuration changes?

Implement TACACS+ for authentication and authorization.

Configure the switch to send all 'configure' commands to the syslog server using 'logging monitor'.

Use the 'show history' command to view past configuration commands.

Enable the 'archive' feature with logging of configuration changes to the syslog server.

CiscoCertified Network Professional Data Center

Domain 1Objective 8

1.8 Implement Network Configuration Management 350-601 Practice Questions (Page 3)

Part of the Network domain, which accounts for 25% of the 350-601 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

8concepts

25%of the exam

Questions 11–15

11expert · hard
A security incident occurred, and the team needs to determine who made a specific configuration change on a Nexus switch. The switch is configured with TACACS+ for authentication and syslog for logging. What should the team use to identify the user and the exact command?
Select an answer first
12expert · hard
A change management policy requires that all configuration changes be approved and logged. The network team uses a ticketing system, and the switches are configured with TACACS+ for authentication. The team wants to enforce that only approved changes are made. Which approach should be used?
Select an answer first
13application · medium
Two Nexus 9000 switches are deployed as a vPC pair. The engineer needs to ensure that the configuration is consistent across both switches, especially for vPC-related parameters. The engineer wants to automate the process to run daily and alert on any discrepancies. Which approach should the engineer use?
Select an answer first
14application · medium
A security audit reveals that unauthorized changes were made to a switch's configuration, but the team cannot determine when or by whom. The switch has NTP configured and syslog is being sent to a central server. What should the team implement to improve auditability of configuration changes?
Select an answer first
15foundation · easy
Which feature on Cisco switches can be used to audit configuration changes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-601

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-601” is a trademark of its owner, used for identification only.

1.8 Implement Network Configuration Management 350-601 Practice Questions (Page 3)

Questions 11–15

A security incident occurred, and the team needs to determine who made a specific configuration change on a Nexus switch. The switch is configured with TACACS+ for authentication and syslog for logging. What should the team use to identify the user and the exact command?

A change management policy requires that all configuration changes be approved and logged. The network team uses a ticketing system, and the switches are configured with TACACS+ for authentication. The team wants to enforce that only approved changes are made. Which approach should be used?

A security audit reveals that unauthorized changes were made to a switch's configuration, but the team cannot determine when or by whom. The switch has NTP configured and syslog is being sent to a central server. What should the team implement to improve auditability of configuration changes?

Which feature on Cisco switches can be used to audit configuration changes?

Keep studying — Network