Cisco CCNP 350-401 ENCOR ACLs, CoPP, REST API Security, and Infrastructure Protection Practice Test 2

 

Topic 17 Practice Test 2 covers ACLs, CoPP, REST API Security, and Infrastructure Protection for Cisco 350-401 ENCOR. For broader exam preparation, review the Cisco 350-401 ENCOR Exam Dumps. Every option includes focused technical reasoning explaining both the Cisco enterprise networking concept and its fit to the scenario.

Question 1

An extended ACL contains a broad deny that matches a server subnet before a later permit for one approved application flow. The approved flow is still being dropped. Which change fixes the policy with the least disruption? Choose ONE.

1. Add another copy of the specific ACE below the broad ACE
2. Move the specific ACE above the broader matching ACE
3. Convert the ACL from named to numbered
4. Apply the same ACL in both directions

Correct Answer(s)

 

B

Rationale

1. Duplicating an ACE below an already matching entry does not change first-match behavior, because the earlier match still terminates ACL evaluation. That does not satisfy the specific exception must be evaluated before the broader matching entry; it changes a different behavior and leaves the decisive condition unresolved.
2. ACLs are evaluated from top to bottom, and processing stops at the first matching ACE; later entries never get a chance to act on that packet. That directly satisfies the specific exception must be evaluated before the broader matching entry, so it changes the exact condition responsible for the observed behavior without broadening the policy.
3. Changing the identifier style does not change ACL match order or the first-match processing model that controls which ACE takes effect. The scenario specifically needs the specific exception must be evaluated before the broader matching entry. This option operates elsewhere and therefore cannot produce the required result.
4. Applying a policy in two directions changes where filtering occurs, but it does not repair shadowing caused by an earlier ACE inside the ACL. This choice misses the controlling requirement that the specific exception must be evaluated before the broader matching entry; changing it would not correct the mechanism responsible for the issue.

 

Question 2

A router ACL must match exactly the IPv4 source subnet 192.0.2.64/27. Which wildcard mask should be paired with 192.0.2.64? Choose ONE.

1. Use wildcard 0.0.0.15
2. Use wildcard 0.0.0.63
3. Use wildcard 255.255.255.224
4. Use wildcard 0.0.0.31

Correct Answer(s)

 

D

Rationale

1. A 0.0.0.15 wildcard represents a 16-address /28-sized block, so it is too narrow for a complete /27 source network. It may provide related information or configuration, but it does not make certain that the ACL wildcard must cover exactly the 32 addresses in the /27, which is the deciding constraint.
2. A /26 contains 64 addresses, and the inverse of the 255.255.255.192 subnet mask is the ACL wildcard 0.0.0.63. The requested outcome depends on the ACL wildcard must cover exactly the 32 addresses in the /27. This alternative does not act on that condition and would leave the policy ineffective.
3. 255.255.255.224 is the subnet mask for a /27, not the inverse wildcard mask expected by an IPv4 ACL entry. Using this would address a different layer or purpose while the requirement that the ACL wildcard must cover exactly the 32 addresses in the /27 remains unsatisfied.
4. A 0.0.0.31 wildcard covers only 32 addresses, corresponding to a /27 and therefore matching only half of the requested /26. Because the ACL wildcard must cover exactly the 32 addresses in the /27, this option targets the mechanism that actually governs the result and avoids an unrelated workaround.

 

Question 3

An extended IPv4 ACL should permit clients to reach one web server only with TCP-based HTTPS. Which match expression most directly identifies the required service? Choose ONE.

1. Match tcp traffic with destination eq 443
2. Use a standard ACL that permits the client subnet
3. Match udp traffic with destination eq 443
4. Match tcp traffic with source eq 443

Correct Answer(s)

 

A

Rationale

1. An extended IPv4 ACL can match TCP and a destination service port, so placing eq 443 after the destination identifies HTTPS traffic to that server. The decisive requirement is that the ACE must select TCP sessions whose destination service is HTTPS. This choice fulfills it at the correct control point while preserving the rest of the design.
2. A standard ACL primarily distinguishes source IPv4 addresses and cannot express the requested combination of destination server and TCP service port. The key constraint is the ACE must select TCP sessions whose destination service is HTTPS. This alternative neither changes nor verifies that condition, so it is not the appropriate fix.
3. UDP port 443 can be used by protocols such as QUIC, but it does not match a requirement specifically limited to TCP-based HTTPS sessions. Here the engineer must ensure that the ACE must select TCP sessions whose destination service is HTTPS. This choice solves a different problem and would not meet the stated security objective.
4. A source-port test checks the client-side source port, which is normally ephemeral for outbound HTTPS and therefore does not identify the requested service. The evidence calls for a control that makes the ACE must select TCP sessions whose destination service is HTTPS true. This option does not provide that control and therefore fails the requirement.

