cisco · ccie security written exam (v5.0) version: 8.0 [ total questions: 443 ] ... it requires...

s@lm@n

Cisco Exam 400-251

CCIE Security Written Exam (v5.0)

Version: 8.0

[ Total Questions: 443 ]

Download 2017 EP 400-251 Dump PDF and VCEhttp://www.ensurepass.com/400-251.html

http://www.ensurepass.com/400-251.html

Topic break down

Topic No. of Questions

Topic 1: Exam Pool A 92

Topic 2: Exam Pool B 310

Topic 3: Exam Pool C 41

2

Topic 1, Exam Pool A

Which two effects of this configuration are true?(Choose two) A. IGMPv2 leave group messages are stored in the switch CAM table for faster processing. B. Hosts send leave group messages to the all-router multicast address when they want tostop data for that group C. It improves the processing time of CGMP leave messages D. Hosts send leave group messages to the Solicited-Node Address multicast addressFF02::1 :ff00:0000/104 E. It optimizes the use of network bandwidth on the LAN segment. F. It allows the switch to detect IGMPv2 leave group messages.

Answer: E,F

Which three statement about 802.1x multiauthentication mode are true?(Choose three) A. It requires each connected client to authenticate individually. B. Each multiauthentication port can support only one voice VLAN. C. It can be deployed in conjunction with MDA functionality on voice VLANs. D. E. It is recommended for guest VLANs. F. On non-802.1x devices, it can support only one authentication method on a single port.

Answer: A,B,C

Question No : 1 - (Topic 1)


3

Which three messages are part of the SSL protocol?(Choose three) A. B. C. D. CipherSpec. E. Message Authorization. F. Change CipherSpec.

Answer: A,B,F

Which data format is used in this script? A. API B. JavaScript C. JSON D. YANG



4

E. XML

Answer: E

Which two effects of this configuration are true?(Choose two) A. B. User fivecan view usernames and passwords. C. User superusercan change usernames and passwords. D. User superuser can view the configuration. E. User superuser can view usernames and password. F. User cisco canview usernames and password.

Answer: A,D



5

Which two effects of this configuration are true?(Choose two) A. If the TACACS+ server is unreachable ,the switch places hosts on critical ports in VLAN50. B. If the authentication priority is changed, the order in switch authentication is performedalso changes. C. If multiple hosts have authenticated to the same port, each can be in their own assignedVLAN D. The port attempts 802.1x authentication first, and. then falls back to MAC authenticationbypass. E. The device allows multiple authenticated sessions for a single MAC address in the voice

F. The switch periodically sends an EAP-Identity-Request to the endpoint supplicant.

Answer: D,E

What are the two different modes in which Private AMP cloud can be deployed?(Choosetwo ) A. Air Gap Mode. B. C. D. E. F. Proxy Mode.

Answer: A,E



6

Which two statements about Botnet Traffic Filter snooping are true?(Choosetwo) A. It requires DNS packet inspection to be enabled to filter domain names in the dynamic

B. It requires the Cisco ASA DNS server to perform DNS lookups. C. It can inspect both IPV4 and IPV6 traffic. D. It can log and block suspicious connections from previously unknown bad domains and

E. It checks inbound traffic only. F.

Answer: A,F

Which two statements about uRPF are true?(Choose two) A. The administrator can configurethe allow-defaultcommand to force the routing table touse only the default . B. It is not supported on the Cisco ASA security appliance. C. The administrator can configure the ip verify unicast source reachable-via any commandto enable the RPF check to work through HSRP touting groups. D.

E. In strict mode, only one routing path can be available to reach network devices on a

Answer: D,E

Which command on Cisco ASA you can enter to send debug messages to a syslog server? A. Loggingdebug-trace B. Logging host C. Logging traps D. Logging syslog



7

Answer: B

A new computer is not getting its IPv6 address assigned by the router. While running wireShark to try to troubleshoot the problem , you find a lot of data that is not helpful to naildown the problem. What two filters would you apply to Wire Shark to the data that you arelooking for?(Choose two) A. Icmpv6.type==135 B. Icmpv6type==136 C. Icmpv6.type==136 D. Icmp5type==135 E. Icmp6type==135

Answer: A,B

Which effect of the crypto pki authenticate commend is true? A. B. C. It configures a CA trustpoint. D. It displays the current CA certificate.

