Cisco 400-251 Exam Preparation Study Guide

Question No. 1

Which statement about x.509 certificates is true?

• A. The version number in the certificate is the OS version of the CA.
• B. The Subject distinguished name in the certificate is of the entity who issued the certificate
• C. The algorithm in the certificate is used by the subiect to encrypt the traffic
• D. The serial number in the certificate is common across the certificates issued by the same CA
• E. The algorithm in the certificate is used by the receiver to sign the certificate
• F. The Issuer distinguished name in the certificate is of the entity issuing the certificate

Question No. 2

Which are the three remediation types that cannot be configured in stealth mode posture? (Choose three.)

• A. Link remediation
• B. Patch management remediation
• C. Manual remediation
• D. File remediation
• E. USB remediation

Question No. 3

A customer has configured ISE to assign a Downloadable Access-list as a result of cusses full 802.1x authentication. When they check the switcher after a successful authentication, they do not see the DACL applied. They also notice that ISE logs do not contain the Framed-IP-Address value from the RADIUS exchange. What is the most likely fix?

• A. Add source IP address on the DACL is ISE
• B. Enable IPDT on the Switch
• C. Apply a default ACL on the switchport
• D. Add the ”aaa accounting dot1 default ” command on the switch

Question No. 4

Which statement about the wireless security technologies is true?

• A. WPA2-PSK mode provides better security by having same passphrase across the network
• B. WPA2 provides message integrity using AES
• C. WPA2-PSK mode does not allow a passphrase to be stored locally on the device
• D. WPA2 is more secure than WPA because it uses TKIP for encryption
• E. WEP is more secure than WPA2 because it uses AES for encryption
• F. WPA2-ENT mode does not require RADIUS for authentication

Question No. 5

You are inspecting Cisco Email security Appliance (ESA) mail_logs, and find the following log lines:

Which two of the following statements are true (Choose two .)

• A. The message was sandboxed and scanned try AMP/ThreatGRID file analysis
• B. E5A didn’t detect any Spam inside received message
• C. E-mail message was successfully delivered to the destination SMTP server responsible for ccie local domain
• D. E-mail message was not delivered successfully 10 the remote SMTP server yet but it is queued by ESA for further delivery
• E. There are two recipients of the email message

Question No. 6

Which two statements about the Cisco FireAMP solution are true? (Choose two.)

• A. It can perform dynamic analysis in the Fire AMP Private Cloud.
• B. The FireAMP Connector can detect malware in network traffic and when files are downloaded.
• C. The FireAMP Private Cloud provides an on-premises option for file disposition lookups and retrospect generation.
• D. The FireAMP Connector is compatible with antivirus software on the endpoint, but you must configure exclusion to prevent the Connector form scanning the antivirus directory.
• E. The FireAMP Connector can provide information about potentially malicious network connections.
• F. The FireAMP Private cloud can act as an anonymized proxy to transport endpoint event data to the public cloud for disposition lookups.e
• G. When a FireAMP Connector detects malware in network traffic, it generates a malware event and a event.

Question No. 7

Which three statements correctly describe the encoding used by NETCONF and RESTCONF? {Choose three.)

• A. NETCONF uses JSON-encoded data
• B. RESTCONF uses JSON-encoded data
• C. RESTCONF uses YAML-encoded data
• D. NETCONF uses YAML-encoded data
• E. RESTCONF uses XML-encoded data
• F. NETCONF uses XML-encoded data

Question No. 8

What are the advantages of using LDAP over AD?

• A. LDAP allows for granular policy control, whereas AD does not.
• B. LDAP provides for faster authentication
• C. LDAP can be configured to use primary and secondary server, whereas AD cannot.
• D. LDAP does not require ISE to join the AD domain
• E. The closest LDAP servers are used for Authentication

Question No. 9

Which IPS deployment mode can blacklist traffic?

• A. Transparent
• B. Strict
• C. Inline
• D. Passive
• E. Tap
• F. Switched

Question No. 10

Which statement is an advantage of network segmentation?

• A. It enables efficient network monitoring due to a flat network
• B. It takes less time to design a complex network with segmentation as one of the critical requirements
• C. It allows flat network design for better security implementation
• D. It allows efficient containment of a security incident as the effect will be limited to local subnet
• E. It improves network performance by having broadcast traffic not limited to local subnets
• F. It allows users to access the resource even though they won’t need to for better visibility

Question No. 11

What are three technologies that can be used to trace the source of an attack in a network environment

with multiple exit/entry points? (Choose three.)

• A. ICMP Unreachable messages
• B. Sinkholes
• C. A honey pot
• D. Remotely-triggered destination-based black holing
• E. Traffic scrubbing

Question No. 12

In to enable the Certificate Authority (CA) server feature using Simple Certificate Enrollment Protocol {SCEP} on an IOS device, which three of the following configuration steps are required1? (Choose three)

• A. Generate a self-signed certificate
• B. Enable ip http server on the device
• C. Set the hostname of the device
• D. Set an authoritative clock source on the device
• E. Enable auto-rollover for the pki server
• F. Issue no shut under the crypto pki server command

Question No. 13

Transmission control protocol, src port: 649999(64999), Dst Port:49086(49086),Seq:2,Ack:2,Len:

Refer to the exhibit.

• A. The TACACS connection keep alive using UDP originated from ASA
• B. The SXP message uses TCP port 64999 for connection termination
• C. The RADIUS connection keep alive using TCP originated from ISE
• D. The SXP message uses MD5 for authentication and integrity check.
• E. The ISE keep alive message for NDAC connection using TCP originated from ASA
• F. The NTP keep alive message using UDP originated from ISE
• G. The SXP keep alive message for SXP connection using UDP originated from ASA

Question No. 14

Which two statements about role-based access control are true? (Choose two.)

• A. The user profile on an AAA server is configured with the roles that grant user privileges.
• B. If the same user name is used for a local user account and a remote user account, the roles defined in
• C. Server profile administrators have read and write access to all system logs by default.
• D. A view is created on the Cisco IOS device to leverage role-based access controls.
• E. Network administrators have read and write access to all system logs by default.

Question No. 15

Refer to the exhibit.

output?

• A. the Finger service
• B. a BOOTP server
• C. a TCP small server
• D. the PAD service