Ccie Sec Written Jan 20 - Full Pool

www.writtendumps.
com 350-018 20-JAN-2017
CCIE Written Workbook
CCIE SECURITY WRITTEN
www.PASSWRITTEN.com
WWW.WRITTENDUMPS.COM WWW.PASSWRITTEN.COM
www.writtendumps.com 350-018 20-JAN-2017
1) What are the two enhancements in WCCP V2.0 over WCCP V1.0? (Choose two)
A. Support for HTTP redirection
B. Multicast support
C. Authentication support
D. IPv6 support
E. Encryption support
Answer:B,C
2) What is the unit of measurement of the average rate of a token bucket?

A. Kilobytes per second
B. Bytes per second
C. Kilobits per second
D. Bits per second
Answer:D
3) Which three items does TLS rely on to prove identity .(Choose three)
A. Certificates
B. Password
C. Username
D. Trustpoint
E. Private keys
F. Public keys
Answer:A,E,F
4) Which two statements about the storm control implementation on the switch are true? (Choose two)
A. Traffic storm level is the percentage of total available bandwidth of the port
B. A lower storm control level means more traffic is allowed to pass through
C. Traffic storm control monitors the broadcast, multicast and unicast traffic
D. Traffic storm control monitors only the broadcast traffic
E. Traffic storm level is the rate at which Layer 2 traffic is received on the port
F. Traffic storm level is the rate at which Layer 3 traffic is received on the port
Answer:A C
5) What is the default duration of IPS anomaly detections learning accept mode?
A. 12 hours
B. 48 hours
C. 24 hours
D. 8 hours
Answer: C
6) Which two of the following pieces of the information are communicated by ASA inn version 8.4 or later when
the Stateful Failover is enabled? (Choosetwo)
A. DHCP server address leases
B. Dynamic routing tables
C. Power status
D. NAT translation table
E. User authentication
Answer:B,D
7) Which two options describe the main purpose of EIGRP authentication?
A. To allow faster convergence

B. To identify authorized peers
C. To provide routing updates confidentiality
D. To prevent injection of incorrect routing information
E. To provide redundancy
Answer:B,D
8) Which are the two characteristics of WPA? (Choose two)

A. Implements a key mixing function before passing the initialization vector to the RC4 algorithm
B. Uses a 40-bit key with 24-bit initialization vector
C. Introduces a 64-bit MIC mechanism
D. WPA does not allow pre-shared key mode
E. Makes the use of AES mandatory
Answer:A,C
9) Which three parameters does the HTTP inspection engine use to inspect the traffic on Cisco IOS Firewall?
A. Source address
B. Application
C. Transfer encoding type
D. Minimum header length
E. Request method
F. Destination address
Answer:B,C,E
10) Which command sets the key length for the IPv6 SeND protocol?
A. Ipv6 nd inspection
B. Ipv6 nd ra-interval
C. Ipv6 nd prefix
D. Ipv6 nd secured
E. Ipv6 nd ns-interval
Answer :D
11) Why do you a disk-image backup to perform forensic investigations?
A) This is a secure way to perform a file copy
B) The backup include areas that are used for the data store
D) The backup creates a bit-level copy of the entries disk
E) The backup timestamps the files with the date and time during copy operations.
Answer :D
12) Flow exporter-map Genie1
Version V9
Transport udp 11000
Destination 10.0.255.150
Refer to the exhibit Which configuration is required to enable the exporter?
A) cache timeout active 60
B) source loopback0
C) cache timeout inactive 60
D) next-hop address
Answer :B
13) What action can you to prevent an amplification attack on an IPv6 network?
A)disable the processing of IPv6 type 0 routing headers globally.
B) disable the processing of IPv6 type 2 routing headers globally
C) disable the processing of IPv6 type 2 routing headers between remote routers
D) disable the processing of IPv6 type 1 routing headers on the interface
E)disable the processing of IPv6 type 1 routing headers globally
Answer :A
14)
Refer to the exhibit. Based on the show command output which statement is true?
A) A NAT/PAT device is translating the local VPN endpoint
B) A NAT/PAT device exists in the path between VPN endpoints
C) A NAT/PAT device is translating the remove VPN endpoint
D) No NAT/PAT device exists in the path between VPN endpoints
Answer :B
15) What IPS form factor is best suited to handling heavy traffic between virtualized servers in a data center?
A) FirePower appliance
B) IOS with Firepower services
C) Firepower NGIPSv
D)ASA with FirePower service
Answer :A
16) Drag each goal of PCI DSS on the left to the corresponding PCI DSS requirement on the right.
Answer :A:5,B:4,C:1,D:3,E:2,F:6
17) Which two cipher mechanisms does PCoIP use? (Choose two)
A) Blowfish
B) AES 256
C) Suite B
D) SEAL
E) autokey
F) RC4
Answer :B,C
18) Which three EAP method require a server-side certificate? ( Choose three)
A) EAP-GTP
B) EAP-TLS
C) PEAP with MS-CHAPv2
D) EAP-TTLS
E) EAP-FAST
Answer :B,C,D
19) What protocol does MSDP use to communicate ?
A) TCP 389
B) UDP 389
C) TCP 639
D) UDP 639
E) IP protocol 87
F) IP protocol 90
Answer :C
20) you run the show ipv6 port-map telnet command and you see that the port 23 (system-defined) message and
the port 223 (User-defined) message are displayed which command is in the router configuration?
A) ipv6 port-map port telnet 223
B) ipv6 port-map telnet port 23 233
C) ipv6 port-map telnet port 223
D) ipv6 port-map port 23 port 23223.
Answer :C
21) which three statement are true about cryptographically Generated addresses for IPv6 ? (choose three)
A) the minimum RAS key length is 512 bits
B) The SHA-1 hash function is used during their computation
C) They prevent spoofing and stealing of existing IPv6 addresses
D) SHA of MD5 is used during their computation
E) They are derived by generating a random 128-bit IPv6 address based on the public key of the node
F) They are used for securing neighbor discover using send
Answer :B,C,F
22) The ssl vpn implementation on a cisco ASA adaptive security appliance supports which three of these feature?
A) establishing a winsock 2 connection between the client and the server through smart tunnels
B) sending TCP and UDP traffic through a smart tunnel
C) establishing a winsock 2 connection between the client and the server through port forwarding
D) sending TCP-only traffic through a smart tunnel
E) sending TCP-only traffic through port forwarding
F) sending TCP and UDP traffic through port forwarding
Answer :A,D,E
23) Which ISMS provides the basis for an optional business certification logo program?
A) HIPAA
B) COBIT 5
C) ISO 27001
D) TOGAF
E) ISO 27002
F) NIST 800-53
Answer :C
24) Which statement about SNMP control plane policing is true?
A) SNMP traffic is processed VIA CEF in the data plane
B) SNMP traps are processed by the data plane
C) The Copp SNMP feature can forward and manage traffic during heavy traffic load
D) The SNMP management plane always has a source ip address
Answer :C
25) You run the show ipv6 port-map telnet command and you see that the port 23(system-defined) message and the
port 223 (user-defined) message are displayed which command is in the router configuration?
A) Ipv6 port-map port telnet 223
B) ipv6 port-map port 23 port 23223
C) ipv6 port-map telnet port 223
D) ipv6 port-map telnet port 23 233
Answer :C
26) which statement about the TACACS+ protocol are true?( Choose two)
A) The entire body of a TCACS+ packet is encrypted with the exception of the standard clear-text TACACS+ header
B) Because it uses UDP for transport TACACS+ can detect server crashes out-of-band
C) TACACS+ take advantage of the UDP protocols connection network transport
D) VSAs allow products from other vendors to interoperate with cisco routers that support TACACS+
E) TACACS+ can handle different AAA services on separate servers
F)TACACS+ combines the authentication and authorization functions
Answer :A,D
27) What SNMPv3 command disables descriptive error message?
A) snmp-server usm cisco
B)snmp-server inform
C)snmp-server infindex persist
D)snmp-server trap link switchover
Answer :A
28) What are two important guidelines to follow when implementing VTP? (choose two)
A) All switches in the VTP domain must run the same version of VTP
B) Enabling VTP pruning on a server will enable the feature for the entire management domain
C)CDP must be enable on all switches In the VTP management domain
D) Use of the VTP multidomain feature should be restricted to migration and temporary implementation
E) When using secure-mode VTP configure management domain password only on VTP servers
Answer :A,B
29) What are three features that are enabled by generating change of Authorization (CoA) requests in a push
model?(Choose three)
A) host termination
B) Mac identification
C) session identification.
D) session termination
E) host reauthentication
F) session reauthentication
Answer: C,D,E
30)
Refer to the exhibit. You have configured an NDAC seed switch as shown but the switch is failing to allow other
switch to securely join the domain what command must you add to the seed switchs configuration to enable secure
RADIUS communication?
A)seed-switch(config)#no dot1x system-auth-control
B)seed-switch(config)#aaa authentication dot1x default group local
C)seed-switch(config)#radius-server host 10.1.1.2 auth-port 1812 acct-port 1813 test username ndac-test pac key
cisco123
D)seed-switch(config)#aaapreauth
E)seed-switch(config)#radius-server VSA send accounting
F)seed-switch(config)#radius-server host non-standard
Answer :C
31) Which three parameters does the HTTP inspection engine use to inspect the traffic on Cisco IOS firewall?
A. Source address
B. Application
C. Transfer encoding type
D. Minimum header length
E. Request method
F. Destination address
Answer:B,C,E
32) Of which IPS application is event action rule a component.

A. NotificationAPP
B. InterfaceApp
C. SensorApp
D. Sensor definition
E. MainApp
F. AuthenticationApp
Answer: C
33) Which statement is true regarding Transparent mode configuration on Cisco ASA firewall running version 9.x?
A. Networks connected with the ASA data interfaces must be different subnet for the traffic to flow.
B. Bridge groups are not supported in Transparent Mode.
C. Default route defined on the ASA is only for the management traffic return path
D. You need to make management interface of the ASA as the next hop for the connected devices to establish
reachablity across the ASA.
E. Management Interface does not update the MAC address table.
Answer : C
34) Which two statement about ISO 27001 are true? Choose two.
A. It is closely aligned to ISO 22000 standard
B. it is an ISO 17799 code of practice.
C. It is an information security management systems specification.
D. It is a code of practice for informational social management
E. It was formerly known as BS7799-2
Answer:C,E
35) Which 3 HTTP header fields can be classified by NBAR for request messages. Choose 3.
A. Referrer
B. Content-Encoding
C. User-Agent
D. From
E. Server
F. Location
Answer:A,C,D
36) Which statement about DNS is true

A. In the DNS message header the QR flag set to 1 indicates a Query
B. Query and response messages have different format
C. In the DNS header an Opcode value of 2 represents a server status request.
D. In the DNS header the R code value is set to 0 for format error
E. The client-server architecture is based on push-pull messages.
Answer:C
37) Which statement about VLAN is true?\

A. Vlan cannot be routed
B. The extended-range VLAN cannot be configured in GLOBAL confugration mode.
C. VLAN 1 is a cisco default VLAN that cannot be deleted.
D. VLAN 1006 through 4094 are not propagated by VTP version 3
Answer:C
38) Which two statements about SSL VPN smart tunnels on a CISCO IOS service are True. Choose 2.
A. They are incompatible with split-tunneling
B. They do not support FTP
C. They are incompatible with MAPI proxy
D. They support private socket libraries
E. They can be started in more than one web browser at the same time
Answer: A,C
39) Depending on configuration which 2 behaviors can the ASA classifier exhibit when it receives unicast traffic on
an interface that is shared by multiple contexts. Choose 2.
A. It is classified using the destination address of the packat using the NAT table.
B. It is classified using the destination address of the packet using the connection table.
C. It is classified by coping and sending the packet to all the contexts.
D. It is classified using the destination address of the packet using the routing table.
E. It is classified using the destination MAC address of the packet.
Answer:A,E
40) Which statement is true regarding the packet flow on Cisco ASA firewall running version 8.2?
A. For the packet that has been received on the ingress interface, ACL is also checked if the connection entry
exists for the packet flow.
B. For the packet that has been received on the ingress interface ,translation route is checked before the ACL if
the connection entry for the packet flow does not exist
C. For the packet that has been received on the egress interface ,translation rule is checked before the ACL if
the connection entry does not exist for the packet flow
D. For the packet that has been received on the ingress interface, ACL is only checked if the connection entry
does not exist for the packet flow.
Answer:D
41) Which statement about the fragmentation of IPsec packets in routers is true?
A. By default if the packet size exceeds MTU or ingress physical interface ,it will be fragmented and send
without encrytion
B. By default if the packet size exceeds MTU of the egress physical interface, it will be dropped.
C. By default the router knows the IPSEC overhead to add to the packet performs the lookup of the packet will
exceed egress physical interface IP MTU after encryption, then fragments the packet before encrypting and
separately encrypts the resulting IP fragements.
D. By default the IP packets that needs encryption are first encrypted with ESP, if the resulting encrypted
packets exceeds the IP MTU on the egress physical interface, then the encrypted packet is fragmented
before being send
Answer: D
42) Which MAC address control commands enable usage monitoring for a CAM table on a Switch?
A. MAC address-table synchronize
B. MAC address-table limit
C. MAC address-table secure
D. MAC address-table notification threshold
E. MAC address-table learning
Answer: D
43) Which three statements about SSH v1 and SSH v2 are true. Choose 3.
A. Both SSHv1 and SSHv2 support multiple session channels on a single connection.
B. Both SSHv1 and SSHv2 require a server key to protect the session key
C. Both SSHv1 and SSHv2 negotiate the bulk chipper
D. SSHv2 supports the wider variety of authentication methods than SSHv1
E. Unlike SSHv1, SSHv2 uses separate protocols for authentication connection and transport
F. Unlike SSHv1, SSHv2 supports multiple forms of user authentication in a single session
Answer:C,E,F
44) What technology can secure DNS information in IP networks.

A. A combination of DNS and SSL/TLS
B. A combination of DNS and IPSEC
C. DNS encryption
D. DNSSEC
Answer: D
45) Which set of encryption algorithms is used by WPA and WPA2?

A. Blowfish and AES
B. CAST and RC6
C. TKIP and RC6
D. TKIP and AES
Answer:D
46) In traceroute, which ICMP message indicates that the packet is dropped by a router in the path.
A. Type 11 code 0
B. Type 11 code 1
C. Type 3 code 1
D. Type 3 code 3
E. Type 5 code 1
Answer: A
47) Which of the following statement is true about ARP spoofing attack?
A. Attacker sents ARP request with the MAC address and the IP address of a legitimate resource in the network
B. ARP spoofing doesnot facilitate man in the middle attack for the attacker
C. Attacker sents the ARP request with its own MAC address and IP address of a legitimate resource in the
network
D. Attacket sents APR request with the MAC address and the IP address of its own
Answer:C
48) Attacks can originate from the multicast receivers. Any receivers that sends an IGMP or MLD report typically
caters state on which router?
A. Customer
B. First-HOP
C. Source
D. RP
Answer:B
49) Which 2 values you must configure on the CISCO ASA firewall to support FQDN Acl ? Choose 2.
A. A DNS server
B. An FQDN object
C. A policy map
D. A class map
E. A service object
F. A service polcy
Answer:A,B
50) Which two parameters can the hostscan feature scan before users log in? (Choose two)
A) Whether specific files are present
B) Whether a proxy service is configured on a Linux host
C) Whether a specific keychain entry exists on an OS X host
D) Whether specific IPv4 and IPv6 addresses are assigned
E) Whether specific certificate authorities are configured
Answer : A,E
51)
Refer to the exhibit. Which line in the given configuration contains a locally significant value ?
A) Ip nhrp authentication cisco

B) Ip nhrp holdtime 60
C) Tunnel key 123
D) Ip nhrp network-id 123
E) Ip nhrp map multicast 150.1.1.1
Answer :D
52) What are four technologies that can be used to trace the source of an attack in a network environment with
multiple exit/entry points? (choose four)
A) ICMP unreachable message

B) Traffic scrubbing
C) Sinkholes
D) Netflow v9
E) A honey pot
F) Remotely-triggered destination-based black holing
Answer :B,C,E,F
53)
Referring to the DMVPN topology diagram shown in the exhibit, which two statements are correct? (choose two)
A) Before a spoke-to-spoke tunnel can be build, the spoke router needs to send an NHRP query to the hub
to resolve the remote spoke router physical interface IP address.
B) The spoke router act as the NHRP serves for resolving the remote spoke physical interface IP address.
C) At the spoke A router, the next hop to reach the 192.168.0.0/24 network should be 172.17.0.1.
D) The hub router tunnel interface must have the EIGRP next hop self-enabled.
E) The hub router needs to have EIGRP split horizon disabled.
F) At the Spoke A router ,the next hop to reach the 192.168.2.0/24 network should be 10.0.0.1.
Answer :E,F
54) Which four cisco IOS feature are used to implement Frist hop security in IPv6? (choose four)
A) SeND
B) IPv6 Selective Packet Discard
C) IPv6 First-Hop Security Binding Table
D) IPv6 Device Tracking
E) IPv6 Source Guard
F) IPv6 RA Guard
Answer :A,C,D,F
55) Which two statement about IPv6 Neighbor Solicitation Messages are true? (Choose two.)
A) They are identified by Type value 133 in the ICMP packet header.
B) They are identified by Type value 134 in the ICMP packet header.
C) They elicit a neighbor advertisement message from the destination device.
D) They include the link-layer address of the source device.
E) They are sent to the link-layer address of the destination node.
F) They are sent at a regular interval through the interfaces on a IPv6 device.
Answer :C,D
56) When you enable the same-security-traffic-permit inter-interface command on the ASA, which two statement
about the configuration are true?(Choose two)
A) Traffic can flow between interface at the same security level without an access list
B) by default the outside interface on every ASA is the on every interface to be configured with a name and security
level of 100.
C) Traffic can enter and exit the same interface
D) the configuration will support more than 101 communication interfaces
E) The configuration will support a maximum of 101 communicating interface
Answer :A,D
57) Which two option are operating mode of security group Tag (SGT) Exchange protocol (SXP) peers? (Choose two)
A) neighbor
B) broadcast
C) transmitter
D) listener
E) speaker
Answer :D,E
58) Which two statement about fast SSID changing on a WLC are true? (choose two)
A) It enables a client to move faster between SSIDs
B) It enables a controller to rapidly cycle its SSID to drop rogue connections
C) It enables a clients to move to a new SSID before its previous entry I the controller connection table is cleared.
D) It enforce MIMO on clients
E) If it is disabled while clients are connected to the controller the clients loses communication with othe hosts in the
same VLAN
F) If it is disabled while clients are connected to the controller the clients loses communication with hosts in other
VLANs.
Answer :AC
59) Which two statement about MPP (Management plane protection) are true? (Choose two)
A) it is supported on both active and standby management interfaces.
B) only out-of-band management interface are supported
C) it is supported on both distribute and hardware-switched platforms
D) Only virtual interface associated with physical interfaces are supported
E) Only virtual interface associated with sub-interfaces are supported
F) Only in-band management interface are supported
Answer :D,F
60) Which two statement about port security are true? (Choose two)
A) The secure port can belong to an Etherchannel.
B)When a violation occure on a port in switchport port-security violation restrict mode,theswitchport will be taken
out of service and placed in the err-disabled state
C)The secure port can be a SPAN destination port
D)When a violation occurs on a port in switchport port security violation restrict mode data is restricted and the
switch writes the violation to a log file
E) the secure port must be an access port
F) When a violation occurs on a port in switch port-security violation shutdown mode the switchport will be taken
out of service and placed in the err-disabled state.
Answer :D,F
61) Drag each step in the IPS anomaly detection configuration process on the left into the correct order of orations
on the right
Answer :
Step1 = Create anomaly detection policy
Step2 = Run the sensor in learning accept mode for 24 hours or more to set a baseline
Step3 = Configure anomaly detection zones and protocols
Step4 = Apply the anomaly detection policy to one or more virtual sensors
Step5 = Configure anomaly detection parameters
62) Drag each step in the flow of packet on a DMVPN network using GD OI on the left into the correct sequence on
the right?
Answer :
1: The hub and spoke that are members of the group register with the GDOI key server.
2. Each group member receives the group key from the GDOI key server.
3. An encrypted DMVPN tunnel is established between the hub and spoke using NHRP.
4. A spoke sends the hub an NHRP resolution request.
5. a spoke encrypts traffic with the group key and sends it directly to other spokes.
63) What IPS risk rating allows the user to assign a risk weighting based on the relative importance of the system
involved?
A) Alert severity Rating
B) Target Value rating
C) signature Fidelity rating
D) Attack Relevancy rating
Answer :B
64) Which three statement correctly describe the purpose and oration of IPv6 and RA messages? (Choose three)
A)RS and RA packets are used by the duplicate address detection function of ipv6
B)Ipv6 hosts learn connected router information from RA message Which may be sent in response to an RS message
C)Ipv6 RA message can help host devices perform stateful or stateless address autoconfiguration; RS message are
sent by host to determine the address of routers
D) Both IPv6 RS and RA packets are ICMPv6 messages
E)RS and RA packets are always sent to an all-nodes multicast address
F)RS and RA packet are used for IPv6 nodes to perform address resolution that similar to ARP in IPv4
Answer :B,C,D
65) which protocol is an extension to SSH 2.0 that provides security for data traffic?
A) TKIP
B)SFTP
C)Kerberos
D)AES
Answer :B
66) Which statement regarding the routing functions of the cisco ASA is true?
A) The translation table can override the routing table for new connections
B) in a failover pair of ASAs the standby firewall establish a peer relationship with OSPF neighbours
C)The ASA support policy-based routing with route maps
D) Routes to the Null0 can be configured to black-hole traffic.
Answer :A
67) Which three options are components of mobile IPv6?(Choose three)
A) Discovery probe
B)Home agent
C)biding node
D) correspondent node
E) mobile node
Answer :B,D,E
68) Which four statements about SeND for IPv6 are correct? (Choose four.)
A) It provides a method for secure default router election on hosts.
B) It protects against rogue RAs.
C) NDP exchanges are protected by IPsec SAs and provide for anti-reply.
D) It defines secure extension for NDP.
E) Neighbour identity protection is provided by Cryptographically Generated Addresses that are derived from a
Diffie-Hellman key exchange.
F) It authorizes routers to advertise certain prefixes.
G) It is facilitated by the certification Path request and certification path response ND message.
Answer :A,B,D,F
69) Which command enables fast-switched PBR?
A) Router(config-if)# ip policy route-map map-tag.
B) Router(config-if)# no ip route-cache policy.
C) Router(config-if)# no ip policy route-map map-tag.
D) Router(config-if)# ip route-cache policy.
Answer :D
70)
Refer to the exhibit. Which statement about the effect of this command is true?
A) It lists the number of packets processed for unknown and unclassified flows.
B) It lists traffic that is packet switched and bypassed by NBAR.
C) It displays the link ag for unknown and unclassified flows.
D) It lists the current protocol-to-port mappings for NBAR.
E) It lists the attributes configured for unknown and unclassified flows.
Answer :E
71) What is an RFC 2827 recommendation for protecting your network against DoS attacks with IP address spoofing
?
A) Use ingress traffic filtering to limit traffic from a downstream network to known advertised prefixes.
B) Advertise only assigned global IP addresses to the internet.
C)Browser-based applications should be filtered on the source to protect your networkfrom known advertised
prefixes.
D) Use the TLS protocol to secure the network against eavesdropping.
Answer :A
72) Which three nonproprietary EAP methods do not require the use of a client-side certificate for mutual
authentication? (Choose three)
A) EAP-TTLS
B) EAP-TLS
C) LEAP
D) EAP-FAST
E) PEAP
Answer :A,D,E
73)Which three statements about remotely triggered black hole filtering are true? (Choose three.)
A)It uses BGP or OSPF to trigger a network-wide remotely controlled response to attack
B)ICMP unreachable message must not be disable on all edge PE router peered with the trigger router
C) it require loose uRPF for destination based filtering
D) Three key components of an RTBH filtering solution are: uRPF, iBGP and a null0 interface
E)It support both source-based ad destination-based filtering
F) It can be used to migrate DDOs and worm attacks
Answer :B,D,E
74) Which three statement are true regarding the eigrp update message?(Choose three)
A)ACKs for update are handled by TCP mechanisms
B)Update always include all routes know by the router with update send in the reply message
C)Update require an acknowledgement with an ACK message
D)Update can be sent to the multicast address 224.0.0.10
E)Updates are sent as unicasts when they are retransmitted
Answer :C,D,E
75)Which two option are Cisco-recommend best practices for provisioning QoS for Scavenger-class traffic?(Choose
two)
A) It should be assingned a lower DHCP value than best effort
B) It should be marked as DSCP CS1 to mitigate DoS attacks
C) It should be assigned a higher CBWfQ percentage than bulk data
D) It should be assigned a higher CoS then bulk data
E) It should be assigned a higher CBWFQ percentage than best effort
F) It should be assigned the lowest possible CBWFQ value
Answer :B,F
76) Which two feature are supported in CBAC on IPV6?(Choose two)
A)Inspection of packets on nonstandard ports
B) Intrusion detection system inspection
C) Inspection of tunnel packets in transit
D) Inspection of fragmented packets
E)Inspection of encrypted packets
Answer :C,D
77) Which two IP multicast addresses belong to the group represented by the mac address0x01-005E-15-6A-2c?
(choose two)
A)224.21.106.44
B)224.25.106.44
C)233.149.106.44
D)239.153.106.44
E)236.25.106.44
Answer :A,C
77)Using Cisco IOS,Which two object-group option will permit network10.1.1.0/24 and 10.1.2.0/24 to host
192.168.5.1 port 80 and 443?(Choose two)
Answer :A,C
78) Drag and drop the web attack types from the left to the corresponding description of the attack on the right.?
Answer :A:2,B:1,D:5,C:3,E:4
79) Which two of these are thing on attacker can do with an encrypted RC4 data stream? (Choose two)
A) filter out the keystream if the attacker gets two stream encrypted with the same RC4 key
B) use XOR to match the encrypted stream to itself in order to retrieve the key
C) retrieve the private key if the attackers has access to the public key
D) flip a bit of the encrypted text which will flip a corresponding bit in the cleartext once it is decrypted.
E) Calculate the checksum of the encrypted stream.
Answer :A,B
80) Which three of these statement about a zone-based policy firewall are correct?(choose three)
A) By defult all traffic to and from an interface that belong to a security zone is dropped unless explicity allowed in
the zone-pair policy.
B) Firewall policies,such as the pass,inspect and drop action can only be applied between two zones
C) An interface can be assigned to only one security zone
D) Traffic cannot flow between a zone member interface and any interface that is not a zone member.
E) In order to pass traffic between two interface that belong to the same security zone, you must configure a pass
action using class-default.
Answer :B,C,D
81)
Refer to the exhibit. Which two statement about the effect of the given Cisco IOS configuration are true?( Choose
two)
A) the maximum number of half-open sessions is 400
B) the idle timeout for UDP connection is 20 minutes
C) the maximum number of half-open sessions is 600.
D) The software will delete half-open sessions if more than 600 new sessions are established per minute.
E) the half-open session timeout is 20 minutes.
Answer :A,D
82) Which three basic security measure are used to harden MSDP? (Choose three)
A)MSDP MD5 neighbor authentication
B) MSDP state limitation
C) MSDP neighbor limitation
D) loopback interface as MSDP originator-ID
E) MSDP SA filters
Answer :A,B,E
83) Drag each dacl entry on the left to the type of access it allows on the right
Answer:
84) Drag and drop the components of a Teredo IPv6 packet from the left to the correct position in the packet on the
right
Answer :
IPv4: Fourth
IPv6 : first
Origin indication: second
UDP: third
85)
Refer to the exhibit. What is the effect of the given command?
A. It enables MPP on the FastEthernet 0/0/ interface, allowing only SSH and SNMP management traffic
B. It enables QoS policing on the control plane of the FastEthernet 0/0/ interface
C. It enables MPP on the FastEthernet 0/0 interface for SSH and SNMP management traffic and CoPP
for the other protocols
D. It enables MPP on the FastEthernet 0/0 interface by enforcing rate-limiting for SSH and SNMP
management traffic
E. It enables CoPP on the FastEthernet 0/0/ interface for SSh and SNMP management traffic
Answer: A
86)What are two control-plane protection features provided by CPPr? (Choose two)
A. All traffic traversing the router undergoes aggregate policing at the control plane host subinterface
B. All control-plane CDP and ARP traffic is received and managed on the control plane host subinterface
C. All control-plane IP traffic is received and managed on the control plane transit subinterface
D. The number of packets allowed in the control plane IP input queue can be managed by queue thresholding
limits
E. When the port-filtering features is enabled, packets that are send to closed TCP ports are dropped prior to
processing
F. The control plane transit subinterface is protected by the port-thresholding features
Answer: A, C
87) Which two statements about traffic storm control are true? (Choose two)
A. It can be configured on the port-channel interface

B. When the traffic storm control bandwidth percentage is set to percent . Only administrative traffic is passed
C. It can be configured on the individual interfaces that are members of a port-channel
D. If you enable both broadcast and multicast storm control and either type of traffic exceeds the configured
traffic storm control level, both types of traffic are dropped for the rest of the control interval
E. Traffic storm control is triggered when the traffic level over a one-minute interval exceeds the configured
percentage of the ports total available
F. When the traffic storm control bandwidth percentage is set to 100 percent, all traffic on the interface is
blocked
Answer : A, F
88) What are the three flag bits in an IPv4 header? (Choose three)
A. Timestamp
B. MF
C. DF
D. Record Route
E. Unused
F. TTL
Answer : B,C,E
89) Which signature engine is used to create a custom IPS signature on a Cisco IPS appliance that triggers when a
vulnerable web application identified by the /runscript URI is run?
A) AIC HTTP
B) META
C) Atomic IP
D) String TCP
E) service HTTP
F) Multi-string
Answer :E
90) Which four of these attacks of wireless tools can the standard IDS signature on a wireless LAN controller detect?
(Choose four)
A) SYn flood
B) AirSnort
C)NEtstumbler
D) long HTTP request
E) Deauthorization flood
F) Fragment overlap attack
G) Wellenreeintire
H) Association flood
Answer :C,E,G,H
91) All of these are predefined reports in the cisco IPS manger Express (Cisco IME) GUI expect which one?
A) Top application report
B) Top attacker report
C) Attack overtime Report
D) Top Victims Report
E) Top Signature Report
Answer :A
92) What Cisco IOS feature prevent an attacker from filling up the MTU cache for locally generate traffic when using
path MTU discovery?
A) Force all traffic to send 1280-Byte packets by hard coding the MSS
B) Always use packets of 1500-bytes size or larger
C) Enable flow-label marking to track packet destination
D) Enable flow-label switching to track IPV6 packets in the MPLS cloud
E) Use NetFlow information to export data to a workstation
Answer :C
93) Which of these is an invalid SYSLOG facility?

A. 0
B. 1
C. 31
D. 12
Answer:C
94) Which statement about SOX is true?
A. Section 404 of SOX is related to non IT compliance

B. It is a US law
C. It is an IEFT compliance procedure for computer systems security
D. It is an IEEE compliance procedure for IT management to produce audit reports
E. It is a private organization that provides best practice for finanacial institution computer systems
Answer:B
95) Which statement is true about the PKI deployment using Cisco IOS devices?
A. During the enrollment CA or RA signs the client certificate request with its public key
B. RA is capable to publish the CRLs
C. Peers use private keys in there certificates to negotiate IPSEC SAs to established a secure channel.
D. RA is used for accepting the enrollment requests
E. Certification revocation is not supported by SCEP protocol.
Answer :D
96) What is Cisco CKM (Centralized key management) used for?

A. To allow an Access Point to act as a TACACS server to authenticate the client
B. To avoid configuring PSKs preshared key locally on network access devices and configure PSKs once on
radius server
C. To provide switch port security
D. To allow authenticated client devices to roam from one AP to another without any perceptible delay
during reassociation
Answer:D
97) Which statement about the infrastructure ACL on Cisco IOS software is true?
A. They are used to protect the device forwarding path
B. They are used to protect the device management and internal link addresses
C. They are used to authorize the transit the traffic
D. They only protect device physical management interface
Answer:B
98) Which two statement about ASA transparent mode are true? Choose two.
A. It drops ARP traffic unless it is permitted
B. It doesnot support NAT
C. It requires inside and outside interface to be in different subnets
D. It can pass IPv6 traffic
E. It cannot pass multicast traffic
F. It supports ARP inspection
Answer:D,F
99) Which ICMP message type code indicates that fragment reaasembly time has exceeded?
A. Type 11 code 0
B. Type 11 code 1
C. Type 12 code 2
D. Type 4 code 0
Answer:B
100) What are the 2 authentication algorithms supported with SNMP v3 on an ASA? Choose 2.
A. 3DES
B. DES
C. SHA
D. RC4
E. MD5
F. RC5
Answer:C,E
101) Which two statements about NHRP are true?(Choose 2)

A. NHRP provides Layer-2 to Layer-3 address mapping
B. NHRP allows NHS to dynamically learn the mapping of VPN IP to BMA IP

C. NHRP is used for broadcast multi access networks
D. NHRP allows NHC to dynamically learn the mapping of VPN IP to NBMA IP
E. Traffic between two NHCs always flows through the NHS
F. NHC must register with NHS
Answer:D,F
102) Which two statements about the BGP backdoor feature are true? Choose 2
A. It makes IGP learned routes preferred over eBGP learned routes
B. It makes iBGP learned routes preferred over IGP learned routes
C. It changes the eBGP administrative distance from 20 to 200
D. It makes eBGP learned routes preferred over IGP learned routes
E. It changes the eBGP administrative distance from 200 to 20
F. It changes the iBGP administrative distance from 200 to 20
Answer:A,C
103) Which statement describes the computed authentication data in the AH protocol?
A. It is part of the original IP header
B. It is send to peer
C. It is part of new IP header
D. It provides integrity only for the new IP header
Answer: B
104) Which two options describe how the traffic for the shared interface is classified in ASA multicontext mode?
Choose 2
A. At the destination address in the packet
B. At the destination address in the context
C. By copying and sending the packet to all the contexts
D. At the source address in the packet
E. By sending the MAC address for the shared interface
Answer:B,E
105) Which option describes the main purpose of EIGRP authentication?
A. To allow faster convergence

B. To authenticate peers
C. To avoid routing table corruption
D. To provide redundancy
Answer:B
106) Which two statements about RFC 2827 are true? Choose 2
A. It defines egress packet filtering to safeguard against IP spoofing
B. It defines ingress packet filtering to defeat DoS that uses IP spoofing
C. It is endorsed by IETF in BCP 38
D. A corresponding practice is documented by the IETF in BCP 84
E. It defines ingress packet filtering for the multihomed network
Answer:C,D
107) Which statement about ISO/IEC 27001 is true?

A. It was reviewed by the international organization for standardization
B. It was published by ISO/IEC
C. It is only intended to report security breaches to the management authority
D. It was reviewed by the international electro technical commission
E. It is intended to bring information security under management control
Answer: C
108) Which two statements about PCI DSS are true? Choose two
A. It is an IETF standard for companies to protect credit, debit and ATM cardholder information
B. It is a proprietary security standard that defines a framework for credit, debit and ATM cardholder
information
C. It is a criminal act of cardholder information fraud
D. It is a US government standard that defines ISP security compliance
E. It has as one of its objectives to restrict physical access to credit, debit and ATM cardholder information
Answer:B,E
109) What is the purpose of the BGP TTL security check?

A. To authenticate a peer
B. To use for iBGP SESSION

C. To protects against CPU utilization based attacks
D. To protect against routing table corruption
E. To check for a TTL value in packet header or less than or equal to for successful peering
Answer:C
110) Which two statements about the RC4 algorithm are true? Choose two
A. The RC4 algorithm is an asymmetric key algorithm
B. In the RC4 algorithm, the 40-bit key represents four characters of ASCII code
C. The RC4 algorithm is faster in computation than DES
D. The RC4 algorithm uses variable-length keys
E. The RC4 algorithm cannot be used with wireless encryption protocols
Answer:C,D
111) Which two statements about VTP passwords are true? Choose 2
A. The VTP password can only be configured when the switch is in client mode
B. The VTP password is hashed to preserve authenticity using the MD5 algorithm
C. The VTP password is encrypted for confidentiality using 3DES
D. The VTP password can be configured only when the switch is in server mode
E. The VTP password is sent in the summary advertisements
Answer:B,E
112) Which statement about the firewall attack is true?

A. It uses ICMP sweep to find expected hosts behind a firewall
B. It uses TTL handling to determine whether packets can pass through a packet-filtering device
C. It is used to find vulnerability in the Cisco IOS firewall code
D. It is used to discover hosts behind a firewall device
E. It uses ICMP sweep with a predetermined TTL value to discover hosts behind a firewall
Answer:E
113) An RSA key pair consists of a public key and a private key and is used to set up PKI. Which statement applies
to RSA and PKI?
A. The public key must be included in the certificate enrollment request
B. The RSA key-pair is a symmetric cryptography

C. It is possible to determine the RSA key-pair private key from its corresponding public key
D. When a router that does not have an RSA key pair requests a certificate, the certificate request is sent, but a
warning is shown to generate the RSA key pair before a CA signed certificate is received.
Answer:A
114) For what reson has the IPv6 Type 0 Routing Header been recommend for depreciation?
A. When a type 0 traffic is blocked by a firewall policy, all other traffic with routing headers is dropped
automatically
B. It can conflict with ingress filtering
C. It can create a black hole when used in combination with other routing headers
D. Attackers can exploit its functionality to generate DoS attacks
Answer:D
115) For which reason would an RSA key pair need to be removed?
A. The CA is under DoS attack
B. The CA has suffered a power outage
C. The existing CA is replaced and the new CA requires newly generated keys
D. PKI architecture would never allow the RSA key pair removal
Answer: C
116) Which two statement about the 3DES encryption algorithm are true? (Choose two)
Answer: B , E
117) Which three IPv6 tunneling methods are point-to-multipoint in nature? (Choose three)
Answer : C, D ,E
118) You have implemented a private VLAN to limit access between hosts on the same VLAN but the secondary
VLAN you created are still visible to other switches on the VTP version 2 domain What is the most efficient
action can you take to correct the problem?
Answer : A
119)
Refer to the exhibit, what is the effect of the given service policy configuration?
A) It block cisco com, msn com ,and facebook.com and permits all other domains.
B) IT block facebook.com, msn.com, Cisco.com and google.com and permit all other domains.
C) It block all domains except cisco.com msn.com, and facebook.com
D) It block all domains except facebook.com, msn.com,cisco.com and google.com.
Answer : C
120) Which two statement about RADIUS VSA are true?(Choose two)
Answer : B , C
121) What is an example of a stream cipher?
A) RC4
B) Blowfish
C) DES
D) RC5
Answer : A
122) Assessing your network for potential security risks (risk assessment)should be an integral elements of your
network architecture. Which four task items need to be performed for an effective risk assessment and to
evaluate network posture?(Choose four)
Answer : A , C , E, G
123)
Refer to the Exhibit. What is the effect of the given Configuration?
A) It disable the IPsec anti-reply feature only for SAs that were created using the ANTI_Reply crypto map.
B) It disable the IPsec anti-reply feature only for SAs on the device.
C) It sets security association to a maximum hold time and disables association for new security connections.
D) It sets security association to a minimum hold time and disables association for new security connection.
Answer : A
124) What are the three scanning engines that the Cisco IronPort dynamic vectoring and streaming engine can
use to protect against malware? (Choose three)
A. F-Secure
B. McAfee
C. Sophos
D. Webroot
E. Symantec
F. TrendMicro
Answer: B, C, D
125) Which standard prescribes a risk assessment to identify whether each control is required to decrease risks
and if so, to which extent it should be applied?
A. ISO 27001
C. ISO 17799
D. HIPPA
E. ISO 9000
Answer: A
126) All of these are available from Cisco IPS Device manager (Cisco IDM) except Which one ?
Answer : E
127) When you are configuring QoS on the Cisco ASA appliance, which four are valid traffic selection criteria?
(Choose four.)
A. VPN group
B. tunnel group
C. IP precedence
D. DSCP
E. default-inspection-traffic
F. qos-group
Answer: B, C, D, E
128) Which feature on the Cisco ASA uses domain and IP-address blacklists to enforce security?
Answer : B
129) Drag each IPS events action on the left to its description on the right?
Answer :
Deny attacker in-line: Drop the current packet and all additional packets from the same ip address for a
configurable period of time
Deny attacker service pair inline: Drop the current packet and all additional packets from the same ip address to
the same destination port for a configurable period of time
Deny attacker victim pair inline: Drop the current packet and all additional packets from the same ip address to
the same destination ip address for a configurable period of time
Deny connection inline: Drop the current packet and any subsequent on the same tcp flow
Deny packet inline:Drop the current packet only
130)
Refer to the exhibit which statement about the result of the given configuration is true?
Answer : B
131) A DNS client that sends DNS massage to obtain information about the requested domain name space is
known as which of these?
Answer : E
132) What ICMPv6 massage type does an IPv6 host use to inform other hosts about its fragmentation
requirements?
Answer : B
133) When applying MD5 route authentication on routers running RIP or EIGRP Which two important key chain
consideration should be accounted for?(Choose two)
Answer : A C
134)
Refer to the Exhibit What feature does the given configuration implement?
Answer : D
135) Drag and drop the desktop-security terms from the left onto their right definitions on the right?
Answer :
governance = directing and controlling information and communications technology

penetration testing = using hacking techniques to attempt to bypass existing security
phishing = attempting to elict information from users by sending targeted emails

SSO = allowing users to sign in to multiple systems without reentering their credentials
two factor authentication = using more than one mechanism to verify a user login
136) Which encapsulation technique does VXLAN use?

A. MAC in TCP
B. MAC in MAC
C. MAC in UDP
D. MAC in GRE
Answer:C
137) Which three statements about Dynamic ARP inspection on Cisco switches are true?
A. The trusted database can be manually configured using the CLI
B. Dynamic ARP inspection does not perform ingress security checking
C. DHCP snooping is used to dynamically build the trusted database
D. Dynamic ARP inspection checks ARP packets against the trusted database
E. Dynamic ARP inspection is supported only on access ports
F. Dynamic ARP inspection checks ARP packets on trusted and untrusted ports
Answer:A,C,D
138) What are the two limitation of the Atomic IP advanced engine? Choose two.
A. It has limited ability to check the fragmentation header
B. It is unable to fire high-severity alerts for known vulnerabilities
C. It is unable to detect IP address anomalies, including IP spoofing
D. It is unable to inspect packets length fields for bad information
E. It is unable to detect layer 4 attacks if the packet are fragmented by IPv6
Answer: A,E
139) Which statement about the Cisco Secure ACS solution engine TACACs + Av pair is true?
A. AV pairs must be enable only on cisco secure ACS for successful implementation
B. AV pairs are only strings values

C. The Cisco secure ACS solution engine does not support accounting AV pairs
D. AV pairs are of two types : String and Integer
Answer:B
140) Which two statements about NEAT are true. Choose two.
A. NEAT supports standard ACLs on the switch port
B. NEAT is not supported on an etherchannel port
C. NEAT should be deployed only with auto configuration
D. NEAT uses CISCP, client information signaling protocol to propagate client IP addresss
E. NEAT is supported on an etherchannel port
Answer:B,C
141) What are two advantages of SNMPv3 over SNMPv2C? Choose two.
A. Integrity, to ensure that data has not been tampered with in transit
B. No source authentication mechanism for faster response time
C. Packet replay protection mechanism removed for efficiency
D. GETBULKREQUEST capability, to retrieve large amount of data in a single request
E. Confidentiality via encryption of packets, to prevent man-in-the-middle-attack
Answer:A,E
142) When attempting to use basic http authentication to authenticate a client, which type of http message
should the server used?
A. HTTP 302 with an authentication header
B. HTTP 401 with a WWW-authenticate header
C. HTTP 407
D. HTTP 200 with a WWW-authenticate header
Answer:B
143) What is the range of valid stratum numbers for NTP when configuring a cisco IOS device as an authoritive
NTP server?
A. 0 to 16
B. 1 to 15
C. 0 to 4
D. 1 to 16
Answer: B
144) Which statement about the DH group is true?