Answer: B

Which two characteristics of DTLS are true?(Choose two ) A. It is used mostly by applications that use application layer object-protocols B. It includes a congestion control mechanism C. It completes key negotiation and bulk data transfer over a single channel.




8

D. It supports long data transfers and connectionless data transfers. E. It cannot be used if NAT exists along the path. F. It concludes a retransmission method because it uses an unreliable datagram transport

Answer: C,D

Which three statements about PKI on Cisco IOS Software are true?(Choose three) A. OCSP is well-suited for enterprise PKIs in which CRLs expire frequently. B. The match certificate and allow expired-certificate commands are ignored unless the

C. If a certificate-based ACL specifies more than one filed, any one successful field-to-

D. E. Certificate-based ACLs can be configured to allow expired certificates if the peer is

F. Different OCSP servers can be configured for different groups of client certificates.

Answer: A,E,F

In which type of multicast does the Cisco ASA forward IGMP messages to the upstreamrouter? A. Clustering B. PIM multicast routing C. Stub multicast routing D. Multicast group concept

Answer: C




9

A client computer at 10.10.7.4 is trying to access a Linux server (11.0.1.9) that is running aTomcat Server application. What TCP dump filter would best to verify that traffic is reaching

A. Tcpdump-ieth0 host 10.10.7.4 and host 11.0.1.9 and port 8080. B. Tcpump-ieth0 host 10.10.7.4 and 11.0.1.9. C. Tcpdump-ieth0 dst 11.0.1.9 and dst port 8080. D. Tcpdump-ieth0 src 10.10.7.4 and dst 11.0.1.9 and dst port 8080.

Answer: D

A. VEM B. Vpath C. VDC D. VPC

Answer: B

Refer to the exhibit,



10

Which three additional configuration elements must you apply to complete a functional FlexVPN deployment?(Choose three) A. Interface Loopback0 Tunnel mode ipsec ipv6 Tunnel protection ipsec profile default B. C. Crypto ikev2 keyring default Peer PEER-ROUTER Address 2001 101/64 Interface Virtual-Template5 type tunnel Ip nhrp network-id 10 Ip nhrp shortcut Loopack0 D. Crypto ikev2 keyring KEYS Peer PEER-ROUTER

11

Address 2001 101/64 Crypto ikev2 profile default Aaa authorization group pak list ccie default E. Bfdinterval 50 min-rx 50 multiplier 3

F. Interface Virtual-Template5 type tunnel Ip nhrp network-id 10 Ipv6 enable

Ipv6 eigrp 10

Answer: B,D,F

Which description of SaaS is true? A. A server offering that allowing developers to bulid their own applications. B. A server offering on-demand software downloads. C. A server offering a software environment in which applications can be build anddeployed. D. A server offering on-demand licensed applications for end users.

Answer: D

Which two events can cause a failover event on an active/standby setup? (Choose two) A. The active unit experiences interface failure above the threshold. B. The unit that was previously active recovers. C. D. E.

Answer: A,E



12

Which three statements about WCCP are true?(Choose three) A. The minimum WCCP-Fast Timers message interval is 500 ms B. If a specific capability is missing from the Capabilities info Component, the router isassumed to supported to the default capability. C. The router must receive a valid receive ID before it negates capabilities. D. The assignment method supports GRE encapsulation for sending traffic. E. If the packet return method is missing from a packet return method advertisement, theweb cache uses the Layer 2 rewrite method. F. The web cache transmits its capabilities as soon as it receives a receives a receive ID

Answer: A,C,E

You are considering using RSPAN to capture traffic between several switches. Which twoconfiguration aspects do you need to consider?(Choose two) A. The RSPAN need to be blocked on all trunk interfaces leadingto the destination RSPAN

B. Not all switches need to support RSPANfor it to work. C. The RSPAN VLAN need to be allow on all trunk interfacesleading to the destination

D. All distribution switches need to support RSPAN. E. All switches need to be running the same IOS version.

Answer: B,C

Which three options are fields in a COA Request Response code packet?(Choose three) A. State. B.