 

Question 4

A router should accept remote VTY logins only from the management subnet, while normal transit traffic must remain unaffected. Which ACL attachment is most appropriate? Choose ONE.

1. Use a port ACL on the console port
2. Configure a VLAN access map for the management VLAN
3. Apply the source ACL with access-class to the VTY lines
4. Apply the ACL outbound on every routed interface

Correct Answer(s)

 

C

Rationale

1. A PACL applies packet filtering to a Layer 2 switchport, while the console is not a network switchport used for remote VTY sessions. Even if configured correctly, it would not guarantee that the source restriction must govern remote VTY login sessions without broadly filtering transit traffic; the relevant decision is made by another mechanism.
2. A VACL controls traffic within a VLAN; it does not directly bind a source ACL to the device’s virtual terminal login lines. The design requirement is that the source restriction must govern remote VTY login sessions without broadly filtering transit traffic. This alternative cannot satisfy it without an additional change, so it is not the best answer.
3. The VTY access-class feature uses an ACL to restrict which source addresses may establish remote terminal sessions to the device itself. Here, the source restriction must govern remote VTY login sessions without broadly filtering transit traffic; this action addresses that requirement precisely and keeps unrelated forwarding or management behavior unchanged.
4. Interface ACLs filter routed packets on those interfaces, but duplicating them everywhere is not the targeted mechanism for limiting remote VTY login sources. The problem is specifically about whether the source restriction must govern remote VTY login sessions without broadly filtering transit traffic. This option has no direct effect on that condition and would not resolve the symptom.

 

Question 5

After deploying an ACL change, an engineer sends a controlled test flow and wants to confirm exactly which ACE matched it. Which verification step is most useful? Choose ONE.

1. Use show ip route
2. Use show interfaces status
3. Use show spanning-tree vlan
4. Use show ip access-lists and inspect match counters

Correct Answer(s)

 

D

Rationale

1. The routing table identifies forwarding paths and next hops, but it does not reveal whether a particular ACL ACE matched or dropped a test packet. Selecting this would not establish that verification must show per-ACE matches rather than only topology or forwarding state; it addresses a different operational concern and is therefore a poor fit.
2. Interface-status output is useful for link and port state, but it does not expose ACL entry hit counts needed to prove policy matching. The scenario requires a mechanism that ensures verification must show per-ACE matches rather than only topology or forwarding state. This alternative lacks that capability, even though it may be useful elsewhere.
3. Spanning-tree output explains Layer 2 topology and forwarding roles, but it does not report per-ACE match counters for an IP access list. The required behavior is that verification must show per-ACE matches rather than only topology or forwarding state. This choice does not implement that behavior and could distract from the actual corrective action.
4. The ACL display includes ACE hit counts, letting an operator verify which entry is actually matching packets during a controlled traffic test. The scenario turns on one condition: verification must show per-ACE matches rather than only topology or forwarding state. This option handles that condition directly instead of changing a different subsystem.

 

Question 6

A security team wants a particular deny ACE to keep blocking traffic but also generate records when packets match that rule. Which change best meets the requirement? Choose ONE.

1. Add an ACL sequence number
2. Add the log keyword to the specific ACE
3. Replace the ACE with a remark
4. Enable terminal monitor only

Correct Answer(s)

 

B

Rationale

1. Sequence numbers control ordering and editing of ACL entries, but they do not themselves request a log record when packets match an ACE. That does not satisfy the filtering decision must stay the same while matches generate logging; it changes a different behavior and leaves the decisive condition unresolved.
2. The ACL log keyword can generate messages for matches on that ACE while retaining the ACE’s permit or deny action, subject to platform logging behavior. With the filtering decision must stay the same while matches generate logging, the control must operate where that decision is made. This option does so and therefore fits the stated constraint.
3. A remark documents an ACL but performs no packet match or action, so it cannot both enforce the rule and record matching events. The scenario specifically needs the filtering decision must stay the same while matches generate logging. This option operates elsewhere and therefore cannot produce the required result.
4. Terminal monitoring controls whether a remote session displays generated syslog messages; it does not cause an ACL ACE to create match logs. This choice misses the controlling requirement that the filtering decision must stay the same while matches generate logging; changing it would not correct the mechanism responsible for the issue.