A. It provides data confidentiality
B. It does not provide data authentication
C. It is negotiated in IPSEC phase 2
D. It establishes a standard key over a secured medium
Answer:B
145) Your co-worker is working on project to prevent DDOS and ingress filtering and needs advice on the
standard an associated process for a single home network. Which two option do you suggest?
A. RFC 5735
B. RFC 3704
C. BCP 84
D. BCP 38
E. RFC 2827
Answer:D,E
146) In the IPv6 address 2001 DB8 130F::870::140:B/64 which portion is the IPv6 interface identifier?
A. 2001:DB8:130F:0
B. 870:0:140B
C. 2001:DB8:130F
D. 0:870:0:14B
Answer: D
147) Which three fields are parts of the AH header? Choose three.
A. Destination address
B. Source address
C. Protocol ID
D. NEXT header
E. Packet ICV
F. SPI identifying SA
G. Application port
Answer:D,E,F
148) Which statement is true about Cisco ASA interface monitoring?

A. ASA does not clear the received packets count on the monitoring interface before running the tests
B. Interfaces of the same context cannot be monitored
C. It is possible to configure a context to monitored a shared interface
D. If the monitored interface has both IPv4 and IPv6 addresses then it cannot be monitored
Answer:C
149) Which two ESTMP commands are supported by the ASA inspection engine? Choose two.
A. SOML
B. LINK
C. VERB
D. ONEX
E. ETRN
F. ATRN
Answer:A,E
150) Which two statement about the ISO are true? Choose two.
A. Correspodant bodies are small countries with there own standards organization
B. Only member bodies have voting rights
C. The ISO has three membership categories- Member, correspondant and subscriber
D. The ISO is government based-organization
E. Subscriber members are individual organisations
Answer:B,C
151) Which statement is valid regarding SGACL?

A. SGACL mapping and policies can only be manually configured
B. Dynamically downloaded SGACL doesnot override manually configured conflicting policies
C. SGACL is access-list bound with a range of SGTs and DGTs
D. SGACL is not a role based access-list
Answer: C
152) Of which IPS application is event store a component ?

A. Interface APP
B. Authentication APP
C. Sensor APP
D. Notification APP
E. Main APP
Answer: E
153) Which statement describe RA?
A. RA is not responsible to verify to users request for digital certificate

B. RA is part of private key infrastructure
C. RA has the power to accept registration requests and to issue certificate
D. RA only forwards the requests to the CA to issue certificates
Answer:D
154) Which statement about the Cisco ASA operation running version 8.3 is true?
A. The interface and global access-lists both can be applied in the input or output direction
B. NAT control is enabled by default
C. The interface access-list is matched first before the global access-lists
D. The static CLI command is used to configure static NAT translation rules
Answer:C
155) For which router configuration is the attack-drop.sdf file recommended?

A. Router with less than 128 MB of memory
B. Router with less than 64 MB of memory
C. Router with atleast 128 MB of memory
D. Router with atleast 192 MB of memory
E. Router with atleast 256 MB of memory
Answer: A
156) Which Cisco IOS IPS signature action denies and attacker session using the Dynamic access-list?
A. Deny-packet-inline
B. Reset-TCP-action
C. Deny-connection-inline
D. Produce-Alert
E. Deny-session-Inline
F. Deny-attacker-inline
Answer:C
157) Which signature engine would you choose to filter for the regex [aA][tT][tT][aA][cC][kK] in the URI field of
the HTTP header?
A. Atomic IP
B. Service HTTP
C. AIC HTTP
D. String TCP
Answer:B
158)
Refer to the exhibit. Against which type of the given configuration protect?
A. Pharming
B. Botnet Attack
C. Phishing
D. DNS Hijacking
E. DNS cache poisoning
Answer: B
159)
Answer:
1-C,2-A,3-D,4-B
160)
Answer:
1-D,2-B,3-A,4-C
161)
Refer to the exhibit. Which option describe the behavior of this configuration ?
A. The switch initiates the authentication

B. The client initiates the authentication
C. The device performs subsequent IEEE 802.1x authentication if it passed MAB authentication. If the
device failed IEEE 802.1x it will start MAB again.
D. Devices that perform IEEE 802.1x should be in MAC address database for successful authentication
E. IEEE 802.1x devices must authenticate via MAB to perform via subsequent IEEE 802.1x
authentication. If 802.1x fails the device is assigned to the guest VLAN.
Answer: C
162)
Refer to the exhibit, After setting the replay window size on your Cisco Router, you received the given system
message. What is the reason for the messge?
A. The replay window size is set too low for the number of packets received.
B. The IP-sec antireplay feature is enable, but the window size feature is disabled.
C. The IPSec anti-replay feature is disabled.
D. The replay window size is set too high for the number of packets received.
Answer: A
163)
Refer to the exihibit. Which option is the reason for the failure of the DMVPN session between R and R2?
A. Incorrect tunnel source on R1

B. IPsec phase 1 policy mismatch
C. Tunnel mode mismatch
D. IPSec phase 2 policy mismatch
E. IPSec phase 1 configuration missing peer address on R2
Answer: B
164)
Refer to the exhibit. Which two statements correctly describe the debug output? (Choose two)
A. The remote VPN address is 180.10.10.1

B. The message is observed on the NHS
C. The message is observed on the NHC
D. The remote routable address is 91.91.91.1
E. The local non-routable address is 20.10.10.3
F. The NHRP hold time is 3hrs.
Answer:A,C
165)
Refer to the exihibit. Which three description of the configuration are router?
A. The configuration is on NHS

B. The tunnel IP address represent the NBMA address
C. This tunnel is a point-to-point GRE tunnel
D. The tunnel is not providing the peer authentication
E. The configuration is on the NHC
F. The tunnel encapsulates multicast traffic
G. The tunnel provides data confidentiality
Answer: A,F,G
166)
Answer:1-B,2-A,3-D,4-C
167)
Answer:1-B,2-B,3-C
168)
Refer to the exhibit. Why does the easyVPN session fail to establish between client and the server?
A. Incomplete ISAKMP profile configuration on the server

B. Incorrect ACL in the ISAKMP client group configuration
C. Incorrect IPSEC Phase 2 configuration on the server
D. Incorrect group configuration on the client
E. ISAKMP key mismatch
Answer: C
169)
Refer to the exihibit. Why there is no encrypted session between host 10.10.10.1 and 20.20.20.1 ?
B. Incorrect or missing virtual-template configuration on the client

C. Incorrect or missing phase 2 configuration on the server
D. Incorrect or missing phase 1 configuration on the server
E. Incorrect or missing group configuration on the server
F. Incorrect or missing group configuration on the client
G. Incorrect or missing Virtual-Template configuration on the server
Answer:A
170)
Answer: C
171)
Answer: A
172)
Answer: B
173)
Answer:A
174)
Answer: A,F
175)
Refer to the exhibit. You have determined that RouterA is sending a high number of fragmented packets from the s0
interface to the Web server, causing performance issues on RouterA. What configuration can you perform to send
the fragmented packets to the workstation at 10.0.0.2 for analysis?
Answer : F
176) Which two statements about 802.1x authentication with port security are true ? (Choose two )
A. 802.1x manages network access for all authorized MAC address
B. If any host causes a security violation, the port is immediately error-disabled
C. If any client causes a security violation , the port is immediately placed in spanning-tree disabled mode
D. An entry is created in the secure host table for any client that is authenticated and manually configured for
port security, even if the table is full
E. If a client is authenticated and port security table is full, the oldest client is aged out
Answer : A, E
177) Which of the following are two valid TLS message content types ? ( Choose two)
A. Application data
B. DynamID
C. Proxy
D. Identity
E. Alert
F. Notification
Answer : A, E
178) Which two statements about PIM-DM are true ? (Choose two )
A. It delivers multicast traffic only when the data is explicitly requested
B. It forwards data packets on the shared distribution tree
C. It is most efficient when the network uses active receivers on every subnet
D. It requires a rendezvous point
E. It uses a unicast routing table to perform the RPF check
Answer : C, E
179) What are two of the valid IPv6 extension headers ? (Choose two)
A. Mobility
B. Options
C. Authentication Header
D. Hop Limit
E. Protocol
F. Next Header
Answer : A, C
180) Why do you use a disk-image backup to perform forensic investigations ?

A. The backup timestamps the files with the date and time during copy operations
B. The backup includes areas that are used for the data store
C. This is a secure way to perform a file copy
D. The backup creates a bit-level copy of the entire disk
Answer : D
181) Which two ICMP types must be allowed in a firewall to enable trace routes through the firewall ? (Choose
two)
A. ICMP type=3, code=12
B. ICMP type=5, code=1
C. ICMP type=5, code=0
D. ICMP type=3, code=3
E. ICMP type=11, code=1
F. ICMP type= 11, code=0
Answer : D , F
182) Which three multicast features are supported on the Cisco ASA? (Choose three.)
A. NAT of multicast traffic

B. IGMP forwarding
C. PIM dense mode
D. PIM sparse mode
E. Auto-RP
Answer : A, B ,D
183) What are two functions that ESMTP application inspection provides when enabled on the ASA ? (Choose
two)
A. It supports extended SMTP commands, such as ONEX, and VERB
B. It protects the network from SMTP aplication inspection and phishing attacks
C. It supports both SMTP and ESMTP sessions
D. It scans MAIL and RCPT commands for invalid characters and other anomalies
E. It generates an audit trail when it rejects invalid commands
F. It supports private extensions
Answer :C, D
184) Which command enables fast-switched PBR?
Router(config-if)# no ip route-chache policy

Router(config-if)# ip policy route-map map-tag
Router(config-if)# no ip policy route-map map-tag
Router(config-if)# ip route-chache policy
Answer : D
185) Which Category to Protocol mapping for NBAR is correct?
A. Category: Enterprise Applications

Protocol: Citrix ICA, PCAnywhere, SAP, IMAP
B. Category: Internet
Protocol: FTP, HTTP, TFTP
C. Category: Network Management

Protocol: ICMP, SNMP, SSH, Telnet
D. Category: Network Mail Services

Protocol: MAPI, POP3, SMTP
Answer : B
186) Which configuration is the correct way to change a GET VPN Key Encryption Key lifetime to 10800 seconds
on the key server?
A. crypto isakmp policy 1

lifetime 10800
B. crypto ipsec security-association lifetime seconds 10800
C. crypto ipsec profile getvpn-profile

set security-association lifetime seconds 10800
!
crypto gdoi group GET-Group
identity number 1234
server local
sa ipsec 1
profile getvpn-profile
D. crypto gdoi group GET-Group

server local
rekey lifetime
seconds 10800
E. crypto godi
group GET-Group
identity number
1234
server local
set security-association lifetime seconds 10800
Answer : D
187) How can the tail drop algorithm support traffic when the queue is filled?
A) It drop older packet with a size of 64 byts or more until queue has more traffic
B)It drop older packet with a size of less than 64 byts until queue has more traffic
C) It drops all new packets until the queue has room for more traffic
D) It drops older TCP packets that are set to be redelivered due to error on the link until the queue has room for
more traffic.
Answer : C
188) Which three options are components of Mobile IPv6? (Choose three.)
A. home agent
B. correspondent node
C. mobile node
D. binding node
E. discovery probe
Answer : A, B ,C
189) What command can you use to display the number of malford messages received by a DHCP server ?
A. show ip dhcp conflict

B. show ip dhcp server statistics
C. show ip dhcp relay information trusted-sources
D. show ip dhcp database
E. show ip dhcp binding
Answer : B
190) Which three EAP methods require a server-side certificate? (Choose three.)
A. PEAP with MS-CHAPv2
B. EAP-TLS
C. EAP-FAST
D. EAP-TTLS
E. EAP-GTP
Answer: A, B, D
191) Which four Cisco IOS features are used to implement First Hop Security in IPv6? (Choose four.)
A. IPv6 First-Hop Security Binding Table
B. IPv6 Device Tracking
C. IPv6 RA Guard
D. SeND
E. IPv6 Selective Packet Discard
F. IPv6 Source Guard
Answer: A, B, C, D
192) Which signature engine is used to create a custom IPS signature on a Cisco IPS appliance that triggers when a
vulnerable web application identified by the "/runscript.php" URI is run?
A. AIC HTTP
B. Service HTTP
C. String TCP
D. Atomic IP
E. META
F. Multi-String
Answer: B
193) Given the IPv4 address 10.10.100.16, which two addresses are valid IPv4-compatible IPv6 addresses? (Choose
two.)
A. :::A:A:64:10
B. ::10:10:100:16
C. 0:0:0:0:0:10:10:100:16
D. 0:0:10:10:100:16:0:0:0
Answer: B, C
194) Which three statements correctly describe the purpose and operation of IPv6 RS and RA messages? (Choose
three.)
A. Both IPv6 RS and RA packets are ICMPv6 messages.
B. IPv6 RA messages can help host devices perform stateful or stateless address autoconfiguration; RS messages are
sent by hosts to determine the addresses of routers.
C. RS and RA packets are always sent to an all-nodes multicast address.
D. RS and RA packets are used by the duplicate address detection function of IPv6.
E. IPv6 hosts learn connected router information from RA messages which may be sent in response to an RS
message.
F. RS and RA packets are used for IPv6 nodes to perform address resolution that is similar to ARP in IPv4.
Answer: A, B, E
195)
Answer:1-B,2-A,3-D,4-E,5-C
196) Which statement about DNS is true?
A. In the DNS header, the Rcode value is set to 0 for format error.
B. The client-server architecture is based on push-pull messages.
C. Query and response messages have different format.
D. In the DNS header, an Opcode value of 2 represents a server status request.
E. In the DNS message header, the QR flag set to 1 indicates a query.
Answer: D
197)
Refer to the exhibit. Which option describes the behavior of this configuration?
A. An initial warning message is displayed when 800 prefixes are received. A different message is displayed when
1000 prefixes are received and the session is not disconnected.
B. The peer session is dropped when 800 prefixes are received.
C. A warning message is displayed when 1000 prefixes are received.
D. An initial warning message is displayed when 80 prefixes area received. The same warning message is displayed
when 1000 prefixes area received and the session is disconnected.
E. The peer session is dropped when 80 prefixes are received.
Answer: A
198)What is the default duration of IPS anomaly detection's learning accept mode?
A. 24 hours
B. 48 hours
C. 12 hours
D. 8 hours
Answer: A
199)Which two statements about the BGP backdoor feature are true? (Choose two)
A. It changes the eBGP administrative distance from 20 to 200.
B. It makes iBGP learned routes preferred over IGP learned routes.
C. It makes IGP learned routes preferred over eBGP learned routes.
D. It changes the iBGP administrative distance from 200 to 20.
E. It makes eBGP learned routes preferred over IGP learned routes.
F. It changes the eBGP administrative distance from 200 to 20.
Answer: AC
200) Which Cisco IOS IPS signature action denies an attacker session using the dynamic access list?
A. deny-connection-inline
B. deny-packet-inline
C. deny-attacker-inline
D. reset-tcp-action
E. produce-alert
F. deny-session-inline
Answer: A
201)What is the range of valid stratum numbers for NTP when configuring a Cisco IOS device as an authoritative NTP
server?
A. 1 to 16
B. 1 to 15
C. 0 to 16
D. 0 to 4
Answer: B
202)Which set of encryption algorithms is used by WPA and WPA2?
A. TKIPandAES
B. Blowfish and AES
C. CAST and RC6
D. TKIP and RC6
Answer: A
203) What are two enhancements in WCCP V2.0 over WCCP V1.0? (Choose two)
A. authentication support
B. multicast support
C. encryption support
D. IPv6 support
E. support for HTTP redirection
Answer: B,A
204) Which two statements about IPv6 path MTU discovery are true? (Choose two)
A. If the source host receives an ICMPv6 Packet Too Big message from a router, it reduces its path MTU.
B. During the discovery process, the DF bit is set to 1.
C. If the destination host receives an ICMPv6 Packet Too Big message from a router, it reduces its path MTU.
D. It can allow fragmentation when the minimum MTU is below a configured value.
E. The initial path MTU is the same as the MTU of the original node's link layer interface.
F. The discovery packets are dropped if there is congestion on the link.
Answer: AE
205)
Refer to the exhibit. Which three descriptions of the configuration are true? (Choose three)
A. The tunnel encapsulates multicast traffic.
B. The tunnel provides data confidentiality.
C. This tunnel is a point-to-point GRE tunnel.
D. The configuration is on the NHS.
E. The tunnel is not providing peer authentication.
F. The tunnel IP address represents the NBMA address.
G. The configuration is on the NHC.
Answer: ABD
206)
Refer to the exhibit. What is the purpose of the command in the NAT PT for IPv6 implementation on a Cisco IOS
device?
A. It defines the IPv4 address pool used by the NAT-PT for dynamic address mapping.
B. It defines the IPv6 address pool used by the NAT-PT for dynamic address mapping.
C. It defines the IPv4 address pool used by the NAT-PT for static address mapping.
D. It defines address pool used by the IPv6 access-list.
E. It defines address pool used by the IPv4 access-list.
Answer: A
207)What technology can secure DNS information in IP networks?
A. DNSSEC
B. a combination of DNS and SSL/TLS
C. a combination of DNS and IPSec
D. DNS encryption
Answer: A
208)
Refer to the exhibit. Why is there no encrypted session between host 10.10.10.1 and 20.20.20.1?
A. incorrect or missing Virtual-Template configuration on the server
B. incorrect or missing Virtual-Template configuration on the client
C. incorrect or missing phase 1 configuration on server
D. incorrect or missing group configuration on the server
E. incorrect or missing phase 2 configuration on the server
F. incorrect or missing group configuration on the client
Answer: B
209)Which three parameters does the HTTP inspection engine use to inspect the traffic on Cisco IOS firewall?
(Choose three)
A. source address
B. application
C. transfer encoding type
D. request method
E. minimum header length
F. destination address
Answer: BCD
210) Which two statements about the RC4 algorithm are true? (Choose two)
A. the RC4 algorithm is an asymmetric key algorithm.
B. the RC4 algorithm is faster in computation than DES.
C. the RC4 algorithm cannot be used with wireless encryption protocols.
D. the RC4 algorithm uses variable-length keys.
E. in the RC4 algorithm, the 40-bit key represents four characters of ASCII code.
Answer: BD
211)Which two are characteristics of WPA? (Choose two)
A. introduces a 64-bit MIC mechanism
B. uses a 40 bit key with 24-bit initialization vector
C. makes the use of AES mandatory
D. WPA does not allow Pre-Shared key mode.
E. implements a key mixing function before passing the initialization vector to the RC4 algorithm
Answer: AE
212) To transport VXLAN traffic, which minimum MTU change, from a default MTU of 1500 bytes on the port, is
required to avoid fragmentation and performance degradation?
A. 1650 bytes
B. 1550 bytes
C. 9100 bytes
D. 9114 bytes
Answer: B
213)
Refer to the exhibit. Why is there no encrypted session between host 10.10.10.1 and 20.20.20.1?
A. incorrect or missing group configuration on the server
B. incorrect or missing phase 2 configuration on the server
C. incorrect or missing Virtual-Template configuration on the server
D. incorrect or missing phase 1 configuration on server
E. incorrect or missing Virtual-Template configuration on the client
Answer: A
214)Which statement is valid regarding SGACL?
A. Dynamically downloaded SGACL does not override manually configured conflicting policies.
B. SGACL is access-list bound with a range of SGTs and DGTs.
C. SGACL mapping and policies can only be manually configured.
D. SGACL is not a role-based access list.
Answer: B
215)Which two statements about ISO 27001 are true? (Choose two)
A. It was formerly known as BS7799-2.
B. It is an Information Security Management Systems specification.
C. It is an ISO 17799 code of practice.
D. It is a code of practice for Informational Social Management.
E. It is closely aligned to ISO 22000 standards.
Answer: AB
216) Drag and drop the ISE profiler components on the left onto their corresponding
Functionalities description on the right
Sensor Allow probe configuration to start-stop

attribute-value pair collection from the end
point
Probe manager
Classifies endpoint into specifies groups
using their attribute-value pairs.
Consists of probes capturing attributes-value

Forwarder
From the endpoint
Stores endpoint along with their attribute-

Analyzer
value pair in the Cisco ISE database
Answer:
Sensor = Consists of probes capturing attributes-value from the endpoint
Probe Manager = allow probe configuration to start-stop attribute-value pair collection from the end.
Forwarder = Stores endpoints along with their attribute-value pair in the Cisco ISE database.
Analyzer = Classifies endpoint into specifies groups using their attribute-value paris.
217)Which encapsulation technique does VXLAN use?
A. MAC in GRE
B. MAC in UDP
C. MAC in TCP
D. MAC in MAC
Answer: B
218)Drag the elements on the left to their corresponding functionality on right.
Answer:
Cisco TrustSec SGT Exchange Protocol = control protocol for propagating IP-to-SGT binding information
SGACL = Associates SGT with a policy
Cisco TrustSec = build secure networks by establishing domains of trusted
219)
Refer to the exhibit. Which two statements about this debug output are true? (Choose two)
A. 192.168.10.1 is the local VPN address.
B. 69.1.1.2 is the local non mutable address.
C. This debug output represents a failed NHRP request.
D. The request is from NHC to NHS.
E. 192.168.10.2 is the remote NBMA address.
E. The request is from NHS to NHC.
Answer: AD
220)
Refer to the exhibit. Which configuration prevents R2 from becoming a PIM neighbor with R1?
A. Access-list 10 deny 192.168.1.2 0.0.0.0

!
Interface gi0/0
Ip pim neighbor-filter10
B. Access-list 10 permit 192.168.1.2 0.0.0.0

!
Interface gi0/0
C. Access-list 10 deny 192.168.1.2 0.0.0.0

!
Interface gi0/0
Ip igmp access-group 10
D. Access-list 10 deny 192.168.1.2 0.0.0.0

!
Interface gi0/0
Answer: A
221)Which statement is true about the PKI deployment using Cisco IOS devices?
A. During the enrollment, CA or RA signs the client certificate request with its public key.
B. RA is capable to publish the CRLs.
C. Certificate Revocation is not supported by SCEP protocol.
D. RA is used for accepting the enrollment requests.
E. Peers use private keys in their certificates to negotiate IPSec SAs to establish the secure channel.
Answer: D
222)Which statement about the Cisco Secure ACS Solution Engine TACACS+ AV pair is true?
A. AV pairs are of two types: sting and integer.
B. AV pairs must be enabled only on Cisco Secure ACS for successful implementation.
C. AV pairs are only string values.
D. the Cisco Secure ACS Solution Engine does not support accounting AV pairs.
Answer: C
223) Of which IPS application is Event Store a component?
A. MainApp
B. InterfaceApp
C. AuthenticationApp
D. NotificationApp
E. SensorApp
Answer: A
224) for what reason has the IPv6 Type 0 Routing Header been recommended for deprecation?
A. Attackers can exploit its functionality to generate DoS attacks.
B. It can create a black hold when used in combination with other routing headers.
C. When Type 0 traffic is blocked by a firewall policy, all other traffic with routing headers is dropped automatically
D. It can conflict with ingress filtering.
Answer: A
225) In the IPv6 address 2001:DB8:130E::870:0:140B/64, which portion is the IPv6 interface identifier?
A. 2001:DB8:130F:0:
B. 0:870:0:140B
C. 870:0:140B
D. 2001:DB8:130F
Answer: B
226)
Refer to the exhibit. Which two statements correctly describe the debug output? (Choose two)
A. The message is observed on the NHS
B. the NHRP hold time is 3 hours
C. The local non-routable address is 20.10.10.3
D. The message is observed on the NHC
E. The remote routable address 91.91.91.1
F. The remote VPN address is 180.10.10.1
Answer: DF
227)In traceroute, which ICMP message indicates that the packet is dropped by a router in the path?
A. Type 3, Code 1
B. Type 11, Code 0
C. Type 5, Code 1
D. Type 3, Code 3
E. Type 11, Code 1
Answer: B
228)What are two advantages of SNMPv3 over SNMPv2c? (Choose two)
A. integrity, to ensure that data has not been tampered with in transit
B. GetBulkRequest capability, to retrieve large amounts of data in a single request
C. confidentiality via encryption of packets, to prevent man-in-the-middle attacks
D. Packet replay protection mechanism removed for efficiency
E. no source authentication mechanism for faster response time
Answer: AC
229) Which statement about the DH group is true?
A. It establishes a shared key over a secured medium.
B. It is negotiated in IPsec phase 2.
C. It does not provide data authentication.
D. It provides data confidentiality.
Answer: C
230) Drag and drop the SMTP components on the left onto their corresponding roles on the right.
Answer:
231)
Refer to the exhibit. Which option is the reason for the failure of the DMVPN session between R1 and R2?
A. IPsec phase-2 policy mismatch
B. IPsec phase-1 policy mismatch
C. IPsec phase-1 configuration missing peer address on R2
D. tunnel mode mismatch
E. incorrect tunnel source interface on R1
Answer: B
232) Of which IPS application is Event Action Rule a component?
A. AuthenticationApp
B. InterfaceApp
C. SensorApp
D. MainApp
E. SensorDefinition
F. NotificationApp
Answer: C
234)Which statement describes RA?
A. The RA is part of private key infrastructure.
B. The RA has the power to accept registration requests and to issue certificates.
C. The RA is not responsible to verify users request for digital certificates.
D. The RA only forwards the requests to the CA to issue certificates.
Answer: D
235)Which statement about Infrastructure ACLs on Cisco IOS software is true?
A. They are used to protect the device forwarding path.
B. They are used to protect device management and internal link addresses.
C. They only protect device physical management interface.
D. They are used to authorize the transit traffic.
Answer: B
236)
Refer to the exhibit. Why does the EasyVPN session fail to establish between the client and server?
A. ISAKMP key mismatch
B. incorrect ACL in the ISAKMP client group configuration
C. incorrect group configuration on the client
D. incomplete IPsec phase-1 configuration on the server
E. incorrect IPsec phase-2 configuration on the server
Answer: C
237)
Refer to the exhibit. Which statement about the configuration commands is true?
A. These commands return an error because of a mismatch between the Dot1x order and priority.
B. By default, the switch attempts MAB and then Dot1x.
C. Changing the default order of authentication does not introduce additional authentication traffic in the network.
D. These are valid configuration commands and the switch accepts them.
Answer: D
238) If a nodes IPv6 interface address is 2001:DB2::1F5C:7A92,what is its solicited-node multicast address?
Answer : F
239) Which two network protocol can operate on the application layer? (Choose two)
A) UDP
B) DNS
C) DCCP
D) NetBIOS
E) SMB
F) TCP
Ans: B,E
240) What are two EAP types used for authentication on a wireless network? (Choose two)
A) VPN
B) EAP-TLS
C) EAP-CHAP
D) PEAP
E) EAP SHA
F) EAP MAC
Ans: B,D
241) Which three of this protocol are supported when using TACACS+? (Choose three)
A) NetBIOS
B) CHAP
C) Kerberos
D) Apple Talk
E) NASI
Answer : A, D, E
242) What are two limitation of CPPr (control plane protection)?(Choose two)
Answer : C , D
243) Which two statement about SSIDs are true? (Choose two)
Ans: A,D
244) TACACS+ authentication uses which three packet Types? (Choose Three)
Answer : C,D,E
245) Which three global correlation features can be enabled from cisco IPS Device manager (Cisco ICM)? (Choose
three)
Ans: A, D, F
246) Which three statements about Security Group Tag Exchange Protocol are true? (Choose three.)
A. SXP runs on UDP port 64999.
B. A connection is established between a "listener" and a "speaker."
C. It propagates the IP-to-SGT binding table across network devices that do not have the ability to perform SGT
tagging at Layer 2 to devices that support it.
D. SXP is supported across multiple hops.
E. SXPv2 introduces connection security via TLS.
Answer: B, C, D
247) Which two statement about IPv6 router advertisement massages are true?(Choose two)
Answer : C,E
248)
Refer to the exhibit switch SW2 has just been added to fastEthernet 0/23 on sw1,after a few second interface
Fa0/23 on SW1 is placed in the error-disabled state.SW2 is removed from port 0/23 and inserted into SW1 port
Fa0/22 with the same result. What is the most likely cause of this problem?
Answer : D
249) Which three statement regarding cisco ASA multicast routing support are correct ? (Choose three)
Answer : C , D, F
250) your organization has implemented an internal stratum 2 NTPv4 server using a Cisco router. How can you
prevent NTP clients that are configured without authentication from syncing with the NTP server?
Answer : D
251) You have configured a downlink MACsec switch port without a policy if the ISE server fails to return the CISCO-
av-pair= subscriber:linksec-policy,What policy will the MACsec switch port use?
Answer : D
252) Which two statement are correct about the aaa authentication login defaults group tacacs+ local global
configuration command?(Choose two)
Answer : B E
253) Drag each cryptographic algorithm on the left to the operation it support on the right?
254) Drag each IPS signature engine on the left to its description on the right?
Answer :
Atomic : combines Layer 3 and layer 4 attributes in one signature

Normalizer: configures IP and TCP functions to enforce RFC compliance
255) What are two important guideline to follow when implementing VTP? (Choose Two)
Answer : A, E
256) DNS security Extension(DNSSEC) adds security functionality to the domain name system for which name system
for which three purposes? (Choose three)
Answer:A, B , F
257)Which two ESMTP commands are supported by the ASA inspection engine? (Choose two)
A. ATRN
B. ETRN
C. VERB
D. VERB E.ONEX
F. SOML
G. LINK
Answer: BF
258)
Refer to the exhibit. Which statement about the exhibit is true?
A. IPsec phase-2 will fail to negotiate due to a mismatch in parameters.
B. A DMVPN session will fail to establish because R2 is missing the ISAKMP peer address.
C. A DMVPN session will establish between R1 and R2
D. IPsec phase-1 will fail to negotiate due to a mismatch in parameters
E. The tunnel configuration is incomplete and the DMVPN session will fail between Rl and R2
Answer: C
259)Which ICMP message type code indicates that fragment reassembly time has been exceeded?
A. Type 12, Code 2
B. Type 11, Code 1
C. Type 4, Code 0
D. Type 11, Code 0
Answer: B
260) When a client attempts to authenticate to an access point with the RADIUS server, the server returns the error
message "Invalid message authenticator in EAP request" Which action can you take to correct the problem?
A. Enable the external database account.
B. Add the user profile to ACS.
C. Configure the required privileges for the authentication service.
D. Synchronize the shared password between AP and ACS.
Answer: D
261) Which signature engine would you choose to filter for the regex [aA][tT][tT][aA][cC][kK) in the
URI field of the HTTP header?
A. AIC HTTP
B. ATOMIC IP
C. service HTTP
D. string TCP
Answer: C
262)What is Cisco CKM (Centralized Key Management) used for?
A. to provide switch port security
B. to allow an access point to act as a TACACS server to authenticate the client
C. to avoid configuring PSKs (Pre-Shared Key) locally on network access devices and to configure a PSK once on a
RADIUS server
D. to allow authenticated client devices to roam from one access point to another without any perceptible delay
during re-association
Answer: D
263)What are two limitations of the Atomic IP Advanced Engine? (Choose two)
A. It is unable to fire high-severity alerts for known vulnerabilities.
B. It is usable to detect IP address anomalies, including IP spoofing.
C. It has limited ability to check the fragmentation header.
D. It is unable to inspect a packet's length fields for bad information.
E. It is unable to detect Layer 4 attacks it the packets were fragmented by IPv6.
Answer: CE
264) your coworker is working on a project to prevent DDoS and ingress filtering and needs advice on the standard
and associated process for a single-homed network. Which two options do you suggest? (Choose two)
A. RFC 3704
B. RFC S73S
C. RFC 2827
D. BCP 38
E. BCP 84
Answer: CD
265)
Refer to the exhibit. With the client attempting which mode works by default?
A. passive
B. active
C. both passive and active
D. neither passive nor active
Answer: A
266) For which router configuration is the attack-drop sdf file recommended?
A. Routers with less than 128 MB of memory
B. Routers with at least 256 MB of memory
C. Routers with at least 128 MB of memory
D. Routers with at least 192 MB of memory
E. Routers with less than 64 MB of memory
Answer: A
267)Which statement about the Firewall attack is true?
A. It uses ICMP sweep to find expected hosts behind a firewall.
B. It uses ICMP sweep with a predetermined TTL value to discover hosts behind a firewall.
C. It is used to discover hosts behind a firewall device.
D. It is used to find the vulnerability in the Cisco IOS firewall code.
E. It uses TTL handling to determine whether packets can pass through a packet-filtering device.
Answer: B
268) Which statement about the Firewall attack is true?
A. It uses ICMP sweep to find expected hosts behind a firewall.
B. It uses ICMP sweep with a predetermined TTL value to discover hosts behind a firewall.
C. It is used to discover hosts behind a firewall device.
D. It is used to find the vulnerability in the Cisco IOS firewall code.
E. It uses TTL handling to determine whether packets can pass through a packet-filtering device.
Answer: B
269)
Refer to the exhibit. Which option describes the behavior of this configuration?
A. IEEE 802.lx devices must first authenticate via MAB to perform subsequent IEEE 802.IX authentication. If 802.IX
fails, the device is assigned to the default guest VLAN.
B. The switch initiates the authentication.
C. The device performs subsequent IEEE 802.IX authentication if it passed MAB authentication. If the device fails
IEEE 802.IX, it will start MAB again.
D. Devices that perform IEEE 802.IX should be in the MAC address database for successful authentication.
Answer: C
270)
Refer to the exhibit.
Why does the EasyVPN session fail to establish between the client and server?
A. incorrect IPsec phase 2 configuration on the server
B. incorrect group configuration on the client
C. ISAKMP key mismatch
D. incomplete ISAKMP profile configuration on the server
E. incorrect ACL in the ISAKMP client group configuration
Answer A
271)What are two authentication algorithms supported with SNMPv3 on an ASA? (Choose two) ARCS
A. DES C.RC4
B. MD5
C. 3DES
D. SHA
Answer: C, D
272) Which three statements about VRF aware Cisco Firewall are true? (Choose three)
A. A. It enables service providers to implement firewall on PE devices

B. B. It can run as more than one instance
C. C. Its can support VPN network with overlapping address range without NAT
D. D. It can generate syslog message that are visible only to individual VPN
E. E. Its support both global and per-VRF commands and DOS parameter
F. F. It enables service providers to deploy firewall on customer device
Answer: A, B, D
273)What are three benefits of Cisco IOS FlexVPN? (Choose three)
A. Its provide hierarchical QoS on a per-tunnel basis

B. It is compatible with most private intranet deployments
C. Its support TACACS+
D. It is compatible with IKEv2-based third-party VPN solutions
E. It provides centralized policy control
F. It support DMVPN deployment
Answer: A, D, E
274)Which two statements about the BGP TTL security check are true? (Choose two)
A. It is more useful for iBGP sessions than eBGP sessions.

B. The default TTL for all neighbor session packets is 255 when eBGP is configured.
C. It secures incoming eBGP session only
D. It Protects the BGP process from DOS attacks
E. It enforces each BGP packets maximum TTL value
Answer: C, D,
275)
R1(config)# interface Tunnel1

R1(config-if) ip address 172.16.1.1 255.255.255.0
R1(config-if) tunnel source 1.1.1.1
R1(config-if) tunnel destination 2.2.2.2
Refer to the exhibit. You are configuring a GRE tunnel between two sites. What action can you take to minimize
packet fragmentation on the tunnel?
A. Configure ip mtu 1400 and ip tcp adjust-mss 1360 under the tunnel1 interface on both routers.
B. Configure ip mtu1360 and ip tcp adjust-mss 1400 under the tunnel1 interface on both routers
C. Configure ip mtu 1500 and ip tcp adjust-mss 1400 under the tunnel1 interface on either router
D. Configure ip mtu 1500 and ip tcp adjust-mss 1360 under the tunnel1 interface on either router
Answer: A
276)Which two statements about MACsec are true? (Choose two)
A. It is best deployed at the access layer, close to the switch port

B. It store per-DNS broadcast information in radius accounting records.
C. Each endpoints MACsec policy is define by the authentication server.
D. the distribution and core layers in the network can be segregated
E. It works in conjunction with 802.11 wireless technologies
Answer: A, C
277)
ipv6 access-list permit
permit icmp any any 128 0
Refer to the exhibit. What are three effects of the given firewall configuration? (Choose three)
A. the firewall allows destination unreachable error messages from any source to pass to the server
B. PCs outside the firewall are unable to communicate with server over HTTP
C. The firewall allows Echo Request packets from any source to pass to the server
D. The firewall allows Echo Replay packets from any sources to pass to the server
E. The firewall allows Time Exceeded error message from any source to pass to the server
F. The firewall allows Packet too big error message from any source to pass to the server.
Answer: C, D, F
278)What are two benefit of Cisco TrustSec NDAC? (Choose three)
A. It can protect against rogue network devices.

B. It enables untrusted devices to acquire trust on the network and negotiate manual keys.
C. It uses authorization to negotiate keys and the cipher suite for encryption
D. It uses 802.1X encryption instead of 802.1AE encryption
E. It can prevent untrusted devices from launching DoS attacks.
F. It supports 802.1AE-based encryptions with an automatic key.
Answer: A,B,D
279)What is the most common use of Scavenger-Class QoS?
A. Mitigating DoS attacks

B. Mitigating SQL injection attacks
C. traffic shaping
D. prioritizing traffic
Answer: A
280)Drag each field authentication Header on the left into the order in which it appears in the header on the right
Answer:
281) Drag each step in the Cisco PSIRT response to incidents and vulnerabilities involving Cisco products on the left
in the correct order on the right
Answer:
282) Drag each IPv6 extension header on the left into the recommended order for more than one extension header
in the same IPv6 packet on the right
Answer:
283) What is an RFC 2827 recommendation for protecting your network against DoS attacks with IP address
spoofing?
A. Advertise only assigned global IP addresses to the internet

B. Use ingress traffic filtering to limit traffic from a downstream network to known advertised prefixes.
C. Use the TLS protocol to secure the network against eavesdropping
D. Brower-based applications should be filtered on the source to protect your network from know advertised
prefix
Answer: B
284) Which two statements about Flexible Packet Matching are true? (Choose two)
A. It is supported by CSM management applications

B. It can classify traffic at the bit level
C. It can detected and filter malicious traffic
D. It provides stateful classification for Layer 2 to Layer 7 traffic
E. It can inspect non-IP protocol
Answer:B, C
285) Which three statements about VRF-Aware Firewall are true? (Choose three)
A. It can run as more than one instance

B. It enables service providers to implement firewall on PE devices.
C. It can generate syslog message that are visible only to individual VPNs
D. It can support VPN network with overlapping address range without NAT
E. It supports both global and per-VRF commands and DoS parameters
F. It enables service providers to deploy firewall on customer device.
Answer: A, B, C
286 ) Which two statements about attacks against IPV4 and IPv6 network are true? (Choose two)
A. Man-in-the-middle attacks are more common against IPv4 and IPv6

B. The multicast DHCPv6 replies on IPv6 network are easier to protect from attacks
C. Rogue devices provide more risk to IPv4 networks than IPv6 networks
D. It is easier to scan an IPv4 network than an IPv6 networks.
E. Data can be captured in transit across both network types.
F. Attacks performed at the application layer can compromise both types
Answer: A, F
287) given the IPV4 address 10.10.100.16 which two addresses are valid IPv4-compatible IPv6 addressed?(choose
two)
A) 0:0:10:10:100:16:0:0:0
B) 0:0:0:0:0:10:10:100:16
C):::A:A64:10
D):::10:10:100:16
Answer :B,D
288) if any ASA device is configured as a remote access ipsec server with RADIUS authentication and password
management enabled,which type of authentication will it use?
A) MS-CHAPv2.
B)PAP
C)RSA
D)NTLM
E)MS-CHAPv1
Answer :A
289) Which of the following statement are true regarding hashing?
A)MD5 takes more CPU cycles to compute than SHA-1
B)MD5 produces a 160-bit result
C) Changing 1 bit of the input to SHA-1 changes 1 bit of the output
D)SHA-1 is stronger than MD5 because it can be used with a key to prevent modification
E) SHA-256 is an extension to SHA-1 with a longer output
Answer :C,E
290)Which three of these are true statement about TLS? (choose three)
A) It can be used to secure SIP
B)It is a secure protocol encapsulated within SSL
C) It has a more recent version of SSL
D) It allows for client authentication via certificates
E)If a third-party(man-in-the-middle)observes the entire handshake between clients and server,third-party can
decrypt the encrypted data that passes between them
F) It cannot be used for HTTPS
Answer :A,C,D
291) You have discovered that a router on your network is experiencing high CPU when management server
10.11.10.12 queries OLD iidpMIB Assuming management stations access to OID is not critical What configuration can
you apply to the router to prevent high CPU usage when the OID is queried?
Answer :B
292) Which three routing characteristic are relevant for DMVPN Phase 3?(Choose three)
A) Hubs must preserve the original ip next-hop
B) Split-horizon must be turned off for RIP and EIGRP
C) Hubs are routing neighbor with other hubs and must use the same routing protocol as that used on hub-spoke
tunnels
D) spokes are only routing neighbor with hubs
E) spokes are routing neighbors with hubs and other spokes
F) Hub must not preserve the original IP next-hop
Answer :B,D,F
293) In RFC 4034,DNSSEC introduced which four new resource record types?(Choose four)
A) Resource record signature (RRSIG)
B)Next secure (NSEC)
C) Delegation signer (DS)
D) Top level domain (TLD)
E) Zone signing key (ZSK)
F) DNS Public key (DNSKEY)
Answer :A,B,C,F
294) Which ASA device is designated as the cluster master?
A) The ASA configured with the lowest priority value
B) The ASA configured with the highest priority value
C) The ASA with the lowest MAC address
D) The ASA with the highest MAC address
Answer :A
295)
Refer to the exhibit what is the maximum number of hops from the device that generated the given output to its
BGP neighbor at 4.4.4.4?
A)5
B)2
C)3
D)254
E)252
F)255
Answer :C
296) Drag and drop the step in the Cisco ASA packet processing flow on the left into the correct order of operation
on the right?
Answer :
the packet arrives:step1
the input counter is incremented:step2
the packet is checked against the global:step3
the packet is checked against existing:step4
the packet is forwarded to the :step5
the egress interface counter:step6
297)Which three statements about Cisco Secure Desktop are true? (Choose three)
A. It is interpretable with Clientless SSL VPN, AnyConnect, and the IPSec VPN client.
B. Its supports shared network folder
C. It validate PKI certificates
D. It supports multiple prelogin checks, including IP address, certificate and OS
E. It supports unlimited CSD locations.
F. It can be pre-installed to reduce download time.
Answer: B, D, E
298)Which two statements about Cisco MQC are true? (Choose two)
A. It can classify Layer 2 Packets from legacy protocols

B. By default, its uses match-any matching
C. A packet can match only one traffic class within an individual traffic policy
D. It allows you to link multiple traffic policies to a single traffic class.
E. Unclassified traffic is queued in a FIFO queue to be managed by the match not command configuration
F. It can handle Layer2 packets from legacy protocol without classifying them.
Answer: C, F
299) What are the three default account duration settings supported by the Cisco ISE Guest services? (Choose three)
A. DefaultStartEnd
B. DefaultEightHours
C. DefaultFirstLoginEight
D. DefaultUnlimited
E. DefaultFirstLogin
F. DefaultFiveHours
Answer: A, B, C
300) What are the three probes supported by Cisco ISE profiling services? (Choose three)
A. NetFlow (NetFlow Probe)

B. DHCP (DHCP Probe)
C. DHCP SPAN (DHCP SPAN Probe)
D. HTTP(HTTP Probe)
E. HTTP SPAN (HTTP SPAN Probe)
F. RADIUS (RADIUS Probe)
G. Network Scan (Network Scan Probe)
H. DNS (DNS Probe)
I. SNMP Query (SNMP Query Probe)
J. SNMP Trap (SNMP Trap Probe)
Answer: All are correct except HTTP span and Network Scan
301) Which statement about ACS rule-based policies is true?
A. The permissions for rule-based policies are defined in authentication profile.

