Cisco CCNP 350-401 ENCOR ACLs, CoPP, REST API Security, and Infrastructure Protection Practice Test 1

 

Topic 17 Practice Test 1 covers ACLs, CoPP, REST API Security, and Infrastructure Protection for Cisco 350-401 ENCOR. For broader exam preparation, review the Cisco 350-401 ENCOR Exam Dumps. Every option includes focused technical reasoning explaining both the Cisco enterprise networking concept and its fit to the scenario.

Question 1

A compliance check requires that the policy only needs to distinguish source networks or hosts. Which option best satisfies the requirement? Choose ONE.

1. standard IPv4 ACL
2. ACL sequence numbers
3. VLAN access map
4. object-group ACL

Correct Answer(s)

 

A

Rationale

1. For selection, the capability applies because standard IPv4 ACL filters IPv4 traffic primarily by source address. The design hinges on the policy only needs to distinguish source networks or hosts. That makes it the precise fit.
2. In selection, ACL sequence numbers place or resequence ACEs so evaluation order matches policy intent. This fits when a new exception must be inserted before a broader deny. Here, appending an ACE after a terminal match will not help; the tested decision contrasts ACL sequence numbers with standard IPv4 ACL, so it targets the wrong layer.
3. In selection, VLAN access map filters or redirects traffic within a VLAN, including bridged traffic. This fits when east-west traffic in the same VLAN must be controlled. Here, a routed interface ACL may not see same-VLAN bridged flows; the tested decision contrasts VLAN access map with standard IPv4 ACL, making it unsuitable here.
4. In selection, object-group ACL reuses grouped network or service objects in ACL entries. This fits when many related addresses or ports must be maintained consistently. Here, duplicating many individual ACEs increases operational error risk; the tested decision contrasts object-group ACL with standard IPv4 ACL, so it fails this constraint.

 

Question 2

A service owner has documented that the security rule must permit or deny a specific application flow. What should be implemented to meet it? Choose ONE.

1. implicit deny
2. port ACL
3. extended IPv4 ACL
4. TCP established matching

Correct Answer(s)

 

C

Rationale

1. In selection, implicit deny drops packets that reach the end of an ACL without a permit match. This fits when a legitimate flow unexpectedly fails because no explicit permit exists. Here, adding unrelated denies does not restore required traffic; the tested decision contrasts implicit deny with extended IPv4 ACL, leaving the requirement unmet.
2. In selection, port ACL applies IP or MAC filtering directly to a Layer 2 switch port. This fits when traffic entering an access port must be filtered before normal switching. Here, a VACL targets an entire VLAN rather than one access port; the tested decision contrasts port ACL with extended IPv4 ACL, so it misses the requirement.
3. For selection, use this option because extended IPv4 ACL matches source, destination, protocol, and transport details for granular filtering. The relevant constraint is the security rule must permit or deny a specific application flow. The requirement maps to this capability.
4. In selection, TCP established matching matches return TCP traffic by ACK or RST state indicators in supported ACL syntax. This fits when a simple stateless return-flow rule is needed for established TCP sessions. Here, it does not create a stateful firewall session table; the tested decision contrasts TCP established matching with extended IPv4 ACL, so the mismatch is decisive.

 

Question 3

A post-incident review finds that operators need readable policy names and selective entry changes. Which capability is the most precise fit? Choose ONE.

1. inbound interface ACL
2. named ACL
3. IPv6 traffic-filter ACL
4. Control Plane Policing

Correct Answer(s)

 

B

Rationale

1. In selection, inbound interface ACL filters packets as they enter an interface before routing. This fits when unwanted traffic should be discarded close to its ingress point. Here, an outbound filter acts after the routing decision; the tested decision contrasts inbound interface ACL with named ACL, therefore another control is needed.
2. For selection, this answer is strongest because named ACL uses a descriptive identifier and supports easier ACE maintenance. The evidence points to operators need readable policy names and selective entry changes. That linkage resolves the stated need.
3. In selection, IPv6 traffic-filter ACL applies IPv6 permit and deny entries to an interface. This fits when the protected flow uses IPv6 addressing. Here, an IPv4 ACL cannot match IPv6 packet headers; the tested decision contrasts IPv6 traffic-filter ACL with named ACL, making it unsuitable here.
4. In selection, Control Plane Policing classifies and polices CPU-bound traffic to protect routing and management processes. This fits when excess punted or control traffic threatens device CPU availability. Here, data-plane interface policing does not specifically protect the route processor; the tested decision contrasts Control Plane Policing with named ACL, so it fails this constraint.

