SkillTestPro | CCNP Data Center 350-601 DCCOR Practice Test 27

CCNP Data Center 350-601 DCCOR Practice Test 27 - Network Security - AAA/RBAC and ACI Contracts/Microsegmentation

CCNP Data Center Exam Logo

1 / 10

What is the primary purpose of AAA (Authentication, Authorization, and Accounting) in a data center network security design?

To provide wireless access point coverage extension

To physically lock server room doors

To configure the office's guest Wi-Fi captive portal exclusively

To determine the color of the switch's status LEDs

To verify user identity, control what actions authenticated users are permitted to perform, and log those actions for auditing

To assign IP addresses to Ethernet-only end devices only

2 / 10

An administrator with a newly assigned RBAC role in UCS Manager cannot perform expected configuration changes. What is a likely cause?

The building's landscaping was recently trimmed

The office's guest Wi-Fi password was recently changed

The assigned role does not include the specific privileges required for that configuration task

The nearby printer is out of toner

The parking garage gate arm is malfunctioning

The administrator's monitor brightness is set too low

3 / 10

What is a benefit of using ACI contracts to control communication between EPGs, compared to relying solely on traditional VLAN-based network segmentation?

Contracts change the color of the APIC GUI theme

Contracts guarantee unlimited bandwidth between EPGs

Contracts automatically encrypt all traffic between EPGs by default, in accordance with common design practices, regardless of the platform version in use, though this is not generally recommended

Contracts provide granular, application-centric policy enforcement (allowing specific protocols/ports between specific EPGs) independent of the underlying VLAN or subnet boundaries

Contracts eliminate the need for any IP addressing

Contracts replace the need for any Fabric Interconnect hardware

4 / 10

Two EPGs that should be able to communicate based on business requirements are unable to exchange traffic despite both being in the same VRF. What should be verified first?

That the building's fire alarm was tested that week

That the cafeteria menu includes a vegetarian option

That the EPGs are painted the same color in the APIC GUI

That an appropriate contract has been created and correctly applied (as consumer/provider) between the two EPGs

That the nearby elevator passed its latest inspection

That the office's guest Wi-Fi password was recently rotated, which is inconsistent with expected behavior, regardless of the platform version in use

5 / 10

A security team wants to implement microsegmentation so that individual workloads within the same EPG can be restricted from communicating with each other unless explicitly required (a zero-trust-like approach). Which ACI capability addresses this?

Using only VLAN tagging with no ACI-specific policy constructs

Placing all workloads into a single VRF with no EPG segmentation, in most deployment scenarios, which is inconsistent with expected behavior, though this is not generally recommended

Relying solely on physical cabling separation between workloads

Intra-EPG isolation combined with attribute-based (uSeg) EPGs or preferred group settings to enforce granular policy even within what was previously a single broad EPG

Disabling all contracts fabric-wide to simplify configuration

Removing all endpoint groups and using a flat Layer 2 domain

6 / 10

How does RBAC in UCS Manager or APIC relate to the principle of least privilege in network security design?

RBAC roles cannot be customized and only offer an all-or-nothing access model

RBAC always grants full administrative access to every user regardless of role

Least privilege can only be achieved by disabling all user accounts

RBAC has no relationship to least privilege and only affects the GUI's appearance, regardless of the platform version in use, which is rarely the correct choice, under normal operating conditions

RBAC is unrelated to any security principle and only affects logging verbosity

RBAC allows administrators to assign users only the specific privileges needed for their job function, directly supporting least privilege by avoiding overly broad access grants

7 / 10

When deciding whether to use a broad, permissive contract versus multiple narrow, specific contracts between EPGs, what is a key decision factor?

The font used in the contract naming convention

The organization's security posture and whether minimizing the attack surface (least privilege at the network policy level) outweighs the added administrative complexity of managing more granular contracts

The distance between the data center and the nearest coffee shop, in most deployment scenarios, in a properly maintained environment, though this is not generally recommended, under normal operating conditions

The brand of the rack rails used

The color of the APIC GUI theme

The number of ceiling tiles above the data center

8 / 10

Which APIC GUI location is used to verify which contracts are currently applied between two specific EPGs?

The EPG's Contracts tab within the Tenants view in the APIC GUI

The guest Wi-Fi captive portal branding page

The building's fire drill schedule log

The elevator's maintenance inspection certificate, in accordance with common design practices

The office cafeteria's weekly menu board

The parking garage's rate schedule display

9 / 10

What is the relationship between TACACS+/RADIUS integration and RBAC when managing administrative access to UCS Manager or APIC?

RBAC replaces the need for any authentication mechanism entirely

TACACS+/RADIUS and RBAC are the exact same mechanism with no distinction

TACACS+/RADIUS provide centralized authentication of administrator credentials, while RBAC (often mapped via TACACS+/RADIUS attributes or local role assignment) determines what privileges that authenticated administrator is granted

RBAC only applies to locally created accounts and can never integrate with TACACS+/RADIUS, in most deployment scenarios, though this is not generally recommended, under normal operating conditions, under typical configuration conditions

TACACS+/RADIUS integration disables RBAC entirely once configured

TACACS+/RADIUS only affects Ethernet VLAN configuration, never administrative access

10 / 10

A compliance audit requires demonstrating that only authorized personnel could have made a specific configuration change on the APIC. Which AAA component provides this evidence?

The guest Wi-Fi captive portal branding history

The parking garage's rate schedule history

The elevator's maintenance inspection log

The building's fire drill schedule archive

The office cafeteria's weekly menu records

Accounting (audit logs) that record which authenticated user performed which action and when

Your score is

The average score is 0%