CiscoProfessional level350-401Page 4 of 7

350-401 exam dumps: questions 301 to 400 of 629

Page 4 of the free 350-401 question bank for the Implementing Cisco Enterprise Network Core Technologies exam. Questions 301 to 400 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated February 2025

Start timed practice exam Questions 301 to 400

Free 350-401 practice questions

Questions 301 to 305 of 629

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

350-401 Question 301

Select 3

An enterprise network is deploying Cisco TrustSec to ensure secure communication between devices across their network. The network administrator wants to classify traffic based on Security Group Tags (SGTs) and enforce policy-based access controls. Additionally, the administrator is considering deploying MACsec to secure communication at Layer 2. Which of the following statements are correct about TrustSec and MACsec in this scenario?

A
Cisco TrustSec uses SGTs to classify traffic and enforce access control policies.
B
MACsec provides end-to-end encryption at the IP layer across the network.
C
Cisco TrustSec can operate without requiring 802.1X for SGT propagation.
D
MACsec encrypts Layer 2 traffic and protects against eavesdropping and tampering.
E
Cisco TrustSec and MACsec are mutually exclusive and cannot be deployed together.

Show answer and explanation

Correct answers: A, C, D

Explanation

Cisco TrustSec and MACsec are complementary technologies that enhance network security. TrustSec uses SGTs to classify and control traffic, while MACsec provides encryption and integrity at Layer 2. TrustSec does not strictly require 802.1X for SGT propagation, making it flexible for different deployment scenarios. Together, these technologies provide a robust security framework for enterprise networks.

A. Correct.
Correct: Cisco TrustSec uses SGTs to classify traffic and enforce security policies. SGTs allow for scalable and flexible policy management in the network.
B. Incorrect.
Incorrect: MACsec operates at Layer 2 and does not provide encryption at the IP layer. It secures Ethernet frames between directly connected devices.
C. Correct.
Correct: While 802.1X is often used for SGT propagation, Cisco TrustSec can also use alternative methods such as inline tagging or manual configuration.
D. Correct.
Correct: MACsec secures Layer 2 communication by encrypting Ethernet frames, providing protection against eavesdropping and tampering.
E. Incorrect.
Incorrect: Cisco TrustSec and MACsec are complementary technologies and can be deployed together. TrustSec adds policy-based access control while MACsec provides Layer 2 encryption.

350-401 Question 302

Select 3

An enterprise network administrator is tasked with ensuring data integrity and confidentiality between switches in the campus network. The network is configured with TrustSec for scalable security policies and uses MACsec for link-layer encryption. During implementation, the administrator encounters a situation where TrustSec works as expected, but MACsec fails to establish. Which of the following could be the reason for MACsec failure?

A
The switches do not support IEEE 802.1AE (MACsec) on the physical interfaces.
B
The TrustSec Security Group Tag (SGT) is not properly assigned to the devices.
C
The key agreement protocol (MKA) is not enabled on the interfaces.
D
The physical link between the switches is not configured as a trunk.
E
The switches are configured in different MACsec key agreement (MKA) policy modes.

Show answer and explanation

Correct answers: A, C, E

Explanation

MACsec relies on specific hardware and software configurations to function. For MACsec to successfully establish, the physical interfaces must support IEEE 802.1AE, the MACsec Key Agreement (MKA) protocol must be enabled to negotiate encryption keys, and the MKA policy modes on both switches must match. TrustSec and trunk configurations, while related to broader network functionality, are not directly responsible for MACsec encryption failures.

A. Correct.
If the switches' physical interfaces do not support IEEE 802.1AE (MACsec), MACsec encryption cannot be established. This is a hardware feature that must be supported on the interfaces.
B. Incorrect.
TrustSec Security Group Tags (SGTs) are used for policy enforcement and segmentation, but they do not affect the establishment of MACsec encryption. This is not a reason for MACsec failure.
C. Correct.
The MACsec Key Agreement (MKA) protocol is essential for negotiating and managing encryption keys for MACsec. If MKA is not enabled, MACsec will fail to establish.
D. Incorrect.
While trunk links are commonly used between switches, MACsec can also operate on access links. The link not being a trunk is not a cause for MACsec failure.
E. Correct.
If the switches are configured with different MKA policy modes (e.g., static vs. dynamic), they cannot successfully negotiate encryption keys, causing MACsec to fail.

350-401 Question 303

Select 2

An enterprise network is implementing network access control on its wired switches. The goal is to ensure only authenticated devices can gain network access using 802.1X, but some legacy devices do not support 802.1X. The network administrator has configured fallback mechanisms to provide controlled access for these legacy devices. Which combination of mechanisms should the administrator use to achieve this?

A
Configure 802.1X for devices that support it, and use MAC Authentication Bypass (MAB) for legacy devices.
B
Use WebAuth as the sole authentication mechanism for all devices.
C
Enable 802.1X for capable devices and configure WebAuth as a fallback for legacy devices.
D
Rely solely on MAC Authentication Bypass (MAB) for all devices, including 802.1X-capable ones.
E
Combine 802.1X for authentication and implement WebAuth for guest access.

Show answer and explanation

Correct answers: A, C

Explanation

802.1X is the most secure method for authenticating devices and should be used wherever possible. For devices that do not support 802.1X, fallback mechanisms such as MAB or WebAuth can be configured to provide controlled access. Using both 802.1X and a fallback mechanism like WebAuth ensures a secure and flexible approach that accommodates a variety of device capabilities in the network.