 

Question 4

A rollout cannot proceed unless a new exception must be inserted before a broader deny. Which control should the team select? Choose ONE.

1. outbound interface ACL
2. time-based ACL
3. control-plane service policy
4. ACL sequence numbers

Correct Answer(s)

 

D

Rationale

1. In selection, outbound interface ACL filters packets after routing as they leave an interface. This fits when the requirement is to control traffic headed toward a specific egress segment. Here, an inbound rule on an unrelated ingress cannot enforce all egress paths; the tested decision contrasts outbound interface ACL with ACL sequence numbers, leaving the requirement unmet.
2. In selection, time-based ACL activates selected ACEs only during configured time ranges. This fits when temporary access must be allowed only during a maintenance window. Here, a permanently active ACE would violate the schedule constraint; the tested decision contrasts time-based ACL with ACL sequence numbers, so it misses the requirement.
3. In selection, control-plane service policy attaches the CoPP policy to the logical control-plane interface. This fits when MQC classes and policers are defined but are not yet active on CPU-bound traffic. Here, configuring a class map alone does not enforce the policer; the tested decision contrasts control-plane service policy with ACL sequence numbers, making it secondary here.
4. For selection, this is appropriate because ACL sequence numbers place or resequence ACEs so evaluation order matches policy intent. The operational requirement is a new exception must be inserted before a broader deny. That is why it wins here.

 

Question 5

A platform standard now requires that a legitimate flow unexpectedly fails because no explicit permit exists. Which feature directly addresses it? Choose ONE.

1. VLAN access map
2. implicit deny
3. object-group ACL
4. CoPP access-group classification

Correct Answer(s)

 

B

Rationale

1. In selection, VLAN access map filters or redirects traffic within a VLAN, including bridged traffic. This fits when east-west traffic in the same VLAN must be controlled. Here, a routed interface ACL may not see same-VLAN bridged flows; the tested decision contrasts VLAN access map with implicit deny, therefore another control is needed.
2. For selection, this answer is strongest because implicit deny drops packets that reach the end of an ACL without a permit match. The evidence points to a legitimate flow unexpectedly fails because no explicit permit exists. That linkage resolves the stated need.
3. In selection, object-group ACL reuses grouped network or service objects in ACL entries. This fits when many related addresses or ports must be maintained consistently. Here, duplicating many individual ACEs increases operational error risk; the tested decision contrasts object-group ACL with implicit deny, making it unsuitable here.
4. In selection, CoPP access-group classification uses ACL-based matching inside a class map to identify control-plane traffic. This fits when only selected protocol traffic should receive a dedicated control-plane policer. Here, a generic any-any class loses traffic-type discrimination; the tested decision contrasts CoPP access-group classification with implicit deny, so it fails this constraint.

 

Question 6

A technical review highlights that unwanted traffic should be discarded close to its ingress point. Which option best satisfies the requirement? Choose ONE.

1. inbound interface ACL
2. port ACL
3. TCP established matching
4. HTTPS for RESTCONF

Correct Answer(s)

 

A

Rationale

1. For selection, this mechanism works because inbound interface ACL filters packets as they enter an interface before routing. The decisive condition is unwanted traffic should be discarded close to its ingress point. That distinction determines the answer.
2. In selection, port ACL applies IP or MAC filtering directly to a Layer 2 switch port. This fits when traffic entering an access port must be filtered before normal switching. Here, a VACL targets an entire VLAN rather than one access port; the tested decision contrasts port ACL with inbound interface ACL, so it misses the requirement.
3. In selection, TCP established matching matches return TCP traffic by ACK or RST state indicators in supported ACL syntax. This fits when a simple stateless return-flow rule is needed for established TCP sessions. Here, it does not create a stateful firewall session table; the tested decision contrasts TCP established matching with inbound interface ACL, making it secondary here.
4. In selection, HTTPS for RESTCONF encrypts RESTCONF management traffic using TLS on the secure HTTP service. This fits when API credentials and configuration data must not cross the network in cleartext. Here, plain HTTP exposes management data to interception; the tested decision contrasts HTTPS for RESTCONF with inbound interface ACL, so the mismatch is decisive.