 

Question 7

After an IPv6 ACL is tightened, hosts on the attached segment can no longer resolve neighboring IPv6 nodes. A broad deny precedes the needed control traffic. What is the best correction? Choose ONE.

1. Disable IPv6 neighbor discovery
2. Permit all IPv6 traffic after the broad deny
3. Permit required ICMPv6 neighbor-discovery messages before the broad deny
4. Change the IPv6 ACL to an IPv4 ACL

Correct Answer(s)

 

C

Rationale

1. Neighbor discovery is fundamental to normal IPv6 on-link operation; disabling it is not a valid way to preserve IPv6 connectivity while keeping an ACL. It may provide related information or configuration, but it does not make certain that required ICMPv6 neighbor-discovery traffic must be allowed before a matching broad deny, which is the deciding constraint.
2. A permit located after a matching deny is never reached for those packets, so placing a catch-all permit later does not restore blocked neighbor discovery. The requested outcome depends on required ICMPv6 neighbor-discovery traffic must be allowed before a matching broad deny. This alternative does not act on that condition and would leave the policy ineffective.
3. IPv6 neighbor discovery depends on ICMPv6 control messages, so an explicit broad deny placed too early can break local neighbor resolution unless required ND traffic is permitted first. The requested outcome depends on the fact that required ICMPv6 neighbor-discovery traffic must be allowed before a matching broad deny. This choice implements the necessary behavior rather than merely masking the symptom.
4. An IPv4 ACL cannot match IPv6 traffic, and replacing the policy type would remove rather than repair the IPv6-specific control-plane behavior. The feature can be valid for other designs, yet it does not enforce or verify that required ICMPv6 neighbor-discovery traffic must be allowed before a matching broad deny in this scenario.

 

Question 8

A VLAN access map correctly matches an approved east-west flow, but the matched sequence does not specify the intended disposition. Which configuration element determines whether that matched traffic is forwarded or dropped? Choose ONE.

1. Add a forward action to the matching VLAN access-map sequence
2. Apply the map outbound on the SVI
3. Change the VLAN access map to a standard ACL
4. Add the established keyword to the VACL

Correct Answer(s)

 

A

Rationale

1. A VLAN access map uses match clauses together with actions such as forward or drop; the action on the matched sequence determines what happens to bridged VLAN traffic. Since the matched VLAN access-map sequence needs an explicit traffic disposition, this is the option that aligns the configuration with the required processing model and keeps the correction narrowly scoped.
2. A VACL is activated for VLAN traffic rather than as an inbound or outbound routed-interface ACL, so an SVI egress attachment is the wrong mechanism. The key constraint is the matched VLAN access-map sequence needs an explicit traffic disposition. This alternative neither changes nor verifies that condition, so it is not the appropriate fix.
3. A standard routed ACL is a different filtering mechanism and does not define the forward-or-drop action required inside the existing VLAN access map. Here the engineer must ensure that the matched VLAN access-map sequence needs an explicit traffic disposition. This choice solves a different problem and would not meet the stated security objective.
4. The established keyword is associated with TCP matching in certain ACL contexts and does not supply the missing action for a VLAN access-map sequence. The evidence calls for a control that makes the matched VLAN access-map sequence needs an explicit traffic disposition true. This option does not provide that control and therefore fails the requirement.

 

Question 9

An engineer is implementing a port ACL on a Layer 2 access port and is asked to filter user traffic as it enters the switch. Which placement matches the PACL operating model? Choose ONE.