B. Permission for rule-bases polices are associated with user group.
C. Rule-based polices can apply different permission to the same user under different condition
D. TACACS+ is one of the attributes included in the authorization profile
Answer: B
302) Which two statements about the IPv6 OSPFv3 authentication Trailer are true (choose two)
A. The AT-bit resides in the OSPFv3 Header field

B. The IPv6 Payload length includes the length of the authentication Trailer
C. It Provide an alternative option to OSPFv3 IPsec authentication
D. The AT-bit must be set only in OSPFv3 Hello packets that include an Authentication Trailer
E. The AT-bit must be set only in OSPFv3 Database Description packets that include an Authentication Trailer
F. The OSPFv3 packet length includes the length of the Authentication Trailer
Answer: D, E
303) Which two statements about DNSSEC are true? (Choose two)
A. It support data confidentiality for DNS client

B. It can protect bulk data as is it transmitted between DNS servers.
C. It supports data integrity for DNS clients.
D. It supports spilt-horizon DNS to prevent attackers from enumerating the names in a zone
E. It can protect all types of data published in the DNS
Answer: C,E
304)
Refer the exhibit. Two routers are connected using GRE through a WAN link. Your syslog server is logging the given
error message. What is a possible reason for the errors?
A. The loopback interface is configured as the source of the tunnel

B. The connection is experiencing WAN link flapping
C. The tunnel key is misconfigured
D. Secondary addresses are being used on the physical interface
E. The tunnel source and destination are advertised through the tunnel itself
Answer: E
305) Which three statements about VXLANs are true? (Choose three.)
A. It requires that IP protocol 8472 be opened to allow traffic through a firewall.
B. Layer 2 frames are encapsulated in IP, using a VXLAN ID to identify the source VM.
C. A VXLAN gateway maps VXLAN IDs to VLAN IDs.
D. IGMP join messages are sent by new VMs to determine the VXLAN multicast IP.
E. A VXLAN ID is a 32-bit value.
Answer: B, C, D
306) In order to reassemble IP fragments into a complete IP datagram, which three IP header fields are referenced
by the receiver? (Choose three.)
A. don't fragment flag

B. packet is fragmented flag
C. IP identification field
D. more fragment flag
E. number of fragments field
F. fragment offset field
Answer: C, D, F
307) Which VTP mode allows the Cisco Catalyst switch administrator to make changes to the VLAN configuration
that only affect the local switch and are not propagated to other switches in the VTP domain?
A. transparent
B. server
C. client
D. local
E. pass-through
Answer: A
308) Which type of VPN is based on the concept of trusted group members using the GDOI key management
protocol?
A. DMVPN
B. SSLVPN
C. GETVPN
D. EzVPN
E. MPLS VPN
F. FlexVPN
Answer: C
309) Based on RFC 4890, what is the ICMP type and code that should never be dropped by the firewall to allow
PMTUD?
A. ICMPv6 Type 1 Code 0 no route to host

B. ICMPv6 Type 1 Code 1 communication with destination administratively prohibited
C. ICMPv6 Type 2 Code 0 packet too big
D. ICMPv6 Type 3 Code 1 fragment reassembly time exceeded
E. ICMPv6 Type 128 Code 0 echo request
F. ICMPv6 Type 129 Code 0 echo reply
Answer: C
310) A firewall rule that filters on the protocol field of an IP packet is acting on which layer of the OSI reference
model?
A. network layer
B. application layer
C. transport layer
D. session layer
Answer: A
311) Which layer of the OSI model is referenced when utilizing http inspection on the Cisco ASA to filter Instant
Messaging or Peer to Peer networks with the Modular Policy Framework?
A. application layer
B. presentation layer
C. network layer
D. transport layer
Answer: A
312) When a Cisco IOS Router receives a TCP packet with a TTL value less than or equal to 1, what will it do?
A. Route the packet normally
B. Drop the packet and reply with an ICMP Type 3, Code 1 (Destination Unreachable, Host Unreachable)
C. Drop the packet and reply with an ICMP Type 11, Code 0 (Time Exceeded, Hop Count Exceeded)
D. Drop the packet and reply with an ICMP Type 14, Code 0 (Timestamp Reply)
Answer: C
313) In an 802.11 WLAN, which option is the Layer 2 identifier of a basic service set, and also is typically the MAC
address of the radio of the access point?
A. BSSID
B. SSID
C. VBSSID
D. MBSSID
Answer: A
314) What term describes an access point which is detected by your wireless network, but is not a trusted or
managed access point?
A. rogue
B. unclassified
C. interferer
D. malicious
Answer: A
315)A router has four interfaces addressed as 10.1.1.1/24, 10.1.2.1/24, 10.1.3.1/24, and 10.1.4.1/24. What is the
smallest summary route that can be advertised covering these four subnets?
A. 10.1.2.0/22
B. 10.1.0.0/22
C. 10.1.0.0/21
D. 10.1.0.0/16
Answer: C
316) Which authentication mechanism is available to OSPFv3?
A. simple passwords
B. MD5
C. null
D. IKEv2
E. IPsec AH/ESP
Answer: E
317) Which two IPv6 tunnel types support only point-to-point communication? (Choose two.)
A. manually configured
B. automatic 6to4
C. ISATAP
D. GRE
Answer: A, D
318) Which two EIGRP packet types are considered to be unreliable packets? (Choose two.)
A. update
B. query
C. reply
D. hello
E. acknowledgement
Answer: D, E
319) Before BGP update messages may be sent, a neighbor must stabilize into which neighbor state?
A. Active
B. Idle
C. Connected
D. Established
Answer: D
320) Which three statements are correct when comparing Mobile IPv6 and Mobile IPv4 support? (Choose three.)
A. Mobile IPv6 does not require a foreign agent, but Mobile IPv4 does.
B. Mobile IPv6 supports route optimization as a fundamental part of the protocol; IPv4 requires extensions.
C. Mobile IPv6 and Mobile IPv4 use a directed broadcast approach for home agent address discovery.
D. Mobile IPv6 makes use of its own routing header; Mobile IPv4 uses only IP encapsulation.
E. Mobile IPv6 and Mobile IPv4 use ARP for neighbor discovery.
F. Mobile IPv4 has adopted the use of IPv6 ND.
Answer: A, B, D
321) Which three statements are true about MACsec? (Choose three.)
A. It supports GCM modes of AES and 3DES.

B. It is defined under IEEE 802.1AE.
C. It provides hop-by-hop encryption at Layer 2.
D. MACsec expects a strict order of frames to prevent anti-replay.
E. MKA is used for session and encryption key management.
F. It uses EAP PACs to distribute encryption keys.
Answer: B, C, E
322) Troubleshooting the web authentication fallback feature on a Cisco Catalyst switch shows that clients with the
802.1X supplicant are able to authenticate, but clients without the supplicant are not able to use web
authentication. Which configuration option will correct this issue?
A. switch(config)# aaa accounting auth-proxy default start-stop group radius
B. switch(config-if)# authentication host-mode multi-auth
C. switch(config-if)# webauth
D. switch(config)# ip http server
E. switch(config-if)# authentication priority webauth dot1x
Answer: D
323) Refer to the exhibit.
Which route will be advertised by the Cisco ASA to its OSPF neighbors?
A. 10.39.23.0/24
B. 10.40.29.0/24
C. 10.66.42.215/32
D. 10.40.29.0/24
Answer: A
324) Which three configuration components are required to implement QoS policies on Cisco routers using MQC?
(Choose three.)
A. class-map
B. global-policy
C. policy-map
D. service-policy
E. inspect-map
Answer: A, C, D
325) Which type of PVLAN ports can communicate among themselves and with the promiscuous port?
A. isolated
B. community
C. primary
D. secondary
E. protected
Answer: B.
326) Which of the following provides the features of route summarization, assignment of contiguous blocks of
addresses, and combining routes for multiple classful networks into a single route?
A. classless interdomain routing
B. route summarization
C. supernetting
D. private IP addressing
Answer: A
327) Aggregate global IPv6 addresses begin with which bit pattern in the first 16-bit group?
A. 000/3
B. 001/3
C. 010/2
D. 011/2
Answer: B
328) Which layer of the OSI reference model typically deals with the physical addressing of interface cards?
A. physical layer
B. data-link layer
C. network layer
D. host layer
Answer: B.
329) Which statement best describes a key difference in IPv6 fragmentation support compared to IPv4?
A. In IPv6, IP fragmentation is no longer needed because all Internet links must have an IP MTU of 1280 bytes or
greater.
B. In IPv6, PMTUD is no longer performed by the source node of an IP packet.
C. In IPv6, IP fragmentation is no longer needed since all nodes must perform PMTUD and send packets equal to or
smaller than the minimum discovered path MTU.
D. In IPv6, PMTUD is no longer performed by any node since the don't fragment flag is removed from the IPv6
header.
E. In IPv6, IP fragmentation is performed only by the source node of a large packet, and not by any other devices in
the data path.
Answer: E
It shows the format of an IPv6 Router Advertisement packet. If the Router Lifetime value is set to 0, what does that
mean?
A. The router that is sending the RA is not the default router.
B. The router that is sending the RA is the default router.
C. The router that is sending the RA will never power down.
D. The router that is sending the RA is the NTP master.
E. The router that is sending the RA is a certificate authority.
F. The router that is sending the RA has its time synchronized to an NTP source.
Answer: A
331) If a host receives a TCP packet with an SEQ number of 1234, an ACK number of 5678, and a length of 1000
bytes, what will it send in reply?
A. a TCP packet with SEQ number: 6678, and ACK number: 1234
B. a TCP packet with SEQ number: 2234, and ACK number: 5678
C. a TCP packet with SEQ number: 1234, and ACK number: 2234
D. a TCP packet with SEQ number: 5678, and ACK number 2234
Answer: D
Explanation: The response will be SEQ number + length of packet i.e. 1234 + 1000 = 2234.
332) A network administrator uses a LAN analyzer to troubleshoot OSPF router exchange messages sent to all OSPF
routers. To which one of these MAC addresses are these messages sent?
A. 00-00-1C-EF-00-00
B. 01-00-5E-00-00-05
C. 01-00-5E-EF-00-00
D. EF-FF-FF-00-00-05
E. EF-00-00-FF-FF-FF
F. FF-FF-FF-FF-FF-FF
Answer: B
333)Which option correctly describes the security enhancement added for OSPFv3?
A. The AuType field in OSPFv3 now supports the more secure SHA-1 and SHA-2 algorithms in addition to MD5.
B. The AuType field is removed from the OSPFv3 header since simple password authentication is no longer an
option.
C. The Authentication field in OSPFv3 is increased from 64 bits to 128 bits to accommodate more secure
authentication algorithms.
D. Both the AuType and Authentication fields are removed from the OSPF header in OSPFv3, since now it relies on
the IPv6 Authentication Header (AH) and IPv6 Encapsulating Security Payload (ESP) to provide integrity,
authentication, and/or confidentiality.?
E. The Authentication field is removed from the OSPF header in OSPFv3, because OSPFv3 must only run inside of an
authenticated IPSec tunnel.
Answer: D
334) Which IPv6 tunnel type is a standard that is defined in RFC 4214?
A. ISATAP
B. 6to4
C. GREv6
D. manually configured
Answer: A
335) What IP protocol number is used in the protocol field of an IPv4 header, when IPv4 is used to tunnel IPv6
packets?
A. 6
B. 27
C. 41
D. 47
E. 51
Answer: C
336) An IPv6 multicast receiver joins an IPv6 multicast group using which mechanism?
A. IGMPv3 report
B. IGMPv3 join
C. MLD report
D. general query
E. PIM join
Answer: C
Explanation: The Multicast Listener Discovery (MLD) protocol is the multicast group management protocol for IPv6
and is used to exchange group information between multicast hosts and routers. The MLD protocol was designed
based on IGMP, the Internet Group Management Protocol for IPv4, and the protocol specification is the same in
many points. Unlike IGMP, however, MLD is defined as part of ICMPv6, while IGMP is defined as a separate
transport layer protocol.
337) Which option shows the correct sequence of the DHCP packets that are involved in IP address assignment
between the DHCP client and the server?
A. REQUEST, OFFER, ACK
B. DISCOVER, OFFER, REQUEST, ACK
C. REQUEST, ASSIGN, ACK
D. DISCOVER, ASSIGN, ACK
E. REQUEST, DISCOVER, OFFER, ACK
Answer: B
338)Which common FTP client command transmits a direct, byte-for-byte copy of a file?
A. ascii
B. binary
C. hash
D. quote
E. glob
Answer: B
339)Which option is a desktop sharing application, used across a variety of platforms, with default TCP ports
5800/5801 and 5900/5901?
A. X Windows
B. remote desktop protocol
C. VNC
D. desktop proxy
Answer: C
Explanation: VNC enables you to remotely access and control your devices wherever you are in the world, whenever
you need to. VNC has a widespread user base from individuals to the world's largest multi-national companies
utilizing the technology for a range of applications.
340)Which multicast routing mechanism is optimal to support many-to-many multicast applications?
A. PIM-SM
B. MOSPF
C. DVMRP
D. BIDIR-PIM
E. MSDP
Answer: D
Explanation: Bidir-PIM is a variant of the PIM suite of routing protocols for IP multicast. In PIM, packet traffic for a
multicast group is routed according to the rules of the mode configured for that multicast group. The Cisco IOS
implementation of PIM supports three modes for a multicast group:
Bidirectional mode
Dense mode
Sparse mode
341)Which three statements regarding VLANs are true? (Choose three.)
A. To create a new VLAN on a Cisco Catalyst switch, the VLAN name, VLAN ID and VLAN type must all be specifically
configured by the administrator.
B. A VLAN is a broadcast domain.
C. Each VLAN must have an SVI configured on the Cisco Catalyst switch for it to be operational.
D. The native VLAN is used for untagged traffic on an 802.1Q trunk.
E. VLANs can be connected across wide-area networks.
Answer: B, D, E
342) Which technology, configured on the Cisco ASA, allows Active Directory authentication credentials to be
applied automatically to web forms that require authentication for clientless SSL connections?
A. one-time passwords
B. certificate authentication
C. user credentials obtained during authentication
D. Kerberos authentication
Answer: C
343)In what subnet does address 192.168.23.197/27 reside?
A. 192.168.23.0
B. 192.168.23.128
C. 192.168.23.160
D. 192.168.23.192
E. 192.168.23.196
Answer: D
344)What is the size of a point-to-point GRE header, and what is the protocol number at the IP layer?
A. 8 bytes, and protocol number 74
B. 4 bytes, and protocol number 47
C. 2 bytes, and protocol number 71
D. 24 bytes, and protocol number 1
E. 8 bytes, and protocol number 47
Answer: B
345)Which mode of operation must be enabled on CSM to support roles such as Network Administrator, Approver,
Network Operator, and Help Desk?
A. Deployment Mode
B. Activity Mode
C. Workflow Mode
D. User Roles Mode
E. Administration Mode
F. Network Mode
Answer: C
346) Which three statements about triple DES are true? (Choose three.)
A. For 3DES, ANSI X9.52 describes three options for the selection of the keys in a bundle, where all keys are
independent.
B. A 3DES key bundle is 192 bits long.
C. A 3DES keyspace is168 bits.
D. CBC, 64-bit CFB, OFB, and CTR are modes of 3DES.
E. 3DES involves encrypting a 64-bit block of plaintext with the 3 keys of the key bundle.
Answer: B, C, D
347) A Cisco IOS router is configured as follows:
ip dns spoofing 192.168.20.1
What will the router respond with when it receives a DNS query for its own host name?
A. The router will respond with the IP address of the incoming interface.
B. The router will respond with 192.168.20.1 only if the outside interface is down.
C. The router will respond with 192.168.20.1.
D. The router will ignore the DNS query and forward it directly to the DNS server.
Answer: A
348) What are the three configurations in which SSL VPN can be implemented? (Choose three)
Answer : A , C , F
349)
Refer to the exhibit What is the effect of the given configuration?
Answer : B
350) Drag each SNMPv3 entity component on the left to its function on the right?
Answer :
Access control subsystem: Provides authorization services
Command generator: initiates PDUs and processes responses
Command responder: Receives PDUs and generates replies
Dispatcher: Accepts and delivers PDUs
Message Processing Subsystem: Extracts data from incoming messages
Notification Originator: Generates inform and Trap messages
Notification Responder: Replies to messages that contain Inform PDUs
Security subsystem: Authenticates incoming messages
351) If a cisco ASA firewall that configured in multiple-context mode of operation receives a packet whose
destination MAC address is a multicast address, how is the packet routed?
Ans: C
352) Which series of steps illustrates the correct flow for incident management?
A. Identify, log, categorize, prioritize, initial diagnosis, escalate, investigate and diagnose, resolve and recover, close
B. Categorize, log, identify, prioritize, initial diagnosis, escalate, investigate and diagnose, resolve and recover, close
C. Identify, log, categorize, prioritize, initial diagnosis, investigate and diagnose, escalate, resolve and recover, close
D. Identify, categorize, prioritize, log, initial diagnosis, escalate, investigate and diagnose, resolve and recover, close
Answer: A
353) Which three of these make use of a certificate as part of the protocol? (Choose three)
Answer : A , B , D
354) What are two key characteristic of VTP? (Choose two)
Answer : C D
355) Which two statement about MSDP are true? (Choose two)
Answer: C,F
356)
Refer to the Exhibit. Which statement about the effect of this configuration is true?
Answer : B
357)
Refer to the exhibit. What is the effect of the given configuration?