 

Question 7

An implementation team must address this condition: the requirement is to control traffic headed toward a specific egress segment. What should be implemented to meet it? Choose ONE.

1. IPv6 traffic-filter ACL
2. Control Plane Policing
3. AAA-backed RESTCONF authentication
4. outbound interface ACL

Correct Answer(s)

 

D

Rationale

1. In selection, IPv6 traffic-filter ACL applies IPv6 permit and deny entries to an interface. This fits when the protected flow uses IPv6 addressing. Here, an IPv4 ACL cannot match IPv6 packet headers; the tested decision contrasts IPv6 traffic-filter ACL with outbound interface ACL, therefore another control is needed.
2. In selection, Control Plane Policing classifies and polices CPU-bound traffic to protect routing and management processes. This fits when excess punted or control traffic threatens device CPU availability. Here, data-plane interface policing does not specifically protect the route processor; the tested decision contrasts Control Plane Policing with outbound interface ACL, so it targets the wrong layer.
3. In selection, AAA-backed RESTCONF authentication uses approved local, RADIUS, or TACACS+ credentials to authorize model-driven API access. This fits when API callers must authenticate under the enterprise identity policy. Here, an open endpoint without AAA cannot enforce administrator identity; the tested decision contrasts AAA-backed RESTCONF authentication with outbound interface ACL, making it unsuitable here.
4. For selection, the feature matches because outbound interface ACL filters packets after routing as they leave an interface. The controlling need is the requirement is to control traffic headed toward a specific egress segment. This directly matches the tested condition.

 

Question 8

A control validation exercise shows that east-west traffic in the same VLAN must be controlled. Which capability is the most precise fit? Choose ONE.

1. time-based ACL
2. control-plane service policy
3. VLAN access map
4. trusted certificate validation

Correct Answer(s)

 

C

Rationale

1. In selection, time-based ACL activates selected ACEs only during configured time ranges. This fits when temporary access must be allowed only during a maintenance window. Here, a permanently active ACE would violate the schedule constraint; the tested decision contrasts time-based ACL with VLAN access map, leaving the requirement unmet.
2. In selection, control-plane service policy attaches the CoPP policy to the logical control-plane interface. This fits when MQC classes and policers are defined but are not yet active on CPU-bound traffic. Here, configuring a class map alone does not enforce the policer; the tested decision contrasts control-plane service policy with VLAN access map, so it misses the requirement.
3. For selection, use this option because VLAN access map filters or redirects traffic within a VLAN, including bridged traffic. The relevant constraint is east-west traffic in the same VLAN must be controlled. The requirement maps to this capability.
4. In selection, trusted certificate validation verifies the HTTPS server certificate and trust chain for API clients. This fits when automation must detect impersonated management endpoints. Here, disabling certificate verification defeats server-authentication checks; the tested decision contrasts trusted certificate validation with VLAN access map, so the mismatch is decisive.

 

Question 9

A reliability review depends on this outcome: traffic entering an access port must be filtered before normal switching. Which control should the team select? Choose ONE.

1. object-group ACL
2. CoPP access-group classification
3. port ACL
4. infrastructure ACL

Correct Answer(s)

 

C

Rationale

1. In selection, object-group ACL reuses grouped network or service objects in ACL entries. This fits when many related addresses or ports must be maintained consistently. Here, duplicating many individual ACEs increases operational error risk; the tested decision contrasts object-group ACL with port ACL, therefore another control is needed.
2. In selection, CoPP access-group classification uses ACL-based matching inside a class map to identify control-plane traffic. This fits when only selected protocol traffic should receive a dedicated control-plane policer. Here, a generic any-any class loses traffic-type discrimination; the tested decision contrasts CoPP access-group classification with port ACL, so it targets the wrong layer.
3. For selection, select this control because port ACL applies IP or MAC filtering directly to a Layer 2 switch port. The requested outcome is traffic entering an access port must be filtered before normal switching. The alternatives solve different problems.
4. In selection, infrastructure ACL filters traffic at network boundaries so only required traffic reaches infrastructure addresses. This fits when routing and management subnets must be shielded from arbitrary user traffic. Here, host firewall policy alone does not protect the network-device address space; the tested decision contrasts infrastructure ACL with port ACL, so it fails this constraint.