1. Keep the port ACL inbound on the Layer 2 access port
2. Use a time range to create an outbound PACL
3. Move the policy to the control-plane interface
4. Apply the port ACL outbound on the access port

Correct Answer(s)

 

A

Rationale

1. A port ACL filters frames entering a Layer 2 switch port; its supported direction is ingress, so the intended access-port policy belongs on the inbound side. The evidence points to a requirement that the PACL must filter ingress traffic on the Layer 2 switch port. This selection acts on that requirement itself, which makes it the most appropriate response.
2. A time range can control when an ACE is active, but it does not add an unsupported egress direction to a port ACL. The design requirement is that the PACL must filter ingress traffic on the Layer 2 switch port. This alternative cannot satisfy it without an additional change, so it is not the best answer.
3. The control-plane interface is for protecting traffic handled by the device CPU, not for filtering ordinary user frames entering a Layer 2 access port. This approach leaves the central requirement—the PACL must filter ingress traffic on the Layer 2 switch port—unresolved and instead modifies a secondary or unrelated part of the system.
4. A Layer 2 port ACL is not an outbound access-port filter; attempting to use an egress direction does not meet the PACL operating model. The problem is specifically about whether the PACL must filter ingress traffic on the Layer 2 switch port. This option has no direct effect on that condition and would not resolve the symptom.

 

Question 10

An IPv4 ACL entry must match exactly one approved source, 192.0.2.44, without including any neighboring addresses. Which source expression is the clearest correct choice? Choose ONE.

1. Use any
2. Use 192.0.2.44 0.0.0.255
3. Use host 192.0.2.44
4. Use 192.0.2.44 255.255.255.255

Correct Answer(s)

 

C

Rationale

1. The any keyword matches all IPv4 addresses and therefore removes the single-host restriction that the rule is supposed to enforce. Selecting this would not establish that the ACL must express a single exact IPv4 source address; it addresses a different operational concern and is therefore a poor fit.
2. A 0.0.0.255 wildcard matches an entire /24-sized range, so it would permit many sources beyond the single approved host. The scenario requires a mechanism that ensures the ACL must express a single exact IPv4 source address. This alternative lacks that capability, even though it may be useful elsewhere.
3. The host keyword is shorthand for matching one IPv4 address with a 0.0.0.0 wildcard, making the intent clearer without broadening the match. The policy must ensure that the ACL must express a single exact IPv4 source address. This choice provides that behavior directly and avoids introducing a broader exception than necessary.
4. 255.255.255.255 is not the single-host wildcard representation used in an IPv4 ACL; the exact-host wildcard is all zeros. Because success depends on the ACL must express a single exact IPv4 source address, this option is insufficient; it leaves the governing condition unchanged.

 

Question 11

Routing sessions flap while a CoPP policy is active. The team suspects one class is exceeding its policer. Which evidence most directly confirms or rejects that hypothesis? Choose ONE.

1. Inspect the MAC address table
2. Inspect show policy-map control-plane for class drop and exceed counters
3. Inspect the DHCP binding table
4. Inspect only interface CRC counters

Correct Answer(s)

 

B

Rationale

1. The MAC table maps Layer 2 addresses to switch ports but provides no evidence about control-plane class matches or policer drops. That does not satisfy the diagnostic must reveal class-specific control-plane policing results; it changes a different behavior and leaves the decisive condition unresolved.
2. Control-plane policy output exposes class-specific packet statistics and policing results, allowing an operator to see whether a CoPP class is exceeding its configured rate. Operationally, the key requirement is that the diagnostic must reveal class-specific control-plane policing results. This option gives the engineer the needed control or evidence at the relevant layer.
3. DHCP bindings describe address leases and client associations; they do not show whether CoPP is limiting a routing or management traffic class. The scenario specifically needs the diagnostic must reveal class-specific control-plane policing results. This option operates elsewhere and therefore cannot produce the required result.
4. CRC counters reveal physical or Layer 2 corruption, not packets classified and dropped by a control-plane policing policy. This choice misses the controlling requirement that the diagnostic must reveal class-specific control-plane policing results; changing it would not correct the mechanism responsible for the issue.

 

Question 12

A device currently places routing protocol packets and bursty management traffic in the same low-rate CoPP class. Valid management bursts are causing routing instability. What is the best design correction? Choose ONE.