13

C. Length. D. E. Calling-Station-ID. F.

Answer: A,B,E

Which two options are normal functionalities for ICMP?Choose two A. B. Packet filtering. C. Relaying traffic statics to applications. D. Path MTU discovery . E. Port scanning. F. Router discovery

Answer: D,F

Which option is a data modeling language used to model configuration and state data of

A. RESTCONF B. YANG. C. SNMPv4. D. BETCONF.

Answer: B

Which of the following is AMP Endpoints offline engine for windows ?




14

A. B. C. TETRAAMP D. TETRA

Answer: D

Which three commands can you use to configure VXLAN on a Cisco ASA firewall?(Choosethree). A. Sysopt connection tcpmss. B. Nve-only. C. Default-mcast-group. D. Segment-id. E. Inspect VXLAN. F. Set ip next-hop verify-availability.

Answer: B,C,D

Which three ISAKMP SA Message States can be output from the device that initiated anIPSec tunnel?(Choose three) A. MM_WAIT_MSG4 B. MM_WAIT_MSG2 C. MM_WAIT_MSG5 D. MM_WAIT_MSG6 E. MM_WAIT_MSG1 F. MM_WAIT_MSG3

Answer: A,B,D




15

Which three ESMTP extensions are supported by the Cisco ASA?(Choose three) A. Noop B. PIPELINING C. SAML D. 8BITMIME E. STARTTLS F. ATRN

Answer: A,C,E

Which three VSA attributes are present in a RADIUS WLAN Access-Acceptpacket?(Choose three) A. Tunnel-Private-Group-ID B. Tunnel-Type C. SSID D. EAP-Message E. LEAP Session-key F. Authorization-Algorithm-Type

Answer: A,B,C

Which option best describes RPL? A. RPL stands for Routing over low priority links that use distance vector DOGAG to

B. RPL stands for Routing over low-power Lossy Networks that use distance vector

C. RPL stands for Routing over low priority links that use link-state LSAs to determine the

D. RPL stands for Routing over low-power Lossy Networks that use link-state LSAs to



16

Answer: B

Which two statements about SCEP are true? (Choose two) A. CA Servers must support GetCACaps response messages in order to implementextended functionality. B. The GetCRL exchange is signed and encrypted only in the response direction. C. It is vulnerable to downgrade attacks on its cryptographic capabilities. D. The GetCert exchange is signed and encrypted only in the response direction. E. The GetCACaps response message supports DES encryption and the SHA-128 hashingalgorithm.

Answer: A,C

Which two statements about Cisco URL Filtering on Cisco IOS Software are true?(Choosetwo) A. It supports Websense and N2H2 filtering at the same time. B. It supports local URL lists and third-party URL filtering servers. C. By default, it uses ports 80 and 22. D. It supports HTTP and HTTP traffic. E. By default, it allows all URLs when the connection to the filtering server is down. F. It requires minimal CPU time.

Answer: A,B

Which two statements about Net Flow Secure Event Logging on a Cisco ASA aretrue?(Choose two)




17

A. It tracks configured collectors over TCP. B. It is supported only in single-context mode. C. It can export templates through NetFlow. D. E. It supports one event type per collector F. It can log different event types on the same device to different collectors.

Answer: C,F

Which two statements about 802.1x components are true?(Choose two) A. The access layer switchis the policy enforcement point. B. The certificates that are used in the client-server authentication process are stored on

C. The RADIUS server is the policy enforcement point. D. The RADIUS server is the policy informant point. E. The RADIUS server is the policy decision point. F. An LADP server can server as the policy enforcement point.

