aaaa

Question 1

Which next-generation encryption algorithms support four variants? 
A. SHA2 
B. SHA1 
C. MD5 
D. HMAC

Answer 1

SHA2

Question 2

Which type of malicious software can create a back‐door into a device or network?
A. worm B. trojan C. virus D. bot

Answer 2

trojan

Question 3

Which attack can be prevented by OSPF authentication?

A. smurf attack B. IP spoofing attack C. buffer overflow attack D. denial of service attack

Answer 3

denial of service attack

Question 4

Which SNMPv3 security level provides authentication using HMAC with MD5, but does not use encryption?
A. authNoPriv B. noAuthNoPriv C. noAuthPriv D. authPriv

Answer 4

authNoPriv

Question 5

What are two advanced features of the Cisco AMP solution for endpoints? (Choose two)
A. reflection B. foresight C. sandboxing D. contemplation E. reputation

Answer 5

sandboxing

reputation

Question 6

What does the DH group refer to? 
A. length of key hashing 
B. length of key exchange 
C. tunnel lifetime key 
D. length of key for authentication 
E. length of key for encryption

Answer 6

length of key exchange

Question 7

In which two modes can the Cisco Web Security Appliance be deployed? (Choose two)
A. explicit proxy mode
B. as a transparent proxy using the Secure Sockets Layer protocol
C. as a transparent proxy using the Hyper Text Transfer Protocol
D. as a transparent proxy using the Web Cache Communication Protocol
E. explicit active mode

Answer 7

explicit proxy mode

as a transparent proxy using the Web Cache Communication Protocol

Question 8

Which type of mechanism does Cisco FirePOWER deploy to protect against email threats that are detected moving across other networks? 
A. reputation‐based 
B. signature‐based 
C. antivirus scanning 
D. policy‐based

Answer 8

reputation‐based

Question 9

Which action does standard antivirus software perform as part of the file‐analysis process?
A. execute the file in a simulated environment to examine its behaviour
B. examine the execution instructions in the file
C. flag the unexamined file as a potential threat
D. create a backup copy of the file

Answer 9

examine the execution instructions in the file

Question 10

When you edit an IPS subsignature, what is the effect on the parent signature and the family of signatures?

A. The change applies to the parent signature and the subsignature that you edit.
B. The change applies to the parent signature and the entire family of subsignatures.
C. The change applies only to subsignatures that are numbered sequentially after the subsignature that you edit.
D. Other signatures are unaffected; the change applies only to the subsignature that you edit.

Answer 10

Other signatures are unaffected; the change applies only to the subsignature that you edit.

Question 11

Which two ESA services are available for incoming and outgoing mails? (Choose two) 
A. DLP 
B. reputation filter 
C. content filter 
D. anti-Dos 
E. antispam

Answer 11

content filter

antispam

Question 12

Which EAP method uses Protected Access Credentials? 
A. EAP-FAST 
B. EAP-TLS 
C. EAP-PEAP 
D. EAP-GTC

Answer 12

EAP-FAST

Question 13

You have implemented a dynamic blacklist, using intelligence to block illicit network activity. However, the blacklist contains several approved connections that users must access for business purposes. Which action can you take to retain the blacklist while allowing users to access the approved sites?

A. Disable the dynamic blacklist and create a static blacklist in its place.
B. Create a whitelist and manually add the approved addresses.
C. Disable the dynamic blacklist and deny the specific address on a whitelist while permitting the others.
D. Edit the dynamic blacklist to remove the approved addresses.

Answer 13

Create a whitelist and manually add the approved addresses.

Question 14

Which two configurations can prevent VLAN hopping attack from attackers at VLAN 10? (Choose two)
A. creating VLAN 99 and using switchport trunk native vlan 99 command on trunk ports
B. enabling BPDU guard on all access ports
C. using switchport trunk native vlan 10 command on trunk ports
D. using switchport nonegotiate command on dynamic desirable ports
E. applying ACL between VLANs
F: using switchport mode access command on all host ports

Answer 14

creating VLAN 99 and using switchport trunk native vlan 99 command on trunk ports

using switchport mode access command on all host ports

Question 15

Q15 What is a limitation of network-based IPS?
A. It is unable to monitor attacks across the entire network.
B. It is most effective at the individual host level.
C. It must be individually configured to support every operating system on the network.
D. Large installations require numerous sensors to fully protect the network.

Answer 15

Large installations require numerous sensors to fully protect the network.

Question 16

Which statement represents a difference between an access list on an ASA versus an access list on a router?
A. The ASA does not support extended access lists
B. The ASA does not support number access lists
C. The ASA does not ever use a wildcard mask
D. The ASA does not support standard access lists

Answer 16

The ASA does not ever use a wildcard mask

Question 17

Which three descriptions of RADIUS are true? (Choose three.)
A. It supports multiple transport protocols.
B. It uses TCP as its transport protocol.
C. Only the password is encrypted.
D. It uses UDP as its transport protocol.
E. It separates authentication, authorization and accounting.
F. It combines authentication and authorization.

Answer 17

Only the password is encrypted.
It uses UDP as its transport protocol.
It combines authentication and authorization.

Question 18

Which two models of ASA tend to be used in a data centre? (Choose two) 
A. 5555X 
B. ASA service module 
C. 5585X 
D. 5540 
E. 5520
 F. 5512

Answer 18

ASA service module

5585X

Question 19

Which statement about interface and global access rules is true?
A. Interface access rules are processed before global access rules.
B. The implicit allow is processed after both the global and interface access rules.
C. If an interface access rule is applied, the global access rule is ignored.
D. Global access rules apply only to outbound traffic, but interface access rules can be applied in either direction.

Answer 19

Interface access rules are processed before global access rules.