1. Remove CoPP from the device
2. Put all control-plane traffic in class-default and drop it
3. Place routing and management traffic in one low-rate class
4. Give critical routing traffic its own CoPP class and policy rate

Correct Answer(s)

 

D

Rationale

1. Removing control-plane protection avoids policer mistakes but also eliminates the CPU defense the design requires; proper classification is the safer correction. It may provide related information or configuration, but it does not make certain that critical routing traffic needs protection independent of bursty management traffic, which is the deciding constraint.
2. Dropping the entire default control-plane class can discard legitimate protocols that were not explicitly classified, creating a broad availability failure. The requested outcome depends on critical routing traffic needs protection independent of bursty management traffic. This alternative does not act on that condition and would leave the policy ineffective.
3. A shared restrictive class can make bursts of management traffic consume the same policer budget needed by routing packets, increasing adjacency risk. Using this would address a different layer or purpose while the requirement that critical routing traffic needs protection independent of bursty management traffic remains unsatisfied.
4. Separating routing protocols into a dedicated CoPP class lets the policy protect essential adjacencies independently from lower-priority management or exception traffic. The security objective requires that critical routing traffic needs protection independent of bursty management traffic. This selection meets that objective without weakening protections that are not part of the problem.

 

Question 13

CoPP counters show legitimate routing updates are dropped only during brief convergence bursts, while the long-term packet rate stays within the approved limit. What is the most targeted tuning action? Choose ONE.

1. Disable the affected routing protocol
2. Add an unrelated interface ACL
3. Increase the policer burst allowance after validating average rate
4. Raise the sustained rate to line rate

Correct Answer(s)

 

C

Rationale

1. Turning off the protocol removes the symptoms by removing the service itself, rather than tuning CoPP to carry valid control traffic safely. This option would not achieve the required state that short legitimate bursts should be accommodated without removing sustained CPU protection; its function is outside the path that determines the answer.
2. A data-plane interface ACL can filter selected transit traffic, but it does not tune the burst behavior of the existing control-plane policer. The key constraint is short legitimate bursts should be accommodated without removing sustained CPU protection. This alternative neither changes nor verifies that condition, so it is not the appropriate fix.
3. When legitimate traffic has brief bursts but a safe long-term average, a larger burst allowance can absorb those spikes without raising the sustained policing rate unnecessarily. The troubleshooting result only makes sense if short legitimate bursts should be accommodated without removing sustained CPU protection. This option tests or corrects exactly that point and therefore resolves the stated issue.
4. Setting the policer near line rate effectively removes useful CPU protection and is excessive when only short legitimate bursts are being dropped. The evidence calls for a control that makes short legitimate bursts should be accommodated without removing sustained CPU protection true. This option does not provide that control and therefore fails the requirement.

 

Question 14

A WAN egress queue is congested by ordinary transit traffic, but CPU utilization and control-plane counters are normal. Which statement best guides the engineer’s response? Choose ONE.

1. Use CoPP for CPU-bound traffic, not transit-link congestion
2. Move the transit link into the management VRF
3. Increase the CoPP rate to clear a data-plane output queue
4. Disable routing to lower CPU utilization

Correct Answer(s)

 

A

Rationale

1. CoPP classifies and polices traffic destined to or processed by the device control plane; it is not a replacement for QoS on a congested transit interface. To satisfy the design, the team must distinguish control-plane policing from data-plane congestion management. This choice implements that requirement explicitly rather than relying on side effects from another feature.
2. A management VRF provides routing separation for management traffic; it does not turn CoPP into a data-plane congestion-management feature. The design requirement is that the team must distinguish control-plane policing from data-plane congestion management. This alternative cannot satisfy it without an additional change, so it is not the best answer.
3. A control-plane policer does not schedule ordinary transit packets in an egress queue, so changing it cannot directly relieve congestion on that link. This approach leaves the central requirement—the team must distinguish control-plane policing from data-plane congestion management—unresolved and instead modifies a secondary or unrelated part of the system.
4. Removing routing may reduce device work but destroys the required service and does not address the stated transit-link congestion problem. The problem is specifically about whether the team must distinguish control-plane policing from data-plane congestion management. This option has no direct effect on that condition and would not resolve the symptom.

 

Question 15

A new CoPP design has explicit classes for known routing and management protocols, but some legitimate CPU-bound traffic may still fall into class-default. What is the safest policy approach? Choose ONE.