 

Question 10

A governance review sets this requirement: the protected flow uses IPv6 addressing. Which feature directly addresses it? Choose ONE.

1. TCP established matching
2. HTTPS for RESTCONF
3. standard IPv4 ACL
4. IPv6 traffic-filter ACL

Correct Answer(s)

 

D

Rationale

1. In selection, TCP established matching matches return TCP traffic by ACK or RST state indicators in supported ACL syntax. This fits when a simple stateless return-flow rule is needed for established TCP sessions. Here, it does not create a stateful firewall session table; the tested decision contrasts TCP established matching with IPv6 traffic-filter ACL, leaving the requirement unmet.
2. In selection, HTTPS for RESTCONF encrypts RESTCONF management traffic using TLS on the secure HTTP service. This fits when API credentials and configuration data must not cross the network in cleartext. Here, plain HTTP exposes management data to interception; the tested decision contrasts HTTPS for RESTCONF with IPv6 traffic-filter ACL, so it misses the requirement.
3. In selection, standard IPv4 ACL filters IPv4 traffic primarily by source address. This fits when the policy only needs to distinguish source networks or hosts. Here, extended ACLs add destination, protocol, and port criteria; the tested decision contrasts standard IPv4 ACL with IPv6 traffic-filter ACL, making it secondary here.
4. For selection, this is appropriate because IPv6 traffic-filter ACL applies IPv6 permit and deny entries to an interface. The operational requirement is the protected flow uses IPv6 addressing. That is why it wins here.

 

Question 11

A configuration review uncovers this need: temporary access must be allowed only during a maintenance window. Which option best satisfies the requirement? Choose ONE.

1. time-based ACL
2. Control Plane Policing
3. AAA-backed RESTCONF authentication
4. extended IPv4 ACL

Correct Answer(s)

 

A

Rationale

1. For selection, the capability applies because time-based ACL activates selected ACEs only during configured time ranges. The design hinges on temporary access must be allowed only during a maintenance window. That makes it the precise fit.
2. In selection, Control Plane Policing classifies and polices CPU-bound traffic to protect routing and management processes. This fits when excess punted or control traffic threatens device CPU availability. Here, data-plane interface policing does not specifically protect the route processor; the tested decision contrasts Control Plane Policing with time-based ACL, so it targets the wrong layer.
3. In selection, AAA-backed RESTCONF authentication uses approved local, RADIUS, or TACACS+ credentials to authorize model-driven API access. This fits when API callers must authenticate under the enterprise identity policy. Here, an open endpoint without AAA cannot enforce administrator identity; the tested decision contrasts AAA-backed RESTCONF authentication with time-based ACL, making it unsuitable here.
4. In selection, extended IPv4 ACL matches source, destination, protocol, and transport details for granular filtering. This fits when the security rule must permit or deny a specific application flow. Here, a standard ACL cannot express destination ports; the tested decision contrasts extended IPv4 ACL with time-based ACL, so it fails this constraint.

 

Question 12

A solution assessment must satisfy this condition: many related addresses or ports must be maintained consistently. What should be implemented to meet it? Choose ONE.