A. It allows SSH connections to console login into the ASA
B. Users will be authenticated against the RADIUS servers defined in the adm_net list
C. It requires the enable password to be authorized by the LOCAL database
D. It allows users to log in with any user name in the LOCAL database
E. It enables management authorization for a user-authentication RADIUS server
Answer: B
358) Which authentication does WCCPv2 use to protect massage against interception ,inspection and reply attack?
Answer : C
359) Which AS-path ACL is used to deny all the prefixes that original in AS65104 and permit all other prefixes?
Answer : E
360)
Refer to the exhibit. Host 1 is assigned the static ip address 10.1.1.200 as shown but host 3 have dynamic ip address
DHCP snooping and dynamic ARP inception are configured on the network. What command sequence must you
configured on the switch to allow host 1 to communicate woith the other hosts?
Answer: A
361) You have noticed a continuous flow of %CRYP TO-4-PKT_REPLAY-ERR:decrypt check failed events in the
log of a router on a network configured with IPSec. Which command can you enter to mitigate the possible
counter-based reply problem with the least impact on IPSec security?
Answer: B
362) Which Three of these are properties of RC4?(Choose Three)
Answer: B , E, F
What is this configuration designed to prevent?
A. Man in the Middle Attacks
B. DNS Inspection
C. Backdoor control channels for infected hosts
D. Dynamic payload inspection
Answer: C
364) Which two statement about MSS(Maximum segment size) values are true? (Choose two)
Answer: E, F
365) Which two ISE Probes would be required to distinguish accurately the difference between an iPad and a
MacBook Pro? (Choose two.)
A. DHCP or DHCPSPAN
B. SNMPTRAP
C. SNMPQUERY
D. NESSUS
E. HTTP
F. DHCP TRAP
Answer: A, E
366) Which option is the correct definition for MAB?
A. MAB is the process of checking the mac-address-table on the local switch for the sticky address. If the mac-
address of the device attempting to access the network matches the configured sticky address, it will be permitted
to bypass 802.1X authentication.
B. MAB is a process where the switch will send an authentication request on behalf of the endpoint that is
attempting to access the network, using the mac-address of the device as the credentials. The authentication server
evaluates that MAC address against a list of devices permitted to access the network without a stronger
authentication.
C. MAB is a process where the switch will check a local list of MAC addresses to identify systems that are permitted
network access without using 802.1X.
D. MAB is a process where the supplicant on the endpoint is configured to send the MAC address of the endpoint as
its credentials.
Answer: B
367) Review the exhibit.
Which three statements about the Cisco IPS sensor are true? (Choose three.)
A. A
B. B
C. C
D. D
E. E
Answer: A, C, E
368) Which QoS marking is only locally significant on a Cisco router?
A. MPLS EXP
B. DSCP
C. QoS group
D. IP precedence
E. traffic class
F. flow label
Answer: C
369)Which two VLSM subnets, when taken as a pair, overlap? (Choose two.)
A. 10.22.21.128/26
B. 10.22.22.128/26
C. 10.22.22.0/27
D. 10.22.20.0/23
E. 10.22.16.0/22
Answer: A, D
370)What is the ICMPv6 type and destination IPv6 address for a Neighbor Solicitation packet that is sent by a router
that wants to learn about a newly introduced network device?
A. ICMP type 136 and the Solicited-Node multicast address
B. ICMP type 135 and the Broadcast address
C. ICMP type 136 and the All-Routers multicast address
D. ICMP type 135 and the All-Routers multicast address
E. ICMP type 135 and the Solicited-Node multicast address
F. ICMP type 136 and the Broadcast address
Answer: E
371)Which three options are extension headers that are implemented in IPv6? (Choose three.)
A. Routing Header.
B. Generic Tunnel Header.
C. Quality of Service Header.
D. Fragment Header.
E. Encapsulating Security Payload Header.
F. Path MTU Discovery Header.
Answer: A, D, E
372)What is a key characteristic of MSTP?
A. always uses a separate STP instance per VLAN to increase efficiency
B. only supports a single STP instance for all VLANs
C. is a Cisco proprietary standard
D. several VLANs can be mapped to the same spanning-tree instance
Answer: D
373) Which spanning-tree mode supports a separate spanning-tree instance for each VLAN and also supports the
802.1w standard that has a faster convergence than 802.1D?
A. PVST+
B. PVRST+
C. PVST
D. CST
E. MST
F. RST
Answer: B
374)Which three LSA types are used by OSPFv3? (Choose three.)
A. Link LSA
B. Intra-Area Prefix LSA
C. Interarea-prefix LSA for ASBRs
D. Autonomous system external LSA
E. Internetwork LSA
Asnwer:B,C,D
375)Which protocol provides the same functions in IPv6 that IGMP provides in IPv4 networks?
A. ICMPv6
B. ND
C. MLD
D. TLA
Answer: C
376)Which authentication scheme, that is supported on the Cisco ASA, generates a unique key that is used in a
single password challenge?
A. one-time passwords
B. disposable certificates
C. password management
D. Capcha web text
Answer: A
377)Which label is advertised by an LSR to inform neighboring LSRs to perform the penultimate hop popping
operation?
A. 0x00
B. php
C. swap
D. push
E. imp-null
Answer: E
378)When the RSA algorithm is used for signing a message from Alice to Bob, which statement best describes that
operation?
A. Alice signs the message with her private key, and Bob verifies that signature with Alice's public key.
B. Alice signs the message with her public key, and Bob verifies that signature with Alice's private key.
C. Alice signs the message with Bob's private key, and Bob verifies that signature with his public key.
D. Alice signs the message with Bob's public key, and Bob verifies that signature with his private key.
E. Alice signs the message with her public key, and Bob verifies that signature with his private key.
F. Alice signs the message with her private key, and Bob verifies that signature with his public key.
Answer: A
379) According to RFC-5426, syslog senders must support sending syslog message datagrams to which port?
A. TCP port 514
B. UDP port 514
C. TCP port 69
D. UDP port 69
E. TCP port 161
F. UDP port 161
Answer: B
380)What is the function of this command?
switch(config-if)# switchport port-security mac-address sticky
A. It allows the switch to restrict the MAC addresses on the switch port, based on the static MAC addresses
configured in the startup configuration.
B. It allows the administrator to manually configure the secured MAC addresses on the switch port.
C. It allows the switch to permanently store the secured MAC addresses in the MAC address table (CAM table).
D. It allows the switch to perform sticky learning, in which the dynamically learned MAC addresses are copied from
the MAC address table (CAM table) to the startup configuration.
E. It allows the switch to dynamically learn the MAC addresses on the switch port, and the MAC addresses will be
added to the running configuration
Answer: E
381)When configuring a switchport for port security that will support multiple devices and that has already been
configured for 802.1X support, which two commands need to be added? (Choose two.)
A. The 802.1X port configuration must be extended with the command dot1x multiple-host.
B. The 802.1X port configuration must be extended with the command dot1x port-security.
C. The switchport configuration needs to include the command switchport port-security.
D. The switchport configuration needs to include the port-security aging command.
E. The 802.1X port configuration needs to remain in port-control force-authorized rather than port-control auto.
Answer: A, C
382) In Cisco IOS, what is the result of the ip dns spoofing command on DNS queries that are coming from the inside
and are destined to DNS servers on the outside?
A. The router will prevent DNS packets without TSIG information from passing through the router.
B. The router will act as a proxy to the DNS request and reply to the DNS request with the IP address of the interface
that received the DNS query if the outside interface is down.
C. The router will take the DNS query and forward it on to the DNS server with its information in place of the client
IP.
D. The router will block unknown DNS requests on both the inside and outside interfaces.
Answer: B
383)Which three traffic conditions can be matched when configuring single rate, dual token bucket traffic policing
on Cisco routers? (Choose three.)
A. conform
B. normal
C. violate
D. peak
E. exceed
F. average
Answer: A, C, E
384) A frame relay PVC at router HQ has a CIR of 768 kb/s and the frame relay PVC at router branch office has a CIR
of 384 kb/s. Which QoS mechanism can best be used to ease the data congestion and data loss due to the CIR speed
mismatch?
A. traffic policing at the HQ
B. traffic policing at the branch office
C. traffic shaping at the HQ
D. traffic shaping at the branch office
E. LLQ at the HQ
F. LLQ at the branch office
Answer: C
385)Which four options could be flagged as potential issues by a network security risk assessment? (Choose four.)
A. router hostname and IP addressing scheme
B. router filtering rules
C. route optimization
D. database connectivity and RTT
E. weak authentication mechanisms
F. improperly configured email servers
G. potential web server exploits
Answer: B, E, F, G
386) Which MPLS label is the signaled value to activate PHP (penultimate hop popping)?
A. 0x00
B. php
C. swap
D. push
E. imp-null
Answer: E
387) What action will be taken by a Cisco IOS router if a TCP packet, with the DF bit set, is larger than the egress
interface MTU?
A. Split the packet into two packets, so that neither packet exceeds the egress interface MTU, and forward them
out.
B. Respond to the sender with an ICMP Type 3 , Code 4.
C. Respond to the sender with an ICMP Type 12, Code 2.
D. Transmit the packet unmodified.
Answer: B
388)What will the receiving router do when it receives a packet that is too large to forward, and the DF bit is not set
in the IP header?
A. Drop the packet, and send the source an ICMP packet, indicating that the packet was too big to transmit.
B. Fragment the packet into segments, with all segments having the MF bit set.
C. Fragment the packet into segments, with all except the last segment having the MF bit set.
D. Fragment the packet into segments, with all except the first segment having the MF bit set.
Answer: C
389) Identify three IPv6 extension headers? (Choose three.)
A. traffic class
B. flow label
C. routing
D. fragment
E. encapsulating security payload
Answer: C, D, E
390)Which three statements are true regarding the EIGRP update message? (Choose three.)
A. Updates require an acknowledgement with an ACK message.
B. Updates can be sent to the multicast address 224.0.0.10.
C. Updates are sent as unicasts when they are retransmitted.
D. Updates always include all routes known by the router with partial updates sent in the Reply message.
E. ACKs for updates are handled by TCP mechanisms.
Answer: A, B, C
391)Which two EIGRP packet types are considered to be unreliable packets? (Choose two.)
A. update
B. query
C. reply
D. hello
E. acknowledgement
Answer: D, E
392)Which IPv6 routing protocol can use IPv6 ESP and AH to provide integrity, authentication, and confidentiality
services to protect the routing information exchange between the adjacent routing neighbors?
A. RIPng
B. EIGRPv6
C. BGP-4
D. IS-IS
E. OSPFv3
Answer: E
393)Which additional capability was added in IGMPv3?
A. leave group messages support
B. source filtering support
C. group-specific host membership queries support
D. IPv6 support
E. authentication support between the multicast receivers and the last hop router
Answer: B
394) Beacons, probe request, and association request frames are associated with which category?
A. management
B. control
C. data
D. request
Answer: A
395)Which feature can be implemented to avoid any MPLS packet loss?
A. IP TTL propagation
B. LDP IGP sync
C. label advertisement sync
D. conditional label advertisement
E. PHP
Answer: B
396)Which domain is used for a reverse lookup of IPv4 addresses?
A. in-addr.arpa
B. ip4.arpa
C. in-addr.net
D. ip4.net
Answer: A
397)Which port or ports are used for the FTP data channel in passive mode?
A. random TCP ports
B. TCP port 21 on the server side
C. TCP port 21 on the client side
D. TCP port 20 on the server side
E. TCP port 20 on the client side
Answer: A
398)Why do firewalls need to specially treat an active mode FTP session?
A. The data channel is originating from a server side.
B. The FTP client opens too many concurrent data connections.
C. The FTP server sends chunks of data that are too big.
D. The data channel is using a 7-bit transfer mode.
Answer: A
399)Which statement is true about the TFTP protocol?
A. The client is unable to get a directory listing from the server.
B. The client is unable to create a new file on a server.
C. The client needs to log in with a username and password.
D. The client needs to log in using "anonymous" as a username and specifying an email address as a password.
Answer: A
400)Which NTP stratum level means that the clock is unsynchronized?
A. 0
B. 1
C. 8
D. 16
Answer: D
401)Which statement is true about an NTP server?
A. It answers using UTC time.
B. It uses the local time of the server with its time zone indication.
C. It uses the local time of the server and does not indicate its time zone.
D. It answers using the time zone of the client.
Answer: A
402)Which statement is true about an SNMPv2 communication?
A. The whole communication is not encrypted.
B. Only the community field is encrypted.
C. Only the query packets are encrypted.
D. The whole communication is encrypted.
Answer: A
403)Which four functionalities are built into the ISE? (Choose four.)
A. Profiling Server
B. Profiling Collector
C. RADIUS AAA for Device Administration
D. RADIUS AAA for Network Access
E. TACACS+ for Device Administration
F. TACACS+ for Network Access
G. Guest Lifecycle Management
Answer: A, B, D, G
404)Which two statements about the fragmentation of IPsec packets in routers are true? (Choose two.)
By default, the IP packets that need encryption are first encrypted with ESP. If the resulting encrypted packet
exceeds the IP MTU on the egress physical interface, then the encrypted packet is fragmented and sent out.
B. By default, the router knows the IPsec overhead to add to the packet. The router performs a lookup if the packet
will exceed the egress physical interface IP MTU after encryption, then fragments the packet and encrypts the
resulting IP fragments separately.
C. increases CPU utilization on the decrypting device.
D. increases CPU utilization on the encrypting device.
Answer: B, C
405)crypto gdoi group gdoi_group
server local
sa receive-only
sa ipsec 1
profile gdoi-p
match address ipv4 120
Which statement about the above configuration is true?
A. The key server instructs the DMVPN spoke to install SAs outbound only.
B. The key server instructs the GDOI group to install SAs inbound only.
C. The key server instructs the DMVPN hub to install SAs outbound only.
D. The key server instructs the GDOI spoke to install SAs inbound only.
Answer: B
According to this DHCP packet header, which field is populated by a DHCP relay agent with its own IP address before
the DHCPDISCOVER message is forwarded to the DHCP server?
A. ciaddr
B. yiaddr
C. siaddr
D. giaddr
Answer: D
407)Which two are valid SMTP commands, according to RFC 821? (Choose two.)
A. EHLO
B. HELO
C. RCPT
D. AUTH
Answer: B, C
408)Which two statements about VTP passwords are true? (Choose two)
A. The VTP password can only be configured when the switch is in Server mode.
B. The VTP password is sent in the summary advertisements..
C. The VTP password is encrypted for confidentiality using 3DES.
D. VTP is not required to be configured on all switches in the domain.
E. The VTP password is hashed to preserve authenticity using the MD5 algorithm.
F. The VTP password can only be configured when the switch is in Client mode.
Answer: B, E
409)Which option represents IPv6 address ff02::1?
A. PIM routers.
B. RIP routers.
C. all nodes on the local network.
D. NTP.
Answer: C
410) Which two statements about IPv6 are true? (Choose two.)
A. Broadcast is available.
B. Routing tables are less complicated.
C. The address pool will eventually deplete.
D. Data encryption is built into the packet frame.
E. Increased NAT is required.
F. Fewer bits makes IPv6 easier to configure.
Answer: B, D
411) Which statement describes an IPv6 benefit?
A. Broadcast is not available.
B. Routing tables are more complicated.
C. The address pool is limited.
D. Data encryption is not built into the packet frame.
E. Increased NAT is required.
Answer: A
412) Which option is representative of automatic IP addressing in IPv4?
A. 10.1.x.x
B. 172.10.1.x
C. 169.254.x.x
D. 196.245.x.x
E. 128.1.1.x
F. 127.1.x.x
Answer: C
Which option describes the behavior of this configuration?
A. Traffic from the 30.30.0.0/16 network to the 10.10.0.0/32 network will be translated.
B. Traffic from the 30.30.0.0/32 network to the 10.10.0.0/16 network will not be translated.
C. Traffic from the 10.10.0.0/16 network to the 30.30.30.0/24 network will not be translated.
D. Traffic from the 10.10.0.0/32 network to the 30.30.30.0/16 network will be translated.
Answer: C
A. Host 10.10.10.1 will get translated as 20.20.20.1 from inside to outside.
B. Host 20.20.20.1 will be translated as 10.10.10.1 from outside to inside.
C. Host 20.20.20.1 will be translated as 10.10.10.1 from inside to outside.
D. Host 10.10.10.1 will be translated as 20.20.20.1 from outside to inside.
Answer: A
415)Which ICMP message type code indicates fragment reassembly time exceeded?
A. Type 4, Code 0
B. Type 11, Code 0
C. Type 11, Code 1
D. Type 12, Code 2
Answer: C
416) Which IPV4 header field increments every time when packet is sent from a source to a destination?
A. Flag
B. Fragment Offset
C. Identification
D. Time To Live
Answer: C
417)A device is sending a PDU of 5000 B on a link with an MTU of 1500 B. If the PDU includes 20 B of IP header,
which statement is true?
A. The first three packets will have a packet payload size of 1400.
B. The last packet will have a payload size of 560.
C. The first three packets will have a packet payload size of 1480.
D. The last packet will have a payload size of 20.
Answer: C
418) Which statement about VLAN is true?
A. VLAN cannot be routed.
B. VLANs 1006 through 4094 are not propagated by VTP.
C. VLAN1 is a Cisco default VLAN that can be deleted.
D. The extended-range VLANs cannot be configured in global configuration mode.
Answer: B
419) Which two statements about SNMP are true? (Choose two)
A. SNMP operates at Layer-6 of the OSI model.
B. NMS sends a request to the agent at TCP port 161.
C. NMS sends request to the agent from any source port.
D. NMS receives notifications from the agent on UDP 162.
E. MIB is a hierarchical representation of management data on NMS.
Answer: C, D
420) Which two statement about the DNS are true? (Choose two.)
A. The client-server architecture is based on query and response messages.
B. Query and response messages have different format.
C. In the DNS message header, the QR flag set to 1 indicates a query.
D. In the DNS header, an Opcode value of 2 represents a client status request.
E. In the DNS header, the Rcode value is set to 0 in Query message.
Answer: A, D
421)Which three HTTP header fields can be classified by NBAR for request messages? (Choose three.)
A. User-Agent
B. Server
C. Referrer
D. Content-Encoding
E. Location
F. From
Answer: A, C, F
A. The packet will be dropped if received on the same interface that the router would use to forward return packet.
B. The packet will be forwarded as long as it is in the routing table.
C. The packet will be forwarded if received on the same interface that the router would use to forward return
packet.
D. Packet will be forwarded only if exists a default route for the return path.
Answer: C
423) Which three types of traffic are processed by CoPP configured on the device? (Choose three.)
A. tansient traffic
B. routing protocol traffic
C. IPsec traffic
D. traffic that is destined to the device interface
E. any traffic filtered by the access list
F. traffic from a management protocol such as Telnet or SNMP
Answer: B, D, F
424) Which statement about PVLAN setup is true?
A. The host that is connected to the community port can communicate with a host that is connected to a different
community port.
B. The host that is connected to the community port cannot communicate with hosts that are connected to the
promiscuous port.
C. The host that is connected to the community port cannot communicate with hosts that are connected to the
isolated port.
D. The host that is connected to the community port can only communicate with hosts that are connected to the
same community port.
Answer: C
425) Which statement applies to Flexible NetFlow?
A. Flexible NetFlow uses seven key fields in IP datagrams to identify the flow.
B. Flexible NetFlow uses key fields of IP datagram to identify fields from which data is captured.
C. User-defined flows can be defined in Flexible NetFlow.
D. Flexible NetFlow cannot be used for billing and accounting applications.
E. Flexible NetFlow does not have any predefined records.
Answer: C
426)Which statement about Storm Control implementation on a switch is true?
A. Storm Control does not prevent disruption due to unicast traffic.
B. Storm Control is implemented as a global configuration.
C. Storm Control uses the bandwidth and rate at which a packet is received to measure the activity.
D. Storm Control uses the bandwidth and rate at which a packet is dispatched to measure the activity.
E. Storm Control is enabled by default.
Answer: C
If SW4 is sending superior BPDUs, where should the root guard feature be configured to preserve SW3 as a root
bridge?
A. SW4 Gi0/0 interface.
B. Sw3 Gi0/0 interface.
C. Sw2 Gi0/1 interface.
D. SW2 Gi0/1 and SW3 Gi0/1
Answer: C
Which three statements correctly describe the configuration? (Choose three).
A. The tunnel is not providing peer authentication
B. The tunnel encapsulates multicast traffic.
C. This is a point-to-point GRE tunnel.
D. The configuration is on the NHS.
E. The configuration is on the NHC.
F. The tunnel provides data confidentiality.
G. The tunnel IP address represents the NBMA address.
Answer: B, D, F
Which statement correctly describes the configuration?
A. The configuration is the super view configuration of role-based access control.
B. The configuration would not work unless the AAA server is configured for authentication and authorization.
C. The exec commands in the configuration will be excluded from the test view.
D. The configuration is the CLI configuration of role-based access control.
Answer: D
430) Which item is not encrypted by ESP?
A. ESP header
B. ESP trailer
C. IP header
D. Data
E. TCP-UDP header
Answer: A
431) Which item is not authenticated by ESP?
A. ESP header
B. ESP trailer
C. New IP header
D. Original IP header
E. Data
F. TCP-UDP header
Answer: C
432) Which statement about the Cisco NAC CAS is true?
A. The Cisco NAC CAS acts as a gateway between untrusted networks.
B. The Cisco NAC CAS can only operate as an in-band real IP gateway.
C. The Cisco NAC CAS can operate as an out-of-band virtual gateway.
D. The Cisco NAC CAS is an administration and monitoring server.
Answer: C
433) Which two statements about dynamic ARP inspection are true? (Choose two.)
A. Dynamic ARP inspection checks ARP packets on both trusted and untrusted ports.
B. Dynamic ARP inspection is only supported on access and trunk ports.
C. Dynamic ARP inspection checks invalid ARP packets against the trusted database.
D. The trusted database to check for an invalid ARP packet is manually configured.
E. Dynamic ARP inspection does not perform ingress security checking.
F. DHCP snooping must be enabled.
Answer: C, F
Which command caused the above messages?
A. Neighbor 101.0.0.1 maximum-prefix 500 80 warning-only.
B. Neighbor 101.0.0.1 maximum-prefix 500 90.
C. Neighbor 101.0.0.1 maximum-prefix 500 70.
D. Neighbor 101.0.0.1 maximum-prefix 500 70 warning-only.
Answer: C
435) Which two options describe the main purpose of EIGRP authentication? (Choose two.)
A. To identify authorized peers.
B. To allow faster convergence
C. To provide redundancy
D. To prevent injection of incorrect routing information.
E. To provide routing updates confidentiality
Answer: A, D
436) Which statement about IPv6 is true?
A. Broadcast is available.
B. The address pool will never deplete.
C. Data security is natively supported through mandatory IPv6 extension headers for ESP and AH.
D. Increased NAT is required compared to IPv4.
E. IPv6 has fewer bits available for addressing than IPv4.
Answer: C
437) Which IPv4 header field usually increments for each subsequent packet sent?
A. Flag
B. Fragment Offset
C. Identification
D. Time To Live
Answer: C
438) Which address range is representative of Automatic Private IP Addressing?
A. 10.1.x.x
B. 172.10.1.x
C. 169.254.x.x
D. 196.245.x.x
E. 128.1.1.x
F. 127.1.x.x
Answer: C
439) Which ICMP message type code indicates fragmentation needed but DF bit set?
A. Type 3, Code 0
B. Type 4, Code 2
C. Type 3, Code 4
D. Type 8, Code 0
Answer: C
440) Which group of devices is represented by the IPv6 address ff02::1?
A. All PIM routers on the local network.
B. All the routers running RIP on the local network.
C. All nodes on the local network.
D. All NTP servers on the local network.
Answer: C
441) Which statement about layer-2 VLAN is true?
A. VLAN cannot be routed.
B. VLANs 1006 through 4094 are not propagated by VTP version 3.
C. VLAN1 is a Cisco default VLAN that can be deleted.
D. The extended-range VLANs cannot be configured in global configuration mode.
Answer: A
442) Which two statements about the OSPF authentication configuration are true? (Choose two.)
A. OSPF authentication is required in area 0.
B. There are three types of OSPF authentication options available.
C. In MD5 authentication, the password is encrypted when it is sent.
D. Null authentication includes the password in clear-text.
E. Type-3 authentication is a clear-text password authentication.
F. In MD5 authentication, the password never goes across the network.
Answer: B, F
443) Which statement about DH group is true?
A. The DH group does not provide data authentication.
B. The DH group is used to provide data confidentiality.
C. The DH group is used to establish a shared key over a secured medium.
D. The DH group is negotiated in IPsec phase-2.
Answer: A
444) Which statement about DHCP is true?
A. DHCP uses TCP port 68 and 67
B. The DHCPDiscover packet is a broadcast message
C. The DHCPRequest is a unicast message.
D. The DHCPOffer packet is sent from the DHCP client
Answer: B
445) Which three statements about SMTP are true? (Choose three.)
A. SMTP uses TCP port 25.
B. The POP protocol is used by the SMTP client to manage stored mail.
C. The IMAP protocol is used by the SMTP client to send email.
D. The mail delivery agent in the SMTP architecture is responsible for DNS lookup.
E. SMTPS uses SSL and TLS.
F. SMTP uses TCP port 587.
Answer: A, E, F
446) Which statement about DNS is true?
A. The client-server architecture is based on push-pull messages.
B. Query and response messages have different format.
C. In the DNS message header, the QR flag set to 1 indicates a query.
D. In the DNS header, an Opcode value of 2 represents a server status request.
E. In the DNS header, the Rcode value is set to 0 for format error.
Answer: D
447) Which statement about Infrastructure ACLs on Cisco IOS software is true?
A. Infrastructure ACLs are used to protect the device forwarding path.
B. Infrastructure ACLs are used to protect device management and internal link addresses.
C. Infrastructure ACLs are used to authorize the transit traffic.
D. Infrastructure ACLs only protect device physical management interface.
Answer: B
448) In traceroute, which ICMP message indicates the packet is dropped by a router in the path?
A. Type 3, Code 3
B. Type 11, Code 0
C. Type 5, Code 1
D. Type 3, Code 1
E. Type 11, Code 1
Answer: B
449) Which three statements about Dynamic ARP Inspection on Cisco Switches are true? (Choose three.)
A. Dynamic ARP inspection checks ARP packets on both trusted and untrusted ports.
B. Dynamic ARP inspection is only supported on access ports.
C. Dynamic ARP inspection checks ARP packets against the trusted database.
D. The trusted database can be manually configured using the CLI.
E. Dynamic ARP inspection does not perform ingress security checking.
F. DHCP snooping is used to dynamically build the trusted database.
Answer: C, D, F
450) Which statement about the PVLAN is true?
A. Promiscuous ports can only communicate with other promiscuous ports.
B. Isolated ports cannot communicate with the other promiscuous ports.
C. Community ports can communicate with the other promiscuous ports but not with the other community ports.
D. Isolated ports can communicate with the other isolated ports only.
E. Promiscuous ports can communicate with all the other type of ports.
F. Community ports can communicate with the other community ports but not with promiscuous ports.
Answer: E
451) A device is sending a PDU of 5000 B on a link with an MTU of 1500 B. If the PDU includes 20 B of IP header,
which statement is true considering the most efficient way to transmit this PDU?
A. The first three packets will have a packet payload size of 1400.
B. The last packet will have a payload size of 560.
C. The first three packets will have a packet payload size of 1480.
D. The last packet will have a payload size of 20.
Answer: C
A. Traffic from the 30.30.0.0/16 network to the 10.10.0.0/32 network will be translated.
B. Traffic from the 30.30.0.0/32 network to the 10.10.0.0/16 network will not be translated.
C. Traffic from the 10.10.0.0/16 network to the 30.30.30.0/24 network will not be translated.
D. Traffic from the 10.10.0.0/32 network to the 30.30.30.0/16 network will be translated.
Answer: C
A. Traffic from the n2 network object to the outside network will be translated using the g1 network objects and
outside interface.
B. Traffic from the n3 network object to the inside network will be translated using the g1 network objects and
outside interface.
C. Traffic from the n1 network object to the outside network will be translated using the g1 network object and
outside interface.
D. Traffic from the n3 network object to the outside network will be translated using the g1 network object and
outside interface.
Answer: D
A. Traffic from the n2 network object to the inside network will be translated using the n1 network object.
B. Traffic from the n1 network object to the outside network will be translated using the n2 network object.
C. Traffic from the n2 network object to the outside network will be translated using the n1 network object.
D. Traffic from the n2 network object to the outside network will be translated using the n2 network object.
Answer: C
455) What are two advantages of using NLA with Windows Terminal Services? (Choose two.)
A. uses SPNEGO and TLS to provide optional double encryption of user credentials
B. forces the use of Kerberos to pass credentials from client to server
C. protects against man-in-the-middle attacks
D. requires clients to present an SSL certificate to verify their authenticity
E. protects servers against DoS attacks by requiring lesser resources for authentication
Answer: A, C
456) Which record statement is part of the NetFlow monitor configuration that is used to collect MPLS traffic with
an IPv6 payload?
A. record mpls IPv6-fields labels 3
B. record mpls IPv4-fields labels 3
C. record mpls labels 3
D. record mpls ipv6-fields labels
Answer: A
457) Hierarchical priority queuing is used on the interfaces on which you enable a traffic-shaping queue. Which two
statements about hierarchical priority queuing are true? (Choose two.)
A. Priority packets are never dropped from the shape queue unless the sustained rate of priority traffic exceeds the
shape rate.
B. For IPsec-encrypted packets, you can match traffic based only on the DSCP or precedence setting.
C. IPsec over TCP is not supported for priority traffic classification.
D. For IPsec-encrypted packets, you cannot match traffic based on the DSCP or precedence setting.
E. IPsec over TCP is supported for priority traffic classification.
Answer: B, C
458) Which two MAC authentication methods are supported on WLCs? (Choose two.)
A. local MAC authentication
B. MAC authentication using a RADIUS server
C. MAC authentication using tokens
D. MAC authentication using a PIN
Answer: A, B
459) Client MFP supplements rather than replaces infrastructure MFP. Which three are client MFP components?
(Choose three.)
A. key generation and distribution
B. protection and validation of management frames
C. error reports
D. error generation
E. non-management messages protection
Answer: A, B, C
460) Which two items are required for LDAP authenticated bind operations? (Choose two.)
A. Root DN
B. Password
C. Username
D. SSO
E. UID
Answer: A, B
461) Which three authentication types does OSPF support? (Choose three.)
A. Null
B. Plaintext
C. MD5
D. PAP
E. PEAP
F. MS-CHAP
Answer: A, B, C
462) Which three steps are required to rekey the routers on a link without dropping OSPFv3 protocol packets or
disturbing the adjacency? (Choose three.)
A. For every router on the link, create an additional inbound SA for the interface that is being rekeyed using a new
SPI and the new key.
B. For every router on the link, replace the original outbound SA with one that uses the new SPI and key values.
C. For every router on the link, remove the original inbound SA.
D. For every router on the link, create an additional outbound SA for the interface that is being rekeyed using a new
SPI and the new key.
E. For every router on the link, replace the original inbound SA with one that uses the new SPI and key values.
F. For every router on the link, remove the original outbound SA.
Answer: A, B, C
463) Which BGP configuration forces the session to tear down when the learned routes from the neighbor exceed
10?
A. neighbor 10.0.0.1 maximum-prefix 10 80 warning-only
B. neighbor 10.0.0.1 maximum-prefix 10 80
C. neighbor 10.0.0.1 maximum-prefix 80 10 warning-only
D. neighbor 10.0.0.1 maximum-prefix 80 10
Answer: B
464) Which three RADIUS protocol statements are true? (Choose three.)
A. RADIUS protocol runs over TCP 1645 and 1646.
B. Network Access Server operates as a server for RADIUS.
C. RADIUS packet types for authentication include Access-Request, Access-Challenge, Access-Accept, and Access-
Reject.
D. RADIUS protocol runs over UDP 1812 and 1813.
E. RADIUS packet types for authentication include Access-Request, Access-Challenge, Access-Permit, and Access-
Denied.
F. RADIUS supports PPP, PAP, and CHAP as authentication methods.
Answer: C, D, F
465) Which three statements are true about TLS? (Choose three.)
A. TLS protocol uses a MAC to protect the message integrity.
B. TLS data encryption is provided by the use of asymmetric cryptography.
C. The identity of a TLS peer can be authenticated using public key or asymmetric cryptography.
D. TLS protocol is originally based on the SSL 3.0 protocol specification.
E. TLS provides support for confidentiality, authentication, and nonrepudiation.
Answer: A, C, D
466) Which three features are supported with ESP? (Choose three.)
A. ESP uses IP protocol 50.
B. ESP supports Layer 4 and above encryption only.
C. ESP provides confidentiality, data origin authentication, connectionless integrity, and antireplay service.
D. ESP supports tunnel or transport modes.
E. ESP has less overhead and is faster than the AH protocol.
F. ESP provides confidentiality, data origin authentication, connection-oriented integrity, and antireplay service.
Answer: A, C, D
467) Which three options correctly describe the AH protocol? (Choose three.)
A. The AH protocol encrypts the entire IP and upper layer protocols for security.
B. The AH protocol provides connectionless integrity and data origin authentication.
C. The AH protocol provides protection against replay attacks.
D. The AH protocol supports tunnel mode only.
E. The AH protocol uses IP protocol 51.
F. The AH protocol supports IPv4 only.
Answer: B, C, E
468) Which two identifiers are used by a Cisco Easy VPN Server to reference the correct group policy information for
connecting a Cisco Easy VPN Client? (Choose two.)
A. IKE ID_KEY_ID
B. OU field in a certificate that is presented by a client
C. XAUTH username
D. hash of the OTP that is sent during XAUTH challenge/response
E. IKE ID_IPV4_ADDR
Answer: A, B
469) Which two security measures are provided when you configure 802.1X on switchports that connect to
corporate-controlled wireless access points? (Choose two.)
A. It prevents rogue APs from being wired into the network.
B. It provides encryption capability of data traffic between APs and controllers.
C. It prevents rogue clients from accessing the wired network.
D. It ensures that 802.1x requirements for wired PCs can no longer be bypassed by disconnecting the AP and
connecting a PC in its place.
Answer: A, D
470) Which configuration implements an ingress traffic filter on a dual-stack ISR border router to prevent attacks
from the outside to services such as DNSv6 and DHCPv6?
A. !
ipv6 access-list test
deny ipv6 FF05::/16 any
deny ipv6 any FF05::/16
! output omitted
permit ipv6 any any
B. !
permit ipv6 any FF05::/16
! output omitted
deny ipv6 any any
C. !
deny ipv6 any any eq dns
deny ipv6 any any eq dhcp
! output omitted
permit ipv6 any any
D. !
deny ipv6 any 2000::/3
! output omitted
permit ipv6 any any
E. !
deny ipv6 any FE80::/10
! output omitted
permit ipv6 any any
Answer: A
471) Which protocol does 802.1X use between the supplicant and the authenticator to authenticate users who wish
to access the network?
A. SNMP
B. TACACS+
C. RADIUS
D. EAP over LAN
E. PPPoE
Answer: D
472) Which two statements are correct regarding the AES encryption algorithm? (Choose two.)
A. It is a FIPS-approved symmetric block cipher.
B. It supports a block size of 128, 192, or 256 bits.
C. It supports a variable length block size from 16 to 448 bits.
D. It supports a cipher key size of 128, 192, or 256 bits.
E. The AES encryption algorithm is based on the presumed difficulty of factoring large integers.
Answer: A, D
473) What are two benefits of using IKEv2 instead of IKEv1 when deploying remote-access IPsec VPNs? (Choose
two.)
A. IKEv2 supports EAP authentication methods as part of the protocol.
B. IKEv2 inherently supports NAT traversal.
C. IKEv2 messages use random message IDs.
D. The IKEv2 SA plus the IPsec SA can be established in six messages instead of nine messages.
E. All IKEv2 messages are encryption-protected.
Answer: A, B
474) DNSSEC was designed to overcome which security limitation of DNS?
A. DNS man-in-the-middle attacks
B. DNS flood attacks
C. DNS fragmentation attacks
D. DNS hash attacks
E. DNS replay attacks
F. DNS violation attacks
Answer: A
475) Which SSL protocol takes an application message to be transmitted, fragments the data into manageable
blocks, optionally compresses the data, applies a MAC, encrypts, adds a header, and transmits the resulting unit in a
TCP segment?
A. SSL Handshake Protocol
B. SSL Alert Protocol
C. SSL Record Protocol
D. SSL Change CipherSpec Protocol
Answer: C
476)
Refer to the exhibit. You log the cisco IPS and a warming banner is displayed as shown.What user role is assigned to
the account you used to log in?
Answer : D
477) you have configured an ASA firewall in multiple context mode. If the context are sharing an inteface what are
two of the action you could take to classify packet to the appropriate context? (choose two)
Answer:A,B
478) What context-based Access control(CBAC)Command sets the maximum time that a router running
Cisco IOS will wait for a new TCP session to reach the establish state?
Answer : B
479)
Refer to the exhibit R1 and R2 are failing to establish a BGP neighbor relation, What is a possible reason for the
problem?
Answer:A
480) Which two statement about CBAC are true? (Choose two)
Answer : A , B
481) Which three statements about the keying methods used by MACSec are true? (Choose three.)
A. Key management for host-to-switch and switch-to-switch MACSec sessions is provided by MKA.
B. A valid mode for SAP is NULL.
C. MKA is implemented as an EAPoL packet exchange.
D. SAP is enabled by default for Cisco TrustSec in manual configuration mode.
E. SAP is not supported on switch SVIs.
F. SAP is supported on SPAN destination ports.
Answer: B, C, E
482)Which two statement about source specific multicast are true? (Choose two)
Answer: D,E
483) Which three of these situations warrant engagement of a Security Incident Response team? (Choose three.)
A. loss of data confidentiality/integrity
B. damage to computer/network resources
C. denial of service (DoS)
D. computer or network misuse/abuse
E. pornographic blogs/websites
Answer: A, C, D
484) What are three of the components of the Cisco PCI solution framework (choose three)
A. Infrastructure
B. Risk Assessment
C. Virtualization
D. Endpoint
E. Disaster management
F. Services
Answer: A, D, F
485) Which two of these are valid TACACS+ accounting packets?(Choose two)
Answer : A C
486) What are three Ways you can enforce a BCP 38 policy on an internet edge device? (Choose three)
Answer : C , E , F
487) Which two statements about CGMP frames are true? (Choose two)
Answer : B, D
488) You are trying to set up a site-to-site IPsec tunnel between two Cisco ASA adaptive security appliances, but you
are not able to pass traffic. You try to troubleshoot the issue by enabling debug crypto isakmp and see the following
messages:
CiscoASA# debug crypto isakmp
[IKEv1]: Group = 209.165.200.231, IP = 209.165.200.231, Tunnel RejecteD. Conflicting protocols specified by tunnel-
group and group-policy
[IKEv1]: Group = 209.165.200.231, IP = 209.165.200.231, QM FSM error (P2 struct &0xb0cf31e8, mess id
0x97d965e5)!
[IKEv1]: Group = 209.165.200.231, IP = 209.165.200.231, Removing peer from correlator table failed, no match!
What could be the potential problem?
A. The policy group mapped to the site-to-site tunnel group is configured to use both IPsec and SSL VPN tunnels.
B. The policy group mapped to the site-to-site tunnel group is configured to use both IPsec and L2TP over IPsec
tunnels.
C. The policy group mapped to the site-to-site tunnel group is configured to just use the SSL VPN tunnel.
D. The site-to-site tunnel group is configured to use both IPsec and L2TP over IPsec tunnels.
E. The site-to-site tunnel group is configured to just use the SSL VPN tunnel.
Answer: C
489 )
Referring to the partial Cisco IOS router configuration shown in the exhibit which statement is true?
Answer : E
490) class-map nbar_rtp
match protocol rtp payload-type "0, 1, 4 - 0x10, 10001b - 10010b, 64"
The above NBAR configuration matches RTP traffic with which payload types
A. 0, 1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 64
B. 0, 1, 4, 5, 6, 7, 8, 9, 10
C. 0, 1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 64
D. 0, 1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 64
Answer: A
491) your network is configured to block outgoing ISAKMP packet, to enable incoming access, you have configured a
users Cisco VPN clients for transparent tunneling using ipsec over TCP on port 445. The user attempts to connect to
the server are failing. what is the most likely reason for this failure?
Answer:D
492)
Refer to the exhibit What are two effect of the given configuration? (Choose two)
Answer : C , F
493)
Refer to the exhibit What is the effect of the given command?
Answer : D
494) Which three of the following statement are true about a RADIUS vendor-specific attribute? (Choose
three)
Answer : C , D, E
495) Which statement about disabling the SSID broadcast in a WI-FI environment is true?
Answer : C
496)
Refer to the exhibit What type of NAT configuration is shown?
Answer : A
497)
Refer to the exhibit You Issued the Show Crypto isakmpsa command to troubleshoot a connection failure on
an IP sec VPN What possible issue does the given output indicate?
Answer : D
498)
Refer to the Exhibit Client 1 has an IPsec VPN tunnel establish to a cisco ASA adaptive security appliance in Chicago
.the remote access VPN Client wants to access WWW.cisco.com But splits tunneling is disabled Which of these is the
appropriate configuration on the cisco ASA adaptive security appliance is theVPN clients public IP address is
209.165.201.10 and it is assigned a private address from 192.168.1.0/24?
Answer : C
499)
Refer to the exhibit, what type of packet can trigger the rate limiter in the given configuration?
Answer : A
500) When a Cisco ASA is configured for stateful failover, which information is replicated by default on the
stateful failover link? Drag and drop the state information item on the left into the corresponding category
on the right?
Answer :
501) Drag each neighbor-discover vulnerability on the left to the send mechanism that counters it on the right?
Answer :
Duplicate address detection DoS attack: RSA signature and proof of authorization in neighbor advertisement
message.
Neighbor solicitation and advertisement spoofing: RSA signature and CGA options in neighbor
Neighbor unreachability detection failure:Proof of authorization when a node responds to a neighbor solicitation.
Replay attacks: Including a nonce in solicitation message.
Router solicitation attacks: Proof of authorization in Router advertisement messages.
502) Which feature of WEP was intended to prevent and attacker from altering and resending data packet
over a WEP connection?
Answer : A
503) Which two statement about CoPP are true? (Choose two)
Answer : B, F
504) which three statement about NetFlow v9 packet are true? (Choose three)
Answer : A , B , C
505) IPsec SAs can be applied as a security mechanism for which three options? (Choose three.)
A. Send
B. Mobile IPv6
C. site-to-site virtual interfaces
D. OSPFv3
E. CAPWAP
F. LWAPP
Answer: B, C, D
506) Which four options are valid EAP mechanisms to be used with WPA2? (Choose four.)
A. PEAP
B. EAP-TLS
C. EAP-FAST
D. EAP-TTLS
E. EAPOL
F. EAP-RADIUS
G. EAP-MD5
Answer: A, B, C, D
507) Which three statements are true about the SSH protocol? (Choose three.)
A. SSH protocol runs over TCP port 23.
B. SSH protocol provides for secure remote login and other secure network services over an insecure network.
C. Telnet is more secure than SSH for remote terminal access.
D. SSH protocol runs over UDP port 22.
E. SSH transport protocol provides for authentication, key exchange, confidentiality, and integrity.
F. SSH authentication protocol supports public key, password, host based, or none as authentication methods.
Answer: B, E, F
508) Which two statements are true when comparing ESMTP and SMTP? (Choose two.)
A. Only SMTP inspection is provided on the Cisco ASA firewall.
B. A mail sender identifies itself as only able to support SMTP by issuing an EHLO command to the mail server.
C. ESMTP mail servers will respond to an EHLO with a list of the additional extensions they support.
D. SMTP commands must be in upper case, whereas ESMTP can be either lower or upper case.
E. ESMTP servers can identify the maximum email size they can receive by using the SIZE command.
Answer: C, E
509) How does a DHCP client request its previously used IP address in a DHCP DISCOVER packet?
A. It is included in the CIADDR field.
B. It is included as DHCP Option 50 in the OPTIONS field.
C. It is included in the YIADDR field.
D. It is the source IP address of the UDP/53 wrapper packet.
E. The client cannot request its last IP address; it is assigned automatically by the server.
Answer: B
510) Which two statements about an authoritative server in a DNS system are true? (Choose two.)
A. It indicates that it is authoritative for a name by setting the AA bit in responses.
B. It has a direct connection to one of the root name servers.
C. It has a ratio of exactly one authoritative name server per domain.
D. It cannot cache or respond to queries from domains outside its authority.
E. It has a ratio of at least one authoritative name server per domain.
Answer: A, E
511) Which three security features were introduced with the SNMPv3 protocol? (Choose three.)
A. Message integrity, which ensures that a packet has not been tampered with in-transit
B. DoS prevention, which ensures that the device cannot be impacted by SNMP buffer overflow
C. Authentication, which ensures that the message is from a valid source
D. Authorization, which allows access to certain data sections for certain authorized users
E. Digital certificates, which ensure nonrepudiation of authentications
F. Encryption of the packet to prevent it from being seen by an unauthorized source
Answer: A, C, F
512) Which common Microsoft protocol allows Microsoft machine administration and operates over TCP port 3389?
A. remote desktop protocol
B. desktop mirroring
C. desktop shadowing
D. Tarantella remote desktop
Answer: A
513) What does the Common Criteria (CC) standard define?
A. The current list of Common Vulnerabilities and Exposures (CVEs)
B. The U.S standards for encryption export regulations
C. Tools to support the development of pivotal, forward-looking information system technologies
D. The international standards for evaluating trust in information systems and products
E. The international standards for privacy laws
F. The standards for establishing a security incident response system
Answer: D
514) Which three types of information could be used during the incident response investigation phase? (Choose
three.)
A. netflow data
B. SNMP alerts
C. encryption policy
D. syslog output
E. IT compliance reports
Answer: A, B, D
515) Which protocol can be used to encrypt traffic sent over a GRE tunnel?
A. SSL
B. SSH
C. IPsec
D. DH
E. TLS
Answer: C
516) When you compare WEP to WPA (not WPA2), which three protections are gained? (Choose three.)
A. a message integrity check
B. AES-based encryption
C. avoidance of weak Initialization vectors
D. longer RC4 keys
E. a rekeying mechanism
Answer: A, C, E
517) Which two statements about SHA are correct? (Choose two.)
A. Five 32-bit variables are applied to the message to produce the 160-bit hash.
B. The message is split into 64-bit blocks for processing.
C. The message is split into 512-bit blocks for processing.
D. SHA-2 and MD5 both consist of four rounds of processing.
Answer: A, C
518) Which three statements about IKEv2 are correct? (Choose three.)
A. INITIAL_CONTACT is used to synchronize state between peers.
B. The IKEv2 standard defines a method for fragmenting large messages.
C. The initial exchanges of IKEv2 consist of IKE_SA_INIT and IKE_AUTH.
D. Rekeying IKE and child SAs is facilitated by the IKEv2 CREATE_CHILD_SA exchange.
E. NAT-T is not supported.
F. Attribute policy push (via the configuration payload) is only supported in REQUEST/REPLY mode.
Answer: A, C, D
519) Which three statements about LDAP are true? (Choose three.)
A. LDAP uses UDP port 389 by default.
B. LDAP is defined in terms of ASN.1 and transmitted using BER.
C. LDAP is used for accessing X.500 directory services.
D. An LDAP directory entry is uniquely identified by its DN.
E. A secure connection via TLS is established via the UseTLS operation.
Answer: B, C, D
520) Which three features describe DTLS protocol? (Choose three.)
A. DTLS handshake does not support reordering or manage loss packets.
B. DTLS provides enhanced security, as compared to TLS.
C. DTLS provides block cipher encryption and decryption services.
D. DTLS is designed to prevent man-in-the-middle attacks, message tampering, and message forgery.
E. DTLS is used by application layer protocols that use UDP as a transport mechanism.
F. DTLS does not support replay detection.
Answer: C, D, E
521) Which statement regarding TFTP is not true?
A. Communication is initiated over UDP port 69.
B. Files are transferred using a secondary data channel.
C. Data is transferred using fixed-size blocks.
D. TFTP authentication information is sent in clear text.
E. TFTP is often utilized by operating system boot loader procedures.
F. The TFTP protocol is implemented by a wide variety of operating systems and network devices.
Answer: D
522) Which three new capabilities were added to HTTP v1.1 over HTTP v1.0? (Choose three.)
A. chunked transfer encoding
B. HTTP pipelining
C. POST method
D. HTTP cookies
E. keepalive mechanism
Answer: A, B, E
523)
Refer to the exhibit, which shows a partial output of the show command.
Which statement best describes the problem?
A. Context vpn1 is not inservice.
B. There is no gateway that is configured under context vpn1.
C. The config has not been properly updated for context vpn1.
D. The gateway that is configured under context vpn1 is not inservice.
Answer: A
524) Which four protocols are supported by Cisco IOS Management Plane Protection? (Choose four.)
A. Blocks Extensible Exchange Protocol (BEEP)
B. Hypertext Transfer Protocol Secure (HTTPS)
C. Secure Copy Protocol (SCP)
D. Secure File Transfer Protocol (SFTP)
E. Secure Shell (SSH)
F. Simple Network Management Protocol (SNMP)
Answer: A, B, E, F
525) Which three statements about OCSP are correct? (Choose three.)
A. OCSP is defined in RFC2560.
B. OCSP uses only http as a transport.
C. OCSP responders can use RSA and DSA signatures to validate that responses are from trusted entities.
D. A response indicator may be good, revoked, or unknown.
E. OCSP is an updated version SCEP.
Answer: A, C, D
526) DHCPv6 is used in which IPv6 address autoconfiguration method?
A. stateful autoconfiguration
B. stateless autoconfiguration
C. EUI-64 address generation
D. cryptographically generated addresses
Answer: A
527) Which two options represent definitions that are found in the syslog protocol (RFC 5426)? (Choose two.)
A. Syslog message transport is reliable.
B. Each syslog datagram must contain only one message.
C. IPv6 syslog receivers must be able to receive datagrams of up to 1180 bytes.
D. Syslog messages must be prioritized with an IP precedence of 7.
E. Syslog servers must use NTP for the accurate time stamping of message arrival.
Answer: B, C
528) Which protocol is superseded by AES?
A. DES
B. RSA
C. RC4
D. MD5
Answer: A
529) What is the purpose of the SPI field in an IPsec packet?
A. identifies a transmission channel
B. provides anti-replay protection
C. ensures data integrity
D. contains a shared session key
Answer: A
530) Which IPsec protocol provides data integrity but no data encryption?
A. AH
B. ESP
C. SPI
D. DH
Answer: A
531) What transport protocol and port are used by GDOI for its IKE sessions that are established between the group
members and the key server?
A. UDP port 848
B. TCP port 848
C. ESP port 51
D. SSL port 443
E. UDP port 4500
Answer: A
532) What is the advantage of using the ESP protocol over the AH?
A. data confidentiality
B. data integrity verification
C. nonrepudiation
D. anti-replay protection
Answer: A
533) Which three statements about the TACACS protocol are correct? (Choose three.)
A. TACACS+ is an IETF standard protocol.
B. TACACS+ uses TCP port 47 by default.
C. TACACS+ is considered to be more secure than the RADIUS protocol.
D. TACACS+ can support authorization and accounting while having another separate authentication solution.
E. TACACS+ only encrypts the password of the user for security.
F. TACACS+ supports per-user or per-group for authorization of router commands.
Answer: C, D, F
534) What is the purpose of the OCSP protocol?
A. checks the revocation status of a digital certificate
B. submits a certificate signing request
C. verifies a signature of a digital certificate
D. protects a digital certificate with its private key
Answer: A
535) Which transport method is used by the IEEE 802.1X protocol?
A. EAPOL frames
B. 802.3 frames
C. UDP RADIUS datagrams
D. PPPoE frames
Answer: A
536) Which encryption mechanism is used in WEP?
A. RC4
B. RC5
C. DES
D. AES
Answer: A
537) What does the SXP protocol exchange between peers?
A. IP to SGT binding information
B. MAC to SGT binding information
C. ingress port to SGT binding information
D. ingress switch to SGT binding information
Answer: A
538) What is a primary function of the SXP protocol?
A. to extend a TrustSec domain on switches that do not support packet tagging with SGTs
B. to map the SGT tag to VLAN information
C. to allow the SGT tagged packets to be transmitted on trunks
D. to exchange the SGT information between different TrustSec domains
Answer: A
539) Which transport type is used by the DHCP protocol?
A. UDP ports 67 and 69
B. TCP ports 67 and 68
C. UDP and TCP port 67
D. UDP ports 67 and 68
Answer: D
540) Which statement describes the computed authentication data in the AH protocol?
A. The computed authentication data is never sent across.
B. The computed authentication data is part of a new IP header.
C. The computed authentication data is part of the AH header.
D. The computed authentication data is part of the original IP header.
Answer: C
541) Which statement about the AH is true?
A. AH authenticates only the data.
B. AH authenticates only the IP header.
C. AH authenticates only the TCP-UDP header.
D. AH authenticates the entire packet and any mutable fields.
E. AH authenticates the entire packet except for any mutable fields.
Answer: E
542) Which three fields are part of the AH header? (Choose three.)
A. Source Address
B. Destination Address
C. Packet ICV
D. Protocol ID
E. Application Port
F. SPI identifying SA
G. Payload Data Type Identifier
Answer: C, F, G
543) Which statement about the HTTP protocol is true?
A. The request method does not include the protocol version.
B. The proxy acts as an intermediary receiving agent in the request-response chain.
C. The tunnel acts as an intermediary relay agent in the request-response chain.
D. The gateway acts as an intermediary forwarding agent in the request-response chain.
E. The success and error codes are returned in the response message by the user-agent.
Answer: C
544) Which statement about SMTP is true?
A. SMTP uses UDP port 25.
B. The POP protocol is used by the SMTP client to manage stored mail.
C. The IMAP protocol is used by the SMTP client to retrieve and manage stored email.
D. The mail delivery agent in the SMTP architecture is responsible for DNS lookup.
E. SMTP uses TCP port 20.
Answer: C
Explanation: Internet Message Access Protocol (IMAP) is a protocol for e-mail retrieval and storage developed by
Mark Crispin in 1986 at Stanford University as an alternative to POP. IMAP, unlike POP, specifically allows multiple
clients simultaneously connected to the same mailbox, and through flags stored on the server, different clients
accessing the same mailbox at the same or different times can detect state changes made by other clients.
Ref: http://en.wikipedia.org/wiki/Internet_Message_Access_Protocol
545) Which two statements about DHCP are true? (Choose two.)
A. DHCP uses TCP port 67.
B. DHCP uses UDP ports 67 and 68.
C. The DHCPDiscover packet has a multicast address of 239.1.1.1.
D. DHCPRequest is a broadcast message.
E. The DHCPOffer packet is sent from the DHCP server.
Answer: B, E
546) Which three statements describe the security weaknesses of WEP? (Choose three.)
A. Key strength is weak and non-standardized.
B. The WEP ICV algorithm is not optimal for cryptographic integrity checking.
C. There is no key distribution mechanism.
D. Its key rotation mechanism is too predictable.
E. For integrity, it uses MD5, which has known weaknesses.
Answer: A, B, C
547) When implementing WLAN security, what are three benefits of using the TKIP instead of WEP? (Choose three.)
A. TKIP uses an advanced encryption scheme based on AES.
B. TKIP provides authentication and integrity checking using CBC-MAC.
C. TKIP provides per-packet keying and a rekeying mechanism.
D. TKIP provides message integrity check.
E. TKIP reduces WEP vulnerabilities by using a different hardware encryption chipset.
F. TKIP uses a 48-bit initialization vector.
Answer: C, D, F
548) Which option explains the passive scan technique that is used by wireless clients to discover available wireless
networks?
A. listening for access point beacons that contain available wireless networks
B. sending a null probe request
C. sending a null association request
D. listening for access point probe response frames that contain available wireless networks
Answer: A
Which message could contain an authenticated initial_contact notify during IKE main mode negotiation?
A. message 3
B. message 5
C. message 1
D. none, initial_contact is sent only during quick mode
E. none, notify messages are sent only as independent message types
Answer: B
Which three statements are true? (Choose three.)
A. Because of a "root delay" of 0ms, this router is probably receiving its time directly from a Stratum 0 or 1 GPS
reference clock.
B. This router has correctly synchronized its clock to its NTP master.
C. The NTP server is running authentication and should be trusted as a valid time source.
D. Specific local time zones have not been configured on this router.
E. This router will not act as an NTP server for requests from other devices.
Answer: B, C, E
What will be the default action?
A. HTTP traffic to the Facebook, Youtube, and Twitter websites will be dropped.
B. HTTP traffic to the Facebook and Youtube websites will be dropped.
C. HTTP traffic to the Youtube and Twitter websites will be dropped.
D. HTTP traffic to the Facebook and Twitter websites will be dropped.
Answer: D
Explanation:
As we know to block websites we need to configure the command under class-map type option
Match regex domainlist &order(1 or 2 or).So facebook & twitter are blocked here.
552) Which Cisco ASA feature can be used to update non-compliant antivirus/antispyware definition files on an
AnyConnect client?
A. dynamic access policies
B. dynamic access policies with Host Scan and advanced endpoint assessment
C. Cisco Secure Desktop
D. advanced endpoint assessment
Answer: B
Which message of the ISAKMP exchange is failing?
A. main mode 1
B. main mode 3
C. aggressive mode 1
D. main mode 5
E. aggressive mode 2
Answer: B
Which statement about this Cisco Catalyst switch 802.1X configuration is true?
A. If an IP phone behind the switch port has an 802.1X supplicant, MAC address bypass will still be used to
authenticate the IP Phone.
B. If an IP phone behind the switch port has an 802.1X supplicant, 802.1X authentication will be used to authenticate
the IP phone.
C. The authentication host-mode multi-domain command enables the PC connected behind the IP phone to bypass
802.1X authentication.
D. Using the authentication host-mode multi-domain command will allow up to eight PCs connected behind the IP
phone via a hub to be individually authentication using 802.1X.
Answer: B
555) The ASA can be configured to drop IPv6 headers with routing-type 0 using the MPF. Choose the correct
configuration.
A. policy-map type inspect ipv6 IPv6_PMAP
match header routing-type eq 0
drop log
B. policy-map type inspect icmpv6 ICMPv6_PMAP
drop log
C. policy-map type inspect ipv6-header HEADER_PMAP
drop log
D. policy-map type inspect http HEADER_PMAP
match routing-header 0
drop log
E. policy-map type inspect ipv6 IPv6_PMAP
match header type 0
drop log
F. policy-map type inspect ipv6-header HEADER_PMAP
match header type 0
drop log
Answer: A
With the client protected by the firewall, an HTTP connection from the client to the server on TCP port 80 will be
subject to which action?
A. inspection action by the HTTP_CMAP
B. inspection action by the TCP_CMAP
C. drop action by the default class
D. inspection action by both the HTTP_CMAP and TCP_CMAP
E. pass action by the HTTP_CMAP
F. drop action due to class-map misclassification
Answer: B
Which statement best describes the problem?
A. Context vpn1 is not in service.
B. There is no gateway that is configured under context vpn1.
C. The config has not been properly updated for context vpn1.
D. The gateway that is configured under context vpn1 is not inservice.
Answer: A
Which two statements about this Cisco Catalyst switch configuration are correct? (Choose two.)
A. The default gateway for VLAN 200 should be attached to the FastEthernet 5/1 interface.
B. Hosts attached to the FastEthernet 5/1 interface can communicate only with hosts attached to the FastEthernet
5/4 interface.
C. Hosts attached to the FastEthernet 5/2 interface can communicate with hosts attached to the FastEthernet 5/3
interface.
D. Hosts attached to the FastEthernet 5/4 interface can communicate only with hosts attached to the FastEthernet
5/2 and FastEthernet 5/3 interfaces.
E. Interface FastEthernet 5/1 is the community port.
F. Interface FastEthernet 5/4 is the isolated port.
Answer: B, C
559) Which additional configuration component is required to implement a MACSec Key Agreement policy on user-
facing Cisco Catalyst switch ports?
A. PKI
B. TACACS+
C. multi-auth host mode
D. port security
E. 802.1x
Answer: E
Which statement is true?
A. This packet decoder is using relative TCP sequence numbering?.
B. This TCP client is proposing the use of TCP window scaling?.
C. This packet represents an active FTP data session?.
D. This packet contains no TCP payload.
Answer: D
561) When configuring an Infrastructure ACL (iACL) to protect the IPv6 infrastructure of an enterprise network,
where should the iACL be applied??
A. all infrastructure devices in both the inbound and outbound direction
B. all infrastructure devices in the inbound direction
C. all infrastructure devices in the outbound direction
D. all parameter devices in both the inbound and outbound direction
E. all parameter devices in the inbound direction
F. all parameter devices in the outbound direction
Answer: E
562) What feature on the Cisco ASA is used to check for the presence of an up-to-date antivirus vendor on an
AnyConnect client?
A. Dynamic Access Policies with no additional options
B. Dynamic Access Policies with Host Scan enabled
C. advanced endpoint assessment
D. LDAP attribute maps obtained from Antivirus vendor
Answer: B
563) Which statement is true regarding Cisco ASA operations using software versions 8.3 and later?
A. The global access list is matched first before the interface access lists.
B. Both the interface and global access lists can be applied in the input or output direction.
C. When creating an access list entry using the Cisco ASDM Add Access Rule window, choosing "global" as the
interface will apply the access list entry globally.
D. NAT control is enabled by default.
E. The static CLI command is used to configure static NAT translation rules.
Answer: C
564) Which statement regarding the routing functions of the Cisco ASA is true?
A. The translation table can override the routing table for new connections.
B. The ASA supports policy-based routing with route maps?.
C. In a failover pair of ASAs, the standby firewall establishes a peer relationship with OSPF neighbors.
D. Routes to the Null0 interface can be configured to black-hole traffic.
Answer: A
565) Which three statements about remotely triggered black hole filtering are true? (Choose three.)
A) It uses BGP or OSPF to trigger a network-wide remotely controlled response to attack
B) ICMP unreachable message must not be disable on all edge PE router peered with the trigger router
C) It require loose uRPF for destination based filtering
D) Three key components of an RTBH filtering solution are: uRPF, iBGP and a null0 interface
E) It support both source-based ad destination-based filtering
F) It can be used to migrate DDOs and worm attacks
Answer :B,D,E
565) Which ASA device is designated as the cluster master?
A) THE ASA with the highest MAC address.

