[400-251 Free Questions] 400-251 CCIE Security Written Exam

Are you looking for CCIE Security 400-251 free questions? Get practice here online for 400-251 CCIE Security Written Exam. They are just part of full version. All 400-251 free questions are from Passquestion CCIE Security 400-251 full version of 182 Q&As.

We provide 20 free questions for 400-251 CCIE Security Written Exam. You will score 5 points after you answer each question correctly. If you want to get full version to study , please click the picture “Get Full Version“. If you have any questions, please contact us via Live Chat or email us [email protected].

Test Begin:

1. What are the most common methods that security auditors use to access an organization’s security processes? (choose two)

physical observation

social engineering attempts

penetration testing

policy assessment

document review

interviews

2. Which three statements about WCCP are true? (choose three)

if a specific capability is missing from the capabilities Info Component, the router is assumed to support the default capability.

the web cache transmits its capabilities as soon as it receives a Receive ID from a router

the minimum WCCP-Fast Timers message interval is 500 ms.

the assignment method supports GRE encapsulation for sending traffic

if the packet return method is missing from a packet return method advertisement, the web cache uses the layer 2 rewrite method

the router must receive a valid receive ID before it negotiates capabilities.

3. Refer to the exhibit,

Which two effects of this configuration are true? (Choose two)

the switch periodically sends an EAP-Identity-Request to the endpoint supplicant

the device allows multiple authenticated sessions for a single MAC address in the voice domain

if the TACACS+ server is unreachable, the switch places hosts on critical ports in VLAN50

if the authentication priority is changed, the order is Which authentications is performed also changes

if multiple hosts have authenticated to the same port, each can be in their own assigned VLAN

the port attempts 802.1x authentication first, and then falls back to MAC authentication bypass.

4. Which 2 statements about 6to4 tunneling are true? (choose two)

it provides a /128 address book.

it supports static and BGPv4 routing

it provides a /48 address block

it supports managed NAT along the path of the tunnel

the prefix address of the tunnel is determined by the IPv6 configuration of the interface

it supports multihoming

5. Which 2 statements about a wireless access point configured with the guest-mode command are true? (Choose two)

it can support more than one guest mode SSID

it supports associations by client that perform passive scans

it allows client configured without SSID to associate

it allows associated client to transmit packet using its SSID

if one device on a network is configure in guest-mode, client can use the guest-mode SSID to connect to any device in the same network.

6. Refer to the exhibit.

Which two statement about a device with this configuration are true? (choose two)

when a peer establishes a new connection to the device, CTS retains all existing SGT mapping entries for 3 minutes.

if a peer reconnects to device within 120 seconds of terminating a CTS-SXP connection, the reconciliation timers starts

when a peer re-establishes a previous connection to the device, CTS retains all existing SGT mapping entries for 3 minutes

if a peer reconnects to device within 180 seconds of terminating a CTS-SXP connection, the reconciliation timer starts

if a peer re-establishes a connection to the device before the hold-down timer expires, the device retains the SGT mapping entries it learned during the previous connection for an additional 3 minutes

it sets the internal hold down timer of the device to 3 minutes

7. Which option is a data modeling language used to model configuration and state data of network elements?

RESTCONF

SNMPv4

NETCONF

YANG

8. Refer to the exhibit

Which data format is used in this script?

JSON

YANG

API

XML

JavaScript

9. Which three statements about VRF-Aware Cisco Firewall are true? (choose three)

it supports both global and per-VRF commands and DoS parameters

it enables services providers to deploy firewalls on customer devices

it can generate syslog messages that are visible only to individual VPNs

it can support VPN networks with overlapping address ranges without NA

it enables service providers to implement firewalls on PE devices

it can run as more than on instance.

10. Which OpenStack project has orchestration capabilities?

Cinder

Horizon

Sahara

Heat

11. Which two statements about Role-Based Access Control are true? (Choose two)

the user profile on an AAA server is configured with the roles that grant user privileges

if the same user name is used for a local user account and a remote user account, the roles defined in the remote user account override the local user account.

server profile administrators have read and write access to all system logs by default.

A view is created on the Cisco IOS device to leverage RBAC

Network administrators have read and write access to all system logs by default

12. Refer to the exhibit

Which two statements about the given IPv6 ZBF configuration are true? (choose two)

it inspects TCP, UDP, ICMP, and FTP traffic from Z1 to Z2

it provides backward compatibility with legacy IPv4 inspection

it inspects TCP, UDP, ICMP, and FTP traffic from Z2 to Z1

it passes TCP, UDP, ICMP, and FTP traffic in both directions between Z1 to Z2

it provides backward compatibility with legacy IPv6 inspection

it passes TCP, UDP, ICMP, and FTP traffic from Z1 TO Z2.

13. Which three options are fields in a CoA Request Response code packet? (choose three)

calling-station-ID

identifier

state

length

acc-session-ID

authenticator

14. Refer to the exhibit.

What are two effects of the given configuration? (choose two)

it enables the ASA to download the static botnet filter database

it enables the ASA to download the dynamic botnet filter database

it enables botnet filtering in single context mode

it enables multiple context mode

it enables single context mode

15. Which option best describes RPL?

RPL stands for Routing Over Low priority links that use link-state LSAs to determine the best route between two root border routers

RPL stands for Routing Over Low priority links that use distance vector DOGAG to determine the best route between two root border routers

RPL stands for Routing Over Low-Power Lossy Networks that use link-state LSAs to determine the best route between leaves and the root border router

RPL stands for Routing Over Low-Power Lossy Networks that use distance vector DOGAG to determine the best route between leaves and the root border router

16. Which two statements about the SeND protocol are true? (choose two)

it counters neighbor discovery threats

it must be enabled before you can configure IPv6 addresses

it supports numerous custom neighbor discovery messages

it logs IPv6-related threats to an external log server

it supports an autoconfiguration mechanism

it uses IPSec as a baseline mechanism

17. In OpenStack, which two statements about the NOVA component are true? (choose two)

it provides the authentication and authorization services

it launches virtual machine instances

it is considered the cloud computing fabric controller

it provides persistent block storage to running instances of virtual machines

it tracks cloud usage statistics for billing purposes.

18. Which two statements about Botnet Traffic Filter snooping are true? (choose two)

it can log and block suspicious connections from previously unknown bad domains and IP addresses

it requires the Cisco ASA DNS server to perform DNS lookup

it requires DNS packet inspection to be enabled to filter domain names in the dynamic database

it checks inbound traffic only

it can inspect both IPv4 and IPv6 traffic

it checks inbound and outbound traffic

19. Which two statements about ping flood attacks are true? (choose two)

they attack by sending ping requests to the broadcast address of the network

they use SYN packets

the attack is intended to overwhelm the CPU of the target victim

they use UDP packet

they use ICMP packet

they attack by sending ping requests to the return address of the network

20. Which two design options are best to reduce security concerns when adopting IoT into an organization? (Choose two)

Segment the Field Area Network from the Data Center Network

Encrypt sensor data in transit

Ensure that application can gather and analyze data at the edge

Implement video analytics on IP cameras

Encrypt data at rest on all devices in the Lot network

Question 1 of 20

[400-251 Free Questions] 400-251 CCIE Security Written Exam

Leave a Reply Cancel reply