1. control-plane service policy
2. object-group ACL
3. trusted certificate validation
4. named ACL

Correct Answer(s)

 

B

Rationale

1. In selection, control-plane service policy attaches the CoPP policy to the logical control-plane interface. This fits when MQC classes and policers are defined but are not yet active on CPU-bound traffic. Here, configuring a class map alone does not enforce the policer; the tested decision contrasts control-plane service policy with object-group ACL, leaving the requirement unmet.
2. For selection, this choice fits because object-group ACL reuses grouped network or service objects in ACL entries. The scenario specifically requires many related addresses or ports must be maintained consistently. This is the narrowest correct choice.
3. In selection, trusted certificate validation verifies the HTTPS server certificate and trust chain for API clients. This fits when automation must detect impersonated management endpoints. Here, disabling certificate verification defeats server-authentication checks; the tested decision contrasts trusted certificate validation with object-group ACL, making it secondary here.
4. In selection, named ACL uses a descriptive identifier and supports easier ACE maintenance. This fits when operators need readable policy names and selective entry changes. Here, a numbered ACL is less expressive operationally; the tested decision contrasts named ACL with object-group ACL, so the mismatch is decisive.

 

Question 13

A design review identifies this requirement: a simple stateless return-flow rule is needed for established TCP sessions. Which capability is the most precise fit? Choose ONE.

1. CoPP access-group classification
2. infrastructure ACL
3. ACL sequence numbers
4. TCP established matching

Correct Answer(s)

 

D

Rationale

1. In selection, CoPP access-group classification uses ACL-based matching inside a class map to identify control-plane traffic. This fits when only selected protocol traffic should receive a dedicated control-plane policer. Here, a generic any-any class loses traffic-type discrimination; the tested decision contrasts CoPP access-group classification with TCP established matching, therefore another control is needed.
2. In selection, infrastructure ACL filters traffic at network boundaries so only required traffic reaches infrastructure addresses. This fits when routing and management subnets must be shielded from arbitrary user traffic. Here, host firewall policy alone does not protect the network-device address space; the tested decision contrasts infrastructure ACL with TCP established matching, so it targets the wrong layer.
3. In selection, ACL sequence numbers place or resequence ACEs so evaluation order matches policy intent. This fits when a new exception must be inserted before a broader deny. Here, appending an ACE after a terminal match will not help; the tested decision contrasts ACL sequence numbers with TCP established matching, making it unsuitable here.
4. For selection, the feature matches because TCP established matching matches return TCP traffic by ACK or RST state indicators in supported ACL syntax. The controlling need is a simple stateless return-flow rule is needed for established TCP sessions. This directly matches the tested condition.

 

Question 14

A production change is being evaluated because excess punted or control traffic threatens device CPU availability. Which control should the team select? Choose ONE.

1. HTTPS for RESTCONF
2. Control Plane Policing
3. standard IPv4 ACL
4. implicit deny

Correct Answer(s)

 

B

Rationale

1. In selection, HTTPS for RESTCONF encrypts RESTCONF management traffic using TLS on the secure HTTP service. This fits when API credentials and configuration data must not cross the network in cleartext. Here, plain HTTP exposes management data to interception; the tested decision contrasts HTTPS for RESTCONF with Control Plane Policing, leaving the requirement unmet.
2. For selection, this choice fits because Control Plane Policing classifies and polices CPU-bound traffic to protect routing and management processes. The scenario specifically requires excess punted or control traffic threatens device CPU availability. This is the narrowest correct choice.
3. In selection, standard IPv4 ACL filters IPv4 traffic primarily by source address. This fits when the policy only needs to distinguish source networks or hosts. Here, extended ACLs add destination, protocol, and port criteria; the tested decision contrasts standard IPv4 ACL with Control Plane Policing, making it secondary here.
4. In selection, implicit deny drops packets that reach the end of an ACL without a permit match. This fits when a legitimate flow unexpectedly fails because no explicit permit exists. Here, adding unrelated denies does not restore required traffic; the tested decision contrasts implicit deny with Control Plane Policing, so the mismatch is decisive.

 

Question 15

An operations team reports that MQC classes and policers are defined but are not yet active on CPU-bound traffic. Which feature directly addresses it? Choose ONE.

