350-701 Practice Test

350-701 Practice Test practice questions, page 15 of 28, with answer review and explanations.

Question 71

What is the result of running the crypto isakmp key ciscXXXXXXXX address 172.16.0.0 command?

  1. authenticates the IKEv2 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
  2. authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX
  3. authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
  4. secures all the certificates in the IKE exchange by using the key ciscXXXXXXXX

Question 72

Which command enables 802.1X globally on a Cisco switch?

  1. dot1x system-auth-control
  2. dot1x pae authenticator
  3. authentication port-control auto
  4. aaa new-model

Question 73

What is a characteristic of Dynamic ARP Inspection?

  1. DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the DHCP snooping binding database.
  2. In a typical network, make all ports as trusted except for the ports connecting to switches, which are untrusted.
  3. DAI associates a trust state with each switch.
  4. DAI intercepts all ARP requests and responses on trusted ports only.

Question 74

Which statement about IOS zone-based firewalls is true?

  1. An unassigned interface can communicate with assigned interfaces
  2. Only one interface can be assigned to a zone.
  3. An interface can be assigned to multiple zones.
  4. An interface can be assigned only to one zone.

Question 75

When wired 802.1X authentication is implemented, which two components are required? (Choose two.)

  1. authentication server: Cisco Identity Service Engine
  2. supplicant: Cisco AnyConnect ISE Posture module
  3. authenticator: Cisco Catalyst switch
  4. authenticator: Cisco Identity Services Engine
  5. authentication server: Cisco Prime Infrastructure