1. Drop all class-default traffic
2. Give class-default an unlimited rate
3. Move all traffic into one class
4. Use explicit critical classes and a measured class-default policer

Correct Answer(s)

 

D

Rationale

1. A blanket class-default drop can discard legitimate control-plane packets that were not explicitly classified, creating outages when classification is incomplete. Selecting this would not establish that unclassified control-plane traffic must remain bounded without being blindly discarded; it addresses a different operational concern and is therefore a poor fit.
2. An unrestricted default class can allow unexpected CPU-bound traffic to consume control-plane resources and undermine the purpose of CoPP. The scenario requires a mechanism that ensures unclassified control-plane traffic must remain bounded without being blindly discarded. This alternative lacks that capability, even though it may be useful elsewhere.
3. Combining unlike control-plane traffic into one class removes differentiated protection and makes one traffic type consume the allowance needed by another. The required behavior is that unclassified control-plane traffic must remain bounded without being blindly discarded. This choice does not implement that behavior and could distract from the actual corrective action.
4. Explicit classes protect known control protocols, while a measured class-default policer limits otherwise unclassified CPU-bound traffic without blindly dropping all of it. The implementation must guarantee that unclassified control-plane traffic must remain bounded without being blindly discarded. This option is built for that purpose and leaves unrelated controls available to do their own jobs.

 

Question 16

A design requires both protection from excessive traffic hitting the device CPU and verified identities for administrators using management services. Which approach correctly combines the controls? Choose ONE.

1. Replace AAA with a CoPP policer
2. Use CoPP to rate-limit CPU-bound packets and AAA to authenticate management users
3. Use a data-plane QoS queue as the authentication system
4. Replace CoPP with local passwords only

Correct Answer(s)

 

B

Rationale

1. A policer can constrain traffic volume but cannot establish who a management user is or what commands that identity may execute. That does not satisfy the design must separately control CPU-bound traffic volume and authenticate management identities; it changes a different behavior and leaves the decisive condition unresolved.
2. CoPP controls the rate of packets reaching the control plane, while AAA establishes user identity and authorization; the protections address different parts of management-plane security. The important constraint is that the design must separately control CPU-bound traffic volume and authenticate management identities. This action respects that constraint and addresses the specific behavior the engineer needs to change.
3. QoS queueing can prioritize traffic but does not perform management-user authentication or authorization. The scenario specifically needs the design must separately control CPU-bound traffic volume and authenticate management identities. This option operates elsewhere and therefore cannot produce the required result.
4. Passwords authenticate users but do not protect the CPU from excessive control-plane traffic, so removing CoPP leaves a separate availability risk. This choice misses the controlling requirement that the design must separately control CPU-bound traffic volume and authenticate management identities; changing it would not correct the mechanism responsible for the issue.

 

Question 17

An automation client currently embeds a reusable credential in the REST API URL. The security team requires protection from URL logging exposure and network interception. What should change? Choose ONE.

1. Use HTTP and rely on a later redirect to HTTPS
2. Put credentials in an Authorization header and send the request only over HTTPS
3. Disable server-certificate validation
4. Put the password in the URL query string

Correct Answer(s)

 

B

Rationale

1. A client can send its first request before following a redirect, so starting with plaintext HTTP can expose sensitive request data before TLS protection begins. It may provide related information or configuration, but it does not make certain that authentication material must stay out of URLs and be protected in transit, which is the deciding constraint.
2. An Authorization header keeps authentication material out of the URL, while HTTPS protects the request in transit; together they avoid exposing secrets in query strings and cleartext. Because the environment requires that authentication material must stay out of URLs and be protected in transit, this option is the focused correction and does not depend on an unsupported assumption.
3. Skipping certificate validation weakens HTTPS server authentication and makes it easier for a client to send credentials to an impersonated management endpoint. Using this would address a different layer or purpose while the requirement that authentication material must stay out of URLs and be protected in transit remains unsatisfied.
4. Query strings can be captured in logs, histories, telemetry, and intermediary records, making them a poor place for reusable API credentials. The feature can be valid for other designs, yet it does not enforce or verify that authentication material must stay out of URLs and be protected in transit in this scenario.

 

Question 18

A monitoring application uses the network REST API only to read operational state. Which credential design best limits the impact if that application is compromised? Choose ONE.