A. Correct.
This is correct because 802.1X is the primary mechanism for capable devices, while MAB can provide fallback for devices unable to use 802.1X.
B. Incorrect.
This is incorrect because WebAuth is not suitable as the sole mechanism for network access control in environments where 802.1X can be utilized. It is better suited for guest networks or fallback scenarios.
C. Correct.
This is correct because combining 802.1X for capable devices and WebAuth for legacy devices provides a flexible approach to network access control.
D. Incorrect.
This is incorrect because relying solely on MAB does not leverage the stronger security provided by 802.1X for capable devices.
E. Incorrect.
This is partially correct conceptually, but it does not address the use of WebAuth as a fallback specifically for legacy devices that cannot use 802.1X.

350-401 Question 304

Select 3

A network administrator is configuring access control on a switch for a corporate office. The goal is to authenticate users connecting to the network via wired connections by requiring them to provide valid credentials. However, some legacy devices, such as printers, do not support 802.1X authentication. The administrator also wants to enable guest access for non-employee devices using a web portal. Which combination of network access control methods should the administrator implement to meet these requirements?

A
802.1X for user authentication
B
MAC Authentication Bypass (MAB) for legacy devices
C
WebAuth for guest access
D
Port security with static MAC addresses for all devices
E
802.1X for guest access instead of WebAuth

Show answer and explanation

Correct answers: A, B, C

Explanation

To meet the requirements, the administrator should use 802.1X to authenticate users with valid credentials, MAB for legacy devices that cannot perform 802.1X authentication, and WebAuth to enable guest access via a web portal. This combination ensures secure access for employees, support for legacy devices, and a simple onboarding process for guest users. Port security is too rigid for this environment, and 802.1X is not appropriate for guest access.

A. Correct.
802.1X is the preferred method for authenticating users connecting to the network with valid credentials, such as employees using laptops or desktops.
B. Correct.
MAC Authentication Bypass (MAB) allows devices that do not support 802.1X (e.g., printers or other legacy devices) to authenticate based on their MAC address.
C. Correct.
WebAuth is typically used to provide guest access through a web portal, allowing non-employees to connect to the network after providing appropriate details.
D. Incorrect.
Port security with static MAC addresses is not scalable or flexible in this scenario, as it would require manual configuration of MAC addresses for all devices, including guest devices and legacy devices.
E. Incorrect.
802.1X is not suitable for guest access because guest devices often do not have the necessary credentials or configuration required for 802.1X authentication.

350-401 Question 305

Select 2

A network administrator is configuring network access control on a Cisco switch to provide secure authentication for endpoints. The requirement is to authenticate corporate devices using certificates, while allowing guest devices with no 802.1X capability to access a web-based authentication portal. What combination of methods should the administrator configure?

A
802.1X for corporate devices and MAB for guest devices
B
MAB for corporate devices and WebAuth for guest devices
C
802.1X for corporate devices and WebAuth for guest devices
D
802.1X for corporate devices only, with no authentication for guest devices
E
WebAuth for both corporate and guest devices

Show answer and explanation

Correct answers: A, C

Explanation

In this scenario, 802.1X is the best solution for corporate devices as it provides secure, certificate-based authentication. However, guest devices often lack 802.1X capabilities, making WebAuth a suitable option to redirect them to a portal for authentication. Combining these two methods ensures secure and flexible access control for both corporate and guest devices.

A. Correct.
Correct. 802.1X is suitable for authenticating corporate devices using certificates, and MAB (MAC Authentication Bypass) can serve as a fallback mechanism. However, in this scenario, WebAuth is preferred for guest devices as it provides a user-friendly portal for access.
B. Incorrect.
Incorrect. MAB is not typically used for corporate devices as it does not provide strong authentication. WebAuth is better suited for guest devices.
C. Correct.
Correct. 802.1X is ideal for corporate devices leveraging certificates, while WebAuth provides a convenient method for guest devices without 802.1X support to authenticate via a web portal.
D. Incorrect.
Incorrect. Not authenticating guest devices would pose a security risk. A mechanism like WebAuth should be implemented for guest access control.
E. Incorrect.
Incorrect. Using WebAuth for corporate devices does not meet the requirement of certificate-based authentication for secure corporate access.

Timed practice exam

Take a 350-401 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

350-401 practice questions 301 to 400 of 629

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 7 pages of up to 100 questions.

More Cisco exam dumps

All Cisco exams

300-435321 questions

Cisco ENAUTO exam dumps

Automating Cisco Enterprise Solutions

200-301503 questions

Cisco CCNA exam dumps

Cisco Certified Network Associate

100-160264 questions

Cisco CCST Cybersecurity exam dumps

Cisco Certified Support Technician (CCST) Cybersecurity

100-140389 questions

Cisco CCST IT Support exam dumps

Cisco Certified Support Technician (CCST) IT Support

100-150294 questions

Cisco CCST Networking exam dumps

Cisco Certified Support Technician (CCST) Networking

200-201403 questions

Cisco CyberOps Associate (CBROPS) exam dumps

Cisco Cybersecurity Associate

200-901203 questions

Cisco DevNet Associate (DEVASC) exam dumps

Cisco DevNet Associate

300-215228 questions

Cisco CBRFIR (Forensic Analysis and Incident Response) exam dumps

Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity