1Y0-350 · Question #140
During a recent security penetration test, several ports on the management address were identified as providing unsecured services. Which two methods could the network engineer use to restrict these…
The correct answer is C. Create Access Control Lists (ACLs). D. Configure options on the Management IP addresses. Exam Questions, Study Guides, Practice Tests. Lead the way to help you pass any IT Certification exams, 100% Pass Guaranteed or Full Refund. Especially Cisco, CompTIA, Citrix, EMC, HP, Oracle, VMware, Juniper, Check Point, LPI, Nortel, EXIN and so on. Our Slogan: First Test…
Question
During a recent security penetration test, several ports on the management address were identified as providing unsecured services. Which two methods could the network engineer use to restrict these services? (Choose two.)
Options
- AConfigure Auditing policies.
- BCreate Content Filtering policies.
- CCreate Access Control Lists (ACLs).
- DConfigure options on the Management IP addresses.
How the community answered
(20 responses)- A5% (1)
- B10% (2)
- C85% (17)
Explanation
Exam Questions, Study Guides, Practice Tests. Lead the way to help you pass any IT Certification exams, 100% Pass Guaranteed or Full Refund. Especially Cisco, CompTIA, Citrix, EMC, HP, Oracle, VMware, Juniper, Check Point, LPI, Nortel, EXIN and so on. Our Slogan: First Test, First Pass. Help you to pass any IT Certification exams at the first try. You can reach us at any of the email addresses listed below. Any problems about IT certification or our products, you could rely upon us, we will give you satisfactory answers in 24 hours.
Topics
Community Discussion
6
Toby R.Apr 6, 2026C and D are your answers here. ACLs let you block or allow traffic to specific ports on the management address, and the Management IP address options let you directly control which services are enabled or disabled on that interface, so both of these directly address the problem of restricting unsecured services found during the pen test.
Bao N.Mar 23, 2026The "restrict these services" language might make B feel plausible if you've been grinding too many firewall questions, but Content Filtering is for web traffic policy, not port-level access control on a management interface. ACLs (C) and Management IP options (D) are your two levers here, full stop.
Prof. SaraMar 24, 2026Solid breakdown, and worth drilling the tie-breaker: ACLs control which ports and protocols can reach the device at the network layer, while Management IP restrictions whitelist which source addresses are permitted to initiate that connection in the first place, so when the exam hands you both options, the phrase "trusted host" or "source IP" in the scenario stem is your signal to pick D every time.
Prof. SaraApr 8, 2026C and D are exactly right, and this is one of those questions where the distractors are there to catch candidates who mix up security hardening with traffic management features. ACLs (C) let you whitelist specific source IPs or networks that are permitted to reach the management plane, so you block everything else at the packet level before it even touches a service. The Management IP options (D) let you toggle individual services like HTTP, SSH, and SNMP directly on the NSIP itself, which means you can shut off cleartext protocols without relying on an external filter. Think of it as a two-layer approach, perimeter restriction via ACL and service-level hardening via NSIP settings, which maps cleanly to Domain 3 security controls on the blueprint. Auditing policies (A) log what happens after access is granted and Content Filtering (B) inspects application-layer HTTP traffic, so neither one blocks a port from being reachable in the first place.
Carlos M.Mar 21, 2026ACLs block ports, but what management IP options are you seeing in your lab?
Luis F.Apr 9, 2026C and D are definitely right here. ACLs let you whitelist only the IPs that should be hitting those management ports, and the Management IP address options on the NetScaler let you disable specific services like SSH or SNMP directly on that interface so you are not leaving anything exposed that you do not need.