121-160

Question 1

Which command enables authentication at the OSPFv2 routing process level?
A. area 0 authentication message-digest
B. area 0 authentication ipsec spi 500 md5 1234567890ABCDEF1234567890ABCDEF
C. ip ospf authentication message-digest
D. ip ospf message-digest-key 1 md5 C1sc0!

Answer 1

area 0 authentication message-digest

OSPFv2 routing process lvl ##

Question 2

Which statement about traffic inspection using the Cisco Modular Policy Framework on the ASA is true?

A. HTTP inspection is supported with Cloud Web Security inspection.
B. QoS policing and QoS pnonty queuing can be configured for the same traffic.
C. ASA with FirePOWER supports HTTP inspection.
D. Traffic can be sent to multiple modules for inspection.

Answer 2

HTTP inspection is supported with Cloud Web Security inspection.

Question 3

Which adverse consequence can occur on a network without BPDU guard?
A. The oldest switch can be elected as the root bridge.
B. Unauthorized switches that are connected to the network can cause spanning-tree loops.
C. Double tagging can cause the switches to experience CAM table overload.
D. Rogue switches can be difficult to detect.

Answer 3

Unauthorized switches that are connected to the network can cause spanning-tree loops.

Question 4

Which two 802.1x features can you enable by running the IOS authentication priority command? (Choose two)

A. forced authorized port state 
B. Telnet authentication 
C. automatic selection
D. Web authentication 
E. MAC authentication bypass

Answer 4

Web authentication

MAC authentication bypass

Question 5

If a personal Firewall specifically blocks NTP, which type of blocking is the firewall performing? 
A. service 
B. file 
C. application 
D. network

Answer 5

application

Question 6

Which two problems can arise when a proxy firewall serves as the gateway between networks? (Choose two)

A. It can cause reduced throughput.
B. It is unable to prevent direct connections to other networks.
C. It can prevent content caching.
D. It is unable to provide antivirus protection.
E. It can ktrtf application support.

Answer 6

It can cause reduced throughput.

It can ktrtf application support.

Question 7

What command could you implement in the firewall to conceal internal IP address? 
A. no source-route 
B. no cdp run 
C. no broadcast 
D. no proxy-arp

Answer 7

no proxy-arp

Question 8

What are the direct two methods for redirecting web traffic to cisco web security? (Choose two) 
A. Cisco ISE 
B. 3rd party proxies 
C. PAC file 
D. NAC

Answer 8

3rd party proxies

PAC file

Question 9

For the SNMP V3 access control, how to control access of clients & managers? (Choose two) 
A. routing filtering 
B. create access list 
C. make managers view 
D. authentication

Answer 9

create access list

authentication

Question 10

About encryption protocol using in MPLS VPN confidentiality...? 
A. IPsec 
B. SSL 
C. AES 
D. 3DES

Answer 10

IPsec

Question 11

Why does ISE require its own certification issued by a trusted CA?
A. ISE certificate allow guest device to validate it as a trusted network device.
B. ISE certificate allow it to join the network security framework.
C. It request certificates for guest device from the CA server based on its own certificate.
D. It generate certificates for guest device based on its own certificate.

Answer 11

ISE certificate allow guest device to validate it as a trusted network device.

Question 12

What is the main purpose of Control Plane Policing?
A. to prevent exhaustion of route-processor resources
B. to organize the egress packet queues
C. to define traffic classes
D. to maintain the policy map

Answer 12

to prevent exhaustion of route-processor resources

Question 13

How can you mitigate DCE/RPC evasion techniques while allowing access to the DCE/RPC service?

A. Update the IPS signature for HTTPS to validate DCE/RPC connections.
B. Block suspicious hosts from DCE/RPC port 593.
C. Tunnel DCE/RPC traffic through GRE.
D. Configure the DCE/RPC preprocessor

Answer 13

Configure the DCE/RPC preprocessor

Question 14

Which type of mechanism does Cisco FirePOWER deploy to protect against email threats that are detected moving across other networks? 
A. signature-based 
B. reputation-based 
C. antivirus scanning 
D. policy-based

Answer 14

reputation-based

Question 15

Which component of a security zone firewall policy defines how traffic is handled? 
A. ACL 
B. Service policy 
C. Policy map 
D. Class map

Answer 15

Policy map

Question 16

Of all parameters that are negotiated for the IKE Phase 1 tunnel, which parameter is the only one that does not have to exactly match between VPN pees to be accepted? 
A. DH group 
B. Hashing algorithm 
C. Encryption algorithm 
D. Digital signature 
E. Authentication method 
F. Lifetime

Answer 16

Lifetime

Question 17

What is the range of levels provided by the Privilege command?