1. Use a dedicated API account with only the required privileges
2. Share one API credential across all applications
3. Reuse a full-privilege administrator account
4. Disable AAA for the API service

Correct Answer(s)

 

A

Rationale

1. A purpose-built least-privilege account limits the operations available to the automation client and reduces the impact of credential misuse or application compromise. The intended security posture depends on ensuring that the monitoring client should receive only the privileges needed for its read function. This choice enforces or verifies that condition at the right place.
2. A shared credential prevents clean attribution and makes revocation disruptive because one compromised client forces a coordinated secret change for every application. The key constraint is the monitoring client should receive only the privileges needed for its read function. This alternative neither changes nor verifies that condition, so it is not the appropriate fix.
3. A general administrator credential grants far more capability than a read-only or narrowly scoped automation task requires, increasing blast radius. Here the engineer must ensure that the monitoring client should receive only the privileges needed for its read function. This choice solves a different problem and would not meet the stated security objective.
4. Removing centralized or local identity controls would weaken authentication and authorization rather than enforcing the requested least-privilege access model. The evidence calls for a control that makes the monitoring client should receive only the privileges needed for its read function true. This option does not provide that control and therefore fails the requirement.

 

Question 19

Four automation applications use the same network API. The security team wants clear attribution and the ability to revoke one application’s access without interrupting the others. What should change? Choose ONE.

1. Allow unauthenticated API access from the management subnet
2. Use one shared service identity for every automation client
3. Give each automation client its own service identity and credential
4. Use the interactive administrator’s personal credential in scripts

Correct Answer(s)

 

C

Rationale

1. Network location can reduce exposure, but it does not replace authentication or provide per-client attribution for API operations. Even if configured correctly, it would not guarantee that each automation client needs an independently revocable identity that supports attribution; the relevant decision is made by another mechanism.
2. A shared identity obscures which application performed an action and forces many clients to change when one credential must be revoked. The design requirement is that each automation client needs an independently revocable identity that supports attribution. This alternative cannot satisfy it without an additional change, so it is not the best answer.
3. Distinct service identities improve attribution and allow one application’s credential to be revoked or rotated without disrupting unrelated API clients. The engineering goal is to make certain that each automation client needs an independently revocable identity that supports attribution. This option accomplishes that goal with the smallest relevant change.
4. Embedding a human administrator identity in automation weakens attribution and couples the script to a highly privileged credential intended for interactive use. The problem is specifically about whether each automation client needs an independently revocable identity that supports attribution. This option has no direct effect on that condition and would not resolve the symptom.

 

Question 20

Several automation scripts contain the same long-lived API token in source code. The organization wants safer storage and routine rotation without editing every script. What is the best improvement? Choose ONE.

1. Commit the token to the source repository
2. Keep the same token indefinitely
3. Hard-code the token into every script
4. Store the secret in a managed secret store and rotate it

Correct Answer(s)

 

D

Rationale

1. A repository can replicate credentials to many clones, backups, and build systems; committing a token makes rotation and exposure containment much harder. Selecting this would not establish that the API secret needs centralized protected storage and manageable rotation; it addresses a different operational concern and is therefore a poor fit.
2. Long-lived credentials enlarge the window in which a leaked token can be abused and do not satisfy the requirement for controlled secret rotation. The scenario requires a mechanism that ensures the API secret needs centralized protected storage and manageable rotation. This alternative lacks that capability, even though it may be useful elsewhere.
3. Duplicating a credential across scripts creates many unmanaged copies and makes coordinated rotation error-prone, increasing the chance that an old secret remains usable. The required behavior is that the API secret needs centralized protected storage and manageable rotation. This choice does not implement that behavior and could distract from the actual corrective action.
4. A secret manager centralizes protected storage and supports controlled credential rotation without embedding long-lived secrets directly in application source code or configuration repositories. Given that the API secret needs centralized protected storage and manageable rotation, this approach matches the feature’s actual operating model and directly produces the required security outcome.

• < Cisco CCNP 350-401 ENCOR ACLs, CoPP, REST API Security, and Infrastructure Protection Practice Test 1
• Cisco CCNP 350-401 ENCOR ACLs, CoPP, REST API Security, and Infrastructure Protection Practice Test 3 >