B) The ASA configured with the lowest priority value.
C) The ASA with the Lowest MAC address.
D) The ASA configured with the highest priority value.
Answer : B
566) What context-based access control (CBAC)command sets the maximum time that a router running Cisco IOS
Will wait for a new TCP session to reach the established state?
A) IP inspect max-incomplete
B) IP inspect tcp finwait-time
C) Ip inspect udp idle-time
D) Ip inspect tcp synwait-time
E) Ip inspect tcp idle-time
Answer :D
567) Which three statements are true about Cryptographically Generated Addresses for IPv6? (Choose three.)
A. They prevent spoofing and stealing of existing IPv6 addresses.
B. They are derived by generating a random 128-bit IPv6 address based on the public key of the node.
C. They are used for securing neighbor discovery using SeND.
D. SHA or MD5 is used during their computation.
E. The minimum RSA key length is 512 bits.
F. The SHA-1 hash function is used during their computation.
Answer: A, C, F
568)Why do you use a disk-image backup to perform forensic investigations?
A. The backup timestamps the files with the date and time during copy operations.
B. The backup creates a bit-level copy of the entire disk.
C. The backup includes areas that are used for the data store.
D. This is a secure way to perform a file copy.
Answer: B
569) In RFC 4034, DNSSEC introduced which four new resource record types? (Choose four.)
A. DNS Public Key (DNSKEY)
B. Next Secure (NSEC)
C. Resource Record Signature (RRSIG)
D. Delegation Signer (DS)
E. Top Level Domain (TLD)
F. Zone Signing Key (ZSK)
Answer: A, B, C, D
570) Using Cisco IOS, which two object-group options will permit networks 10.1.1.0/24 and 10.1.2.0/24 to host
192.168.5.1 port 80 and 443? (Choose 2.)
A. object-group network SOURCE
range 10.1.1.0 10.1.2.255
object-group network DESTINATION
host 192.168.5.1
object-group service HTTP
tcp eq www
tcp eq 443
tcp source gt 1024
access-list 101 permit object-group HTTP object-group SOURCE object-group DESTINATION
B. object-group network SOURCE
10.1.1.0 0.0.0.255
10.1.2.0 0.0.0.255
host 192.168.5.1
tcp eq www
tcp eq 443
ip access-list extended ACL-NEW
permit object-group SOURCE object-group DESTINATION object-group HTTP
C. object-group network SOURCE
10.1.1.0 255.255.255.0
10.1.2.0 255.255.255.0
host 192.168.5.1
tcp eq www
tcp eq 443
permit object-group SOURCE object-group DESTINATION object-group HTTP
D. object-group network SOURCE
10.1.1.0 255.255.255.0
10.1.2.0 255.255.255.0
host 192.168.5.1
tcp eq www
tcp eq 443
tcp source gt 1024
permit object-group HTTP object-group SOURCE object-group DESTINATION
Answer: A, D
571) You run the show ipv6 port-map telnet command and you see that the port 23 (system-defined) message and
the port 223 (user-defined) message are displayed. Which command is in the router configuration?
A. ipv6 port-map port telnet 223
B. ipv6 port-map port 23 port 23223
C. ipv6 port-map telnet port 23 233
D. ipv6 port-map telnet port 223
Answer: D
572) Which three basic security measures are used to harden MSDP? (Choose three.)
A. MSDP SA filters
B. MSDP state limitation
C. MSDP MD5 neighbor authentication
D. MSDP neighbor limitation
E. loopback interface as MSDP originator-ID
Answer: A, B, C
Based on the show command output, which statement is true?
A. A NAT/PAT device is translating the local VPN endpoint.
B. A NAT/PAT device is translating the remote VPN endpoint.
C. A NAT/PAT device exists in the path between VPN endpoints.
D. No NAT/PAT device exists in the path between VPN endpoints.
Answer: C
574) Which two statements about IPv6 path MTU discovery are true? Choose 2
A. If the destination host receives on ICMPv6 packet too big message from router, it reduces its path MTU
B. It can allow fragmentation when the minimum MTU is below a configured value
C. The discovery packets are dropped if there is congestion on the link
D. If the source host receives an ICMPv6 packet too big message from a router, it reduces its path MTU
E. During the discovery process, the DF bit is set to 1
F. The initial path MTU is the same as the MTU of the original nodes link layer interface
Answer:D F
575)Which four statements about SeND for IPv6 are correct? (Choose four.)
A. It protects against rogue RAs.
B. NDP exchanges are protected by IPsec SAs and provide for anti-replay.
C. It defines secure extensions for NDP.
D. It authorizes routers to advertise certain prefixes.
E. It provides a method for secure default router election on hosts.
F. Neighbor identity protection is provided by Cryptographically Generated Addresses that are derived from a Diffie-
Hellman key exchange.
G. It is facilitated by the Certification Path Request and Certification Path Response ND messages.
Answer: A, C, D, E
576) Which three routing characteristics are relevant for DMVPN Phase 3? (Choose three.)
A. Hubs must not preserve the original IP next-hop.
B. Hubs must preserve the original IP next-hop.
C. Split-horizon must be turned off for RIP and EIGRP.
D. Spokes are only routing neighbors with hubs.
E. Spokes are routing neighbors with hubs and other spokes.
F. Hubs are routing neighbors with other hubs and must use the same routing protocol as that used on hub-spoke
tunnels.
Answer: A, C, D
Which configuration is required to enable the exporter ?
A. Source Loopback0
B. Cache timeout active 60
C. Cache timeout inactive 60
D. Next-hop address
Answer: A
578) Which three nonproprietary EAP methods do not require the use of a client-side certificate for mutual
authentication? (Choose three.)
A. LEAP
B. EAP-TLS
C. PEAP
D. EAP-TTLS
E. EAP-FAST
Answer: C, D, E
579) Which of the following two options can you configure to avoid iBGP full mesh? (Choose two.)
A. Route reflectors
B. Confederations
C. BGP NHT
D. Local preference
E. Virtual peering
Answer: A, B
580) Which two address translation types can map a group of private addresses to a smaller group of public
addresses? (Choose two.)
A. static NAT
B. dynamic NAT
C. dynamic NAT with overloading
D. PAT
E. VAT
Answer: C, D
581) As defined by Cisco TrustSec, which EAP method is used for Network Device Admission Control authentication?
A. EAP-FAST
B. EAP-TLS
C. PEAP
D. LEAP
Answer: A
582) Which three configuration tasks are required for VPN clustering of AnyConnect clients that are connecting to an
FQDN on the Cisco ASA?? (Choose three.)
A. The redirect-fqdn command must be entered under the vpn load-balancing sub-configuration.
B. Each ASA in the VPN cluster must be able to resolve the IP of all DNS hostnames that are used in the cluster.
C. The identification and CA certificates for the master FQDN hostname must be imported into each VPN cluster-
member device?.
D. The remote-access IP pools must be configured the same on each VPN cluster-member interface.
Answer: A, B, C
Explanation: Please refer to the link to understand the working of Anyconnect in load balancing cluster.
Reference: https://supportforums.cisco.com/document/29886/asa-vpn-load-balancingclustering-digital-certificates-
deployment-guide
583) Which three statements are true about objects and object groups on a Cisco ASA appliance that is running
Software Version 8.4 or later? (Choose three.)
A. TCP, UDP, ICMP, and ICMPv6 are supported service object protocol types.
B. IPv6 object nesting is supported.
C. Network objects support IPv4 and IPv6 addresses.
D. Objects are not supported in transparent mode.
E. Objects are supported in single- and multiple-context firewall modes.
Answer: A, C, E
Supports IPv6, with limitations.
584) Which command is used to replicate HTTP connections from the Active to the Standby Cisco ASA appliance in
failover?
A. monitor-interface http
B. failover link fover replicate http
C. failover replication http
D. interface fover
replicate http standby
E. No command is needed, as this is the default behavior.
Answer: C
585) policy-map type inspect ipv6 IPv6-map
match header routing-type range 0 255
drop
class-map outside-class
match any
policy-map outside-policy
class outside-class
inspect ipv6 IPv6-map
service-policy outside-policy interface outside
Refer to the exhibit.
Given the Cisco ASA configuration above, which commands need to be added in order for the Cisco ASA appliance to
deny all IPv6 packets with more than three extension headers?
A. policy-map type inspect ipv6 IPv6-map
match ipv6 header
count> 3
B. policy-map outside-policy
class outside-class
inspect ipv6 header count gt 3
C. class-map outside-class
match ipv6 header count greater 3
D. policy-map type inspect ipv6 IPv6-map
match header count gt 3
drop
Answer: D
586) Which C3PL configuration component is used to tune the inspection timers such as setting the tcp idle-time and
tcp synwait-time on the Cisco ZBFW?
A. class-map type inspect
B. parameter-map type inspect
C. service-policy type inspect
D. policy-map type inspect tcp
E. inspect-map type tcp
Answer: B
587) Which three NAT types support bidirectional traffic initiation? (Choose three.)
A. static NAT
B. NAT exemption
C. policy NAT with nat/global
D. static PAT
E. identity NAT
Answer: A, B, D
588) Which IPS module can be installed on the Cisco ASA 5520 appliance?
A. IPS-AIM
B. AIP-SSM
C. AIP-SSC
D. NME-IPS-K9
E. IDSM-2
Answer: B
589) Which two options best describe the authorization process as it relates to network access? (Choose two.)
A. the process of identifying the validity of a certificate, and validating specific fields in the certificate against an
identity store
B. the process of providing network access to the end user
C. applying enforcement controls, such as downloadable ACLs and VLAN assignment, to the network access session
of a user
D. the process of validating the provided credentials
Answer: B, C
590) If ISE is not Layer 2 adjacent to the Wireless LAN Controller, which two options should be configured on the
Wireless LAN Controller to profile wireless endpoints accurately? (Choose two.)
A. Configure the Call Station ID Type to bE. "IP Address".
B. Configure the Call Station ID Type to bE. "System MAC Address".
C. Configure the Call Station ID Type to bE. "MAC and IP Address".
D. Enable DHCP Proxy.
E. Disable DHCP Proxy.
Answer: B, E
On R1, encrypt counters are incrementing. On R2, packets are decrypted, but the encrypt counter is not being
incremented. What is the most likely cause of this issue?
A. a routing problem on R1
B. a routing problem on R2
C. incomplete IPsec SA establishment
D. crypto engine failure on R2
E. IPsec rekeying is occurring
Answer: B
592) Which two methods are used for forwarding traffic to the Cisco ScanSafe Web Security service? (Choose two.)
A. Cisco AnyConnect VPN Client with Web Security and ScanSafe subscription
B. Cisco ISR G2 Router with SECK9 and ScanSafe subscription
C. Cisco ASA adaptive security appliance using DNAT policies to forward traffic to ScanSafe subscription servers
D. Cisco Web Security Appliance with ScanSafe subscription
Answer: B, C
593) What is the recommended network MACSec policy mode for high security deployments?
A. should-secure
B. must-not-secure
C. must-secure
D. monitor-only
E. high-impact
Answer: C
594) Which PKCS is invoked during IKE MM5 and MM6 when digital certificates are used as the authentication
method?
A. PKCS#7
B. PKCS#10
C. PKCS#13
D. PKCS#11
E. PKCS#3
Answer: A
595) User A at Company A is trying to transfer files to Company B, using FTP. User A can connect to the FTP server at
Company B correctly, but User A cannot get a directory listing or upload files. The session hangs.
What are two possible causes for this problem? (Choose two.)
A. Active FTP is being used, and the firewall at Company A is not allowing the returning data connection to be
initiated from the FTP server at Company B.
B. Passive FTP is being used, and the firewall at Company A is not allowing the returning data connection to be
initiated from the FTP server at Company B.
C. At Company A, active FTP is being used with a non-application aware firewall applying NAT to the source address
of User A only.
D. The FTP server administrator at Company B has disallowed User A from accessing files on that server.
E. Passive FTP is being used, and the firewall at Company B is not allowing connections through to port 20 on the FTP
server.
Answer: A, C
596) Which four IPv6 messages should be allowed to transit a transparent firewall? (Choose four.)
A. router solicitation with hop limit = 1
B. router advertisement with hop limit = 1
C. neighbor solicitation with hop limit = 255
D. neighbor advertisement with hop limit = 255
E. listener query with link-local source address
F. listener report with link-local source address
Answer: C, D, E, F
597) Refer to the exhibit of an ISAKMP debug.
Which message of the exchange is failing?
A. main mode 1
B. main mode 3
C. aggressive mode 1
D. main mode 5
E. aggressive mode 2
Answer: B
598) Which two ISE Probes would be required to distinguish accurately the difference between an iPad and a
MacBook Pro? (Choose two.)
A. DHCP or DHCPSPAN
B. SNMPTRAP
C. SNMPQUERY
D. NESSUS
E. HTTP
F. DHCP TRAP
Answer: A, E
599) An internal DNS server requires a NAT on a Cisco IOS router that is dual-homed to separate ISPs using distinct
CIDR blocks. Which NAT capability is required to allow hosts in each CIDR block to contact the DNS server via one
translated address?
A. NAT overload
B. NAT extendable
C. NAT TCP load balancing
D. NAT service-type DNS
E. NAT port-to-application mapping
Answer: B
Which three command sets are required to complete this IPv6 IPsec site-to-site VTI? (Choose three.)
A. interface Tunnel0
tunnel mode ipsec ipv6
B. crypto isakmp-profile
match identity address ipv6 any
C. interface Tunnel0
ipv6 enable
D. ipv6 unicast-routing
E. interface Tunnel0
ipv6 enable-ipsec
Answer: A, C, D
Which option correctly identifies the point on the exhibit where Control Plane Policing (input) is applied to incoming
packets?
A. point 6
B. point 7
C. point 4
D. point 1
E. points 5 and 6
Answer: A
602) Management Frame Protection is available in two deployment modes, Infrastructure and Client. Which three
statements describe the differences between these modes? (Choose three.)
A. Infrastructure mode appends a MIC to management frames.
B. Client mode encrypts management frames.
C. Infrastructure mode can detect and prevent common DoS attacks.
D. Client mode can detect and prevent common DoS attacks.
E. Infrastructure mode requires Cisco Compatible Extensions version 5 support on clients.
Answer: A, B, D
603) The address of an inside client is translated from a private address to a public address by a NAT router for
access to an outside web server. What term describes the destination address (client) after the outside web server
responds, and before it hits the NAT router?
A. inside local
B. inside global
C. outside local
D. outside global
Answer: B
604) After a client discovers a supportable wireless network, what is the correct sequence of operations that the
client will take to join it?
A. association, then authentication
B. authentication, then association
C. probe request, then association
D. authentication, then authorization
Answer: B
605) In HTTPS session establishment, what does the server hello message inform the client?
A. that the server will accept only HTTPS traffic
B. which versions of SSL/TLS the server will accept
C. which ciphersuites the client may choose from
D. which cipher suite the server has chosen to use
E. the PreMaster secret to use in generating keys
Answer: D
Which statement regarding the output is true?
A. Every 1800 seconds the secondary name server will query the SOA record of the primary name server for updates.
B. If the secondary name server has an SOA record with the serial number of 10973815, it will initiate a zone transfer
on the next cycle.
C. Other DNS servers will cache records from this domain for 864000 seconds (10 days) before requesting them
again.
D. Email queries concerning this domain should be sent to "admin@postmaster.cisco.com".
E. Both primary and secondary name servers will clear (refresh) their caches every 7200 seconds to ensure that up-
to-date information is always in use.
Answer: B
607) According to RFC 4890, which four ICMPv6 types are recommended to be allowed to transit a firewall? (Choose
four.)
A. Type 1 - destination unreachable
B. Type 2 - packet too big
C. Type 3 - time exceeded
D. Type 0 - echo reply
E. Type 8 - echo request
F. Type 4 - parameter problem
Answer: A, B, C, F
608) Which action is performed first on the Cisco ASA appliance when it receives an incoming packet on its outside
interface?
A. check if the packet is permitted or denied by the inbound ACL applied to the outside interface
B. check if the packet is permitted or denied by the global ACL
C. check if the packet matches an existing connection in the connection table
D. check if the packet matches an inspection policy
E. check if the packet matches a NAT rule
F. check if the packet needs to be passed to the Cisco ASA AIP-SSM for inspections
Answer: C
Which three statements about the Cisco ASDM screen seen in the exhibit are true? (Choose three.)
A. This access rule is applied to all the ASA interfaces in the inbound direction.
B. The ASA administrator needs to expand the More Options tag to configure the inbound or outbound direction of
the access rule.
C. The ASA administrator needs to expand the More Options tag to apply the access rule to an interface.
D. The resulting ASA CLI command from this ASDM configuration is access-list global_access line 1 extended permit
ip host 1.1.1.1 host 2.2.2.1.
E. This access rule is valid only on the ASA appliance that is running software release 8.3 or later.
F. This is an outbound access rule.
Answer: A, D, E
610) If an incoming packet from the outside interface does not match an existing connection in the connection table,
which action will the Cisco ASA appliance perform next?
A. drop the packet
B. check the outside interface inbound ACL to determine if the packet is permitted or denied
C. perform NAT operations on the packet if required
D. check the MPF policy to determine if the packet should be passed to the SSM
E. perform stateful packet inspection based on the MPF policy
Answer: B
Choose the correct description of the implementation that produced this output on the Cisco ASA appliance.
A. stateful failover using active-active for multi-context
B. stateful failover using active-standby for multi-context
C. stateful failover using active-standby for single-context
D. stateless failover using interface-level failover for multi-context
Answer: A
612) Which command is required in order for the Botnet Traffic Filter on the Cisco ASA appliance to function
properly?
A. dynamic-filter inspect tcp/80
B. dynamic-filter whitelist
C. inspect botnet
D. inspect dns dynamic-filter-snoop
Answer: D
613) Which four configuration steps are required to implement a zone-based policy firewall configuration on a Cisco
IOS router? (Choose four.)
A. Create the security zones and security zone pairs.
B. Create the self zone.
C. Create the default global inspection policy.
D. Create the type inspect class maps and policy maps.
E. Assign a security level to each security zone.
F. Assign each router interface to a security zone.
G. Apply a type inspect policy map to each zone pair.
Answer: A, D, F, G
The client is protected by a firewall. An IPv6 SMTP connection from the client to the server on TCP port 25 will be
subject to which action?
A. pass action by the HTTP_CMAP
B. inspection action by the TCP_CMAP
C. inspection action by the SMTP_CMAP
D. drop action by the default class
E. pass action by the HTTP_CMAP
Answer: C
615) Which Cisco IPS appliance signature engine defines events that occur in a related manner, within a sliding time
interval, as components of a combined signature?
A. Service engine
B. Sweep engine
C. Multistring engine
D. Meta engine
Answer: D
What is the cause of the issue that is reported in this debug output?
A. The identity of the peer is not acceptable.
B. There is an esp transform mismatch.
C. There are mismatched ACLs on remote and local peers.
D. The SA lifetimes are set to 0.
Answer: C
617) Refer to the exhibit,
which shows a partial configuration for the EzVPN server. Which three missing ISAKMP profile options are required
to support EzVPN using DVTI? (Choose three.)
A. match identity group
B. trustpoint
C. virtual-interface
D. keyring
E. enable udp-encapsulation
F. isakmp authorization list
G. virtual-template
Answer: A, F, G
618) In order to implement CGA on a Cisco IOS router for SeND, which three configuration steps are required?
(Choose three.)
A. Generate an RSA key pair.
B. Define a site-wide pre-shared key.
C. Define a hash algorithm that is used to generate the CGA.
D. Generate the CGA modifier.
E. Assign a CGA link-local or globally unique address to the interface.
F. Define an encryption algorithm that is used to generate the CGA.
Answer: A, D, E
619) When you are configuring the COOP feature for GETVPN redundancy, which two steps are required to ensure
the proper COOP operations between the key servers? (Choose two.)
A. Generate an exportable RSA key pair on the primary key server and export it to the secondary key server.
B. Enable dead peer detection between the primary and secondary key servers.
C. Configure HSRP between the primary and secondary key servers.
D. Enable IPC between the primary and secondary key servers.
E. Enable NTP on both the primary and secondary key servers to ensure that they are synchronized to the same
clock source.
Answer: A, B
620) During the establishment of an Easy VPN tunnel, when is XAUTH performed?
A. at the end of IKEv1 Phase 2
B. at the beginning of IKEv1 Phase 1
C. at the end of Phase 1 and before Phase 2 starts in IKEv1 and IKEv2
D. at the end of Phase 1 and before Phase 2 starts in IKEv1
Answer: D
A customer has an IPsec tunnel that is configured between two remote offices. The customer is seeing these syslog
messages on Router B:
%CRYPTO-4-PKT_REPLAY_ERR: decrypt: replay check failed connection id=x, sequence number=y
What is the most likely cause of this error?
A. The customer has an LLQ QoS policy that is configured on the WAN interface of Router A.
B. A hacker on the Internet is launching a spoofing attack.
C. Router B has an incorrectly configured IP MTU value on the WAN interface.
D. There is packet corruption in the network between Router A and Router B.
E. Router A and Router B are not synchronized to the same timer source.
Answer: A
622) Which four types of VPN natively provide encryption of user traffic? (Choose four.)
A. MPLS
B. IPsec
C. L2TPv3
D. SSL
E. VPLS
F. AToM
G. GETVPN
H. Microsoft PPTP
Answer: B, D, G, H
623) Which three options are components of Mobile IPv6? (Choose three.)
A. home agent
B. correspondent node
C. mobile node
D. binding node
E. discovery probe
Answer: A, B, C
624) What are two uses of an RSA algorithm? (Choose two.)
A. Data encryption
B. Digital signature verification
C. Shared key generation
D. Message hashing
Answer: A, B
625) What is needed to verify a digital signature that was created using an RSA algorithm?
A. public key
B. private key
C. both public and private key
D. trusted third-party certificate
Answer: A
626) Which algorithm is used to generate the IKEv2 session key?
A. Diffie-Hellman
B. Rivest, Shamir, and Adleman
C. Secure Hash Algorithm
D. Rivest Cipher 4
Answer: A
627) Which statement is true about IKEv2 and IKEv1?
A. IKEv2 can be configured to use EAP, but IKEv1 cannot.
B. IKEv2 can be configured to use AES encryption, but IKEv1 cannot.
C. IKEv2 can be configured to interoperate with IKEv1 on the other end.
D. IKEv2 consumes more bandwidth than IKEv1.
Answer: A
628) Which statement is true about IKEv2 preshared key authentication between two peers?
A. IKEv2 allows usage of different preshared keys for local and remote authentication.
B. IKEv2 allows usage of only one preshared key.
C. IKEv2 allows usage of only one preshared key and only in hub-and-spoke topology.
D. IKEv2 does not allow usage of preshared key authentication.
Answer: A
629) How does 3DES use the DES algorithm to encrypt a message?
A. encrypts a message with K1, decrypts the output with K2, then encrypts it with K3
B. encrypts a message with K1, encrypts the output with K2, then encrypts it with K3
C. encrypts K1 using K2, then encrypts it using K3, then encrypts a message using the output key
D. encrypts a message with K1, encrypts the output with the K2, then decrypts it with K3
Answer: A
630) Which three statements about IKEv2 are correct? (Choose three.)
A. INITIAL_CONTACT is used to synchronize state between peers.
B. The IKEv2 standard defines a method for fragmenting large messages.
C. The initial exchanges of IKEv2 consist of IKE_SA_INIT and IKE_AUTH.
D. Rekeying IKE and child SAs is facilitated by the IKEv2 CREATE_CHILD_SA exchange.
E. NAT-T is not supported.
F. Attribute policy push (via the configuration payload) is only supported in REQUEST/REPLY mode.
Answer: A, C, D
631) What entities decrypt a transmission sent by a GDOI group member?
A. all group members
B. the key server only
C. the peer that is indicated by the key server
D. the key server and the peer that is indicated by the key server
Answer: A
632) What applications take advantage of a DTLS protocol?
A. delay-sensitive applications, such as voice or video
B. applications that require double encryption
C. point-to-multipoint topology applications
D. applications that are unable to use TLS
Answer: A
Explanation: DTLS is commonly used for delay-sensitive applications(voice & video).The greatest benefit that DTLS
can provide for standard TLS when operating delay-sensitive applications is the use of UDP, which allows for faster
transmission of application data without the additional overhead of TCP.DTLS was actually invented to achieve a
good user experience for delay-sensitive applications that natively user UDP, once DTLS is enabled & negotiated ,all
applications are actually tunneled over the DTLS VPN session.
633) What mechanism does SSL use to provide confidentiality of user data?
A. symmetric encryption
B. asymmetric encryption
C. RSA public-key encryption
D. Diffie-Hellman exchange
Answer: A
634) Which statement is true about EAP-FAST?
A. It supports Windows single sign-on.
B. It is a proprietary protocol.
C. It requires a certificate only on the server side.
D. It does not support an LDAP database.
Answer: A
635) Which four attributes are identified in an X.509v3 basic certificate field? (Choose four.)
A. key usage
B. certificate serial number
C. issuer
D. subject name
E. signature algorithm identifier
F. CRL distribution points
G. subject alt name
Answer: B, C, D, E
636) What are two reasons for a certificate to appear in a CRL? (Choose two.)
A. CA key compromise
B. cessation of operation
C. validity expiration
D. key length incompatibility
E. certification path invalidity
Answer: A, B
637) A Cisco Easy VPN software client is unable to access its local LAN devices once the VPN tunnel is established.
How can this issue be resolved?
A. The IP address that is assigned by the Cisco Easy VPN Server to the client must be on the same network as the
local LAN of the client.
B. The Cisco Easy VPN Server should apply split-tunnel-policy excludespecified with a split-tunnel-list containing the
local LAN addresses that are relevant to the client.
C. The Cisco Easy VPN Server must push down an interface ACL that permits the traffic to the local LAN from the
client.
D. The Cisco Easy VPN Server should apply a split-tunnel-policy tunnelall policy to the client.
E. The Cisco Easy VPN client machine needs to have multiple NICs to support this.
Answer: B
638) error: % Invalid input detected at '^' marker.
Above error is received when generating RSA keys for SSH access on a router using the crypto key generate rsa
command. What are the reasons for this error? (Choose two.)
A. The hostname must be configured before generating RSA keys.
B. The image that is used on the router does not support the crypto key generate rsa command.
C. The command has been used with incorrect syntax.
D. The crypto key generate rsa command is used to configure SSHv2, which is not supported on Cisco IOS devices.
Answer: B, C
Explanation: The error message is received when the router image is not a k9 image to support the security features.
Also, we can get this error message if the correct syntax is not used while generating key pairs.
639) crypto isakmp profile vpn1
vrf vpn1
keyring vpn1
match identity address 172.16.1.1 255.255.255.255
crypto map crypmap 1 ipsec-isakmp
set peer 172.16.1.1
set transform-set vpn1
set isakmp-profile vpn1
match address 101
interface Ethernet1/2
crypto map crypmap
Which statements apply to the above configuration? (Choose two.)
A. This configuration shows the VRF-Aware IPsec feature that is used to map the crypto ISAKMP profile to a specific
VRF.
B. VRF and ISAKMP profiles are mutually exclusive, so the configuration is invalid.
C. An IPsec tunnel can be mapped to a VRF instance.
D. Peer command under the crypto map is redundant and not required.
Answer: A, C
640) MACsec, which is defined in 802.1AE, provides MAC-layer encryption over wired networks. Which two
statements about MACsec are true? (Choose two.)
A. Only links between network access devices and endpoint devices can be secured by using MACsec.
B. MACsec is designed to support communications between network devices only.
C. MACsec manages the encryption keys that the MKA protocol uses.
D. A switch that uses MACsec accepts either MACsec or non-MACsec frames, depending on the policy that is
associated with the client.
Answer: A, D
641) Which two statements about OSPF authentication are true? (Choose two.)
A. OSPF authentication is required in area 0.
B. There are three types of OSPF authentication.
C. In MD5 authentication, the password is encrypted when it is sent.
D. Null authentication includes the password in clear-text.
E. Type-3 authentication is a clear-text password authentication.
F. In MD5 authentication, the password never goes across the network.
Answer: B, F
642) Which option describes the main purpose of EIGRP authentication?
A. to authenticate peers
B. to allow faster convergence
C. to provide redundancy
D. to avoid routing table corruption
Answer: D
643) What is the purpose of the BGP TTL security check?
A. The BGP TTL security check is used for iBGP session.
B. The BGP TTL security check protects against CPU utilization-based attacks.
C. The BGP TTL security check checks for a TTL value in packet header of less than or equal to for successful peering.
D. The BGP TTL security check authenticates a peer.
E. The BGP TTL security check protects against routing table corruption.
Answer: B
A. The peer session is dropped when 80 prefixes are received.
B. A warning message is displayed when 1000 prefixes are received.
C. The peer session is dropped when 800 prefixes are received.
D. An Initial warning message is displayed when 800 prefixes are received. A different message is displayed when
1000 prefixes received and the session will not be disconnected
E. An Initial warning message is displayed when 80 prefixes received. The same warning message is displayed when
1000 prefixes are received and the session will be disconnected.
Answer: D
645) Which two statements describe GRE? (Choose two.)
A. GRE acts as passenger protocol for a Layer 3 transport protocol.
B. GRE acts as a tunneling protocol and encapsulates other protocols.
C. GRE provides data confidentiality.
D. Packet MTU must be adjusted to accommodate GRE overhead.
E. GRE does not allow multicast to be sent across the tunnel.
F. The GRE tunnel interface remains down until it can see the remote tunnel end.
Answer: B, D
646) Which two statements about NHRP are true? (Choose two.)
A. NHRP is used for broadcast multi-access networks.
B. NHRP allows NHC to dynamically learn the mapping of VPN IP to NBMA IP.
C. NHRP allows NHS to dynamically learn the mapping of VPN IP to BMA IP.
D. NHC registers with NHS.
E. Traffic between two NHCs always flows through the NHS.
F. NHRP provides Layer-2 to Layer-3 address mapping.
Answer: B, D
A. Devices that perform IEEE 802.1X should be in the MAC address database for successful authentication.
B. IEEE 802.1x devices must fail MAB to perform IEEE 802.1X authentication.
C. If 802.1X fails, the device will be assigned to the default guest VLAN.
D. The device will perform subsequent IEEE 802.1X authentication if it passed MAB authentication.
E. If the device fails IEEE 802.1X, it will start MAB again.
Answer: B
648) When is the supplicant considered to be clientless?
A. when the authentication server does not have credentials to authenticate.
B. when the authenticator is missing the dot1x guest VLAN under the port with which the supplicant is connected.
C. when the supplicant fails EAP-MD5 challenge with the authentication server.
D. when the supplicant fails to respond to EAPOL messages from the authenticator.
E. when the authenticator is missing the reauthentication timeout configuration under the port with which the
supplicant is connected.
Answer: D
649 )When routing is configured on ASA, which statement is true?
A. If the default route is not present, then the routing table is checked.
B. If the routing table has two matching entries, the packet is dropped.
C. If routing table has two matching entries with same prefix length, the first entry is used.
D. If routing table has two matching entries with different prefix lengths, the entry with the longer prefix length is
used.
Answer: D
650) Which statement about the ASA redundant interface is true?
A. It is a logical interface that combines two physical interfaces, both of which are active.
B. It can only be used for failover links.
C. By default, the first physical interface that is configured in the pair is the active interface.
D. The redundant interface uses the MAC address of the second physical interface in the pair.
Answer: C
651) Which two pieces of information are communicated by the ASA failover link? (Choose two.)
A. unit state
B. connections State
C. routing tables
D. power status
E. MAC address exchange
Answer: A, E
652) When is a connection entry created on ASA for a packet that is received on the ingress interface?
A. When the packet is checked by the access-list.
B. When the packet reaches the ingress interface internal buffer.
C. When the packet is a SYN packet or UDP packet.
D. When a translation rule exists for the packet.
E. When the packet is subjected to inspection.
Answer: D
653) Which two statements about the multiple context mode running Version 9.x are true? (Choose two.)
A. RIP is not supported.
B. An interface cannot be shared by multiple contexts.
C. Remote access VPN is supported.
D. Only the admin and context configuration files are supported.
E. OSPFv3 is supported.
F. Multicast feature is supported
G. Site-To-Site VPN feature is supported
Answer: A, G
654) Which two options describe how the traffic for the shared interface is classified in ASA multi context mode?
(Choose two.)
A. Traffic is classified at the source address in the packet.
B. Traffic is classified at the destination address in the packet.
C. Traffic is classified at the destination address in the context.
D. Traffic is classified by copying and sending the packet to all the contexts.
E. Traffic is classified by sending the MAC address for the shared interface.
Answer: C, E
655) Which two statements correctly describes ASA resource management in multiple context mode? (Choose two.)
A. The class sets the resource maximum limit for a context to which it belongs.
B. A resource cannot be oversubscribed or set to be unlimited in the class.
C. The resource limit can only be set as a percentage in the class and not as an absolute value.
D. Context belongs to a default class if not assigned to any other class.
E. The default class provides unlimited access for all the resources.
Answer: A, D
656)Which two statements about ASA transparent mode are true? (Choose two.)
A. Transparent mose acts as a Layer-3 firewall.
B. The inside and outside interface must be in a different subnet.
C. IP traffic will not pass unless it is permitted by an access-list.
D. ARP traffic is dropped unless it is permitted.
E. A configured route applies only to the traffic that is originated by the ASA.
F. In multiple context mode, all contexts need to be in transparent mode.
Answer: C, E
657) Which statement correctly describes a botnet filter category?
A. Unlisted addresses: The addresses are malware addresses that are not identified by the dynamic database and
are hence defined statically.
B. Ambiguous addresses: In this case, the same domain name has multiple malware addresses but not all the
addresses are in the dynamic database. These addresses are on the graylist.
C. Known malware addresses: These addresses are identified as blacklist addresses in the dynamic database and
static list.
D. Known allowed addresses: These addresses are identified as whitelist addresses that are bad addresses but still
allowed.
Answer: C
A. incomplete ISAKMP profile configuration on the server
B. incorrect IPsec phase-2 configuration on the server
C. incorrect group configuration on the client
D. ISAKMP key mismatch
E. incorrect ACL in the ISAKMP client group configuration
Answer: B
What is the reason for the failure of the DMVPN session between R1 and R2?
A. tunnel mode mismatch
B. IPsec phase-1 configuration is missing peer address on R2
C. IPsec phase-1 policy mismatch
D. IPsec phase-2 policy mismatch
Answer: E
What is the reason for the failure of the DMVPN session between R1 and R2?
A. tunnel mode mismatch
B. IPsec phase-1 configuration missing peer address on R2
C. IPsec phase-1 policy mismatch
D. IPsec phase-2 policy mismatch
Answer: C
Explanation: There is Phase 1 policy mismatch. Under the crypto isakmp policy 1, on one side it is group 3 and on
another side it is group 2.
Which statement about the exhibit is true?
A. The tunnel configuration is incomplete and the DMVPN session will fail between R1 and R2.
B. IPsec phase-2 will fail to negotiate due to a mismatch in parameters.
C. A DMVPN session will establish between R1 and R2 provided that the BGP and EIGRP configurations are correct.
D. A DMVPN session will establish between R1 and R2 provided that the BGP configuration is correct.
E. A DMVPN session will fail to establish because R2 is missing the ISAKMP peer address.
Answer: C
Identify the behavior of the ACL if it is applied inbound on E0/0.
A. The ACL will drop both initial and noninitial fragments for port 80 only.
B. The ACL will pass both initial and noninitial fragments for port 80 only.
C. The ACL will pass the initial fragment for port 80 but drop the noninitial fragment for any port.
D. The ACL will drop the initial fragment for port 80 but pass the noninitial fragment for any port.
Answer: C
Explanation: The first packet will be permitted but the other packets will be dropped because of the top most
access-list that has an action of denying the traffic.
Identify the behavior of the ACL if it is applied inbound on E0/0.
B. The ACL will pass both initial and non-initial fragments for port 80 only.
Answer: B
664) Which statement about DHCP snooping is true?
A. The dynamic ARP inspection feature must be enabled for DHCP snooping to work.
B. DHCP snooping is enabled on a per-VLAN basis.
C. DHCP snooping builds a binding database using information that is extracted from intercepted ARP requests.
D. DHCP snooping is enabled on a per-port basis.
E. DHCP snooping is does not rate-limit DHCP traffic from trusted ports.
Answer: B
665) Which two statements about PCI DSS are true? (Choose two.)
A. PCI DSS is a US government standard that defines ISP security compliance.
B. PCI DSS is a proprietary security standard that defines a framework for credit, debit, and ATM cardholder
information.
C. PCI DSS is a criminal act of cardholder information fraud.
D. One of the PCI DSS objectives is to restrict physical access to credit, debit, and ATM cardholder information.
E. PCI DSS is an IETF standard for companies to protect credit, debit, and ATM cardholder information.
Answer: B, D
A. Incomplete IPsec phase-1 configuration on the server
B. Incorrect IPsec phase-2 configuration on the server
C. Incorrect group configuration on the client
E. Incorrect ACL in the ISAKMP client group configuration
Answer: C
A. Incomplete ISAKMP profile configuration on the server
B. Incorrect IPsec phase-2 configuration on the server
C. Incorrect group configuration on the client
E. Incorrect virtual-template configuration on the sever
Answer: A
Explanation: Under the isakmp configuration on the server, this command is missing:
Isakmp configuration address respond
If this command is not applied then the client will not be able to obtain the ip address from the ip pool defined on
the server.
Which two items are not encrypted by ESP in tunnel mode? (Choose two)
A. ESP header
B. ESP trailer
C. Original IP header
D. Data
E. TCP-UDP header
F. Authentication Data
Answer: A, F
670) Which three statements about the RSA algorithm are true to provide data confidentiality? (Choose three.)
A. The RSA algorithm provides encryption and authentication.
B. The RSA algorithm provides authentication but not encryption.
C. The RSA algorithm creates a pair of public-private keys and the public key is shared to perform encryption.
D. The private key is never shared after it is generated.
E. The public key is used to decrypt the message that was encrypted by the private key.
F. The private key is used to decrypt the message that was encrypted by the public key.
Answer: C, D, F
671) Which two statements correctly describe ASA resource management in multiple context mode? (Choose two.)
A. The class sets the resource maximum limit for a context to which it belongs.
B. A resource cannot be oversubscribed or set to be unlimited in the class.
C. The resource limit can only be set as a percentage in the class and not as an absolute value.
D. Context belongs to a default class if not assigned to any other class.
E. The default class provides unlimited access for all the resources.
Answer: A, D
672) Event Action Rule is a component of which IPS application?
A. InterfaceApp
B. MainApp
C. SensorApp
D. NotificationApp
E. AuthenticationApp
F. SensorDefinition
Answer: C
673) For what reason is BVI required in the Transparent Cisco IOS Firewall?
A. BVI is required for the inspection of IP traffic.
B. BVI is required if routing is disabled on the firewall.
C. BVI is required if more than two interfaces are in the same bridge group.
D. BVI is required for the inspection of non-IP traffic.
E. BVI cannot be used to manage the device.
Answer: C
674) Depending on configuration, which of the following two behaviors can the ASA classifier exhibit when receiving
unicast traffic on an interface shared by multiple contexts? (Choose two.)
A. Traffic is classified using the destination address of the packet using the connection table.
B. Traffic is classified using the destination address of the packet using the NAT table.
C. Traffic is classified using the destination address of the packet using the routing table.
D. Traffic is classified by copying and sending the packet to all the contexts.
E. Traffic is classified using the destination MAC address of the packet.
Answer: B, E
675) Which Cisco IPS appliance signature engine inspects IPv6 Layer 3 traffic?
A. Atomic IP
B. Meta
C. Atomic IP Advanced
D. Fixed
E. Service
Answer: C
676) Which statement about the TACACS+ AV pair is true?
A. AV pair value is integer.
B. Cisco ACS does not support accounting AV pairs.
C. AV pair values could be both strings and integers.
D. AV pair does not have value type.
Answer: D
677) In Cisco IOS firewall the HTTP inspection engine has the ability to protect against which of the following?
A. Tunneling over port 443.
B. Tunneling over port 80.
C. HTTP file transfers authorized by the configured security policy.
D. Authorized request methods.
Answer: B
678) Which two statements about the storm control implementation on the switch are true? (Choose two.)
A. Traffic storm level is the percentage of total available bandwidth of the port.
B. Traffic storm level is the rate at which layer 3 traffic is received on the port.
C. Traffic storm control monitors only the broadcast traffic.
D. Traffic storm control monitors the broadcast, multicast, and unicast traffic.
E. Traffic storm level is the rate at which layer 2 traffic is received on the port.
F. A Lower storm control level means more traffic is allowed to pass through.
Answer: A, D
679) Which three types of traffic are generally policed via CoPP policies? (Choose three.)
A. Transit traffic
B. Routing protocol traffic
C. IPsec traffic
D. Traffic that is destined to any of the device's interfaces.
E. Traffic from a management protocol such as Telnet or SNMP
Answer: B, D, E
Which option describes the behavior of the ACL if it is applied inbound on E0/0?
B. The ACL will pass both initial fragments for port 80 and non-initial fragments.
Answer: B
Which AS-PATH access-list regular expression should be applied on R2 to allow only updates that originate from AS-
65001 or an AS that attaches directly to AS-65001?
A. ^65001_[0-9]*$
B. _65001^[0-9]*
C. 65001_[0.9]$
D. ^65001_*$
Answer: A
682) What is the purpose of aaa server radius dynamic-author command?
A. Enables the device to dynamically receive updates from a policy server
B. Enables the switch to automatically authorize the connecting device if all the configured RADIUS servers are
unavailable
C. Impairs the ability to configure RADIUS local AAA
D. This command disables dynamic authorization local server configuration mode.
Answer: A
683) On Cisco routers, there are two mutually exclusive types of RSA key pairs: special-usage keys and general-
purpose keys. When you generate RSA key pairs, you are prompted to select either special-usage keys or general-
purpose keys. Which set of statements is true?
A. If you generate special-usage keys, two pairs of RSA keys are generated. One pair is used with any IKE policy that
specifies RSA signatures as the authentication method. The other pair is used with any IKE policy that specifies RSA
encrypted keys as the authentication method.
B. If you generate a named key pair, only one pair of RSA keys is generated. This pair is used with IKE policies that
specify either RSA signatures or RSA encrypted keys. Therefore, a general-purpose key pair might be used more
frequently than a special-usage key pair.
C. If you generate general-purpose keys, you must also specify the usage-key keyword or the general-key keyword.
Named key pairs allow you to have multiple RSA key pairs, enabling the Cisco IOS Software to maintain a different
key pair for each identity certificate.
D. special-usage key pair is default in Cisco IOS
Answer: A
684) Cisco firewalls and routers can respond to a TCP SYN packet that is destined for a protected resource, by using
a SYN-ACK packet to validate the source of the SYN packet. What is this feature called?
A. IP reverse path verification
B. TCP reverse path verification
C. TCP sequence number randomization
D. TCP intercept
Answer: D
Which set of commands is required on an ASA to fix the problem that the exhibit shows?
A. ciscoasa(config)# webvpn
ciscoasa(config-webvpn)# enable <outside-interface-name>
ciscoasa(config)# webvpn
B. ciscoasa(config-webvpn)#anyconnect enable
ciscoasa(config-webvpn)# enable <outside-interface-name>
C. ciscoasa(config-webvpn)# anyconnect enable
D. ciscoasa(config-webvpn)#anyconnect enable
ciscoasa(config-webvpn)#anyconnect image <anyconnect-package-file-location> 1
Answer: B
Client1 has an IPsec VPN tunnel established to a Cisco ASA adaptive security appliance in Chicago. The remote access
VPN client wants to access www.cisco.com, but split tunneling is disabled. Which of these is the appropriate
configuration on the Cisco ASA adaptive security appliance if the VPN client's public IP address is 209.165.201.10 and
it is assigned a private address from 192.168.1.0/24?
A.same-security-traffic permit intra-interface
ip local pool ippool 192.168.1.1-192.168.1.254
global (outside) 1 209.165.200.230
nat (inside) 1 192.168.1.0 255.255.255.0
B. same-security-traffic permit intra-interface
global (outside) 1 209.165.200.230
nat (outside) 1 192.168.1.0 255.255.255.0
C. same-security-traffic permit intra-interface
global (inside) 1 209.165.200.230
nat (inside) 1 192.168.1.0 255.255.255.0
D. same-security-traffic permit intra-interface
global (outside) 1 209.165.200.230
nat (outside) 1 209.165.201.10 255.255.255.255
E. same-security-traffic permit intra-interface
global (outside) 1 209.165.200.230
nat (inside) 1 209.165.201.10 255.255.255.255
F. same-security-traffic permit intra-interface
global (inside) 1 209.165.200.230
nat (inside) 1 209.165.201.10 255.255.255.255
Answer: B
687) Which statement about the Cisco Secure Desktop hostscan endpoint assessment feature is true?
A. Advanced endpoint assessment gives you the ability to turn on an antivirus active scan function if it has been
disabled.
B. Advanced endpoint assessment cannot force the antivirus software to automatically update the dat file if it has
not been updated in n days.
C. With basic endpoint assessment, you cannot check for multiple antivirus vendors products and version.
D. Advanced endpoint assessment cannot enable the firewall if it has been disabled.
Answer: A
688) Which port is used by default to communicate between VPN load-balancing ASAs?
A. TCP 9022
B. UDP 9023
C. TCP 9023
D. UDP 9022
Answer: B
689) Which three statements apply to the behavior of Cisco AnyConnect client auto-reconnect? (Choose three.)
A. By default, Cisco AnyConnect attempts to re-establish a VPN connection when you lose connectivity to the secure
gateway.
B. With respect to VPN load balancing and Cisco AnyConnect reconnect, the client reconnects to the cluster member
with the highest priority.
C. Cisco AnyConnect reconnects when the network interface changes, whether the IP of the NIC changes or whether
connectivity switches from one NIC to another; for example, wireless to wired or vice versa.
D. With respect to VPN load balancing and Cisco AnyConnect reconnect, the client reconnects directly to the cluster
member to which it was previously connected.
E. By default, Cisco AnyConnect attempts to re-establish a VPN connection following a system resume.
Answer: A, C, D
690) When you work on a change-management process, you generally identify potential change, review the change
request, implement change, then review the change and close the process. In which step should the stakeholder be
involved?
A. Identifying potential change
B. Reviewing the change request
C. Implementation
D. Reviewing and closing
E. Depends on the stakeholder request
Answer: E
691) Many guidelines can be used to identify the areas that security policies should cover. In which four areas is
coverage most important? (Choose four.)
A. Physical
B. Host
C. User
D. Document
E. Incident handling and response
F. Security awareness training
Answer: A, B, C, D
692) Interface tunnel 1
ip address 10.1.1.1 255.255.255.252
ip mtu 1400
Tunnel source 172.16.1.1
Tunnel destination 172.16.1.2
Tunnel key 1111
Based on the above configuration, if the input packet size is 1300 bytes, what is the size of the packet leaves the
tunnel after encapsulation?
A. 1324
B. 1325
C. 1326
D. 1328
Answer: D
693) At the end of the Cisco TrustSec authentication process, which three pieces of information do both
authenticator and supplicant know? (Choose three.)
A. Peer device ID
B. Peer Cisco TrustSec capability information
C. SAP key
D. Server device ID
E. Service ID