Answer: A,E

Which WEP configuration can be exploited by a weak IV attack? A. When the static WEP password has been stored without encryption. B. When a per-packet WEP key is in use. C. When a 64-bit key is in use. D. When the static WEP password has been given away. E. When a 40-bit key is in use. F. When the same WEP key is used to create every packet.

Answer: E




18

Which three statements about Cisco Any Connect SSL VPN with the ASA aretrue?(Choose three) A. DTLS can fail back to TLS without enabling dead peer detection. B. By default, the VPN connection connects with DTLS. C. Real-time application performance improves if DTLS is implemented. D. Cisco Any Connect connections use IKEv2 by default when it is configured as theprimary protocol on the client. E. By default, the ASA uses the Cisco Any Connect Essentials license. F. The ASA will verify the remote HTTPS certificate.

Answer: B,C,D

How does Scavenger-class QOS mitigate DOS and worm attacks? A. It monitors normal traffic flow and drops burst traffic above the normal rate for a single

B. It matches traffic from individual hosts against the specific network characteristics ofknown attack types. C. It sets a specific intrusion detection mechanism and applies the appropriate ACL whenmatching traffic is detected. D. It monitors normal traffic flow and aggressively drops sustained abnormally high trafficstreams from multiple hosts.

Answer: D

Which three authorization technologies does Cisco Trust Sec support?(Choose three) A. 802.1x. B. SGACL. C. DACL. D. MAB. E. SGT. F. VLAN.



19

Answer: A,D,F

Which two options are benefits of global ACLs?(Choose two) A. They only operate on logical interfaces. B. They are more efficient because they are processed before interface access rules. C. They server memory because they work without being replicated on each interface D. They can be applied to multiple interface E. They are flexible because they match source and destination IP addresses for packetsthat arrive on any interface

Answer: B,D

Which statement about VRF-aware GDOI group members is true? A. IPsec is used only to secure data traffic. B. The GM cannot route control traffic through the same VRF as data traffic. C. Multiple VRFs are used to separate control traffic and data traffic. D. Registration traffic and rekey traffic must operate on different on different VRFs.

Answer: A

Which type of attack uses a large number of spoofed MAC addresses to emulate wireless

A. Chopchop attack. B. DoS against an accesspoint. C. D.




20

Microsoft Exams List

70-246 Dump PDF VCE 70-485 Dump PDF VCE 70-742 Dump PDF VCE 98-366 Dump PDF VCE









70-345 Dump PDF VCE 70-496 Dump PDF VCE 70-982 Dump PDF VCE MB2-700 Dump PDF VCE





























http://www.ensurepass.com/microsoft.html








































http://www.ensurepass.com/MB2-700.html

















































































































Cisco Exams List

































300-209 Dump PDF VCE 600-503 Dump PDF VCE 650-159 Dump PDF VCE








































































































































































HOT EXAMS

Cisco Microsoft CompTIA

100-105 Dumps VCE PDF 70-410 Dumps VCE PDF 220-901 Dumps VCE PDF

200-105 Dumps VCE PDF 70-411 Dumps VCE PDF 220-902 Dumps VCE PDF

300-101 Dumps VCE PDF 70-412 Dumps VCE PDF N10-006 Dumps VCE PDF

300-115 Dumps VCE PDF 70-413 Dumps VCE PDF SY0-401 Dumps VCE PDF

300-135 Dumps VCE PDF 70-414 Dumps VCE PDF





70-464 Dumps VCE PDF






http://www.ensurepass.com/cisco.html

http://www.ensurepass.com/microsoft.html

http://www.ensurepass.com/CompTIA.html









http://www.ensurepass.com/N10-006.html



http://www.ensurepass.com/SY0-401.html

















cisco · ccie security written exam (v5.0) version: 8.0 [ total questions: 443 ] ... it requires...

Documents