A. 0-16 
B. 0-15 
C. 1-16 
D. 1-14 
E. 0-14 
F. 1-15

Answer 17

0-15

Question 18

Which two types of malware can self-replica and spread? (Choose two) 
A. Backdoors 
B. Worms 
C. Viruses 
D. Trojans 
E. Bots

Answer 18

Viruses

Worms

Question 19

In a Cisco Cloud Web Security environment, when can network traffic bypass the scanning proxies?

A. When the client is on a trusted corporate network.
B. When the client is connected to a VPN service that bypass proxies.
C. When the client is connected to a WPA2 Enterprise network.
D. When the client is connected to a wired network.

Answer 19

When the client is on a trusted corporate network.

Question 20

Which option is the logical container used to maintain information about the connections going through a Cisco ASA firewall? 
A. State table 
B. NAT table 
C. Routing table 
D. Cisco Express Forwarding table

Answer 20

State table

Question 21

On which operating system does the Cisco Email Security Appliance run? 
A. Cisco ESA-OS 
B. Cisco AsyncOS 
C. Cisco IOS XE 
D. Cisco IOS XR 
E. Cisco NX-OS

Answer 21

Cisco AsyncOS

Question 22

Which statement about TACACS+ is true?

A. Passwords are transmitted between the client and server using MD5 hashing.
B. TACACS is flexible than RADIUS because it separates all AAA into individual processes.
C. TACACS is used for access to network resources more than administrator access to network devices.
D. TACACS server listens UDP port 1813 for accounting.
E. All data that is transmitted between the client and TACACS+ server is cleartext.

Answer 22

TACACS is flexible than RADIUS because it separates all AAA into individual processes.

Question 23

Which two statements about an IPS in tap mode are true? (Choose two.)
A. It requires an synchronous routing configuration for full traffic analysis.
B. The device forwards all traffic, regardless of its source or destination.
C. It directly analyses the actual packets as they pass through the system.
D. It can analyse events without impacting network efficiency.
E. It is unable to drop packets in the main flow

Answer 23

It can analyse events without impacting network efficiency.

It is unable to drop packets in the main flow

Question 24

How will a stateful firewall handle an inbound packet that it receives and cannot match in its state table?
A. Passes the traffic.
B. Drops the traffic.
C. Broadcasts the traffic.
D. Looks for an ACL, and acts based upon the ACL.

Answer 24

Looks for an ACL, and acts based upon the ACL.

Question 25

Drag functions on the left to the corresponding fields on the right (HIPS – Host base IPS; NIPS – Network based IPS) ``` Alter an administrator Protect multiple devices protect one device Placed on the perimiter installed on individual system looks for changes in files looks for traffic patterns ```

Answer 25

``` Alter an administrator HIPS/NIPS Protect multiple devices NIPS protect one device HIPS Placed on the perimiter NIPS installed on individual system HIPS looks for changes in files HISP looks for traffic patterns NIPS ```

Question 26

Which two statements about TACACS+ are true? (Choose two.) A. It can run on a UNIX server. B. It authenticates against the user database on the local device. C. It is more secure than AAA authentication. D. It is enabled on Cisco routers by default. E. It uses a managed database.

Answer 26

It can run on a UNIX server It uses a managed database.

Question 27

``` Which EAP method authenticates a client against Active Directory without the use of client-side 802.1X certificates? A. EAP-GTC B. EAP-TLS C. EAP-PEAP D. EAP-MSCHAPv2 ```

Answer 27

EAP-MSCHAPv2

Question 28

If a router configuration includes the line aaa authentication login default group tacacs+ enable, which events will occur when the TACACS+ server returns an error? (Choose two.) A. The user will be prompted to authenticate using the enable password B. Authentication attempts to the router will be denied C. Authentication will use the router`s local database D. Authentication attempts will be sent to the TACACS+ server

Answer 28

The user will be prompted to authenticate using the enable password Authentication attempts will be sent to the TACACS+ server

Question 29

``` how does an Antimalware installed on an endpoint check for a malicious file? A. file reputation B. Signature checking C. Context D. Sandboxing ```

Answer 29

Signature checking

Question 30

``` Where is File Reputation in Cisco AMP being executed? A. Perimeter B. Endpoint C. ESA D. Cloud ```

Answer 30

Endpoint