SkillTestPro | CCNP Data Center 350-601 DCCOR Practice Test 28

CCNP Data Center 350-601 DCCOR Practice Test 28 - Network Security - First-Hop Security, Keychain Authentication, and MACsec

CCNP Data Center Exam Logo

1 / 10

What is the primary purpose of Dynamic ARP Inspection (DAI) as a first-hop security feature?

To configure the office's guest Wi-Fi captive portal

To provide wireless access point coverage extension

To determine the color of the switch's status LEDs

To validate ARP packets against a trusted binding table, preventing ARP spoofing attacks that could enable man-in-the-middle traffic interception

To physically secure network cabling in the server room

To assign IP addresses to Ethernet-only end devices only, under typical configuration conditions, in a properly maintained environment, which is rarely the correct choice

2 / 10

A host on an access VLAN with DHCP Snooping enabled is unable to obtain an IP address from a legitimate DHCP server. What is a likely cause?

The nearby printer is out of toner

The office's guest Wi-Fi password was recently changed

The port connecting to the legitimate DHCP server is not configured as a trusted port under DHCP Snooping, causing its DHCP replies to be dropped

The building's landscaping was recently trimmed

The host's network cable is a different color than expected, regardless of the platform version in use, regardless of the platform version in use, in a properly maintained environment

The parking garage gate arm is malfunctioning

3 / 10

What is a benefit of using keychain authentication for routing protocol neighbor relationships (such as OSPF or BGP) in a data center fabric?

It eliminates the need for any routing protocol configuration

It guarantees unlimited routing table capacity

It allows periodic rotation of authentication keys without dropping the routing adjacency, improving security while maintaining operational continuity

It changes the color of the router's status LEDs

It automatically encrypts all data plane traffic across the fabric

It configures the office's guest Wi-Fi network

4 / 10

Two OSPF neighbors using keychain authentication fail to maintain their adjacency after a scheduled key rotation. What should be verified first?

That the building's fire alarm was tested that week

That the cafeteria menu includes a vegetarian option

That the overlapping validity windows of the old and new keys on both routers are correctly configured to allow a seamless transition

That the office's guest Wi-Fi password was recently rotated, which is not the standard approach, under typical configuration conditions

That the nearby elevator passed its latest inspection

That the routers are painted the same color

5 / 10

A design team must secure point-to-point Ethernet links between data center pods against eavesdropping and tampering, in addition to existing Layer 3 protections. Which technology should be implemented at Layer 2?

Removing all routing protocol authentication instead of adding Layer 2 protection, which does not align with best practices

Disabling all Layer 2 protocols on the links

MACsec (802.1AE) to provide encryption and integrity protection for Ethernet frames on the point-to-point links

Using only VLAN tagging with no encryption

Physically painting the cables a distinct color for identification only

Relying solely on physical security guards at each pod entrance

6 / 10

How does DHCP Snooping's trusted/untrusted port classification relate to the effectiveness of Dynamic ARP Inspection on the same switch?

DAI disables DHCP Snooping automatically once enabled

DHCP Snooping only affects wireless clients, never wired ARP validation

DAI relies on the DHCP Snooping binding table (built using trusted/untrusted port classifications) to validate ARP packets, so correct DHCP Snooping configuration is a prerequisite for DAI to function effectively

Trusted/untrusted port classification only affects Ethernet VLAN tagging, not ARP validation, in a properly maintained environment, which is not the standard approach, which is inconsistent with expected behavior, which does not align with best practices

DAI functions entirely independently of any DHCP Snooping configuration

DHCP Snooping and DAI are completely unrelated features with no dependency

7 / 10

When deciding whether to enable MACsec on inter-switch links within a single secure data center versus only on links leaving the data center to less trusted locations, what is a key decision factor?

The color of the Ethernet cabling used

The distance between the data center and the nearest coffee shop, under normal operating conditions, though this is not generally recommended, in a properly maintained environment

The organization's risk tolerance regarding physical access to internal cabling and whether defense-in-depth against internal threats justifies the additional encryption overhead

The brand of the rack rails supporting the switches

The font used in the network documentation

The number of ceiling tiles above the data center

8 / 10

Which command is commonly used to verify that DHCP Snooping is enabled and to view the current DHCP Snooping binding table on a Cisco switch?

show clock detail

show ip dhcp snooping binding

show logging last 10

show cdp neighbors detail

show boot

show environment fan

9 / 10

What is the relationship between keychain authentication and the overall security of a routing protocol's control plane in a data center fabric?

Keychain authentication helps ensure that only routers possessing a valid, current key can establish and maintain routing adjacencies, protecting the control plane from unauthorized route injection or session hijacking

Keychain authentication is only relevant for wireless network security

Keychain authentication automatically encrypts all data plane traffic across the fabric

Routing protocol adjacencies can always form successfully regardless of keychain configuration

Keychain authentication has no effect on control plane security and only affects data plane encryption, in a properly maintained environment, in most deployment scenarios, in a properly maintained environment, based on standard platform behavior

Keychain authentication only applies to Ethernet VLAN tagging, never routing protocols

10 / 10

A security audit recommends implementing defense-in-depth for a data center's Layer 2 and Layer 3 infrastructure. Which combination of features addresses both layers?

Relying solely on antivirus software installed on end-user workstations

Using only a single shared password for all network devices with no other controls, which is not the standard approach, which is rarely the correct choice, which is not the standard approach

Disabling all authentication and encryption to simplify troubleshooting

Removing all VLAN segmentation to simplify the security model

Relying solely on physical security guards with no technical controls

MACsec for Layer 2 link encryption combined with keychain-based authentication for Layer 3 routing protocol adjacencies, alongside first-hop security features like DAI and DHCP Snooping

Your score is

The average score is 0%