F: Server peers information
Answer: A, B, C
694) You are preparing Control Plane Protection configurations for implementation on the router, which has the
EBGP peering address 1.1.1.2. Which ACL statement can you use to classify the related traffic into the EBGP traffic
compartment?
A. permit tcp host 1.1.1.1 gt 1024 host 1.1.1.2 eq bgp
permit tcp host 1.1.1.1 eq bgp host 1.1.1.2 gt 1024
B. permit tcp host 1.1.1.2 gt 1024 host 1.1.1.2 eq bgp
C. permit tcp host 10.1.1.1 gt 1024 host 10.1.1.2 eq bgp
D. permit tcp host 1.1.1.1 gt 1024 host 1.1.1.1 eq bgp
Answer: A
695) Which of these configurations shows how to configure MPP when only SSH, SNMP, and HTTP are allowed to
access the router through the Gigabit Ethernet 0/3 interface and only HTTP is allowed to access the router through
the Gigabit Ethernet 0/2 interface?
A. Router(config-cp-host)# management-interface GigabitEthernet 0/3 allow http ssh snmp
Router(config-cp-host)# management-interface GigabitEthernet 0/2 allow http
B. Router(config-cp-host)# management-interface GigabitEthernet 0/3 allow http ssh tftp snmp
Router(config-cp-host)# management-interface GigabitEthernet 0/2 allow http
C. Router(config-cp-host)# management-interface GigabitEthernet 0/3 allow http ssh snmp
Router(config-cp-host)# management-interface GigabitEthernet 0/2 allow http ssh
D. Router(config-cp-host)# management-interface GigabitEthernet 0/3 http ssh snmp
Router(config-cp-host)# management-interface GigabitEthernet 0/2 http
Answer: A
696) Which two EAP methods may be susceptible to offline dictionary attacks? (Choose two.)
A. EAP-MD5
B. LEAP
C. PEAP with MS-CHAPv2
D. EAP-FAST
Answer: A, B
Which three fields of the IP header labeled can be used in a spoofing attack? (Choose one.)
A. 6, 7, 11
B. 6, 11, 12
C. 3, 11, 12
D. 4, 7, 11
Answer: A
698) What type of attack consists of injecting traffic that is marked with the DSCP value of EF into the network?
A. brute-force attack
B. QoS marking attack
C. DHCP starvation attack
D. SYN flood attack
Answer: B
699) An exploit that involves connecting to a specific TCP port and gaining access to an administrative command
prompt is an example of which type of attack?
A. botnet
B. Trojan horse
C. privilege escalation
D. DoS
Answer: C
700) Which two of the following provide protect against man-in-the-middle attacks? (Choose two.)
A. TCP initial sequence number randomization?
B. TCP sliding-window checking
C. Network Address Translation
D. IPsec VPNs
E. Secure Sockets Layer
Answer: D, E
701) Which three options are security measures that are defined for Mobile IPv6? (Choose three.)
A. IPsec SAs are used for binding updates and acknowledgements.
B. The use of IKEv1 or IKEv2 is mandatory for connections between the home agent and mobile node.
C. Mobile nodes and the home agents must support ESP in transport mode with non-NULL payload authentication.
D. Mobile IPv6 control messages are protected by SHA-2.
E. IPsec SAs are used to protect dynamic home agent address discovery.
F. IPsec SAs can be used to protect mobile prefix solicitations and advertisements.
Answer: A, C, F
702) Which three statements are true about DES? (Choose three.)
A. A 56-bit key is used to encrypt 56-bit blocks of plaintext.
B. A 56-bit key is used to encrypt 64-bit blocks of plaintext.
C. Each block of plaintext is processed through 16 rounds of identical operations.
D. Each block of plaintext is processed through 64 rounds of identical operations.
E. ECB, CBC, and CBF are modes of DES.
F. Each Block of plaintext is processed through 8 rounds of identical operations.
G. CTR, CBC, and OFB are modes of DES.
Answer: B, C, E
703) Comparing and contrasting IKEv1 and IKEv2, which three statements are true? (Choose three.)
A. IKEv2 adds EAP as a method of authentication for clients; IKEv1 does not use EAP.
B. IKEv1 and IKEv2 endpoints indicate support for NAT-T via the vendor_ID payload.
C. IKEv2 and IKEv1 always ensure protection of the identities of the peers during the negotiation process.
D. IKEv2 provides user authentication via the IKE_AUTH exchange; IKEv1 uses the XAUTH exchange.
E. IKEv1 and IKEv2 both use INITIAL_CONTACT to synchronize SAs.
F. IKEv1 supports config mode via the SET/ACK and REQUEST/RESPONSE methods; IKEv2 supports only
REQUEST/RESPONSE.
Answer: A, D, E
704) Which three statements about GDOI are true? (Choose three.)
A. GDOI uses TCP port 848.
B. The GROUPKEY_PULL exchange is protected by an IKE phase 1 exchange.
C. The KEK protects the GROUPKEY_PUSH message.
D. The TEK is used to encrypt and decrypt data traffic.
E. GDOI does not support PFS.
Answer: B, C, D
705) To prevent a potential attack on a Cisco IOS router with the echo service enabled, what action should you take?
A. Disable the service with the no ip echo command.
B. Disable the service with the no echo command.
C. Disable tcp-small-servers.
D. Disable this service with a global access-list.
Answer: C
Explanation: The Cisco IOS disables the service tcp-small-servers command by default. Enabling this command turns
on the following services on the router: Echo, Discard, Chargen, and Daytime.
706) Which query type is required for an nslookup on an IPv6 addressed host?
A. type=AAAA
B. type=ANY
C. type=PTR
D. type=NAME-IPV6
Answer: A
707) Which option is used to collect wireless traffic passively, for the purposes of eavesdropping or information
gathering?
A. network taps
B. repeater Access Points
C. wireless sniffers
D. intrusion prevention systems
Answer: C
708) Which traffic class is defined for non-business-relevant applications and receives any bandwidth that remains
after QoS policies have been applied?
A. scavenger class
B. best effort
C. discard eligible
D. priority queued
Answer: A
709) In the context of a botnet, what is true regarding a command and control server?
A. It can launch an attack using IRC or Twitter.
B. It is another name for a zombie.
C. It is used to generate a worm.
D. It sends the command to the botnets via adware.
Answer: A
710) Which option is used for anti-replay prevention in a Cisco IOS IPsec implementation?
A. session token
B. one-time password
C. time stamps
D. sequence number
E. nonce
Answer: D
When configuring a Cisco IPS custom signature, what type of signature engine must you use to block podcast clients
from accessing the network?
A. service HTTP
B. service TCP
C. string TCP
D. fixed TCP
E. service GENERIC
Answer: A
712) An attacker configures an access point to broadcast the same SSID that is used at a public hot-spot, and
launches a deauthentication attack against the clients that are connected to the hot-spot, with the hope that the
clients will then associate to the AP of the attacker.
In addition to the deauthentication attack, what attack has been launched?
A. man-in-the-middle
B. MAC spoofing
C. Layer 1 DoS
D. disassociation attack
Answer: A
713) Which statement best describes the concepts of rootkits and privilege escalation?
A. Rootkits propagate themselves.
B. Privilege escalation is the result of a rootkit.
C. Rootkits are a result of a privilege escalation.
D. Both of these require a TCP port to gain access.
Answer: B
714) ) Refer to the exhibit.
What type of attack is being mitigated on the Cisco ASA appliance?
A. HTTPS certificate man-in-the-middle attack
B. HTTP distributed denial of service attack
C. HTTP Shockwave Flash exploit
D. HTTP SQL injection attack
Answer: D
715) Which four values can be used by the Cisco IPS appliance in the risk rating calculation? (Choose four.)
A. attack severity rating
B. target value rating
C. signature fidelity rating
D. promiscuous delta
E. threat rating
F. alert rating
Answer: A, B, C, D
716) Regarding VSAs, which statement is true?
A. VSAs may be implemented on any RADIUS server.
B. VSAs are proprietary, and therefore may only be used on the RADIUS server of that vendor. For example, a Cisco
VSA may only be used on a Cisco RADIUS server, such as ACS or ISE.
C. VSAs do not apply to RADIUS; they are a TACACS attribute.
D. Each VSA is defined in an RFC and is considered to be a standard.
Answer: A
717) Which four items may be checked via a Cisco NAC Agent posture assessment? (Choose four.)
A. Microsoft Windows registry keys
B. the existence of specific processes in memory
C. the UUID of an Apple iPad or iPhone
D. if a service is started on a Windows host
E. the HTTP User-Agent string of a device
F. if an Apple iPad or iPhone has been "jail-broken"
G. if an antivirus application is installed on an Apple MacBook
Answer: A, B, D, G
718) Which of the following describes the DHCP "starvation" attack?
A. Exhaust the address space available on the DHCP servers so that an attacker can inject their own DHCP server for
malicious reasons.
B. Saturate the network with DHCP requests to prevent other network services from working.
C. Inject a DHCP server on the network for the purpose of overflowing DNS servers with bogus learned host names.
D. Send DHCP response packets for the purpose of overloading CAM tables.
Answer: A
719) Which Cisco technology protects against Spanning Tree Protocol manipulation?
A. spanning-tree protection
B. root guard and BPDU guard
C. Unicast Reverse Path Forwarding
D. MAC spoof guard
E. port security
Answer: B
720) Which statement is true about the Cisco NEAT 802.1X feature?
A. The multidomain authentication feature is not supported on the authenticator switch interface.
B. It allows a Cisco Catalyst switch to act as a supplicant to another Cisco Catalyst authenticator switch.
C. The supplicant switch uses CDP to send MAC address information of the connected host to the authenticator
switch.
D. It supports redundant links between the supplicant switch and the authenticator switch.
Answer: B
721) Which four techniques can you use for IP management plane security? (Choose four.)
A. Management Plane Protection
B. uRPF
C. strong passwords
D. RBAC
E. SNMP security measures
F. MD5 authentication
Answer: A, C, D, E
722) During a computer security forensic investigation, a laptop computer is retrieved that requires content analysis
and information retrieval. Which file system is on it, assuming it has the default installation of Microsoft Windows
Vista operating system?
A. HSFS
B. WinFS
C. NTFS
D. FAT
E. FAT32
Answer: C
723) Which Cisco IPS appliance feature can automatically adjust the risk rating of IPS events based on the reputation
of the attacker?
A. botnet traffic filter
B. event action rules
C. anomaly detection
D. reputation filtering
E. global correlation inspection
Answer: E
724) Which three control plane subinterfaces are available when implementing Cisco IOS Control Plane Protection?
(Choose three.)
A. CPU
B. host
C. fast-cache
D. transit
E. CEF-exception
F. management
Answer: B, D, E
What service is enabled on the router for a remote attacker to obtain this information?
A. TCP small services
B. finger
C. maintenance operation protocol
D. chargen
E. Telnet
F. CEF
Answer:E
726) In an 802.11 wireless network, what would an attacker have to spoof to initiate a deauthentication attack
against connected clients?
A. the BSSID of the AP where the clients are currently connected
B. the SSID of the wireless network
C. the MAC address of the target client machine
D. the broadcast address of the wireless network
Answer: A
727) What is the commonly known name for the process of generating and gathering initialization vectors, either
passively or actively, for the purpose of determining the security key of a wireless network?
A. WEP cracking
B. session hijacking
C. man-in-the-middle attacks
D. disassociation flood frames
Answer: A
728) Which three options are the types of zones that are defined for anomaly detection on the Cisco IPS Sensor?
(Choose three.)
A. inside
B. outside
C. internal
D. external
E. illegal
F. baseline
Answer: C, D, E
729) Which four techniques can you use for IP data plane security? (Choose four.)
A. Control Plane Policing
B. interface ACLs
C. uRPF
D. MD5 authentication
E. FPM
F. QoS
Answer: B, C, E, F
730) The Wi-Fi Alliance defined two certification programs, called WPA and WPA2, which are based on the IEEE
802.11i standard. Which three statements are true about these certifications? (Choose three.)
A. WPA is based on the ratified IEEE 802.11i standard.
B. WPA2 is based on the ratified IEEE 802.11i standard.
C. WPA enhanced WEP with the introduction of TKIP.
D. WPA2 requires the support of AES-CCMP.
E. WPA2 supports only 802.1x/EAP authentication.
Answer: B, C, D
731) What action does a RADIUS server take when it cannot authenticate the credentials of a user?
A. An Access-Reject message is sent.
B. An Access-Challenge message is sent, and the user is prompted to re-enter credentials.
C. A Reject message is sent.
D. A RADIUS start-stop message is sent via the accounting service to disconnect the session.
Answer: A
732)Which transport mechanism is used between a RADIUS authenticator and a RADIUS authentication server?
A. UDP, with only the password in the Access-Request packet encrypted
B. UDP, with the whole packet body encrypted
C. TCP, with only the password in the Access-Request packet encrypted
D. EAPOL, with TLS encrypting the entire packet
E. UDP RADIUS encapsulated in the EAP mode enforced by the authentication server.
Answer: A
733) How are the username and password transmitted if a basic HTTP authentication is used?
A. Base64 encoded username and password
B. MD5 hash of the combined username and password
C. username in cleartext and MD5 hash of the password
D. cleartext username and password
Answer: A
734) Which field in an HTTPS server certificate is compared to a server name in the URL?
A. Common Name
B. Issuer Name
C. Organization
D. Organizational Unit
Answer: A
735) Which three of these Window operating system services run automatically(are automatically started upon
appliance power up) on the Cisco secure ACS solution Engine? (Choose three)
Answer : A , D, E
736) All of this statement about the cisco configuration professional tool are correct except which one?
Answer : C
737) Which of these command sequences will send an email to holly@invalid.com using SMTP?
Answer : A
What does this configuration prevent?
A. HTTP downloads of files with the ".bat" extension on all interfaces
B. HTTP downloads of files with the ".batch" extension on the inside interface
C. FTP commands of GET or PUT for files with the ".bat" extension on all interfaces
D. FTP commands of GET or PUT for files with the ".batch" extension on the inside interface
Answer: C
739) Which two options correctly describe Remote Triggered Black Hole Filtering (RFC 5635)? (Choose two.)
A. RTBH destination based filtering can drop traffic destined to a host based on triggered entries in the FIB.
B. RTBH source based filtering will drop traffic from a source destined to a host based on triggered entries in the RIB
C. Loose uRPF must be used in conjunction with RTBH destination based filtering
D. Strict uRPF must be used in conjunction with RTBH source based filtering
E. RTBH uses a discard route on the edge devices of the network and a route server to send triggered route updates
F. When setting the BGP community attribute in a route-map for RTBH use the no-export community unless BGP
confederations are used then use local-as to advertise to sub-as confederations
Answer: A, E
740) EAP-MD5 provides one-way client authentication. The server sends the client a random challenge. The client
proves its identity by hashing the challenge and its password with MD5. What is the problem with EAP-MD5?
A. EAP-MD5 is vulnerable to dictionary attack over an open medium and to spoofing because there is no server
authentication.
B. EAP-MD5 communication must happen over an encrypted medium, which makes it operationally expensive.
C. EAP-MD5 is CPU-intensive on the devices.
D. EAP-MD5 not used by RADIUS protocol.
Answer: A
741) With ASM, sources can launch attacks by sending traffic to any groups that are supported by an active RP. Such
traffic might not reach a receiver but will reach at least the first-hop router in the path, as well as the RP, allowing
limited attacks. However, if the attacking source knows a group to which a target receiver is listening and there are
no appropriate filters in place, then the attacking source can send traffic to that group. This traffic is received as long
as the attacking source is listening to the group.
Based on the above description, which type of security threat is involved?
A. DoS
B. man-in-the-middle
C. compromised key
D. data modification
Answer: A
Which two statements correctly describe the debug output that is shown in the exhibit? (Choose two.)
A. The request is from NHS to NNC.
B. The request is from NHC to NHS.
C. 69.1.1.2 is the local non-routable address.
D. 192.168.10.2 is the remote NBMA address.
E. 192.168.10.1 is the local VPN address.
F. This debug output represents a failed NHRP request.
Answer: B, E
743) Which is an example of a network reconnaissance attack?
A. botnets
B. backdoor
C. ICMP sweep
D. firewalk
E. inverse mapping
Answer: C
744) Which ICMP message could be used with traceroute to map network topology?
A. Echo Reply
B. Redirect
C. Time Exceeded
D. Echo
E. Router Selection
F. Address Mask Request
Answer: C
745) Which statement about the Firewalk attack is true?
A. The firewall attack is used to discover hosts behind firewall device.
B. The firewall attack uses ICMP sweep to find expected hosts behind the firewall.
C. The firewall attack uses traceroute with a predetermined TTL value to discover hosts behind the firewall.
D. The firewall attack is used to find the vulnerability in the Cisco IOS firewall code.
E. The firewall attack uses an ICMP echo message to discover firewall misconfiguration.
Answer: C
746) Which pair of ICMP messages is used in an inverse mapping attack?
A. Echo-Echo Request
B. Route Solicitation- Time Exceeded
C. Echo-Time Exceeded
D. Echo Reply-Host Unreachable
E. Echo-Host Unreachable
Answer: D
747) Which statement about a botnet attack is true?
A. The botnet attack is an attack on a firewall to disable it's filtering ability.
B. The botnet attack is a network sweeping attack to find hosts that are alive alive behind the filtering device.
C. The botnet attack is a collection of infected computers that launch automated attacks.
D. The owner of the infected computer willingly participates in automated attacks.
E. The botnet attack enhances the efficiency of the computer for effective automated attacks.
Answer: C
748) Which statement about the SYN flood attack is true?
A. The SYN flood attack is always directed from valid address.
B. The SYN flood attack target is to deplete server memory so that legitimate request cannot be served.
C. The SYN flood attack is meant to completely deplete the TCB SYN-Received state backlog.
D. The SYN flood attack can be launched for both UDP and TCP open ports on the server.
E. SYN-Received state backlog for TCBs is meant to protect server CPU cycles.
Answer: C
749) The HTTP inspection engine has the ability to inspect traffic based on which three parameters? (Choose three.)
A. Transfer Encoding
B. Request Method
C. Header
D. Application Type
E. Header Size
F. Source Address
Answer: A, B, D
750) Which Cisco IOS IPS signature action denies an attacker session using the dynamic access list?
A. produce-alert
B. deny-attacker-inline
C. deny-connection-inline
D. reset-tcp-action
E. deny-session-inline
F. deny-packet-inline
Answer: C
751) Which IPS appliance signature engine inspects IPv6 Layer 3 traffic?
A. Atomic IP
B. Meta
C. Atomic IP Advanced
D. Fixed
E. Service
Answer: C
752) Which statement about the distributed SYN flood attack is true?
A. A distributed SYN flood attack is carried out only by the valid address.
B. A distributed SYN flood attack is carried out only by spoofed addresses.
C. Botnet could be used to launch a distributed SYN flood attack.
D. A distributed SYN flood attack does not completely deplete TCBs SYN-Received state backlog.
E. A distributed SYN flood attack is the most effective SYN flood attack because it targets server memory.
Answer: C
753) Which statement about the prelogin assessment module in Cisco Secure Desktop is true?
A. It assigns an IP address to the remote device after successful authentication.
B. It checks for any viruses on the remote device and reports back to the security appliance.
C. It checks the presence or absence of specified files on the remote device.
D. It clears the browser cache on the remote device after successful authentication.
E. It quarantines the remote device for further assessment if specific registry keys are found.
Answer: C
754) Which option is an example of network reconnaissance attack?
A. botnets
B. ping of death
C. SYN flooding
D. inverse mapping
Answer: D
755) Which statement about Cisco IPS signatures is true?
A. All of the built-in signatures are enabled by default.
B. Tuned signatures are built-in signatures whose parameters cannot be adjusted.
C. Once the signature is removed from the sensing engine it cannot be restored.
D. It is recommended to retire a signature not being used to enhance the sensor performance.
Answer:D
756) Which statement correctly describes a category for the ASA Botnet Traffic Filter feature?
A. Unlisted addresses: The addresses are malware addresses that are not identified by the dynamic database and
are hence defined statically.
B. Ambiguous addresses: In this case, the same domain name has multiple malware addresses. These addresses are
on the graylist.
C. Known malware addresses: These addresses are identified as blacklist addresses in the dynamic database and
static list.
D. Known allowed addresses: These addresses are identified as whitelist addresses that are bad addresses but still
allowed.
Answer: C
757) Which is a core function of the risk assessment process?
A. performing regular network upgrades
B. performing network optimization
C. performing network posture validation
D. establishing network baselines
E. prioritizing network roll-outs
Answer: C
758) In an operating system environment, which three attacks give a user elevated privileges to access resources
that are otherwise blocked? (Choose three.)
A. backdoor
B. rootkit
C. privilege escalation
D. DoS
E. smurf
Answer: A, B, C
759) Which two statements about the Cisco AnyConnect client Trusted Network Detection feature are true? (Choose
two.)
A. The feature relies only on the DNS server list to detect whether the client machine is in a trusted or untrusted
network.
B. An attacker can theoretically host a malicious DHCP server and return data that triggers the client to believe that
it resides in a trusted network.
C. If an attacker knows the DNS server value that is configured in the Cisco AnyConnect profile and provisions the
DHCP server to return both a real and spoofed value, then Cisco AnyConnect considers the endpoint to be in an
untrusted network.
D. The feature does not provide AnyConnect ability to automatically establish VPN connection when the user is
outside the trusted network.
Answer: B, C
760) Which two statements apply to the method that ASA uses for tunnel-group lookup for LAN-to-LAN IPSec
connections when using PSK-based authentication? (Choose two.)
A. If the configuration does not contain the tunnel-group with the IKE ID or peer IP address DefaultRAGroup,
DefaultL2LGroup is used instead.
B. DefaultL2LGroup is used only if the PSK check in DefaultRAGroup fails.
C. DefaultRAGroup is used only if the PSK check in DefaultL2LGroup fails.
D. You can delete and create new default tunnels groups as needed.
Answer: A, B
761) Which command can be used on a Cisco IOS device to prevent it from being used as an amplifier in a fraggle
attack?
A. no service tcp-small-servers
B. no service udp-small-servers
C. no ip directed-broadcast
D. no ip redirects
Answer: B
762) Which option is used for anti-replay prevention in a Cisco IOS IPsec implementation using tunnel protection?
A. Session token
B. One-time password
C. Time stamps
D. Sequence number
E. Nonce
Answer: D
763) Which three actions are advisable when implementing desktop security? (Choose three.)
A. Installing and maintaining anti-virus/anti-malware software
B. Educating users on the danger of opening files and attachments from un-trusted sources
C. Statically defining user password based on information like employee ID number to reduce incidence of forgotten
passwords
D. Configuring multiple local network DHCP servers
E. Staying up to date with operating system patches and updates
F. Configuring client firewalls to automatically disable during business hours as not to impact production traffic and
applications
Answer: A, B, E
764) Which three Cisco security product features assist in preventing TCP-based man-in-the-middle attacks? (Choose
three.)
A. Cisco ASA TCP initial sequence number randomization?
B. Cisco ASA TCP sliding-window conformance validation?
C. Cisco IPS TCP stream reassembly?
D. Cisco IOS TCP maximum segment size adjustment?
Answer: A, B, C
765) Which would be the best method to deploy on a Cisco ASA to detect and prevent viruses and worms?
A. deep packet inspection
B. content security via the Control Security Services Module
C. Unicast Reverse Path Forwarding
D. IP audit signatures
Answer: B
766) Which three statements about NetFlow version 9 are correct? (Choose three.)
A. It is backward-compatible with versions 8 and 5.
B. Version 9 is dependent on the underlying transport; only UDP is supported.
C. A version 9 export packet consists of a packet header and flow sets.
D. Generating and maintaining valid template flow sets requires additional processing.
E. NetFlow version 9 does not access the NetFlow cache entry directly.
Answer: C, D, E
767) Which multicast capability is not supported by the Cisco ASA appliance?
A. ASA configured as a rendezvous point
B. Sending multicast traffic across a VPN tunnel
C. NAT of multicast traffic
D. IGMP forwarding (stub) mode
Answer: B
768) Which method of output queuing is supported on the Cisco ASA appliance?
A. CBWFQ
B. priority queuing
C. MDRR
D. WFQ
E. custom queuing
Answer: B
769) Which three authentication methods does the Cisco IBNS Flexible Authentication feature support? (Choose
three.)
A. cut-through proxy
B. dot1x
C. MAB
D. SSO
E. web authentication
Answer: B, C, E
770) Which option on the Cisco ASA appliance must be enabled when implementing botnet traffic filtering?
A. HTTP inspection
B. static entries in the botnet blacklist and whitelist
C. global ACL
D. NetFlow
E. DNS inspection and DNS snooping
Answer: E
771) Which three options can be configured within the definition of a network object, as introduced in Cisco ASA
version 8.3(1)? (Choose three.)
A. range of IP addresses
B. subnet of IP addresses
C. destination IP NAT translation
D. source IP NAT translation
E. source and destination FQDNs
F. port and protocol ranges
Answer: A, B, D
772) Which three statements are true about the transparent firewall mode in Cisco ASA? (Choose three.)
A. The firewall is not a routed hop.
B. The firewall can connect to the same Layer 3 network on its inside and outside interfaces.
C. Static routes are supported.
D. PAT and NAT are not supported.
E. Only one global address per device is supported for management.
F. SSL VPN is supported for management.
Answer: A, B, C
773) Which three statements about Cisco IOS RRI are correct? (Choose three.)
A. RRI is not supported with ipsec-profiles.
B. Routes are created from ACL entries when they are applied to a static crypto map.
C. Routes are created from source proxy IDs by the receiver with dynamic crypto maps.
D. VRF-based routes are supported.
E. RRI must be configured with DMVPN.
Answer: B, C, D
774) With the Cisco FlexVPN solution, which four VPN deployments are supported? (Choose four.)
A. site-to-site IPsec tunnels?
B. dynamic spoke-to-spoke IPSec tunnels? (partial mesh)
C. remote access from software or hardware IPsec clients?
D. distributed full mesh IPsec tunnels?
E. IPsec group encryption using GDOI?
F. hub-and-spoke IPsec tunnels?
Answer: A, B, C, F
775) Which three statements are true about the Cisco ASA object configuration below? (Choose three.)
object network vpnclients
range 10.1.100.4 10.1.100.10
object network vpnclients
nat (outside,outside) dynamic interface
A. The NAT configuration in the object specifies a PAT rule?
B. This configuration requires the command same-security-traffic inter-interface for traffic that matches this NAT
rule to pass through the Cisco ASA appliance.
C. The NAT rule of this object will be placed in Section 1 (Auto-NAT) of the Cisco ASA NAT table?
D. This configuration is most likely used to provide Internet access to connected VPN clients.
E. Addresses in the range will be assigned during config-mode.
Answer: A, C, D
776) Which three statements are true about the Cisco NAC Appliance solution? (Choose three.)
A. In a Layer 3 OOB ACL deployment of the Cisco NAC Appliance, the discovery host must be configured as the
untrusted IP address of the Cisco NAC Appliance Server.
B. In a Cisco NAC Appliance deployment, the discovery host must be configured on a Cisco router using the "NAC
discovery-host" global configuration command.
C. In a VRF-style OOB deployment of the Cisco NAC Appliance, the discovery host may be the IP address that is on
the trusted side of the Cisco NAC Appliance Server.
D. In a Layer 3 IB deployment of the Cisco NAC Appliance, the discovery host may be configured as the IP address of
the Cisco NAC Appliance Manager.
Answer: A, C, D
777) Which three object tracking options are supported by Cisco IOS policy-based routing? (Choose three.)
A. absence of an entry in the routing table
B. existence of a CDP neighbor relationship
C. existence of an entry in the routing table
D. results of an SAA operation
E. state of the line protocol of an interface
Answer: C, D, E
778) In ISO 27001 ISMS, which three of these certification process phases are required to collect information for ISO
27001? (Choose three.)
A. discover
B. certification audit
C. post-audit
D. observation
E. pre-audit
F. major compliance
Answer: B, C, E
779) Which three statements regarding ISO 27002 and COBIT are correct? (Choose three.)
A. COBIT and ISO 27002 both define a best practices framework for IT controls.
B. COBIT focuses on information system processes, whereas ISO 27002 focuses on the security of the information
systems.
C. ISO 27002 addresses control objectives, whereas COBIT addresses information security management process
requirements.
D. Compared to COBIT, ISO 27002 covers a broader area in planning, operations, delivery, support, maintenance,
and IT governance.
E. Unlike COBIT, ISO 27002 is used mainly by the IT audit community to demonstrate risk mitigation and avoidance
mechanisms.
Answer: A, B, C
780) The IETF is a collaborative effort by the international community of Internet professionals to improve the
design, use, and management of the Internet. Which international organization charters the activity of IETF?
A. IANA
B. ISO
C. ISOC
D. RIR
E. IEC
Answer: C
781) Which statement is correct about the Cisco IOS Control Plane Protection feature?
A. Control Plane Protection is restricted to the IPv4 or IPv6 input path.
B. Traffic that is destined to the router with IP options will be redirected to the host control plane.
C. Disabling CEF will remove all active control-plane protection policies. Aggregate control-plane policies will
continue to operate.?
D. The open-port option of a port-filtering policy allows access to all TCP/UDP based services that are configured on
the router.
Answer: C
782) Which two statements about IPS signatures are true? (Choose two.)
A. All of the built-in signatures are enabled by default.
B. Tuned signatures are built-in signatures whose parameters are adjusted.
C. Once the signature is removed from the sensing engine it cannot be restored
D. It is recommended not to retire a signature that is not being used because then it cannot be restored.
E. It is possible to define custom signatures.
Answer: B, E
783)
Answer: <map><m x1="4" x2="505" y1="45" y2="78" ss="0" a="0" /><m x1="6" x2="504" y1="88" y2="119" ss="0"
a="0" /><m x1="1" x2="503" y1="133" y2="162" ss="0" a="0" /><m x1="3" x2="507" y1="174" y2="205" ss="0"
a="0" /><m x1="518" x2="1016" y1="90" y2="118" ss="1" a="0" /><m x1="519" x2="1016" y1="131" y2="160"
ss="1" a="0" /><m x1="517" x2="1017" y1="174" y2="207" ss="1" a="0" /><m x1="519" x2="1018" y1="216"
y2="248" ss="1" a="0" /><c start="4" stop="0" /><c start="2" stop="1" /><c start="1" stop="2" /><c start="3"
stop="3" /><c start="0" stop="4" /></map>
784)
a="0" /><m x1="520" x2="1021" y1="131" y2="164" ss="1" a="0" /><m x1="519" x2="1021" y1="174" y2="206"
ss="1" a="0" /><c start="2" stop="0" /><c start="1" stop="1" /><c start="3" stop="2" /><c start="0" stop="3"
/></map>
785)
a="0" /><m x1="518" x2="1018" y1="132" y2="164" ss="1" a="0" /><m x1="519" x2="1019" y1="176" y2="206"
stop="3" /><c start="5" stop="4" /><c start="3" stop="5" /></map>
786)
a="0" /><m x1="515" x2="1014" y1="91" y2="119" ss="1" a="0" /><m x1="518" x2="1017" y1="129" y2="163"
787)
a="0" /><m x1="514" x2="1017" y1="90" y2="120" ss="1" a="0" /><m x1="515" x2="1016" y1="132" y2="163"
788)
a="0" /><m x1="518" x2="1014" y1="88" y2="118" ss="1" a="0" /><m x1="514" x2="1017" y1="133" y2="161"
0x1000-0xFFFF
789)
a="0" /><m x1="516" x2="1017" y1="88" y2="119" ss="1" a="0" /><m x1="519" x2="1017" y1="129" y2="162"
y2="244" ss="1" a="0" /><m x1="520" x2="1015" y1="256" y2="291" ss="1" a="0" /><m x1="514" x2="1017"
y1="303" y2="332" ss="1" a="0" /><c start="2" stop="0" /><c start="4" stop="1" /><c start="5" stop="2" /><c
start="6" stop="3" /><c start="3" stop="4" /><c start="1" stop="5" /><c start="0" stop="6" /></map>
790)
a="0" /><m x1="519" x2="1015" y1="128" y2="160" ss="1" a="0" /><m x1="516" x2="1015" y1="172" y2="203"
ss="1" a="0" /><c start="1" stop="0" /><c start="2" stop="1" /><c start="3" stop="2" /><c start="0" stop="3"
/></map>
791)
a="0" /><m x1="520" x2="1015" y1="89" y2="122" ss="1" a="0" /><m x1="519" x2="1017" y1="132" y2="162"
Explanation:
A security policy is a living document that allows an organization and its management team to draw very clear and
understandable objectives, goals, rules and formal procedures that help to define the overall security posture and
architecture for organization.
792)
a="0" /><m x1="517" x2="1015" y1="89" y2="122" ss="1" a="0" /><m x1="516" x2="1016" y1="133" y2="165"
793) Which three statements about the Cisco IPS sensor are true? (Choose three.)
A. You cannot pair a VLAN with itself.
B. For a given sensing interface, an interface used in a VLAN pair can be a member of another inline interface pair.
C. For a given sensing interface, a VLAN can be a member of only one inline VLAN pair, however, a given VLAN can
be a member of an inline VLAN pair on more than one sensing interface.
D. The order in which you specify the VLANs in a inline pair is significant.
E. A sensing interface in inline VLAN pair mode can have from 1 to 255 inline VLAN pairs.
Answer: A, C, E
Explanation:
Inline VLAN Interface Pairs
You cannot pair a VLAN with itself.
For a given sensing interface, a VLAN can be a member of only one inline VLAN pair. However, a given VLAN can be a
member of an inline VLAN pair on more than one sensing interface.
The order in which you specify the VLANs in an inline VLAN pair is not significant.
A sensing interface in inline VLAN pair mode can have from 1 to 255 inline VLAN pairs.
794) According ISO27001 ISMS, which of the following are mandatory documents? (Choose 4)
A. ISMS Policy
B. Corrective Action Procedure
C. IS Procedures
D. Risk Assessment Reports
E. Complete Inventory of all information assets
Answer: A, B, C, D
795) Which two statements describe the Cisco TrustSec system correctly? (Choose two.)
A. The Cisco TrustSec system is a partner program, where Cisco certifies third-party security products as extensions
to the secure infrastructure.
B. The Cisco TrustSec system is an approach to certifying multimedia and collaboration applications as secure.
C. The Cisco TrustSec system is an Advanced Network Access Control System that leverages enforcement intelligence
in the network infrastructure.
D. The Cisco TrustSec system tests and certifies all products and product versions that make up the system as
working together in a validated manner.
Answer: C, D
796)Which three attributes may be configured as part of the Common Tasks panel of an authorization profile in the
Cisco ISE solution? (Choose three.)
A. VLAN
B. voice VLAN
C. dACL name
D. voice domain permission
E. SGT
Answer: A, C, D
797) Which three statements about Cisco Flexible NetFlow are true? (Choose three.)
A. The packet information used to create flows is not configurable by the user.
B. It supports IPv4 and IPv6 packet fields.
C. It tracks all fields of an IPv4 header as well as sections of the data payload.
D. It uses two types of flow cache, normal and permanent.
E. It can be a useful tool in monitoring the network for attacks.
Answer: B, C, E
798) Which three statements are true regarding RFC 5176 (Change of Authorization)? (Choose three.)
A. It defines a mechanism to allow a RADIUS server to initiate a communication inbound to a NAD.
B. It defines a wide variety of authorization actions, including "reauthenticate."
C. It defines the format for a Change of Authorization packet.
D. It defines a DM.
E. It specifies that TCP port 3799 be used for transport of Change of Authorization packets.
Answer: A, C, D
799) Which three statements are true regarding Security Group Tags? (Choose three.)
A. When using the Cisco ISE solution, the Security Group Tag gets defined as a separate authorization result.
B. When using the Cisco ISE solution, the Security Group Tag gets defined as part of a standard authorization profile.
C. Security Group Tags are a supported network authorization result using Cisco ACS 5.x.
D. Security Group Tags are a supported network authorization result for 802.1X, MAC Authentication Bypass, and
WebAuth methods of authentication.
E. A Security Group Tag is a variable length string that is returned as an authorization result.
Answer: A, C, D
800) Which two certificate enrollment methods can be completed without an RA and require no direct connection
to a CA by the end entity? (Choose two.)
A. SCEP
B. TFTP
C. manual cut and paste
D. enrollment profile with direct HTTP
E. PKCS#12 import/export
Answer: C, E
801) Which two statements about the AES algorithm are true? (Choose two)
A. The AES algorithm is an asymmetric block cipher.
B. The AES algorithm operates on a 128-bits block.
C. The AES algorithm uses a fixed length-key of 128 bits.
D. The AES algorithm does not give any advantage over 3DES due to the same key length.
E. The AES algorithm consist of four functions. Three functions provide confusion-diffusion and one provides
encryption.
Answer: B, E
802) Which two statements about the RC4 algorithm are true? (Choose two.)
A. The RC4 algorithm is an asymmetric key algorithm.
B. The RC4 algorithm is a symmetric key algorithm.
C. The RC4 algorithm is slower in computation than DES.
D. The RC4 algorithm is used with wireless encryption protocols.
E. The RC4 algorithm uses fixed-length keys.
Answer: B, D
803) Which three statements about the RSA algorithm are true? (Choose three.)
A. The RSA algorithm provides encryption but not authentication.
B. The RSA algorithm provides authentication but not encryption.
C. The RSA algorithm creates a pair of public-private keys that are shared by entities that perform encryption.
D. The private key is never sent across after it is generated.
E. The public key is used to decrypt the message that was encrypted by the private key.
F. The private key is used to decrypt the message that was encrypted by the public key.
Answer: C, D, F
804) Which two statements about the MD5 Hash are true? (Choose two.)
A. Length of the hash value varies with the length of the message that is being hashed.
B. Every unique message has a unique hash value.
C. Its mathematically possible to find a pair of message that yield the same hash value.
D. MD5 always yields a different value for the same message if repeatedly hashed.
E. The hash value cannot be used to discover the message.
Answer: B, E
805) Which two statements about the SHA-1 algorithm are true? (Choose two)
A. The SHA-1 algorithm is considered secure because it always produces a unique hash for the same message.
B. The SHA-1 algorithm takes input message of any length and produces 160-bit hash output.
C. The SHA-1 algorithm is considered secure because it is possible to find a message from its hash.
D. The purpose of the SHA-1 algorithm is to provide data confidentiality.
E. The purpose of the SHA-1 algorithm is to provide data authenticity.
Answer: B, E
806) Which two statements about the DES algorithm are true? (Choose two)
A. The DES algorithm is based on asymmetric cryptography.
B. The DES algorithm is a stream cipher.
C. The DES algorithm is based on symmetric cryptography.
D. The DES algorithm encrypts a block of 128 bits.
E. The DES algorithm uses a 56-bit key.
Answer: C, E
807) Which statement about the 3DES algorithm is true?
A. The 3DES algorithm uses the same key for encryption and decryption,
B. The 3DES algorithm uses a public-private key pair with a public key for encryption and a private key for
decryption.
C. The 3DES algorithm is a block cipher.
D. The 3DES algorithm uses a key length of 112 bits.
E. The 3DES algorithm is faster than DES due to the shorter key length.
Answer: C
808) Which two statements about the DH group are true? (Choose two.)
A. The DH group is used to provide data authentication.
B. The DH group is negotiated in IPsec phase-1.
C. The DH group is used to provide data confidentiality.
D. The DH group is used to establish a shared key over an unsecured medium.
E. The DH group is negotiated in IPsec phase-2.
Answer: B, D
809) Which two statement about Infrastructure ACLs on Cisco IOS software are true? (Choose two.)
A. Infrastructure ACLs are used to block-permit the traffic in the router forwarding path.
B. Infrastructure ACLs are used to block-permit the traffic handled by the route processor.
C. Infrastructure ACLs are used to block-permit the transit traffic.
D. Infrastructure ACLs only protect device physical management interface.
Answer: B, D
810) For which two reasons BVI is required in the Transparent Cisco IOS Firewall? (Choose two)
A. BVI is required for the inspection of IP traffic.
B. The firewall can perform routing on bridged interfaces.
C. BVI is required if routing is disabled on the firewall.
D. BVI is required if more than two interfaces are in a bridge group.
E. BVI is required for the inspection of non-IP traffic.
F. BVI can manage the device without having an interface that is configured for routing.
Answer: D, F
811) Event Store is a component of which IPS application?
A. SensorApp
B. InterfaceApp
C. MainApp
D. NotificationApp
E. AuthenticationApp
Answer: C
812) Which statement about the Cisco Secure ACS Solution Engine TACACS+ AV pair is true?
A. AV pairs are only required to be enabled on Cisco Secure ACS for successful implementation.
B. The Cisco Secure ACS Solution Engine does not support accounting AV pairs.
C. AV pairs are only string values.
D. AV pairs are of two types: string and integer.
Answer: C
813) MWhich three are RFC 5735 addresses? (Choose three.)
A. 171.10.0.0/24
B. 0.0.0.0/8
C. 203.0.113.0/24
D. 192.80.90.0/24
E. 172.16.0.0/12
F. 198.50.100.0/24
Answer: B, C, E
814) Which statement about ISO/IEC 27001 is true?
A. ISO/IEC 27001 is only intended to report security breaches to the management authority.
B. ISO/IEC 27001 was reviewed by the International Organization for Standardization.
C. ISO/IEC 27001 is intend to bring information security under management control.
D. ISO/IEC 27001 was reviewed by the International Electrotechnical Commission.
E. ISO/IEC 27001 was published by ISO/IEC.
Answer: C
815) NWhich two statements about the ISO are true? (Choose two.)
A. The ISO is a government-based organization.
B. The ISO has three membership categories: Member, Correspondent, and Subscribers.
C. Subscriber members are individual organizations.
D. Only member bodies have voting rights.
E. Correspondent bodies are small countries with their own standards organization.
Answer: B, D
Member bodies are national bodies considered the most representative standards body in each country. These are
the only members of ISO that have voting rights.
816) Which three addresses are special uses as defined in RFC 5735? (Choose three.)
A. 171.10.0.0/24
B. 0.0.0.0/8
C. 203.0.113.0/24
D. 192.80.90.0/24
E. 172.16.0.0/12
F. 198.50.100.0/24
Answer: B, C, E
817) Which statement about Sarbanes-Oxley (SOX) is true?
A. SOX is an IEFT compliance procedure for computer systems security.
B. SOX is a US law.
C. SOX is an IEEE compliance procedure for IT management to produce audit reports.
D. SOX is a private organization that provides best practices for financial institution computer systems.
E. Section 404 of SOX is only related to IT compliance.
Answer: B
818) Which of the following two statements apply to EAP-FAST? (Choose two.)
A. EAP-FAST is useful when a strong password policy cannot be enforced and an 802.1X EAP type that does not
require digital certificates can be deployed.
B. EAP-FAST was developed only for Cisco devices and is not compliant with 802.1X and 802.11i.
C. EAP-FAST provides protection from authentication forging and packet forgery (replay attack).
D. EAP-FAST is a client/client security architecture.
Answer: A, C
819) According to OWASP guidelines, what is the recommended method to prevent cross-site request forgery?
A. Allow only POST requests.
B. Mark all cookies as HTTP only.
C. Use per-session challenge tokens in links within your web application.
D. Always use the "secure" attribute for cookies.
E. Require strong passwords.
Answer: C
820) Which three statements about the IANA are true? (Choose three.)
A. IANA is a department that is operated by the IETF.
B. IANA oversees global IP address allocation.
C. IANA managed the root zone in the DNS.
D. IANA is administered by the ICANN.
E. IANA defines URI schemes for use on the Internet.
Answer: B, C, D
821) Which of the following best describes Chain of Evidence in the context of security forensics?
A. Evidence is locked down, but not necessarily authenticated.
B. Evidence is controlled and accounted for to maintain its authenticity and integrity.
C. The general whereabouts of evidence is known.
D. Someone knows where the evidence is and can say who had it if it is not logged.
Answer: B
822) Which option is a benefit of implementing RFC 2827?
A. prevents DoS from legitimate, non-hostile end systems
B. prevents disruption of special services such as Mobile IP
C. defeats DoS attacks which employ IP source address spoofing
D. restricts directed broadcasts at the ingress router
E. allows DHCP or BOOTP packets to reach the relay agents as appropriate
Answer: C
823) Which current RFC made RFCs 2409, 2407, and 2408 obsolete?
A. RFC 4306
B. RFC 2401
C. RFC 5996
D. RFC 4301
E. RFC 1825
Answer: A
824) Which of these is a core function of the risk assessment process? (Choose one.)
A. performing regular network upgrades
B. performing network optimization
C. performing network posture validation
D. establishing network baselines
E. prioritizing network roll-outs
Answer: C
825) Which two answers describe provisions of the SOX Act and its international counterpart Acts? (Choose two.)
A. confidentiality and integrity of customer records and credit card information
B. accountability in the event of corporate fraud
C. financial information handled by entities such as banks, and mortgage and insurance brokers
D. assurance of the accuracy of financial records
E. US Federal government information
F. security standards that protect healthcare patient data
Answer: B, D
826)A Cisco Easy VPN software client is unable to access its local LAN devices once the VPN tunnel is established.
What is the best way to solve this issue?
A. The IP address that is assigned by the Cisco Easy VPN Server to the client must be on the same network as the
local LAN of the client.
B. The Cisco Easy VPN Server should apply split-tunnel-policy excludespecified with a split-tunnel-list containing the
local LAN addresses that are relevant to the client.
C. The Cisco Easy VPN Server must push down an interface ACL that permits the traffic to the local LAN from the
client.
D. The Cisco Easy VPN Server should apply a split-tunnel-policy tunnelall policy to the client.
E. The Cisco Easy VPN client machine needs to have multiple NICs to support this.
Answer: B
827) Which RFC outlines BCP 84?
A. RFC 3704
B. RFC 2827
C. RFC 3030
D. RFC 2267
E. RFC 1918
Answer: A
828) Which two current RFCs discuss special use IP addresses that may be used as a checklist of invalid routing
prefixes for IPv4 and IPv6 addresses? (Choose two.)
A. RFC 5156
B. RFC 5735
C. RFC 3330
D. RFC 1918
E. RFC 2827
Answer: A, B
829) What functionality is provided by DNSSEC?
A. origin authentication of DNS data
B. data confidentiality of DNS queries and answers
C. access restriction of DNS zone transfers
D. storage of the certificate records in a DNS zone file
Answer: A
830)Which three IP resources is the IANA responsible? (Choose three.)
A. IP address allocation
B. detection of spoofed address
C. criminal prosecution of hackers
D. autonomous system number allocation
E. root zone management in DNS
F. BGP protocol vulnerabilities
Answer: A, D, E
831) Which two statements about RFC 2827 are true? (Choose two.)
A. RFC 2827 defines egress packet filtering to safeguard against IP spoofing.
B. A corresponding practice is documented by the IEFT in BCP 38.
C. RFC 2827 defines ingress packet filtering for the multihomed network.
D. RFC 2827 defines ingress packet filtering to defeat DoS using IP spoofing.
E. A corresponding practice is documented by the IEFT in BCP 84.
Answer: B, D
832) Which two statements about SOX are true? (Choose two.)
A. SOX is an IEFT compliance procedure for computer systems security.
B. SOX is a US law.
C. SOX is an IEEE compliance procedure for IT management to produce audit reports.
D. SOX is a private organization that provides best practices for financial institution computer systems.
E. Section 404 of SOX is related to IT compliance.
Answer: B, E
833) Which three IP resources is IANA responsible for? (Choose three.)
B. detection of spoofed address
C. criminal prosecution of hackers
D. autonomous system number allocation
E. root zone management in DNS
Answer: A, D, E
834) Which VPN technology is based on GDOI (RFC 3547)?
A. MPLS Layer 3 VPN
B. MPLS Layer 2 VPN
C. GET VPN
D. IPsec VPN
Answer: C
835) IANA is responsible for which three IP resources? (Choose three.)
B. Detection of spoofed address
C. Criminal prosecution of hackers
D. Autonomous system number allocation
E. Root zone management in DNS
Answer: A, D, E
836)
Refer to the exhibit. What are two TLS inspection methods you could implement for outbond internet traffic
that can prevent the given untrusted error? (Choose two)
Answer : A , B
187) 837) Which two statements about the SeND protocol are true? (Choose two)
A. It uses IPsec as a baseline mechanism
B. It supports an autoconfiguration mechanism
C. It must be enabled before you can configure IPv6 addresses
D. It supports numerous custom neighbor discovery messages
E. It counters neighbor discovery threats
F. It logs IPv6-related threats to an external log server
Answer: B, E
838) When you are configuring QoS on the Cisco ASA appliance Which four are valid traffic selection
criteria? (Choose four)
Answer : A , C , E, F
839) Class-map nbar_rtp