1. AAA-backed RESTCONF authentication
2. extended IPv4 ACL
3. control-plane service policy
4. inbound interface ACL

Correct Answer(s)

 

C

Rationale

1. In selection, AAA-backed RESTCONF authentication uses approved local, RADIUS, or TACACS+ credentials to authorize model-driven API access. This fits when API callers must authenticate under the enterprise identity policy. Here, an open endpoint without AAA cannot enforce administrator identity; the tested decision contrasts AAA-backed RESTCONF authentication with control-plane service policy, therefore another control is needed.
2. In selection, extended IPv4 ACL matches source, destination, protocol, and transport details for granular filtering. This fits when the security rule must permit or deny a specific application flow. Here, a standard ACL cannot express destination ports; the tested decision contrasts extended IPv4 ACL with control-plane service policy, so it targets the wrong layer.
3. For selection, select this control because control-plane service policy attaches the CoPP policy to the logical control-plane interface. The requested outcome is MQC classes and policers are defined but are not yet active on CPU-bound traffic. The alternatives solve different problems.
4. In selection, inbound interface ACL filters packets as they enter an interface before routing. This fits when unwanted traffic should be discarded close to its ingress point. Here, an outbound filter acts after the routing decision; the tested decision contrasts inbound interface ACL with control-plane service policy, so it fails this constraint.

 

Question 16

A security assessment concludes that only selected protocol traffic should receive a dedicated control-plane policer. Which option best satisfies the requirement? Choose ONE.

1. CoPP access-group classification
2. trusted certificate validation
3. named ACL
4. outbound interface ACL

Correct Answer(s)

 

A

Rationale

1. For selection, this mechanism works because CoPP access-group classification uses ACL-based matching inside a class map to identify control-plane traffic. The decisive condition is only selected protocol traffic should receive a dedicated control-plane policer. That distinction determines the answer.
2. In selection, trusted certificate validation verifies the HTTPS server certificate and trust chain for API clients. This fits when automation must detect impersonated management endpoints. Here, disabling certificate verification defeats server-authentication checks; the tested decision contrasts trusted certificate validation with CoPP access-group classification, so it misses the requirement.
3. In selection, named ACL uses a descriptive identifier and supports easier ACE maintenance. This fits when operators need readable policy names and selective entry changes. Here, a numbered ACL is less expressive operationally; the tested decision contrasts named ACL with CoPP access-group classification, making it secondary here.
4. In selection, outbound interface ACL filters packets after routing as they leave an interface. This fits when the requirement is to control traffic headed toward a specific egress segment. Here, an inbound rule on an unrelated ingress cannot enforce all egress paths; the tested decision contrasts outbound interface ACL with CoPP access-group classification, so the mismatch is decisive.

 

Question 17

During troubleshooting, engineers determine that API credentials and configuration data must not cross the network in cleartext. What should be implemented to meet it? Choose ONE.

1. HTTPS for RESTCONF
2. infrastructure ACL
3. ACL sequence numbers
4. VLAN access map

Correct Answer(s)

 

A

Rationale

1. For selection, the capability applies because HTTPS for RESTCONF encrypts RESTCONF management traffic using TLS on the secure HTTP service. The design hinges on API credentials and configuration data must not cross the network in cleartext. That makes it the precise fit.
2. In selection, infrastructure ACL filters traffic at network boundaries so only required traffic reaches infrastructure addresses. This fits when routing and management subnets must be shielded from arbitrary user traffic. Here, host firewall policy alone does not protect the network-device address space; the tested decision contrasts infrastructure ACL with HTTPS for RESTCONF, so it targets the wrong layer.
3. In selection, ACL sequence numbers place or resequence ACEs so evaluation order matches policy intent. This fits when a new exception must be inserted before a broader deny. Here, appending an ACE after a terminal match will not help; the tested decision contrasts ACL sequence numbers with HTTPS for RESTCONF, making it unsuitable here.
4. In selection, VLAN access map filters or redirects traffic within a VLAN, including bridged traffic. This fits when east-west traffic in the same VLAN must be controlled. Here, a routed interface ACL may not see same-VLAN bridged flows; the tested decision contrasts VLAN access map with HTTPS for RESTCONF, so it fails this constraint.

 

Question 18

A new deployment has a constraint: API callers must authenticate under the enterprise identity policy. Which capability is the most precise fit? Choose ONE.

