Refer to the exhibit. A multinational corporation with a Cisco-based network wants to leverage Cisco security features to enhance the security of their LAN and protect against eavesdropping and man-in-the-middle attacks. The solution must comply with the IEEE 802.1 AE standard. A network engineer must implement the new security configurations on a pair of interconnected Cisco switches. The engineer already completed the configuration to enable AAA new-model and set up a basic AAA configuration for user authentication. Management VLAN 10 is in place for network administration. Which action must the engineer lake to meet the requirements?
Answer(s): A
IEEE 802.1AE (MACsec):This is the IEEE standard for Media Access Control Security.MACsec ensures secure communication on Ethernet links by providing encryption, integrity, and originauthentication.It protects against threats such as eavesdropping and man-in-the-middle attacks.Encryption Mode:GCM (Galois/Counter Mode) provides confidentiality and integrity protection, meeting the requirements forsecure LAN communication.Why MACsec?MACsec is specifically designed for securing Layer 2 communications between directly connected devices,such as the switches in the exhibit.It is simpler and more efficient for LAN links than alternatives like IPsec, which operates at Layer 3.
How does TACACS+ facilitate secure connections for user access to network routers?
Answer(s): B
TACACS+ Overview:TACACS+ (Terminal Access Controller Access-Control System Plus) is a protocol that provides centralizedauthentication, authorization, and accounting for network devices.It is designed to securely communicate between the network access server (NAS) and the TACACS+daemon (authentication server).Secure Authentication Process:When a user attempts to access a network router, the NAS (e.g., router or switch) communicates securelywith the TACACS+ server using the TACACS+ protocol.TACACS+ encrypts the entire payload of the communication, ensuring secure transmission of credentialsand authorization details.TACACS+ separates the processes of authentication, authorization, and accounting, providing granular control over user access.The NAS delegates authentication and authorization responsibilities to the TACACS+ server, enhancing security and simplifying management.
Refer to the exhibit. Which two features characterize remotely triggered black hole filtering? (Choose two.)
Answer(s): B,E
Remotely Triggered Black Hole (RTBH) Filtering:RTBH is a security mechanism used to mitigate DDoS (Distributed Denial of Service) attacks.It redirects undesired traffic (e.g., malicious traffic) to a "black hole" where it is discarded, effectivelyprotecting the target.Key Characteristics:RTBH filtering relies on a set of coordinated configurations across the network, involving routing protocolsand filtering mechanisms.RTBH provides a fast and efficient way to drop unwanted traffic at the network edge, reducing the load oninternal network devices and ensuring service availability.Routing Protocols:RTBH can be implemented with routing protocols like BGP to propagate black hole routes to edge routers.It does not specifically require OSPF or EIGRP.Vendor Independence:While Cisco devices can implement RTBH, it is not a Cisco-specific feature. It can be deployed on anynetwork that supports the necessary routing protocols.RTBH is a powerful and efficient tool for mitigating attacks by coordinating routing and filtering configurations to drop malicious traffic at the network edge.
Company_A is implementing VoIP services across the company. The network architect designed a QoS policy to allow only specific IP subnets and mark the signaling flow with DSCP 36. The solution should be as secure as possible. Phones receive their IP addresses from the 172.184.12.0/24 pool and are assigned by the RADIUS server to VLAN 1021. Skinny Client Control Protocol is used as a signaling protocol in the network. For security reasons, switchport port security maximum 1 vlan voice has been preconfigured on the switch side. Which two tasks must an engineer perform on SW_1 to achieve this goal? (Choose two.)
Answer(s): A,B
Set DSCP AF43 (DSCP 36):DSCP value AF43 corresponds to DSCP 36, as required in the design. Using a class map with the set dscp af43 command ensures that the signaling flow is correctly marked with DSCP 36 for QoS prioritization.Permit SCCP Signaling with ACL:The Skinny Client Control Protocol (SCCP) uses UDP ports in the range 2000-2002. An ACL with the command permit udp 172.184.12.0 0.0.0.255 any range 2000 2002 ensures only signaling traffic from the specified VoIP subnet is allowed.VLAN 1021 and port security: These pre-configurations restrict access to VoIP phones, adding an extra layer of security.
Refer to the exhibit. Two midsize service providers are connected to each other and share VPNv4 routes. The service providers support customers in several geographic regions. The two network-engineering teams have decided to protect against data plane attacks and secure traffic between the two providers. Which task should toe teams perform as part of toe configuration?
Answer(s): D
Remote Triggered Black Hole (RTBH) filtering is an efficient mechanism used to protect networks against data plane attacks, such as DDoS. It works by blackholing unwanted traffic at the edge of the network, preventing it from reaching the core. This ensures traffic from malicious sources is dropped without affecting legitimate traffic. In this scenario, where two service providers are sharing VPNv4 routes, RTBH filtering would effectively secure the data plane and protect against unwanted or malicious traffic.
Refer to the exhibit. If router RA is configured as shown, which IPv4 multicast address space does it use?
Answer(s): C
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/multicast/ configuration_guide/b_mc_3se_3850_cg/b_mc_3se_3850_cg_chapter_01011.html
DRAG DROP (Drag and Drop is not supported)Drag and drop the functions from the left onto the correct Path Computation Element Protocol roles on the right.Select and Place:
Refer to the exhibit. A network engineer with an employee ID: 5086:72:817 is configuring a connection to manage CE1 from the OAM server on VLAN 100. PE1 must push S-VLAN tag 10 toward PE2 while forwarding traffic from CE1 to the OAM server. PE1 must push S-VLAN tag 20 toward PE2 while forwarding traffic from CE2 to the data traffic gateway. Which configuration must the engineer implement on PE2?
On PE2 you must map the incoming S-VLAN tags directly into the CE-VLAN. The onetoone translate command does exactly that - any packet arriving with S-VLAN20 is rewritten into C-VLAN100 on the CE-facing subinterface.PE2(config)# interface GigabitEthernet0/1PE2(config-if)# encapsulation dot1q 100PE2(config-if)# rewrite ingress tag translate 1-to-1 dot1q 20 This ensures that traffic PE1 has S-tagged with 20 (from CE2) is presented to the CE3/OAM server on VLAN100.
Post your Comments and Discuss Cisco 350-501 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 350-501 content, but please register or login to continue.