Match protocol rtp payload-type 0,1,4-0x10, 10001b 10010b,64
The above NBAR configuration matches RTP traffic with which payload types?
Answer : A
840) According to RFC 2577, Which two options describe drawbacks of the FTP protocol? (Choose two)
Answer : D, E
841) On Which encryption algorithm is CCMP based?

A) IDEA
B) BLOWFISH
C) RC5
D) 3DES
E)AES
Answer : E
842)
Refer to the exhibit What type of attack is illustrated?
Answer : B
843) What is the name of the unique tool/feature in cisco security manager that is used to merge an access
list based on the source/destination IP address service or combination of these to provide a manageable
view of access policies?
Answer : E
844)
Refer to the exhibit after you implement ingress filter 101 to deny all icmp traffic on your perimeter router
user complained of poor web performance and the router and the router display increase CPU load. The
debug ipicmp command returned the given output Which configuration you make to the router
configuration to correct the problem?
Answer : D no ip icmp rate-limit unreachable
845) All of these Cisco security products provide event correlation capabilities excepts which one?
Answer : C
846) Which three statements about the keying methods used by MAC Sec are true (Choose Three)
Answer : A B F
847)Which two statement about MSDP ate true? (Choose three)
Answer : B , E , F
848)
A) Modify the tunnel keys to match on the hub and spoke

B) Configure the ipnhrp cache non-authoritative command on the hubs tunnel interface
C) Modify the NHRP hold times to match on the hub and spoke
D) Modify the NHRP network IDs to match on the hub and spoke
Answer : A
849)
Refer to the exhibit What is the configuration design to prevent?
Answer : D
850) Which three of these are security properties that TLS v1.2 provides?(Choose three)?
Answer : B D F
851) Your IPv6 network uses a CA and trust anchor to implement secure network discover. What extension must
your CA certificates support?
Answer : B
852) Which three global correlation feature can be enabled from cisco IPD device manager (Cisco IDM)? (Choose
three)
Answer : C D E
853) Which protocol does VNC use for remote access to a GUI?
Answer : D
854) Which two statement about the IPv6 Hop-by-Hop option extension header (EH) are true?9Choose two)
Answer : B , C
855) Drag and drop the desktop-security terms from the left onto their right definitions on the right?
Answer :
governance = directing and controlling information and communications technology

penetration testing = using hacking techniques to attempt to bypass existing security
phishing = attempting to elict information from users by sending targeted emails
SSO = allowing users to sign in to multiple systems without reentering their credentials
two factor authentication = using more than one mechanism to verify a user login
724) On an ASA firewall in multiple context mode running version8.X What is the default number of VPN site-to site
tunnels per context?
Answer : B
856) By defaults which amount of time does the ASA add to the TTL value of a DNS entry to determine the amount
of time a DNS entry is valid?
Answer : A
857) A server with Ip address 209.165.202.150 is protected behind the inside of a cisco ASA or PIX security appliance
and the internet on the outside interface .User on the internet need to access the server at any time but the firewall
administrator does not want to apply NAT to the address of the server because it is currently a public address which
three of the following command can be used to accomplish this? (Choose three)
Answer : A D F
858) What are two feature that can be used to drop incoming traffic with spoofed bogon address? (Choose two)
Answer : A B
859)During a DoS attacks all of the data is lost from a users laptop and the user must now rebuild the system Which
tool can the user use to extract the outlook PST file from the Microsoft server database?
Answer : C
860) Which three of these situation warrant engagement of a security incident Response team?(Choose three)
Answer : C, D, E
861)
Refer to the exhibit. R1 and R2 are connected across and ASA with MD5 authentication. Which statement
about eBGP peering between the routers could be true?
A) eBGP peering will fail because ASA is transit lacks BGP support.
B) eBGP peering will be successful.
C) eBGP peering will fail because the two routers must be directly connected to allow peering.
D) eBGP peering will fail because of the TCP random sequence number feature.
Answer : C
862) Which two statements about the ISO are true? (Choose two)
A) The ISO is a government-based organization.

B) The ISO has three membership categories: member, correspondent, and subscribers.
C) Only member bodies have voting rights.
D) Correspondent bodies are small countries with their own standards organization.
E) Subscriber members are individual organizations.
Answer : B , C
863) What is the default communication port used by RSA SDI and ASA ?
A) UDP 500
B) UDP 848
C) UDP 4500
D) UDP 5500
Answer : D
864) Which three statement about VRF-Aware Cisco Firewall are true? (Choose three)
A) It can run as more than one instance.

B) It supports both global and per-VRF commands and DoS parameters.
C) It can support VPN networks with overlapping address ranges without NAT.
D) It enables service providers to implement firewalls on PE devices.
E) It can generate syslog massages that are visible only to individual VPNs.
F) It enables service providers to deploy firewalls on customer devices.
Answer : A D E
865) When configuration Cisco IOS firewall CBAC operation on Cisco routers, the inspection rule can be applied at
which two location?(Choose two)
A)at the trusted and untrusted interfaces in the inbound direction.
B)at the trusted interface in the inbound direction.
C)at the trusted and untrusted interfaces in the outbound direction.
D)at the untrusted interface in the inbound direction.
E)at the trusted interface in the outbound direction.
F)at the trusted interface in the outbound direction.
Answer :B,F
866) What message does the TACACS+ daemon send during the AAA authentication process to request additional
authentication information?
A)ACCEPT
B)REJECT
C)CONTINUE
D)ERROR
E)REPLY
Answer :C
867) What are two security controls you can implement to protect your organizations network from virus and worm
outbreak? (Choose two)
A) Require users to authenticate before accessing the network
B) Quarantine hosts that fail to meet your organizations IT security requirements
C) Implement Cisco identity service Engine (ISE)for network security
D) Implement routing protocols with strong interface authentication
E) Deploy Cisco prime LMS to manage network security
Answer :B,C
868) Which two u.s government entities are authorized to execute and enforce the penalties for violations of the
Sarbanes-oxley(SOX)act?(choose two)
A) Federal trade commission (FTC)
B) internal Revenue service (IRS)
C) Office of Civil Rights (OCR)
D)federal reserve board
E) Securities and exchange commission (SEC)
F) United states Citizenship and immigration services (USCIS)
Answer :D,E
869) IKEv2 provide greater network attack resiliency against a DoS attack than IKEv1 by utilizing which two
functionalities?(Choose two)
A) with cookie challenge IKEv2 does not track the state of the initiator until the initiator respond with cookie.
B) Ikev2 perform TCP intercept on all secure connections
C) IKEv2 only allows symmetric keys for peer authentication
D)IKEv2 interoperates with IKEv1 to increase security in IKEv1
E) IKEv2 only allows certificates for peer authentication
F) An IKEv2 responder does not initiate a DH exchange until the initiator responds with a cookie
Answer :A,F
870) What command can you use to protect a router from TCP SYN-flooding attacks?
A) ip igmp snooping
B) rate-limit input <bps><burst-normal><Burst-max>
C) ip tcp intercept list <access-list>
D) ip dns spoofing <ip-address>
E) police <bps>
Answer :C
871) What IOS feature can prevent header attacks by using packet-header information to classify traffic?
A)CAR
B)FPM
C)TOS
D)LLQ
E) TTL
Answer :B
872) How can the tail drop algorithem support traffic when the queue is filled?
A) It drop older packet with a size of 64 byts or more until queue has more traffic
B)It drop older packet with a size of less than 64 byts until queue has more traffic
C) It drops all new packets until the queue has room for more traffic
D) It drops older TCP packets that are set to be redelivered due to error on the link until the queue has room for
more traffic.
Answer :C
873)
Refer to the exhibit. Which statement about the effect of this configuration is true?
A) reply protection is disable
B) It prevent man-in-the-middle attacks
C) The replay window size is set to infinity
D )Out-of-order frames are dropped
Answer :D
874) What technology can you implement on your network to allow IPv4-dependent applications to work with IPv6-
capable application?
A)NAT 6to4
B)DS-lite
C)NAT-PT
D)ISATAP
E)NAT64
Answer :E
875)Which two statement about IPv6 path MTU discovery are true? (choose two)
A) The discover packets are dropped if there is congestion on the link.
B) the initial path MTU is the same as the MTU of the original nodes link layer interface
C)It can allow fragmentation when the minimum MTU is blow a configured value
D) During the discover process the DF bit is set to 1
E) If the source host receiver an ICMPv6 packet too BIG message from a router it reduces its path MTU
F) IF the destination host receives and ICMPv6 packet too Big message from a router it reduces its path MTU
Answer :B,E
876)What context-based access control (CBAC)command sets the maximum time that a router running Cisco IOS
Will wait for a new TCP session to reach the established state?
A) IP inspect max-incomplete
B) IP inspect tcp finwait-time
C) Ip inspect udp idle-time
D) Ip inspect tcpsynwait-time
E) Ip inspect tcp idle-time
Answer :D
877) Which statement is true about SYN cookies?
A) The state is kept on the server machine TCP stack
B) A system has to check every incoming ACK against state tables
C) NO state is kept on the server machine state but is embedded in the initial sequence number
D) SYN cookies do not help to protect against SYN flood attacks
Answer :C
878) You have configured an authenticator switch in access mode on a network configured with NEAT what radius
attribute must the ISE server return to change the switchs port mode to trunk?
A) device-traffic-class=switch
B)device-traffic-class=trunk
C)framed-protocol=1
D)EAP-message-switch
E)Authenticate=Administrative
F)Acct-Authentic=radius
Answer :A
879) Drag each Cisco TrustSec feature on the left to its description on the right?
Answer :
MACSec: a protocol that provides hop-to-hop layer 2 encryption
NDAC: an auth process developed from IEEE 802.1x port-based auth
SAP: key-exchange protocol
SGT:16-bit single label appended to an IP packet
SXP: Protocol that allows devices unable to spport TrustSec to receive SGT attributes from ACS
880) What are the two mechanism that are used to authenticate OSPFv3 packets?(Choose two)
A) MD5
B)ESP
C)PLAIN TEXT
D)AH
E)SHA
Answer :B,D
881)
refer to the exhibit you executed the show crypto key mypubkeyrsa command to verify that the RSA key is protected
and it generated the given output What command must you have entered to protect the key?
Answer :E
882) Drag each IPsec term on the left to the definition on the right?
Answer :
AH: Provides integrity service only for IP packets
ESP: Provides integrity and encryption services for IP packets
SA: The relationship between two peers that determine which algo and keys
the peers use to communicate securely
SADB: A container that stores the policy requirements for a security ass to be esta
SPD: A container for the parameters of each active security asso
SPI: An identification tag that is added to the packet header of traffic intended to be tunneled
883) Which two statement about the multicast addresses query message are true?(choose two)
A) They are solicited when a node initialized the multicast process.
B) They are used to discover the multicast group to which listeners on a link are subscribed
C) They are used to discover whether a specified multicast address has listeners
D) They are send unsolicited when a node initializes the multicast process
E) They are usually sent only by a single router on a link
F)They are sent when a node discover a multicast group
Answer :B,C
884) What security element must an organization have in place before it can implement a security audit and validate
the audit results?
A)firewall
B)network access control
C)an incident response team
D) a security policy
E) a security operation center
Answer :D
885)
Refer to the exhibit. What protocol format is illustrated?
A)GR
B)AH
C)ESP
D)IP
Answer :B
886)
Refer to the exhibit Which as-path access-list regular expression should be applied on R2 as a neighbor filter list to
only allow update with and origin of AS 65503?
A)_65509.?$
B)_65503$
C)^65503.*
D)^65503$
E)_65503_
F)65503
Answer :C
887) Which category to protocol mapping for NBAR is correct?
A) Category:internet
Protocol:FTP,HTTP,TFTP
B))Category:Network management
Protocol:ICMP,SNMP,SSH,telent
C)Category:network mail services
Protocol:mapi,pop3,smtp
D)Category:Enterprise applications
Protocal:citrixICA,PCAnywhere,SAP,IMAP
Answer :A
888) What are two action you can take to protect against DDOS attacks on cisco router and switches?(Choose two)
A) Rate limit SYN packets
B) Filter the RFC-1918 address space
C) configuration IP snooping
D) implement MAC address filtering
E) Configuration PIM-SM
Answer :A,B
889) Which one of the following Cisco ASA adaptive security appliance rule samples will send HTTP data to the AIP-
SSM module to evaluate and stop HTTP attacks?
Answer :C
890) Drag each step in the configuration of a cisco ASA NSEL export to a NETFLOW collector on the left into the
correct order of operations on the right?
Answer :
1. Configure the NSEL collector.
2. Create Class-map to identify the desired traffic.
3. Call ACL under the class-map to match the desired traffic.
4. Create policy-map
5. Associate Class-map to policy map.
6. Configure flow-export action.
7. Associate Policy-map to service-policy.
891) Drag each OSPF security feature on the left to its description on the right.
Answer :
TTL security check:protects ospf neighbor sessions against CPU
prefix length:protects the routers in an ospf neighbor session
Type0:Establishes OSPF sessions without authenthication
Type1:Uses Clear-text authenthication to protect
Type2:Uses MD5 authenthication to protect
892) Which configuration is the correct way to change VPN key Encryption key lifetime to 10800 seconds on the key
server?
Answer :A
893) Which of the following two options can you configure to avoid iBGP full mesh?(Choose two)
A) BGP NHT
B) route reflector
C) local preference
D)confederations
E) Virtual peering
Answer :B,D
894)
Refer to the exhibit you have configured two route-map instances on R1 which passes traffic from switch 1 on both
VLAN 1 and VLAN 2.You wish to ensure that*the first route-map instance matches packets from VLAN 1 and sets
next hop to 3232::2/128.* the second route-map instance matches packets from VLAN 2 and sets the next hop to
3232::3/128 What feature can you implement on R1 to make this configuration possible?
A)PBR
B)BGP local-preference
C)BGP next-hop
D)VSSP
E)GLBP
Answer :C
895) Drag each IP transmission and fragmentation term on the left to the matching statement on the right?
Answer :
DF bit: A value in the IP header that indicates whether packet fragmentation is permitted.
Fragment offset: A value in the IP packet that indicates the location of a fragment in the datagram.
MF bit: Indicates that this is last packet with the biggest offset.
MSS: The amount of data that the receiving host can accept in each TCP segment.
MTU: A value representing the maximum acceptable length of a packet to be transmitted over a link.
PMTUD: A technology used to prevent fragmentation as data travels between two end points.
Tunnel: A logical interface allows packet to be encapsulated inside a passenger protocol for transmission across a
different carrier protocol.
896)
Refer to the exhibit. What is the effect of the given configuration ?

A) It reset and logs FTP connection to all sites except cisco.com and hp.com.
B) FTP connections are unaffected.
C) It resets FTP connection to all sites except cisco.com and hp.com.
D) It resets and logs FTP connection to cisco.com and hp.com only.
E) It resets FPT connection to cisco.com and hp.com only
Answer : A
897)
Refer to the exhibit. What are three effect of the given firewall configuration? (Choose three.)
A) The firewall allows Echo Request packets from any source to pass server.
B) The firewall allows time Exceeded error messages from any source to pass to the server.
C) PCs outside the firewall are unable to communicate with the server over HTTP
D) The firewall allows Echo Reply packets from any source to pass to the server.
E) The firewall allows Destination Unreachable error messages from any source to pass to the server.
F) The firewall allows Packet too big error messages from any source to pass to the server.
Answer: A D F
898) What are two protocols that HTTP can use to secure sessions? (Choose two)
A. HTTPS
B. AES
C. TLS
D. AH
E. SSL
Answer : E, A
899) Which statement regarding the routing functions of the Cisco ASA is true running software version 9.2?
A. In a failover pair of ASAs, the standby firewall establishes a peer relationship with OSPF neighbors
B. The ASA supports policy-based routing with route maps
C. Routes to the Null0 interface cannot be configured to black-hole traffic
D. The translations table cannot override the routing table for new connections
Answer : C
900) when you configure an ASA with RADIUS authentication and authorization, which attribute is used to
differentiate user roles?
A. login-ip-host
B. cisco-priv-level
C. service-type
D. termination-action
E. tunnel-type
Answer : C
901) Which two commands would enable secure logging on Cisco ASA to a syslog server at 10.0.0.1? (Choose two)
A. logging host inside 10.0.0.1 TCP/1500 secure

B. logging host inside 10.0.0.1 UDP/514 secure
C. logging host inside 10.0.0.1 TCP/1470 secure
D. logging host inside 10.0.0.1 UDP/500 secure
E. logging host inside 10.0.0.1 UDP/447 secure
Answer: A,C
902) In Cisco Wireless LAN Controller (WLC) which web policy enables failed Layer 2 authentication to fall back to
WebAuth authentication with a user name and password?
A. On MAC Filter Failure

B. Pass through
C. Splash Page Web Redirect
D. Conditional Web Redirect
E. Authentication
Answer :A
903) Which three options are methods of load-balancing data in an ASA cluster environment?(Choose three)
A. HSRP
B. spanned EtherChannel
C. distance-vector routing
D. PBR
E. floating static routes
F. ECMP
Answer :B,D,F
904) Which two statements about the anti-replay feature are true? (Choose two)
A. By default, the sender uses a single 1024-packet sliding window

B. By default, the receiver uses a single 64-packet sliding window
C. The sender assigns two unique sequence numbers to each clear-text packet
D. The sender assigns two unique sequence numbers to each encrypted packet
E. the receiver performs a hash of each packet in the window to detect replays
F. The replay error counter is incremented only when a packet is dropped
Answer :B,D
905) Refer to the exhibit. What type of attack is represented in the given Wireshark packet capture?
A. a SYN flood
B. spoofing
C. a duplicate ACK
D. TCP congestion control
E. a shrew attack
Answer : A
906) Which three statements about RLDP are true? (Choose three)
A. It can detect rogue Aps that use WPA encryption

B. It detects rogue access points that are connected to the wired network
C. The AP is unable to serve clients while the RLDP process is active
D. It can detect rogue APs operating only on 5 GHz
E. Active Rogue Containment can be initiated manually against rogue devices detected on the wired network
F. It can detect rogue APs that use WEP encryption
Answer : A, B,D
907) Drag each ESP header field on the left into corresponding field-length category on the right?
Answer :
Target 1, 2: Next Header, Pad length
Target 3, 4: Sequence #, Security Parameter Index.
Target 5, 6: Payload data, Authentication data
908) You want to enable users in your companys branch offices to deploy their own access points using
WAN link from the central office, but you are unable to a deploy a controller in the branch offices. What
lightweight access point wireless mode should you choose?
A) TLS mode
B) H-REAP mode
C) Monitor mode
D) REAP mode
E) Local mode
Answer : B
909) Drag each step in the SCEP workflow on the left into the correct order of operations on the right?
Answer :
Step 1: Obtain and validate CA cert.
Step 2: Generate a certificate signing request for the CA.
Step 3: Sent a request to SCEP server to confirm that the cert was signed.
Step 4: Re-enroll the client and replace the existing certificate.
Step 5: Check Certificate revocation list.
910) Drag each IPv6 extension header on the left into the recommended order for more than one extension
header In the same IPv6 packet on the right?
Answer :
1: IPv6 header; 2: Hop by Hop option; 3. Destination options; 4: Routing; 5: Fragment; 6: Authentication; 7:
Encapsulating Security Payload.
911) Which two statement about the Cisco ASA in a transparent-mode deployment are true? (Choose two)
A) It block all ARP packets by default.
B) It supports QoS.
C) It supports iBGP.
D) It can act as a DHCP server.
E) It performs a MAC address look to forward traffic
f) It performs a route lookup to forward traffic.
Ans: D,E
912) Drag each MACsec term on the left to the right matching statement on the right?
Answer :
CAK = key used to generate multiple additional keys
MKA = protocol used for MACsec key negotiation
MSK = key generated during the EAP exchange
SAK = a key used to encrypt traffic for a single session
SAP = a key exchange protocol that is proprietary to Cisco
913) What are two advantages of NBAR2 over NBAR? (Choose two)
A) Only NBAR2 support Flexible NetFlow for extracting and exporting fields from the packet header.
B) Only NBAR2 allows the administrator to apply individual PDL files.
C) Only NBAR2 support PDLM to support new protocals.
D) Only NBAR2 can use Sampled NetFlow to extract pre-defined packet headers for reporting.
E) Only NBAR2 supports custom protocols based on HTTP URLs.
Answer: A, E
914)
With this configuration you notice that the IKE and IPsec SAs come up between the spoke and the hub, but NHRP
registration fails Registration will continue to fail until you do which of these?
A) Modify the NHRP network IDs to match on the hub and spoke.
B) configure the ip nhrp caches non-authoritative command on the hubs tunnel interface.
C) modify the tunnel keys to match on the hub and spoke.
D) modify the NHRP hold time to match on the hub and spoke.
Ans: C
915) Which two OSPF network types support the concept of a designated router? (Choose two.)
A. broadcast
B. NBMA
C. point-to-multipoint
D. point-to-multipoint nonbroadcast
E. loopback
Answer: A, B
916) What are three QoS features supported on the ASA running version 8.x? (Choose Three)
Answer : C,D,F
917) What are the two technologies that support AFT? (Choose two)
A) SNAT
B) NAT -6to4
C) DNAT
D) NAT PT
E) NAT PMP
F) NAT64
Answer:D,F
918) Which statement about ICMPv6 filtering is true?
Answer : B
919) Which five of these are criteria for rule-based rogue classification of access points by the cisco Wireless LAN
controller? (Choose five)
Answer : B, C,D, F, H
920) You have been asked to configure a Cisco ASA appliance in multiple mode with these settings:
A) You need two customer contexts, named contextA and contextB.
B) Allocate interfaces G0/0 and G0/1 to contextA.
C) Allocate interfaces G0/0 and G0/2 to contextB.
D) The physical interface name for G0/1 within contextA should be "inside".
E) All other context interfaces must be viewable via their physical interface names.
If the admin context is already defined and all interfaces are enabled, which command set will complete this
configuration?
A. context contextA
config-url disk0:/contextA.cfg
allocate-interface GigabitEthernet0/0 visible
allocate-interface GigabitEthernet0/1 inside
context contextB
config-url disk0:/contextB.cfg
B. context contexta
context contextb
C. context contextA
allocate-interface GigabitEthernet0/0 invisible
context contextB
D. context contextA
allocate-interface GigabitEthernet0/0
context contextB
E. context contextA
context contextB
Answer: A
921) What are two method of preventing DoS attacks on your network? (Choose two)
A) Increase the ICMP Unreachable massage rate limit interval.
B) Implement shaping on the perimeter router.
C) Disable the ICMP Unreachable response on the loopback and Null0 interfaces
D) Decrees the ICMP Unreachable massage interval
E) Implement CWBQ on the perimeter router
Answer : A E
922) Which statement about the cisco anyconnect web security module is true ?
A) It is VPN client software that works over the SSl protocol.
B) It is an endpoint component that is used with smart tunnel in a clientless SSL VPN.
C) It operates as an NAC agent when it is configured with the Anyconnect VPN client.
D) It is deployed on endpoints to route HTTP traffic to SCANsafe
Answer : D
923) Which two statement about DHCP snooping are true ? (Choose Two)
A) The binding database stores information about trusted interface.
B) Massages sent from outside the service-provider network are untrusted.
C) The binding database stores information about both IP and MAC addresses.
D) The lease time in the binding database is a pre-set value.
E) DHCP servers connect to untrusted interface on the switch.
Answer : C D
924) Drag each field in authentication header on the left into the order in which it appears in the header on
the right?
Answer :
1: Next header; 2: Payload; 3: Reserved; 4: Security Parameter Index; 5: Sequence #; 6: Authentication data.
925) Which three fields are part of the AH header? (Choose three)
A) Destination address
B) Protocol ID
C) Packet ICV
D) SPI identifying SA
E) Next header
F) Application port
G) Source address
Answer : C D E
926) What are the three response types for SCEP enrollment requests? (Choose three.)
A. PKCS#7
B. Reject
C. Pending
D. PKCS#10
E. Success
F. Renewal
Answer : B, C, E
927) What are the two most common methods that security auditors use to assess an organization's security processes?
(Choose two)
A. social engineering attempts
B. interviews
C. policy assessment
D. penetration testing
E. document review
F. physical observations
Answer :A, E
928) What protocol provides security for datagram protocols?

A. MAB
B. DTLS
C. SCEP
D. GET
E. LDP
Answer : B
929) What is the first step in performing a risk assessment?

A. Identifying critical services and network vulnerabilities and determining the potential impact of their compromise
or failure.
B. Investigating reports of data theft or security breaches and assigning responsibility.
C. Terminating any employee believed to be responsible for compromising security.
D. Evaluating the effectiveness and appropriateness of the organizations current risk-management activities.
E. Establishing a security team to perform forensic examinations of previous known attacks.
Answer : A
930) Drag each attack type on the left to the matching attack category on the right.
931) What technique can an attacker use to obfuscate a malware application payload, allowing it to bypass standard
security mechanisms?
A. Teredo tunnelling
B. Decryption
C. A PE32 header
D. Steganography
E. BASE64
Answer : E
932) Which two statements about Network Edge Authentication Technology (NEAT) are true? (Choose two)
A. It requires a standard ACL on the switch port

B. It conflicts with auto-configuration
C. It allows you to configure redundant links between authenticator and supplicant switches
D. It supports port-based authentication on the authenticator switch
E. It can be configured on both access ports and trunk ports
F. It can be configured on both access ports and EtherChannel ports
Answer : D,E
933) Drag and drop step in the flow of packets on a DMVPN network using GDOI on the left into the correct
sequence on the right
Answer : A spoke encrypts: 5
A spoke sends the : 4
An encrypted DMVPN : 3
Each group member : 2
The HUB and spoke that are : 1
934) What is the purpose of the vulnerability risk method for assessing risk?
A. It directs the actions an organization can take in response to a reported vulnerability

B. It evaluates the effectiveness and appropriateness of an organizations current risk management activities
C. It directs the actions an organization can take to ensure perimeter security
D. It prevents and protects against security vulnerabilities in an organization
E. It establishes a security team to perform forensic examinations of known attacks
Answer : C
935) Given the IPv4 address 10.10.100.16, which two address are valid IPv4-compatible IPv6 addresses? (Choose
two)
A. 0:0:0:0:0:10:10:100:16
B. 0:0:10:10:10:16:0:0:0
C. 0:0:10:10:100:16:0:0:0
D. ::10:10:100:16
E. :::A:A:64:10
Answer : A, D
936) What protocol is responsible for issuing certificates?
A. SCEP
B. DTLS
C. ESP
D. AH
E. GET
Answer : A
937) Drag each Management Frame Protection feature on the Left to the function it performs on the right?
Answer :
Client MFP: Enables access points to drop spoofed management frames.
Event reporting: Enables the WLC to aggregate anomaly reports.
Infrastructure Frame validation: Enables and disables MFP protection and validation on selective basis.
Management frame protection: Enables an access point to report management frames with invalid MICs to the WLC.
Management frame validation: Enables an access point to verify that management frame from other access points
include a valid MIC IE from the sending access points BSSID.
938)
Refer to the exhibit if R1 is acting as a DHCP server ,What action can you take to enable the pc to receive
an ip address assignment from the DHCP server ?
A) Configure the IP local pool command on R2
B) Configure DHCP option 150 on R2
C) Configure the IP helper-address command on R2 to use R1s ip address
D) Configure the IP helper-address command on R1 to use R2s ip address
E) Configuration DHCP option 82 on R1
F) Configure the ip local pool command on R1
Answer : C
939) Drag each type of spoofing attack on the left on an action you can take to prevent it on the right?
Answer :
ARP spoofing: Enable dyna mic ARP inspection.
DHCP spoofing: Filter messages and traffic from untrusted sources.
DNS spoofing: Apply current updates and zone transfers only from trusted sources regularly.
IP spoofing: Enables IP source guard.
TCP spoofing: Enable filtering on the router.
URL Spoofing: Apply periodic web browser security patches.
940)
Refer to the exhibit. What is the meaning of the given error massage ?
A) Ike is disable on the remote peer

B) The mirrored crypto ACLs are mismatched
C) The pre-shared keys are mismatched
D) The PFS group are mismatched
Answer : C
941) Drag and drop
Answer :
ACI: Performs in-depth analysis
Atomic : Supports individual signature
Fixed : matches prallel regular
Flood : Detects DoS and DDos attacks
Meta :Process events instead of individual packets
Normalizer : enforces RFC compliance
Trojan : analysis non-standard protocol traffic
942) Which of the following Cisco IPS signature engine has relatively high memory usage ?
A. The STRING-TCP engine

B. The STRING-UDP engine
C. The NORMALIZER engine
D. The STRING-ICMP engine
Answer : C
943) Which option describes the purpose of the RADIUS VAP-ID attribute?
A. It specifies the ACL ID to be matched against the client

B. It specifies the WLAN ID of the wireless LAN to which the client belongs
C. It sets the minimum bandwidth for the connection
D. It sets the maximum bandwidth for the connection
E. It specifies the priority of the client
F. It identifies the VLAN interface to which the client will be associated
Answer : B
944)
Refer to the exhibit. Which statement about this debug output is true ?
A. It was generated by a LAN controller when it responded to a join request from an access point
B. It was generated by a LAN controller when it generated a join request to an access point
C. It was generated by an access point when it sent a join reply message to a LAN controller
D. It was generated by an access point when it received a join request message from a LAN controller
Answer : A
945)
Refer to the exhibit Flexible NetFlow is failing to export flow records from RouterA to your flow collector. What
action can you take to allow the IPv6 flow records to be sent to the colle
A. Set the NetFlow export protocol to v5

B. Configure the output-features command for the IPV4-EXPORTER
C. Add the ipv6 cef command to the configuration
D. Remove the ip cef command from the configuration
E. Create a new flow exporter with an IPv6 destination and apply it to the flow monitor
Answer : D
946) Drag each ISE probe on the left to the matching statement on the right
Answer :
Dhcp:Reprofiles endpoints
Dhcp Span:Listen to network
Dns:Look up an endpoint FQDN
HTTP:Captures Packets
HTTP Span:Captures Web-browser
Snmp Query:Uses CDP to Profile endpoints
947) What is the effect of the Cisco Application Control Engine (ACE) command ipv6 fragment min-mtu 1024 ?
A. It configures the interface to fragment packets on connections with MTUs of 1024 or greater
B. It sets the MTU to 1024 bytes for an IPv6 VLAN interface that accepts fragmented packets
C. It configures the interface to attempt to reassemble only IPv6 fragments that are less than 1024 bytes
D. It configures the interface to fragment packets on connections with MTUs of 1024 or less
E. It configures the interface to attempt to reassemble only IPv6 fragments that are at least 1024 bytes
Answer : E
948 )when a client tries to connect to a WLAN using the MAC filter (RADIUS server), if the client fails the
authentication, what is the web policy used to fallback authentication to web authentication ?
A.Authentication
B.Passthrough
C.Conditional Web Redirect
D.Splash Page Web Redirect
E.On MAC Filter Failure
Answer : E
949)
Refer to the exhibit. After you configured routes R1 and R2 for IPv6 OSPFv3 authentication as shown, the
OSPFv3 neighbor adjacency failed to establish. What is a possible reason for the problem?
A. R2 received a packet with an incorrect area form the loopback1 interface

B. OSPFv3 area authentication is missing
C. R1 received a packet with an incorrect area from the FastEthernet0/0 interface
D. The SPI and the authentication key are unencrypted
E. The SPI value and the key are the same on both R1 and R2
Answer : C
950) Drag and drop the DNS record types from the left to the matching descriptions to the right
. DNSkEY: contains a public key for use by the resolver
NSEC: Link to the zone's next record name
NSEC3 : contains a hashed link to the zone's next record name
PRSIG: contains the record set's DNSSEC signature
NSEC3PARAM : used by authoritative DNS servers when responding to DNSSEC requests
DS : holds the delegated zone's name
951 ) You have configured an authenticator switch in access mode on a network configured with NEAT. What
RADIUS attribute must the ISE sever return to change the switch's port mode to trunk?
A. device-traffic-class=switch
B. device-traffic-class=trunk
C. Framed-protocol=1
D. EAP-message=switch
E. Acct-Authentic=RADIUS
F. Authenticate=Administrative
Answer : A
952)
Refer to the exhibit. What are the two effects of the given configuration? (Choose two)
A. It permits Time Exceeded messages that indicate the fragment assembly time was exceeded
B. It permits Destination Unreachable messages that indicate the host specified in the datagram rejected the
message due to filtering
C. It permits Destination Unreachable messages that indicate a problem delivering the datagram to the
destination address specified in the datagram
D. It permits Parameter Problem messages that indicate an unrecognized value in the Next Header Filed
E. It permits Parameter Problem messages that indicate an error in the header
F. It permits Destination Unreachable messages that indicate an invalid port on the host specified in the
datagram
Answer : C, F
953) In ISO 27002, access control code of practice for information Security Management servers which of the
following objective?
A. Implement protocol control of user, network and application access

B. Optimize the audit process
C. Prevent the physical damage of the resources

D. Educating employees on security requirements and issues
Answer : A
954)
Refer to the exhibit. You executed the show crypto key mypubkey rsa command to verify that the RSA key is
protected and it generated the given output. What command must you have entered to protect the key?
A. crypto key decrypt rsa name pki.cisco.com passphrase CiscoPKI

B. crypto key zeroize rsa CiscoPKI
C. crypto key export ras pki.cisco.com pem url flash: 3des CiscoPKI
D. crypto key lock rsa name pki.cisco.com passphrase CiscoPKI
E. crypto key import rsa pki.cisco.com pem url nvram: CiscoPKI
Answer : D
955) Drag and drop the role on the left onto their responsibility in the change-management process on the right
1 Change Builder - Plans and Implement
2 Change Comittee - Determines whether
3 Customer - Submit Change Request
4 Project Manager - Owns and Leads
956)
Refer to the exhibit You have received an advisory that your organization could be running a vulnerable product.
Using the Cisco Systems Rapid Risk Vulnerability Model, you determine that * Your organization is running an
affected product on a vulnerable version of code vulnerable component is enabled and there is no feasible
workaround * There is medium confidence of an attack without significant collateral damage to the organization.
According to the model what is the appropriate urgency for remediation?
A. priority maintenance process

B. contact ISP to trace attack
C. no action required
D. remove vulnerable device from service
E. standard maintenance process
F. immediate mitigation process
Answer : E
957)
Refer the exhibit. Which of the following is the correct output of the above executed command?
Answer : C
958) Which two statements about VPLS and VPWS are true? (Choose two)
A. VPLS Layer 2 VPNs support both full-mesh and hub-and-spoke implementations

B. VPWS only sends the data payload over an MPLS core
C. VPLS is intended for applications that require point-to-point access
D. VPWS supports multicast using a hub-and-spoke architecture
E. VPLS is intended for applications that require multipoint or broadcast access
F. VPWS supports point-to-point integration of Layer 2 and Layer 3 services over an MPLS cloud
Answer : E,F
959)
Refer to the EXHIBIT .what is the effect of the given configuration?
A) It will Drop all TTL packet with a value of 14 in the IP header field.
B) It will Drop all TTL packet with a TTL value less than 14.
C) It will Drop all TTL packet with a TTL value of 15 or more.
D) It will Drop all TTL packet with a TTL value of 14 or more.
Answer : B
960) Which Three statement about cisco IPS manager express are true? (Choose three)
A) It provides a customizable view of events statistics.
B) It Can provision policies based on risk rating.
C) It Can provision policies based on signatures.
D) It Can provision policies based on IP addresses and ports.
E) It uses vulnerability-focused signature to protect against zero-day attacks.
F) It supports up to 10 sensors.
Answer : A B F
961) What are the two IPSec modes? (Choose two)

A) Aggressive
B) ISAKMP
C) Transport
D) IKE
E) Main
F) Tunnel
Answer : C F
962) Which two statement about MLD version 2 on the ASA are true ? (Choose two)
A) It allows the ASA to function as a multicast router.
B) It enables the ASA to discover multicast address listeners on attached and remote links.
C) It discover other multicast address listeners by listening to multicast listener reports.
D) It enables the ASA to discover multicast address listeners to attached links only.
E) It sends multicast listener reports in response to multicast listener quires.
Answer : D E
963)
Refer to the exhibit which two statement about the given IPV6 ZBF configuration are true? (Choose two)
A) It provides backward compability with legacy IPv6 inspection
B) It inspect TCP, UDP,ICMP and FTP traffic from Z1 to Z2.
C) It inspect TCP, UDP,ICMP and FTP traffic from Z2 to Z1.
D) It inspect TCP,UDP,ICMP and FTP traffic in both direction between z1 and z2
.
E) It passes TCP, UDP,ICMP and FTP traffic from z1 to z2.
F) It provide backward compatibility with legacy IPv4 inseption.
Answer : A B
964)
Refer to the exhibit. What is the effect of the given configuration?
A) It sets the duplicate address detection interval to 60 second and sets the IPv6 neighbor reachable time
to 3600 milliseconds.
B) It sets the number of neighbor solicitation massages to 60 and sets the retransmission interval to
3600 milliseconds.
C) It sets the number of duplicate address detection attempts to 60 and sets the duplicate address
detection interval to 3600 millisecond.
D) It sets the number of neighbor solicitation massage to 60 and set the duplicate address detection
interval to 3600 second.
E) It sets the duplicate address detection interval to 60 second and set the IPv6 neighbor solicitation
interval to 3600 millisecond.
Answer : E
965) What are two features of cisco IOS that can help mitigate Blaster worm attack on RPC ports? (Choose
two)
A) FPM
B) DCAR
C) NBAR
D) IP source Guard
E) URPF
F) Dynamic ARP inspection
Answer : D E
966) What ASA feature can do use to restrict a user to a specific VPN group?
A) A webtypeACL
B) MPF
C) A VPN filter
D) Group-lock
Answer : D
967) Which two statement about PVLAN port types are true? (Choose two)
A) A community port can send traffic to community port in other communities on its broadcast domain.
B) An isolated port can send and receive traffic only to and from promiscuous ports.
C) An isolated port can receive traffic from promiscuous port in an community on its broadcast domain,
but can send traffic only to port in its own community.
D) A promiscuous port can send traffic promiscuous port in other communities on its broadcast
domain.
E) A community port can send traffic to promiscuous port in other communities on its broadcast
domain.
F) A Promiscuous port can send traffic to all ports within a broadcast domain.
Answer : B F
968)
Refer to the Exhibit.What is the effect of the given ACL policy ?
A) The
policy will
deny all IPv6 eBGP session.
B) The policy will disable IPv6 source routing.
C) The policy will deny all IPv6 routing packet.
D) The policy will deny all IPv6 routed packet.
Answer : B
969) Which two value must you configure on the cisco ASA firewall to support FQDN ACL ? (Choose
two)
A) A DNS server
B) A Service policy
C) An FQDN object
D) A Class map
E) A services object
F) A policy map
Answer : A C
970) Drag each step in the cisco PRIST response to incidents and vulnerability involving cisco product on the left into
the correct order on the right?
Answer :
Step 1: PSIRT receives the notification of a security incident.
Step 2: PSIRT coordinates fix and impact assessment.
Step 3: PSIRT sets the notification format and time frames.
Step 4: PSIRT engages experts and executives.
Step 5: PSIRT notifies all the customers simultaneously.
971) From what type of server can you to transfer files to ASAs internal memory ?
A) SSH
B) SFTP
C) Netlogon
D) SMB
Answer : D
972) Drag each SSI encryption algorithm on the left to the encryption and hashing values it uses on the Right?
Answer :
3DES-sha1: 168 bit encryption with 160 bit hash
DES-sha1: 56 bit encryption with 160 bit hash
Null sha1: 160 bit hash without encryption
RC4-md5: 128 bit with 128 bit hash
RC4-sha1: 128 bit with 160 bit hash.
973) What is an example of a WEP cracking attack ?
A) SQL injection attack
B) Caf latte attack
C) directory traversal attack
D) Reflected XSS attack
Answer : B
974) What port has IANA assigned to the GDOI protocol ?
A) UDP 4500
B) UDP 1812
C) UDP 500
D) UDP 848
Answer : D
975) Which two statement about router Advertisement message are true? (Choose two)
A) Local link prefixes are shared automatically.
B) Each prefix included in the advertisement carries lifetime information f
Or that prefix.
C) Massage are sent to the miscast address FF02::1
D) It support a configurable number of retransmission attempts for neighbor solicitation massage.
E) Flag setting are shared in the massage and retransmitted on the link.
F) Router solicitation massage are sent in response to router advertisement massage
Answer : A,F
976) Which Two statement about the PCoIP protocol are true? (Choose two)
A) It support both loss and lossless compression
B) It is a client-rendered, multicast-codec protocol.
C) It is available in both software and hardware.
D) It is a TCP-based protocol.
E) It uses a variety of codec to support different operating system.
Answer : A C
978) What are three IPv6 extension headers? (Choose three)
A) TTL
B) source option
C) Destination options
D) Authentication
E) Segment
F) Hop-by-Hop options
Answer : C D F
979) What is the maximum pattern length supported by FPM searches within a packet ?
A) 256 bytes
B) 1500 bytes
C) 512 bytes
D) 128 bytes
Answer : A
980) What functionality does SXP provide to enhance security?
A) It supports secure communication between cisco ironport Cisco and Microsoft Exchange.
B) It supports Ciscos trustsec solution by transporting information over network that are unable to support
SGT propagation.
C) It support secure communications between cisco ironport and cloud-based email servers.
D) It support ciscos trustsec implementation on virtual machines.
Answer : B
981)Which command sets the Key-length for the IPv6 send protocol?
A) IPv6 nd ns-interval
B) Ipv6 ndra-interval
C) IPv6 nd prefix
D) IPv6 nd inspection
E) IPv6 nd secured
Answer : E
982)What is the purpose of enabling the IP option selective Drop feature on your network routers?
A) To protect the internal network from IP spoofing attacks.

B) To drop IP fragmented packets.
C) To drop packet with a TTL value of Zero.
D) To protect the network from DoS attacks.
Answer : D
983) What command specifies the peer from which MSDP SA message are accepted?
A) IP msdpsa-filter in <peer>[list<acl>] [route-map <map> ]

B) Ipmsdp default-peer <peer>
C) Ipmsdp mesh-group
D) Ipmsdp originator-id <interface>
Answer : B
984) Drag and drop the description on the left on to the associated item on the right.
Answer :
Collection of similar programs that work together to execute specific tasks: Botnet
Independent malicious program copies itself: Worms
Programs that appear to have one function but actually performs a different function: Trojan horse
Programs that modify other programs: Virus
985) Drag each EAP variant in the 802.1x framework to the matching statement on the right?
Answer :
EAP-FAST: An encapsulated EAP variant that can travel through TLS tunnel
EAP-MD5: When used, EAP servers provide authentication to EAP peers only
EAP-OTP: Authenticates using a single-use token
EAP-PEAP: Performs secure tunnel authentication
EAP-SIM: Enables GSM users to access both voice and data services with unified authentication.
EAP-TLS: Provides EAP message fragmentation.
EAP-TTLS: An early EAP variant that uses certificates based authentication of both client and server
LEAP: A simplified EAP variant that uses password as shared service.
986)
Refer to the exhibit, which configuration prevents R2 from become a PIM neighbor with R1?
A) Access-list 10 deny 192.168.1.2.0.0.0.0

!
Interface gi0/0
Ippim neighbor-filter 1
B) Access-list 10 deny 192.168.1.2.0.0.0.0
!
Interface gi0/0
Ipigmp access-group 10
C) Access-list 10 deny 192.168.1.2.0.0.0.0
!
Interface gi0/0
Ippimneighbour-filter 10
D) Access-list 10 permit 192.168.1.2.0.0.0.0
!
Interface gi0/0
Ippim neighbor-filter 10
Answer : D
987) What are feature that can stop man-in-the-middle attacks? (Choose two)
A) ARP sniffing on specific ports
B) ARP spoofing
C) Dynamic ARP inspection
D) DHCP snooping
E) destination MAC ACLs
Answer : C,D
988)When attempting to use basic Http authentication to authenticate a client,which type of HTTP massage should
the server use?
A) HTTP 200 with a WWW-authenticate header.
B) HTTP 401 with a WWW-authenticate header.
C) Http 302 with an authenticate header.
D) HTTP 407.
Answer : B
989)
Refer to the exhibit, what Is the effect of the given command sequence?
A) The router telnet to the on port 2002

B) The AP console port is shut down.
C) A session is opened between the router console and the AP.
D) The router telnet to the router on port 2002.
Answer : C
990) Drag each step in the configuration of flexiblenetflow IPv6 traffic Unicast flows on the left into the Correct
order of operation on the right?
Answer :
Step 1: Configure the flow exporter
Step 2: configure flow record
Step 3: configure flow monitor
Step 4: Apply flow monitor
Step 5: Configure data export.
991) Which two statement about DTLS are true ? (choose two)
A) Unlike TLS,DTLS support VPN connection with ASA.
B) It is more secure that TLS.
C) When DPD is enabled DTLS connection can automatically fall back to TLS.
D) It overcomes the latency and bandwidth problem that can with SSL.
E) IT come reduce packet delays and improve application performance.
F) It support SSL VPNs without requiring an SSL tunnel.
Answer : C , D
992) What feature enables extended secure access from non-secure physical location?
A) Port security
B) Strom control
C) NEAT
D) CBAC
E) 802 1x pot-based authentication
Answer : C
993)
Refer to the
Exhibit which service or feature must be enabled on 209.165.200.255 produce the given output?
A) The finger service

B) A BOOTp server
C) A TCP small server
D) The PAD service
Answer : C
994) What are three protocol that support layer 7 class maps and policy maps for zone based firewalls? (choose
three)
A) IMAP
B) RDP
C) MME
D) ICQ
E) POP3
F) IKE
Answer : A D E
995)
Refer to the Exhibit, What is a possible reason for the given error?
A) One or more require application failed to respond.