Question 20

Which security term refers to the likelihood that a weakness will be exploited to cause damage to an asset? 
A. threat 
B. vulnerability
C. risk 
D. countermeasure

Answer 20

risk

Question 21

Which two descriptions of TACACS+ are true? (Choose two)
A. It uses TCP as its transport protocol.
B. It combines authentication and authorization.
C. Only the password is encrypted.
D. The TACACS+ header is unencrypted
E. It uses UDP as its transport protocol.

Answer 21

It uses TCP as its transport protocol.

The TACACS+ header is unencrypted

Question 22

Which term refers to the electromagnetic interference that can radiate from network cables? 
A. emanations 
B. multimode distortion 
C. Gaussian distributions 
D. Doppler waves

Answer 22

emanations

Question 23

Which mitigation technology for web-based threats prevents the removal of confidential data from the network?
A. AMP B. DLP C. DCA D. CTA

Answer 23

DLP

Question 24

What are two limitations of the self-zone policies on a zone-based firewall? (Choose two)
A. They restrict SNMP traffic.
B. They are unable to implement application inspection.
C. They are unable to block HTTPS traffic.
D. They are unable to support HTTPS traffic.
E. They are unable to perform rate limiting.

Answer 24

They are unable to implement application inspection.

They are unable to perform rate limiting.

Question 25

What are two default behaviours of the traffic on a zone-based firewall? (Choose two) A. The CBAC rules that are configured on router interfaces apply to zone interfaces. B. Communication is blocked between interfaces that are members of the same zone. C. Traffic within self zone uses an implicit deny all D. All traffic between zones is implicitly blocked. E. Communication is allowed between interfaces that are members of the same zone.

Answer 25

All traffic between zones is implicitly blocked. Communication is allowed between interfaces that are members of the same zone.

Question 26

Which two statements about Hardware-Based encryption are true? (Choose two) A. It is potentially easier to compromise than software-based encryption. B. It can be implemented without impacting performance. C. It is widely accessible. D. It is highly cost-effective E. It requires minimal configuration

Answer 26

It can be implemented without impacting performance. It requires minimal configuration

Question 27

Which path do you follow to enable AAA through the SDM? A. Configure >Tasks >AAA B. Configure > Authentication >AAA C. Configure > Additional Authentication > AAA D. Configure > Additional Tasks > AAA E. Configure > AAA

Answer 27

Configure > Additional Tasks > AAA

Question 28

Refer to the exhibit. Which type of NAT is configured on a Cisco ASA? #nat (ins,any) dynamic interface A. dynamic NAT B. source identity NAT C. dynamic PAT D. identity twice NAT

Answer 28

dynamic PAT

Question 29

When connecting to an external resource, you must change a source IP address to use one IP address from a range of 207.165.201.1 to 207.165.201.30. Which option do you implement? A. static destination NAT that uses a subnet as a real destination B. dynamic source NAT that uses a range as a mapped source C. dynamic source NAT that uses an IP address as a mapped source D. static destination NAT that uses a subnet as a real source

Answer 29

ynamic source NAT that uses a range as a mapped source

Question 30

Refer to the exhibit. What is the effect of the given configuration? Device# tunnel group 192.x.x.x ipsec-attributes Device# pre-shared-key cisco654 A. It establishes the preshared key for the router B. It establishes the preshared key for the switch C. It establishes the preshared key for the firewall D. It establishes the preshared key for the Cisco ISE appliance.

Answer 30

It establishes the preshared key for the firewall

Question 31

``` In which type of attack does an attacker overwrite an entry in the CAM table to divert traffic destined to a legitimate host? A. MAC spoofing B. ARP spoofing C. CAM table overflow D. DHCP spoofing ```

Answer 31

MAC spoofing

Question 32

What is an advantage of split tunnelling? A. It allows users with a VPN connection to a corporate network to access the Internet by using the VPN for security B. It enables the VPN server to filter traffic more efficiently. C. It allows users with a VPN connection to a corporate network to access the Internet without sending traffic across the corporate network. D. It protects traffic on the private network from users on the public network.

Answer 32

It allows users with a VPN connection to a corporate network to access the Internet without sending traffic across the corporate network.

Question 33

``` What does the policy map do in CoPP? A. defines the action to be performed B. defines packet selection parameters C. defines the packet filter D. defines service parameters ```

Answer 33

defines the action to be performed

Question 34

What is the maximum number of methods that a single method list can contain? A. 4 B. 3 C. 2 D. 5

Answer 34

4

Question 35

Which attack involves large numbers of ICMP packets with a spoofed source IP address? A. Teardrop attack B. smurf attack C. Nuke attack D. SYN Flood attack

Answer 35

smurf attack

Question 36

Which type of social engineering attack targets top executives? A. baiting B. vishing C. whaling D. spear phishing

Answer 36

whaling

Question 37

``` Which command can you enter to verify the statistics of cisco IOS resilient configuration on cisco router? A. show binary file B. show secure bootset C. secure boot-config D. secure boot-image ```

Answer 37

show secure bootset

Question 38

What aims to remove the ability to deny an action? | A. Integrity B. Deniability C. Accountability D. Non-Repudiation

Answer 38

Non-Repudiation

Question 39

You have just deployed SNMPv3 in your environment. Your manager asks you make sure that your agents can only talk to the SNMP Manager. What would you configure on your SNMP agents to satisfy this request? A. Routing Filter with the SNMP managers in it applied outbound B. A SNMP View containing the SNMP managers C. A standard ACL containing the SNMP managers applied to the SNMP configuration. D. A SNMP Group containing the SNMP managers

Answer 39

A standard ACL containing the SNMP managers applied to the SNMP configuration.