1. standard IPv4 ACL
2. AAA-backed RESTCONF authentication
3. implicit deny
4. port ACL

Correct Answer(s)

 

B

Rationale

1. In selection, standard IPv4 ACL filters IPv4 traffic primarily by source address. This fits when the policy only needs to distinguish source networks or hosts. Here, extended ACLs add destination, protocol, and port criteria; the tested decision contrasts standard IPv4 ACL with AAA-backed RESTCONF authentication, leaving the requirement unmet.
2. For selection, this choice fits because AAA-backed RESTCONF authentication uses approved local, RADIUS, or TACACS+ credentials to authorize model-driven API access. The scenario specifically requires API callers must authenticate under the enterprise identity policy. This is the narrowest correct choice.
3. In selection, implicit deny drops packets that reach the end of an ACL without a permit match. This fits when a legitimate flow unexpectedly fails because no explicit permit exists. Here, adding unrelated denies does not restore required traffic; the tested decision contrasts implicit deny with AAA-backed RESTCONF authentication, making it secondary here.
4. In selection, port ACL applies IP or MAC filtering directly to a Layer 2 switch port. This fits when traffic entering an access port must be filtered before normal switching. Here, a VACL targets an entire VLAN rather than one access port; the tested decision contrasts port ACL with AAA-backed RESTCONF authentication, so the mismatch is decisive.

 

Question 19

A migration review confirms that automation must detect impersonated management endpoints. Which control should the team select? Choose ONE.

1. extended IPv4 ACL
2. inbound interface ACL
3. IPv6 traffic-filter ACL
4. trusted certificate validation

Correct Answer(s)

 

D

Rationale

1. In selection, extended IPv4 ACL matches source, destination, protocol, and transport details for granular filtering. This fits when the security rule must permit or deny a specific application flow. Here, a standard ACL cannot express destination ports; the tested decision contrasts extended IPv4 ACL with trusted certificate validation, therefore another control is needed.
2. In selection, inbound interface ACL filters packets as they enter an interface before routing. This fits when unwanted traffic should be discarded close to its ingress point. Here, an outbound filter acts after the routing decision; the tested decision contrasts inbound interface ACL with trusted certificate validation, so it targets the wrong layer.
3. In selection, IPv6 traffic-filter ACL applies IPv6 permit and deny entries to an interface. This fits when the protected flow uses IPv6 addressing. Here, an IPv4 ACL cannot match IPv6 packet headers; the tested decision contrasts IPv6 traffic-filter ACL with trusted certificate validation, making it unsuitable here.
4. For selection, the feature matches because trusted certificate validation verifies the HTTPS server certificate and trust chain for API clients. The controlling need is automation must detect impersonated management endpoints. This directly matches the tested condition.

 

Question 20

An architecture board must ensure that routing and management subnets must be shielded from arbitrary user traffic. Which feature directly addresses it? Choose ONE.

1. named ACL
2. outbound interface ACL
3. infrastructure ACL
4. time-based ACL

Correct Answer(s)

 

C

Rationale

1. In selection, named ACL uses a descriptive identifier and supports easier ACE maintenance. This fits when operators need readable policy names and selective entry changes. Here, a numbered ACL is less expressive operationally; the tested decision contrasts named ACL with infrastructure ACL, leaving the requirement unmet.
2. In selection, outbound interface ACL filters packets after routing as they leave an interface. This fits when the requirement is to control traffic headed toward a specific egress segment. Here, an inbound rule on an unrelated ingress cannot enforce all egress paths; the tested decision contrasts outbound interface ACL with infrastructure ACL, so it misses the requirement.
3. For selection, use this option because infrastructure ACL filters traffic at network boundaries so only required traffic reaches infrastructure addresses. The relevant constraint is routing and management subnets must be shielded from arbitrary user traffic. The requirement maps to this capability.
4. In selection, time-based ACL activates selected ACEs only during configured time ranges. This fits when temporary access must be allowed only during a maintenance window. Here, a permanently active ACE would violate the schedule constraint; the tested decision contrasts time-based ACL with infrastructure ACL, so the mismatch is decisive.

• < Cisco CCNP 350-401 ENCOR Device Access Control, Local Authentication, and AAA Practice Test 2
• Cisco CCNP 350-401 ENCOR ACLs, CoPP, REST API Security, and Infrastructure Protection Practice Test 2 >