B) The IPS engine is busy building cache files.
C) The IPS engine I waiting for a CLI session to terminate.
D) The virtual sensor is still initializing.
Answer : D
996)
Refer to the Exhibit, Which two Statements about the given Configuration are true? (Choose two)
A) It is an inbound policy.
B) It will allow 209.165.202.129 to connect to 202.165.200.225 on an IMAP port.
C) It will allow 209.165.202.129 to connect to 202.165.200.225 on an RDP port.
D) It will allow 202.165.200.225 to connect to 209.165.202.129 on an RDP port.
E) It will allow 202.165.200.225 to connect to 209.165.202.129 on a VNC port.
F) It is an outbound policy.
Answer : C A
997) Which two statements about WPA 2 with AES CCMP encryption are true? (Choose two)
A. AES CCMP is a block cipher

B. It is compatible with TACACS+ servers running LEAP authentication
C. Every wireless packet sent to the host is tagged with CCMP frames
D. It uses a 256-bit hashing key
E. The MIC prevents modifications of wireless frames and replay attacks
F. It uses a 128-bit hashing key
Answer: A,F
998)
Refer to the exhibit, which conclusion can be drawn from this output?
A. The license of the device supports multiple virtual firewalls
B. The license of the device allows the establishment of the maximum number of client-based, full-
tunnel SSL VPNS for the platform
C. The license of the device allows for it to be used in a failover set
D. The license of the device allows a full-tunnel IPsec VPN using the Rijndael cipher
Answer : A
999) What feature on Cisco IOS router enables user identification and authorization based on per-user policies
A. CBAC
B. IPsec
C. Authentication proxy
D. NetFlow v9
E. Zone-based firewall
F. EEM
Answer : C
1000) Which two statements about CoPP are true? (Choose two)
A. When a deny rule in an access list is used for MQC is matched, classification continues on the next
class
B. It allows all traffic to be rate limited and discarded
C. Access lists that are used with MQC policies for CoPP should omit the log and log-input keywords
D. The mls qos command disables hardware acceleration so that CoPP handles all QoS
E. Access lists that use the log keyword can provide information about the devices CPU usage
F. The policy-map command defines the traffic class
Answer: A,C
1001) What are three pieces of data you should review in response to a suspected SSL MITM attack?
(Choose three)
A. The IP address of the SSL server
B. The X.509 certificate of the SSL server
C. The MAC address of the attacker
D. The MAC address of the SSL server
E. The X.509 certificate of the attacker
F. The DNS name off the SSL server
Answer: A, B,F
1002.Refer to the exhibit. Routers R1, R2, and R3 have IPv6 reachability, and R1 and R3 are able to ping each other
with the IPv6 global unicast address. However, R1 and R3 are unable to ping each other with their
link-local addresses. What is a possible reason for the problem?
A. Link-local addresses can communicate with neighboring interfaces.

B. Link-local addresses are forwarded by IPv6 routers using loopback interfaces.
C. Link-local addresses can be used only with a physical interface's local network.
D. Multicast must be enabled to allow link-local addresses to traverse multiple hops.
Answer: C
1003.What are three ways you can enforce a BCP38 policy on an internet edge policy?(choose three)
A. Avoid RFC1918 internet addressing.

B. Implement Cisco Express Forwarding.
C. Implement Unicast RPF.
D. Apply ingress filters for RFC1918 addresses.
E. Apply ingress ACL filters for BOGON routes.
F. Implement source NAT.
Answer: B,C,E
1004.Which two statements about header attacks are true?(Choose Two)
A. An attacker can use IPv6 Next Header attacks to steal user data and launch phishing attacks.
B. An attacker can use HTTP Header attacks to launch a DoS attack.
C. An attacker can execute a spoofing attack by populating the RH0 routing header subtype with multiple
destination addresses.
D. An attacker can leverage an HTTP response header to write malicious cookies.
E. An attacker can leverage an HTTP response header to inject malicious code into an application layer.
F. An attacker can use vulnerabilities in the IPv6 routing header to launch attacks at the application layer.
Answer: B,C
1005.Which two network protocols can operate on the Application Layer?(Choose two)
A. DNS
B. UDP
C. TCP
D. NetBIOS
E. DCCP
F. SMB
Answer: A, F
1006.Refer to the exhibit . Which Statement about this configuration is true?
A. The ASA stops LSA type 7 packets from flooding into OSPF area 1.
B. The ASA injects a static default route into OSPF area 1.
C. The ASA redistributes routes from one OSPF process to another.
D. The ASA redistributes routes from one routing protocol to another.
E. The ASA injects a static default route into OSPF process 1.
Answer:C
1007.Drag and Drop each Cisco Intrusion Prevention System anomaly detection event action on the left onto the
matching description on the right.
Answer: A-4,B-3,C-1,D-2,E-5,F-7,G-6
1008.Refer to the exhibit. A signature failed to compile and returned the given error messages. What is a possible
reason for the problem?
A. The signature belongs to the IOS IPS Basic category.

B. The signature belongs to the IOS IPS Advanced category.
C. There is insufficient memory to compile the signature.
D. The signature is retired.
E. Additional signature must be complied during the compiling process.
Answer: C
1009.The computer at 10.10.10.4 on your network has been infected by a botnet that directs traffic to a malware
site at 168.65.201.120. Assuming that filtering will be performed on a Cisco ASA, What command can you use to
block all current and future connections from the infected host?
A. ip access-list extended BLOCK_BOT_OUT deny ip any host 10.10.10.4

B. shun 10.10.10.4 168.65.201.120 6000 80
C. ip access-list extended BLOCK_BOT_OUT deny ip host 10.10.10.4 host 168.65.201.120
D. ip access-list extended BLOCK_BOT_OUT deny ip host 168.65.201.120 host 10.10.10.4
E. shun 168.65.201.120 10.10.10.4 6000 80
Answer: C
1010.Which command sequence can you enter to enable IP multicast for WCCPv2?
A. Router(config)#ip wccp web-cache service-list
Router(config)#interface FastEthernet0/0
Router(config)#ip wccp web-cache group-listen
B. Router(config)#ip wccp web-cache group-list
C. Router(config)#ip wccp web-cache group-address 224.1.1.100
Router(config)#ip wccp web-cache redirect in
D. Router(config)#ip wccp web-cache group-address 224.1.1.100
E. Router(config)#ip wccp web-cache group-address 224.1.1.100
Router(config)#ip wccp web-cache redirect out
Answer: D
1011.You have discovered unwanted device with MAC address 001c.0f12.badd on port FastEthernet1/1 on
VLAN 4.what command or command sequence can you enter on the switch to prevent the MAC address from passing
traffic on VLAN 4?
A.
B.
C.
D.
E.
Answer: D
1012.In a Cisco ASA multiple-context mode of operation configuration, what three session types are resource-
limited by default when their context is a member of the default class?(choose three).
A. Telnet sessions
B. ASDM sessions
C. IPSec sessions
D. SSH sessions
E. TCP sessions
F. SSL VPN sessions
Answer: A, B,D
1013.Which two statements about ICMP redirect messages are true? (choose two)
A. By default, configuring HSRP on the interface disables ICMP redirect functionality.

B. They are generated when a packet enters and exits the same router interface.
C. The messages contain an ICMP Type 3 and ICMP code 7.
D. They are generated by the host to inform the router of an alternate route to the destination.
E. Redirects are only punted to the CPU if the packets are also source-routed.
Answer: A,B
1014.Refer to the exhibit. What is the effect of the given command sequence?
A. The HTTP server and client will negotiate the cipher suite encryption parameters.
B. The server will accept secure HTTP connections from clients with signed security certificates.
C. The client profile will match the authorization profile defined in the AAA server.
D. The clients are added to the cipher suite's profile.
E. The server will accept secure HTTP connections form clients defined in the AAA server.
Answer: B
1015.What port has IANA assigned to the GDOI protocol?
A. UDP 4500
B. UDP 500
C. UDP 1812
D. UDP 848
Answer: D
1016.when a host initiates a TCP session, what is the numerical range into which the initial sequence number must
fail?
A. 0 to 65535
B. 1 to 1024
C. 0 to 4,294,967,295
D. 1 to 65535
E. 1 to 4,294,967,295
F. 0 to 1024
Answer: C
1017.Which three statements about Unicast RPF in strict mode and loose mode are true? (choose three)
A. Inadvertent packet loss can occur when loose mode is used with asymmetrical routing.
B. Strict mode requires a default route to be associated with the uplink network interface.
C. Both loose and strict modes are configured globally on the router.
D. Loose mode requires the source address to be present in the routing table.
E. Strict mode is recommended on interfaces that will receive packets only form the same subnet to which the
interface is assigned.
F. Interfaces in strict mode drop traffic with return routes that point to the NULL 0 interface.
Answer: D,E,F
1018.Refer to the exhibit. If you apply the given command to a Cisco device running IOS or IOS XE, which two
statements about connections to the HTTP server on the device are true?(Choose two)
A. The device will close each connection after 90 seconds even if a connection is actively processing a request.
B. Connections will close after 60 seconds without activity or 90 seconds with activity.
C. Connections will close after 60 seconds or as soon as the first request is processed.
D. When you apply the command , the device will immediately close any existing connections that have been
open for longer than 90 seconds.
E. Connections will close after 60 seconds without activity or as soon as the first request is processed.
Answer: C,E
1019.what is the most commonly used technology to establish an encrypted HTTP connection?
A. the HTTP/1.1 Upgrade header

B. the HTTP/1.0 Upgrade header
C. Secure Hypertext Transfer Protocol
D. HTTPS
Answer: D
1020.Which three statements about SCEP are true?(Choose three)
A. It Supports online certification revocation.

B. Cryptographically signed and encrypted message are conveyed using PKCS#7.
C. The certificate request format uses PKCS#10.
D. It supports multiple cryptographic algorithms, including RSA.
E. CRL retrieval is support through CDP (Certificate Distribution Point) queries.
F. It supports Synchronous granting.
Answer: B,C,E
1021.How does a wireless association flood attack create a DoS?
A. It sends a high-power RF pulse that can damage the internals of the AP.
B. It spoofs disassociation frames from the access point.
C. It uses a brute force attack to crack the encryption.
D. It exhausts the access client association table.
Answer: D
1022.Refer to the exhibit . What is the meaning of the given error message?
A. The PFS groups are mismatched.

B. The pre-shared keys are mismatched.
C. The mirrored crypto ACLs are mismatched.
D. IKE is disabled on the remote peer.
Answer: B
1023)
Refer to the exhibit. If R1 is connected upstream to R2 and R3 at different ISPs as shown, what action must be taken
to prevent Unicast Reverse Path Forwarding (uRPF) from dropping asymmetric traffic?
A. Configure Unicast RPF Loose Mode on R2 and R3 only.

B. Configure Unicast RPF Loose Mode on R1 only.
C. Configure Unicast RPF Strict Mode on R1 only.
D. Configure Unicast RPF Strict Mode on R1,R2 and R3.
E. Configure Unicast RPF Strict Mode on R2 and R3 only.
Answer: E
1024.Which feature can you implement to protect against SYN-flooding DoS attacks?
A. the ip verify unicast reverse-path command

B. a null zero route
C. CAR applied to icmp packets
D. TCP Intercept
Answer: B
1025.Drag and drop each RADIUS packet field on the left onto the matching decription on the right.
Answer: A-5,B-2,C-1,D-3,E-4
1026.Which two effects of configuring the tunnel path-mtu-discovery command on a GRE tunnel interface are true?(
Choose two)
A. The maximum path MTU across the GRE tunnel is set to 65534 bytes.
B. If a lower MTU link between the IPsec peers is detected , the GRE tunnel MTU are changed.
C. The router adjusts the MTU value it sends to the GRE tunnel interface in the TCP SYN packet.
D. It disables PMTUD discovery for tunnel interfaces.
E. The DF bit are copied to the GRE IP header.
F. The minimum path MTU across the GRE tunnel is set to 1476 bytes.
Answer: B,E
1027.Which Statement about remote procedure calls is true?
A. They support synchronous and asynchronous requests.

B. They can emulate different hardware specifications on a single platform.
C. They support optimized data replication among multiple machines.
D. They use a special assembly instruction set to process remote code without conflicting with other remote
processes.
E. They can be invoked by the client and the server.
Answer: D
1028.Which two statements about role-based access control are true?(Choose two)
A. Server profile administrators have read and write access to all system logs by default.
B. If the same user name is used for a local user account and a remote user account, the roles defined in the
remote user account override the local user account.
C. A view is created on the Cisco IOS device to leverage role-based access controls.
D. Network administrators have read and write access to all system logs by default.
E. The user profile on an AAA server is configured with the roles that grant user privileges.
Answer: D,E
1029.If the ASA interfaces on a device are configured in passive mode, which mode must be configured on the
remote device to enable EtherChannel?
A. standby
B. active
C. on
D. passive
Answer: B
1030.Why is the IPv6 type 0 routing header vulnerable to attack?
A. It allows the receiver of a packet to control its flow.

B. It allows the sender to generate multiple NDP requests for each packet.
C. It allows the sender of a packet to control its flow.
D. It allows the sender to generate multiple ARP requests for each packet.
E. It allows the receiver of a packet to modify the source IP address.
Answer: C
1031.What protocol does IPv6 Router Advertisement use for its messages?
A. TCP
B. ICMPv6
C. ARP
D. UDP
Answer: B
1032.Refer to the exhibit. Which statement about the router R1 is true?
A. Its private-config is corrupt.

B. Its NVRAM contains public and private crypto keys.
C. Its running configuration is missing.
D. RMON is configured.
Answer: B
1033.Refer to the exhibit. What feature must be implemented on the network to produce the given output?
A. PQ
B. CQ
C. WFQ
D. NBAR
E. CAR
Answer:D
1034.What protocol does SMTPS use to secure SMTP connections?
A. AES
B. TLS
C. Telnet
D. SSH
Answer: B
1035.Which command can you enter to cause the locally-originated Multicast Source Discovery Protocol Source-
Active to be prevented from going to specific peers?
A. ip msdp mesh-group mesh-name {<peer-address>|<peer-name>}

B. ip msdp redistribute [list <acl>][asn as-access-list][route-map <map>]
C. ip msdp sa-filter out <peer> [list<acl>] [route-map<map>]
D. ip msdp default-peer {<peer-address> | <peer-name>}[prefix-list<list>]
E. ip msdp sa-filter in <peer> [list<acl>][route-map <map>]
Answer: C
1036.Refer to the exhibit. What IPSec function does the given debug output demonstrate?
A. DH exchange initiation
B. setting SPIs to pass traffic
C. PFS parameter negotiation
D. crypto ACL confirmation
Answer: B
1037.Which object table contains information about the clients know to the server in Cisco NHRP MIB
implementation?
A. NHRP Cache Table

B. NHRP Client Statistics Table
C. NHRP Purge Request Table
D. NHRP Server NHC Table
Answer: D
1038.Which two statements about NAT-PT with IPv6 are true?(choose twp)
A. It can be configured as dynamic, static, or PAT.

B. It provides end-to-end security.
C. It supports IPv6 BVI configurations.
D. It provides support for Cisco Express Forwarding.
E. It provides ALG support for ICMP and DNS.
F. The router can be a single point of failure on the network.
Answer: A, E
1039.What are two features that help to mitigate man-in-the-middle attacks?(Choose two)
A. dynamic ARP inspection

B. ARP sniffing on specific ports
C. destination MAC ACLs
D. ARP spoofing
E. DHCP snooping
Answer: A,E
1040.You are developing an application to manage the traffic flow of a switch using an OpenDaylight controller.
Knowing you use a Northbound REST API ,which statement is true?
A) Different applications, even in different languages, cannot use the same functions in a REST API at same
time.
B) The server retains client state records
C) We must teach our applications about the Southbound protocol(s) used
D) The applications are considered to be the clients, and the controller is considered to be the server
Answer: D
1041.What is the maximum pattern length supported by FPM searches within a packet?
A) 256 bytes
B) 128 bytes
C) 512 bytes
D) 1500 bytes
Answer: A
1042.Which description of a virtual private cloud is true?
A) An on-demand configurable pool of shared software applications allocated within a public cloud
environment, which provides tenant isolation
B) An on-demand configurable pool of shared data resources allocated within a private cloud environment,
which provides assigned DMZ zones
C) An on-demand configurable pool of shared networking resources allocated within a private cloud
D) An on-demand configurable pool of shared computing resources allocated within a public cloud
Answer: D
1043.Which technology builds on the vPathconcept and can be used in virtual and physical environments?
A) VXLAN
B) ACI
C) NSH
D) SDN
Answer: C
1044.What are the two technologies that support AFT? (Choose two)
A) NAT-PT
B) SNAT
C) NAT64
D) DNAT
E) NAT-PMP
F) NAT-6to4
Answer: A,C
1045.Which two options are differences between automation and orchestration? (Choose two)
A) Automation is to be used to replace human intervention

B) Automation is focused on automating a single or multiple tasks
C) Orchestration is focused on an end-to-end process or workflow
D) Orchestration is focused on multiple technologies to be integrated together
E) Automation is an IT workflow composed of tasks, and Orchestration is a technical task
Answer: B,C
1046.You want to allow existing network hardware (which is not part of the ACI infrastructure) to be governed
by the APIC, by installing device packages. Where must these packages be installed?
A) On the connecting leaf switches

B) On the APIC
C) On the network element you are adding
D) On all devices on the path
Answer: A
1047.Which Cisco product solution is designed for workload mobility between public-public and private-public
clouds?
A) Cisco Cloud Orchestrator

B) Cisco Unified Cloud
C) Cisco Intercloud Fabric
D) Cisco Metapod
Answer: C
1048.A cloud service provider is designing a large multilenant data center to support thousands of tenants. The
provider is concerned about the scalability of the Layer 2 network and providing Layer 2 segmentation to
potentially thousands of tenants. Which Layer 2 technology is best suited in this scenario?
A) LDP
B) VXLAN
C) VRF
D) Extended VLAN ranges
Answer: B
1049.What are two characteristics of RPL, used in loT environments? (Choose two)
A) It is an Exterior Gateway Protocol

B) It is a Interior Gateway Protocol
C) It is a hybrid protocol
D) It is link-state protocol
E) It is a distance-vector protocol
Answer: B,E
1050.Which two options are open-source SDN controllers? (Choose two)
A) OpenContrail
B) OpenDaylight
C) Big Cloud Fabric
D) Virtual Application Networks SDN Controller
E) Application Policy Infrastructure Controller
Answer: A,B
1051.Which option describes the purpose of Fog architecture in loT?
A) To provide compute services at the network edge

B) To provide intersensor traffic routing
C) To provide centralized compute resources
D) To provide highly available environmentally hardened network access
Answer: A
1052.Which significant change to PCI DSS standards was made in PCI DSS version 3.1?
A. No version of TLS is now considered to provide strong cryptography.

B. Storage of sensitive authentication data after authorization is now permitted when proper encryption is
applied.
C. Passwords are now required to be changed at least once every 30 days.
D. SSL is now considered a weak cryptographic technology.
E. If systems that are vulnerable to POODLE are deployed in an organization, a patching and audit review
process must be implemented.
Answer:D
1053.
Refer to the exhibit.While troubleshooting a router issue ,you executed the show ntp associationcommand and it
returned this output.Which condition is indicated by the reach value of 357?
A. The NTP continuously received the previous 8 packets.

B. The NTP process is waiting to receive its first acknowledgement.
C. The NTP process failed to receive the most recent packet, but it received the 4 packets before the most
recent packet.
D. The NTP process received only the most recent packet.
Answer:C
1054.
Refer to the exhibit. Which effect of this command is true?
A. The current public key of the router is deleted from the cache when the router reboots, and the router
generates a new one.
B. The CA revokes the public key certificate of the router.
C. The public key of the remote peer is deleted from the router cache.
D. The router immediately deletes its current public key from the cache and generates a new one.
E. The router sends a request to the CA to delete the router certificate from its configuration.
Answer:C
1055. Which feature can prevent IP spoofing attacks?
A. CoPP
B. CBAC
C. ARP spoofing
D. TCP Intercept
E. Unicast RPF
F. CAR
Answer:E
1056.On which two protocols is VNC based?(Choose two)
A. Rdesktop
B. UDP
C. RFB
D. Terminal Services Client
E. CoRD
F. TCP
Answer:C,F
1057.
Refer to the exhibit. Which effect of this configuratioin is true?
A. The router sends PIM messages only to other routers on the same LAN.
B. The router sends PIM messages, but it rejects any PIM message it receives.
C. The router acts as a stub multicast router for the EIGRP routing protocol.
D. The router accepts all PIM control messages.
E. The router acts as the DR and DF for all bidir-PIM group ranges.
Answer:E
1058.According to RFC 4890, which three message must be dropped at the transit firewall/router?(Choose three.)
A. Router Renumbering(Type 138)

B. Node Information Query(Type 139)
C. Router Solicitation(Type 133)

D. Node information Response(Type 140)
E. Router Advertisement(Type 134)
F. Neighbor Solicitaion(Type 135)
Answer:A,B,D
1059.CCMP (CCM mode Protocol) is based on which algorithm?
A. 3DES
B. Blowfish
C. RC5
D. AES
E. IDEA
Answer:D
1060.Drag and drop each step in the SCEP process on the left into the correct order of operations on the right.
Answer:A:5,B:4,C:2,D:3,E:1,F:6.
1061.Which two statements about DTLS are true?(Choose two)
A. It uses two simultaneous IPSec tunnels to carry traffic.

B. If DPD is enabled, DTLS can fall back to a TLS connection.
C. Because it requires two tunnels, it may experience more latency issues than SSL connections.
D. If DTLS is disabled on an interface, then SSL VPN connections must use SSL/TLS tunnels.
E. It is disabled by default if you enable SSL VPN on the interface.
Answer:B,C
1062.Which two statements about the 3DES encryption protocol are true?(Choose two)
A. It can operate in the Electronic Code Book and Asymmetric Block Chaining modes.
B. Its effective key length is 168 bits.
C. It encrypts and decrypts data in three 64-bit blocks with an overall key length of 192 bits.
D. The algorithm is most efficient when it is implemented in software instead of hardware.
E. It encrypts and decrypts data in three 56-bit blocks with an overall key length of 168 bits.
F. Its effective key length is 112 bits.
Answer:E,F
1063.Which three statements about the Unicast RPF in strict mode and loose mode are true?(Choose three)
A. Loose mode requires the source address to be present in the routing table.
B. Inadvertent packet loss can occur when loose mode is used with asymmetrical routing.
C. Interfaces in strict mode drop traffic with return that point to the Null 0 Interface.
D. Strict mode requires a default route to be associated with the uplink network interface.
E. Strict mode is recommended on interfaces that will receive packets only from the same subnet to which is
assigned.
F. Both loose and strict modes are configured globally on the router.
Answer:A,C,E
1064.Which object table contains information about the clients know to the server in Cisco NHRP MIB
implementaion?
A. NHRP Server NHC Table
B. NHRP Client Statistics Table

C. NHRP Cache Table
D. NHRP Purge Request Table
Answer:A
1065.
Refer to the exhibit. Which effect of this Cisco ASA policy map is true?
A. The Cisco ASA is unable to examine the TLS session.

B. The server ends the SMTP session with a QUIT command if the algorithm or key length is insufficiently
secure.
C. it prevents a STARTTLS session from being established.
D. The Cisco ASA logs SMTP sessions in clear text.
Answer:B
1066.Which two options are differences between a automation and orchestration?(Choose two)
A. Automation is an IT workflow composed of tasks, and orchestration is a technical task.

B. Orchestration is focused on multiple technologies to be integrated together.
C. Orchestration is focused on an end-to-end process or workflow
D. Automation is to be used to replace human intervention.
E. Automation is focused on automating a single or multiple tasks.
Answer:B,C
1067.Which two options are system requirements for single sign-on on Cisco Unified Communications Manager?
(Choose two)
A. OpenAM must be deployed in a different domain Microsoft Active Directory.
B. All participating entities must have their clocks synchronized.

C. The local user profile on Cisco Unified Communications must be disabled.
D. IWA and Kerberos authentication must be configured in the Windows domain.
E. Microsoft Active Directory must be deployed in a domain-based configuration.
Answer:B,E
1068.
Refer to the exhibit. Which effect of this configuration is true?
A. It enables MLD query messages for all link-local groups.

B. It configures the node to generate a link-local group report when it joins the solicited-node multicast group.
C. It enables hosts to send MLD report messages for groups 224.0.0.0/24.
D. it enables local group membership for MLDv1 and MLDv2.
E. It enables the host to send MLD report messages for nonlink local groups.
Answer:C
1069.Which three statements about the SHA-2 algorithm are true? (Choose three)
A. It provides a variable-length output using a collision-resistant cryptographic hash.

B. It provides a fixed-length output using a collision-resistant cryptographic hash.
C. It is used for integrity verification.
D. It generates a 160-bit message digest.
E. It is the collective term for the SHA-224, SHA-256, SHA-384, and SHA-512 algorithms.
F. It generates a 512-bit message digest.
Answer:B,C,E
1070.
A. The WLC accepts self-signed certificates from the RADIUS server to authorize APs.
B. The WLC adds the MAC addresses listed in the ssc ap-policy to its internal authorization list.
C. The WLC adds the ssc access point to the auth-list internal authorization list.
D. The WLC accepts the manufacture-installed certificate from the local access point.
E. The WLC accepts self-signed certificates from devices added to itsa internal authorization list.
Answer:D
1071.Which two statements about implementing GDOI in a DMVPN network are true?(Choose true)
A. Direct spoke-to-spoke traffic is black-holed.

B. Rekeying requires an exclusive IGMP join in the mGRE interface
C. The crypto map is applied to the sub interface of each spoke.
D. If a group member rekey operation fails, it must wait for the SA lifetime to expire before it can reregister
with the key server.
E. The DMVPN hub can act as the GDOI key server.
F. DMVPN spokes with tunnel protection allow traffic to be encrypted to the hub
Answer:D,E
1072.Drag and drop each syslog facility code on the left onto its description on the right.
Answer:A:1,B2,C:3,D:4,E:5,F:6
1073.
Refer to the exhibit. Which two effect of this configuration are true ? (Choose two)
A. The Cisco ASA first check the user credentials against the AD tree of the security.cisco.com.
B. The Cisco ASA use the cisco directory as the starting point for the user search.
C. The AAA server SERVERGROUP is configured on host 10.10.10.1 with the timeout of 20 seconds.
D. The Cisco ASA uses the security account to log in to the AD directory and search for the user cisco.
E. The Cisco ASA authentication directly with the AD server configured on host 10.10.10.1 with the timeout of
20 second.
F. The admin user is authenticated against the members of the security.cisco.com group.
Answer:C,F
1074) Which of the following statement is true about the ARP attack?
A) Attackers sends the ARP request with the MAC address and IP address of a legitimate resource in the
network.
B) Attackers sends the ARP request with the MAC address and IP address of its own.
C) ARP spoofing does not facilitate man-in-the middle attack of the attackers.
D) Attackers sends the ARP request with its own MAC address and IP address of a legitimate resource in the
network.
Answer: D
1075) Which two statements about WPA 2 in enterprise mode are true? (choose two)
A) TKIP generates a MCI to provide data integrity for the wireless frame.
B) The PMK is generated dynamically by the servers and passed to the access point.
C) 802.1x authentication is performed in the second of two authentication phases.
D) It is commonly used in home environments as well as enterprises.
E) 802.1x authentication is performed in the first of two authentication phases.
F) Session keys can be shared with multiple clients.
Answer : B, E
1076) Which two options are benefits of shortcut Switching Enhancements for NHRP on DMVPN networks?
(choose two)
A) Its enables the NHRP FIB lookup process to perform route summarization on the hub.
B) It allows data packets to be fast switched while spoke-to-spoke tunnels are being established.
C) It is most beneficial with partial full-mesh DVMPN setup.
D) It supports layered network topologies with the central hubs and direct spoke-to spoke tunnels between
spokes on different hubs.
E) It enables spokes to use a summary route to build spoke-to-spoke tunnels.
Answer: B, E
1077) Which two options are disadvantages of MPLS layers 3 VPN services? (choose two)
A) They requires cooperation with the service provider to implement transport of non-IP traffic.
B) SLAs are not supported by the service provider.
C) It requires customers to implement QoS to manage congestion in the network.
D) Integration between Layers 2 and 3 peering services is not supported.
E) They may be limited by the technology offered by the service provider.
F) They can transport only IPv6 routing traffic.
Answer: D, E
1078)

A) NUD retransmits 1000 Neighbor solicitation messages every 4 hours and 4 minutes.
B) NUD retransmits Neighbor Solicitation messages after 4, 16, 64 and 256 seconds.
C) NUD retransmits Neighbor Solicitation messages every 4 seconds.
D) NUD retransmits unsolicited Neighbor advertisements messages every 4 hours.
E) NUD retransmits f our Neighbor Solicitation messages every 1000 seconds.
F) NUD retransmits Neighbor Solicitation messages after 1, 4, 16, and 64 seconds.
Answer: E
1079) In which class of applications security threads does HTTP header manipulation reside?
A) Session management
B) Parameter manipulation
C) Software tampering
D) Exception managements
Answer: A
1080) Which of the following statement is true about the ARP spoofing attack?
A) Attacker sends the ARP request with the MAC address and IP address of the legitimate resource in the
network.
B) Attacker of ends the ARP request with MAC address and IP address of its own.
C) ARP spoofing does not facilitate man in-the-middle attack for the attacker.
D) Attacker sends the ARP request with its own MAC address and IP address of legitimate resource in the
network.
Answer: D
1081) Which command can you enter on the Cisco ASA to disable SSH?
A) Crypto key generate ecdsa label
B) Crypto key generate rsa usage-keys noconfirm
C) Crypto keys generate rsa general-keys modulus 768
D) Crypto keys generate ecdsa noconfirm
E) Crypto keys zeroize rsa noconfirm
Answer: E
1082) Which two router configurations block packets with the Type 0 Routing header on the interface? (choose
two)
A) Ipv6 access-list Deny_Loose_Routing
permit ipv6 any any routing-type 0
deny ipv6 any any
interface FastEthernet0/0
ipv6 traffic-filter Deny_Loose_Source_Routing in
B) Ipv6 access-list-Deny_Loose_Source_Routing
Deny ipv6 FE80::/10 any mobility type bind-refresh
Permit ipv6 any any
Interface FastEthernet/0
Ipv6 tr
Affic-filter Deny_Loose_Source_Routing in
C) Ipv6 access-list Deny_Loose_Source_Routing
Deny ipv6 any any routing-type 0
Permit ipv6 any any
Interface FastEthernet0/0
Ipv6 traffic filter Deny_Loose_Routing in
D) Ipv6 access list Deny_Loose_Source_Routing
Deny ipv6 any FE80: :/10 routing type 0
Deny ipv6 any any routing type 0
Permit ipv6 any any
Interface FastEthernet t0/0
Ipv6 traffic filter Deny_Loose_Source_Routing in
E) Ipv6 access list Deny_Loose_Source_Routing
Sequence 1 deny ipv6 any any routing type 0 log-input
Sequence 2 permit ipv6 any any flow label 0 routing interface Fastethernet0/0
Ipv6 traffic-filter Deny_Loose_Source_Routing in
Answer: C, D
1083) Which two statement about the DES algorithm are true?(choose two)
A) It uses a 64-bit key block size and its effective key length is 65 bits
B) It uses a 64-bits key block size and its effective key length is 56 bits
C) It is a stream cripher that can be used with any size input
D) It is more efficient in software implements than hardware implementations.
E) It is vulnerable to differential and linear cryptanalysis
F) It is resistant to square attacks
Answer: B, E
1084) Which two statements about LEAP are true? (Choose two)
A. It is compatible with the PAP and MS-CHAP protocols
B. It is an ideal protocol for campus networks
C. A symmetric key is delivered to the authenticated access point so that future connections from the
same client can be encrypted with different keys
D. It is an open standard based on IETF and IEEE standards
E. It is compatible with the RADIUS authentication protocol
F. Each encrypted session is authentication by the AD server
Answer: E,F
1085) Which Cisco ASA firewall mode supports ASDM one-time-password authentication using RSA SecurID?
A. Network translation mode
B. Single-context routed mode
C. Multiple-context mode
D. Transparent mode
Answer: B
1086) Which two statements about Cisco ASA authentication using LDAP are true? (Choose two)
A. It uses attribute maps to map the AD memberOf attribute to the cisco ASA Group-Poilcy attribute
B. It uses AD attribute maps to assign users to group policies configured under the WebVPN context
C. The Cisco ASA can use more than one AD memberOf attribute to match a user to multiple group
policies
D. It can assign a group policy to a user based on access credentials
E. It can combine AD attributes and LDP attributes to configure group policies on the Cisco ASA
F. It is a closed standard that manages directory-information services over distributed networks
Answer: A,B
1087)

A. Host_1 learns about R2 and only and prefers R2 as its default router
B. Host_1 selects R2 as its default router and load balances between R2 and R3
C. Host_1 learns about R2 and R3 only and prefers R3 as its default router
D. Host_1 learns about R1,R2 and R3 and load balances between them
E. Host_1 learns about R1, R2 and R3 and prefers R2 as its default router
Answer: E
1088) Which two statements about IKEv2 are true? (Choose two)
A. It uses EAP authentication
B. It uses X.509 certificates for authentication
C. The profile is a collection of transforms used to negotiate IKE SAs
D. It supports DPD and Nat-T by default
E. The profile contains a repository of symmetric and asymmetric preshared keys

F. At minimum, a complete proposal requires one encryption algorithm and one integrity algorithm
Answer: E,F
1089) Which two options are benefits of the Cisco ASA Identity Firewall? (Choose two)
A. It can apply security policies on an individual user or user-group basis

B. It can identify threats quickly based on their URLs
C. It can operate completely independently of other services
D. It decouples security policies from the network topology
E. It supports an AD server module to verify identity data
Answer: A,D
1090)
Refer to the exhibit, which effect of this configuration is true?

A. The PMTUD value sets itself to 1452 bytes when the interface MTU is set to 1492 bytes
B. SYN packets carries 1452 bytes in the payload when the Ethernet MTU of the interface is set to 1492
bytes
C. The maximum size of TCP SYN+ACK packets passing the transient host is set to 1452 bytes and the IP
MTU of the interface is set to 1492 bytes
D. The MSS to TCP SYN packets is set to 1452 bytes and the IP MTU of the interface is set to 1492 bytes
E. The minimum size of TCP SYN+ACL packets passing the router is set to 1452 bytes and the IP MTU of the
interface is set to 1492 bytes
Answer: D
1091) Which two statements about SGT Exchange Protocol are true? (Choose two)
A. It propagates the IP-to-SGT binding table across network devices that do not have the ability to perform
SGT tagging at Layer 2 to devices that support it
B. SXP runs on UDP port 64999
C. A connection is established between a listener and a speaker

D. SXP is only supported across two hops
E. SXPv2 introduces connection security via TLS
Answer: A,C
1092) Drag and drop ESP header field on the left to the appropriate field length on the right
Answer:
1093)
Refer to the exhibit. Which two effects of this configuration are true? (Choose two)
A. The BGP neighbor session tears down after R1 receives 100 prefixes from the neighbor 1.1.1.1
B. The BGP neighbor session between R1 and R2 re-establishes after 50 minutes
C. A warning message is displayed on R2 after it receives 50 prefixes
D. A warning message is displayed on R2 after it receives 100 prefixes from neighbor 1.1.1.1
E. The BGP neighbor session tears down after R1 receives 200 prefixes from neighbor 2.2.2.2
F. The BGP neighbor session between R1 and R2 re-establishes after 100 minutes
Answer: D,E
1094) From the list below, which one is the major benefit of AMP Threat GRID?
A. AMP Threat Grid collects file information from customer servers and run tests on them to see if they
are infected with viruses
B. AMP Threat Grid learns ONLY from data you pass on your network and not from anything else to
monitor for suspicious behavior. This makes the system much faster and efficient
C. AMP Threat Grid combines Static, and Dynamic Malware analysis with threat intelligence into one
combined solution
D. AMP Threat Grid analyzes suspicious behavior in your network against exactly 400 behavioral
indicators
Answer: C
095) Which two characteristics of DTLS are true? (Choose two)

A. It includes a congestion control mechanism
B. It supports long data transfers and connections data transfers
C. It completes key negotiation and bulk data transfer over a single channel
D. It is used mostly by applications that use application layer object-security protocols
E. It includes a retransmission method because it uses an unreliable datagram transport
F. It cannot be used if NAT exists along the path
Answer: A,E
1096) Which two of the following ICMP types and code should be allowed in a firewall to enable traceroute?
(Choose two)
A. Destination Unreachable-protocol Unreachable

B. Destination Unreachable-port Unreachable
C. Time Exceeded-Time to Live exceeded in Transit
D. Redirect-Redirect Datagram for the Host
E. Time Exceeded-Fragment Reassembly Time Exceeded
F. Redirect-Redirect Datagram for the Type of service and Host
Answer: B,C
1097) Which three types of addresses can the Botnet Traffic Filter feature of the Cisco ASA monitor? (Choose
three)
A. Ambiguous addresses
B. Known malware addresses
C. Listed addresses
D. Dynamic addresses
E. Internal addresses
F. Known allowed addresses
Answer: A,B,F
1098)
Refer to the exhibit. Which configuration option will correctly process network authentication and
authorization using both single port ?
A.
B.
C.
D.
Answer: B
1099) What is the effect of the following command on Cisco IOS router?
ip dns spoofing 1.1.1.1

A. The router will respond to the DNS query with its highest loopback address configured
B. The router will respond to the DNS query with 1.1.1.1 if the query id for its own hostname
C. The router will respond to the DNS query with the IP address of its incoming interface for any
hostname query
D. The router will respond to the DNS query with the IP address of its incoming interface for its own
hostname
Answer: D
1100) Which of the following is one of the components of cisco Payment Card Industry Solution?
A. Virtualization
B. Risk Assessment
C. Monitoring
D. Disaster Management
Answer: B
1101) Which three Cisco attributes for LDAP authorization are supported on the ASA? (Choose three)
A. L2TP-Encryption
B. Web-VPN-ACL-Filters
C. IPsec-Client-Firewall-Filter-Name
D. Authenticated-User-Idle-Timeout
E. IPsec-Default-Domain
F. Authorization-Type
Answer: B,D,E
1102) Which two statements about global ACLs are true? (Choose two)
A. They support an implicit deny

B. They are applied globally instead of being replicated on each interface
C. They override individual interface access rules
D. They require an explicit deny
E. They can filer different packet types than extended ACLs
F. They require class-map configuration
Answer: A,B
1103) When TCP intercept is enabled in its default mode, how does it react to a SYN request?
A. It intercepts the SYN before it reaches the server and responds with a SYN-ACK
B. It drops the connection
C. It monitors the attempted connection and drops it if it fails to establish within 30 seconds
D. It allows the connection without inspection
E. It monitors the sequence of SYN, SYN-ACK, and ACK messages until the connection is fully
established
Answer: E
1104) Which two statements about IPsec in a NAT-enabled environment are true? (Choose two)
A. The hashes of each peers IP address and port number are compared to determine whether NAT-T is
required
B. NAT-T is not supported when IPsec Phase 1 is set to Aggressive Mode
C. The first two messages of IPsec Phase 2 are used to determine whether the remote host supports
NAT-T
D. NAT-T is not supported when IPsec Phase 1 is set to Main Mode
E. IPsec packets are encapsulated in UDP 500 or UDP 10000 packets

F. To prevent translations from expiring, NAT keepalive messages that include a payload are sent
between the peers
Answer: A,D
1105) You have configured a DMVPN hub and spoke a follows (assume the IPsec profile dmvpnprofile is
configured correctly):
With this configuration, you notice that the IKE and IPsec SAs come up between the spoke and the hub, but NHRP
registration fails. Registration will continue to fail until you do which of these?
A. Configure the ipnhrp cache non-authoritative command on the hubs tunnel interface
B. Modify the NHRP hold times to match on the hub and spoke
C. Modify the NHRP network IDs to match on the hub and spoke
D. Modify the tunnel keys to match on the hub and spoke
Answer: D
1106) Which two options are unicast address types for IPv6 addressing? (Choose two)
A. Established
B. Static
C. Global
D. Dynamic
E. Link-local
Answer: C,E
ALL OUR ACTIVE CLIENTS CAN GET DIRECT SUPPORT FROM

SKYPE: CCIEWRITTENDUMPS
OUR CCIE WRITTEN ENGINEERS ARE AVAILABLE ON SKYPE CHAT OR LIVE SUPPORT CHAT FROM
WEBSITE
http://PASSWRITTEN.COM (LIVE SUPPORT)
http://PASSWRITTEN.COM (UPDATED DATE)
YOUR GATEWAY TO SUCCESS TOWARDS CCIE WRITTEN + LAB
ACTIVE CLIENTS WILL GET VERY SPECIAL DISCOUNTS ON OTHER CCIE TRACKS
KINDLY VISIT FOR FURTHER INFORMATION
CCIE R&S -- WWW.PASSRNSLABS.COM (PRL)
CCIE SECURITY ----> WWW.PASSSECURITYLABS.COM (PSL)
CCIE WIRELESS ----> WWW.PASSWIRELESSLABS.COM (PWL)
CCIE DATACENTER ----> WWW.PASSDATACENTERLABS.COM (PDL)
CCIE COLLABORATION ----> WWW.PASSCOLLABORATIONLABS.COM (PCL)
CCIE SERVICEPROVIDER -----> WWW.PASSSPLABS.COM (PSL)
CCDE LABS -- WWW.PASSCCDELABS.COM (PCL)
CCIE WRITTEN ---- WWW.PASSWRITTEN.COM (PW)
VCIX -- WWW.VCIXLABS.COM (VL)
WORLD FIRST REAL LAB RACK RENTAL FOR ALL CCIE TRACKS
CCIE RACK RENTALS -----> WWW.CCIERACK.RENTALS (CRR)
KINDLY CONTACT US AT SALES@PASSWRITTEN.COM FOR FURTHER INFORMATION ON OTHER TRACKS

Ccie Sec Written Jan 20 - Full Pool

Uploaded by

Copyright:

Available Formats

Ccie Sec Written Jan 20 - Full Pool

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ccie Sec Written Jan 20 - Full Pool

Uploaded by

Copyright:

Available Formats

www.writtendumps.

com 350-018 20-JAN-2017

CCIE Written Workbook

CCIE SECURITY WRITTEN

2) What is the unit of measurement of the average rate of a token bucket?

7) Which two options describe the main purpose of EIGRP authentication?

A. To allow faster convergence

8) Which are the two characteristics of WPA? (Choose two)

11) Why do you a disk-image backup to perform forensic investigations?

A) This is a secure way to perform a file copy

D) The backup creates a bit-level copy of the entries disk

12) Flow exporter-map Genie1

Transport udp 11000

Refer to the exhibit Which configuration is required to enable the exporter?

A) cache timeout active 60

C) cache timeout inactive 60

A)disable the processing of IPv6 type 0 routing headers globally.

B) disable the processing of IPv6 type 2 routing headers globally

D) disable the processing of IPv6 type 1 routing headers on the interface

E)disable the processing of IPv6 type 1 routing headers globally

A) A NAT/PAT device is translating the local VPN endpoint

B) A NAT/PAT device exists in the path between VPN endpoints

C) A NAT/PAT device is translating the remove VPN endpoint

D) No NAT/PAT device exists in the path between VPN endpoints

B) IOS with Firepower services

D)ASA with FirePower service

C) PEAP with MS-CHAPv2

19) What protocol does MSDP use to communicate ?

A) ipv6 port-map port telnet 223

B) ipv6 port-map telnet port 23 233

C) ipv6 port-map telnet port 223

D) ipv6 port-map port 23 port 23223.

A) the minimum RAS key length is 512 bits

B) The SHA-1 hash function is used during their computation

C) They prevent spoofing and stealing of existing IPv6 addresses

D) SHA of MD5 is used during their computation

F) They are used for securing neighbor discover using send

B) sending TCP and UDP traffic through a smart tunnel

D) sending TCP-only traffic through a smart tunnel

E) sending TCP-only traffic through port forwarding

F) sending TCP and UDP traffic through port forwarding

24) Which statement about SNMP control plane policing is true?

A) SNMP traffic is processed VIA CEF in the data plane

B) SNMP traps are processed by the data plane

D) The SNMP management plane always has a source ip address

A) Ipv6 port-map port telnet 223

B) ipv6 port-map port 23 port 23223

C) ipv6 port-map telnet port 223

D) ipv6 port-map telnet port 23 233

C) TACACS+ take advantage of the UDP protocols connection network transport

E) TACACS+ can handle different AAA services on separate servers

F)TACACS+ combines the authentication and authorization functions

27) What SNMPv3 command disables descriptive error message?

A) snmp-server usm cisco

C)snmp-server infindex persist

D)snmp-server trap link switchover

C)CDP must be enable on all switches In the VTP management domain

A)seed-switch(config)#no dot1x system-auth-control