This page was exported from All The Latest MCTS Exam Questions And Answers For Free Share [ https://www.mctsdump.com ]

Export date:Thu Nov 21 10:37:46 2024 / +0000 GMT

___________________________________________________


Title: [Free-Dumps] 366q 400-251 VCE and PDF Exam Dumps -- Must Download For 100% Passing Exam (Question 61 &ndash; Question 90)

---------------------------------------------------


New Updated 400-251 Exam Questions from PassLeader 400-251 PDF dumps! Welcome to download the newest PassLeader 400-251 VCE dumps: http://www.passleader.com/400-251.html (366 Q&amp;As) Keywords: 400-251 exam dumps, 400-251 exam questions, 400-251 VCE dumps, 400-251 PDF dumps, 400-251 practice tests, 400-251 study guide, 400-251 braindumps, CCIE Security Exam p.s. Free 400-251 dumps download from Google Drive: https://drive.google.com/open?id=0B-ob6L_QjGLpd3JLalNVS0VWbms QUESTION 61Which command can you enter on the Cisco ASA to disable SSH? A.&nbsp;&nbsp;&nbsp; Crypto key generate ecdsa labelB.&nbsp;&nbsp;&nbsp; Crypto key generate rsa usage-keys noconfirmC.&nbsp;&nbsp;&nbsp; Crypto keys generate rsa general-keys modulus 768D.&nbsp;&nbsp;&nbsp; Crypto keys generate ecdsa noconfirmE.&nbsp;&nbsp;&nbsp; Crypto keys zeroize rsa noconfirm  Answer: E QUESTION 62Which one of the foiling Cisco ASA adapts security appliance rule samples will send HTTP data to the AIP-SSM module to evaluate and stop HTTP attacks? &nbsp;&nbsp;&nbsp;  Answer: D QUESTION 63Why is the IPv6 type 0 routing header vulnerable to attack? A.&nbsp;&nbsp;&nbsp; It allows the receiver of a packet to control its flow.B.&nbsp;&nbsp;&nbsp; It allows the sender to generate multiple NDP requests for each packet.C.&nbsp;&nbsp;&nbsp; It allows the sender of a packet to control its flow.D.&nbsp;&nbsp;&nbsp; It allows the sender to generate multiple ARP requests for each packet.E.&nbsp;&nbsp;&nbsp; It allows the receiver of a packet to modify the source IP address. Answer: C QUESTION 64What context-based access control (CBAC. command sets the maximum time that a router running Cisco IOS Will wait for a new TCP session to reach the established state? A.&nbsp;&nbsp;&nbsp; IP inspect max-incompleteB.&nbsp;&nbsp;&nbsp; IP inspect tcp finwait-timeC.&nbsp;&nbsp;&nbsp; Ip inspect udp idle-timeD.&nbsp;&nbsp;&nbsp; Ip inspect tcpsynwait-timeE.&nbsp;&nbsp;&nbsp; Ip inspect tcp idle-time Answer: D QUESTION 65Which three statements about Cisco Flexible NetFlow are true? (Choose three.) A.&nbsp;&nbsp;&nbsp; The packet information used to create flows is not configurable by the user.B.&nbsp;&nbsp;&nbsp; It supports IPv4 and IPv6 packet fields.C.&nbsp;&nbsp;&nbsp; It tracks all fields of an IPv4 header as well as sections of the data payload.D.&nbsp;&nbsp;&nbsp; It uses two types of flow cache, normal and permanent.E.&nbsp;&nbsp;&nbsp; It can be a useful tool in monitoring the network for attacks. Answer: BCE QUESTION 66What are the two most common methods that security auditors use to assess an organization's security processes? (Choose two.) A.&nbsp;&nbsp;&nbsp; social engineering attemptsB.&nbsp;&nbsp;&nbsp; interviewsC.&nbsp;&nbsp;&nbsp; policy assessmentD.&nbsp;&nbsp;&nbsp; penetration testingE.&nbsp;&nbsp;&nbsp; document reviewF.&nbsp;&nbsp;&nbsp; physical observations Answer: AE QUESTION 67On Which encryption algorithm is CCMP based? A.&nbsp;&nbsp;&nbsp; IDEAB.&nbsp;&nbsp;&nbsp; BLOWFISHC.&nbsp;&nbsp;&nbsp; RCSD.&nbsp;&nbsp;&nbsp; 3DESE.&nbsp;&nbsp;&nbsp; AES Answer: E QUESTION 68By defaults which amount of time does the ASA add to the TTL value of a DNS entry to determine the amount of time a DNS entry is valid? A.&nbsp;&nbsp;&nbsp; 60 secondsB.&nbsp;&nbsp;&nbsp; 30 secondsC.&nbsp;&nbsp;&nbsp; 0 secondD.&nbsp;&nbsp;&nbsp; 180 secondsE.&nbsp;&nbsp;&nbsp; 120 secondsF.&nbsp;&nbsp;&nbsp; 100 seconds Answer: A QUESTION 69Drag and Drop QuestionDrag and drop the desktop-security terms from the left onto their right definitions on the right. Answer: QUESTION 70What is the name of the unique tool/feature in cisco security manager that is used to merge an access list based on the source/destination IP address service or combination of these to provide a manageable view of access policies? A.&nbsp;&nbsp;&nbsp; merge rule toolB.&nbsp;&nbsp;&nbsp; policy simplification toolC.&nbsp;&nbsp;&nbsp; rule grouping toolD.&nbsp;&nbsp;&nbsp; object group toolE.&nbsp;&nbsp;&nbsp; combine rule tool Answer: E QUESTION 71Refer to the exhibit. Which statement about the effect of this configuration is true? A.&nbsp;&nbsp;&nbsp; reply protection is disableB.&nbsp;&nbsp;&nbsp; It prevent man-in-the-middle attacksC.&nbsp;&nbsp;&nbsp; The replay window size is set to infinityD.&nbsp;&nbsp;&nbsp; Out-of-order frames are dropped Answer: D QUESTION 72when a host initiates a TCP session, what is the numerical range into which the initial sequence number must fail? A.&nbsp;&nbsp;&nbsp; 0 to 65535B.&nbsp;&nbsp;&nbsp; 1 to 1024C.&nbsp;&nbsp;&nbsp; 0 to 4,294,967,295D.&nbsp;&nbsp;&nbsp; 1 to 65535E.&nbsp;&nbsp;&nbsp; 1 to 4,294,967,295F.&nbsp;&nbsp;&nbsp; 0 to 1024 Answer: C QUESTION 73What port has IANA assigned to the GDOI protocol? A.&nbsp;&nbsp;&nbsp; UDP 4500B.&nbsp;&nbsp;&nbsp; UDP 500C.&nbsp;&nbsp;&nbsp; UDP 1812D.&nbsp;&nbsp;&nbsp; UDP 848 Answer: D QUESTION 74Drag and Drop QuestionDrag each Cisco TrustSec feature on the left to its description on the right. Answer: QUESTION 75Which statement is true about SYN cookies? A.&nbsp;&nbsp;&nbsp; The state is kept on the server machine TCP stackB.&nbsp;&nbsp;&nbsp; A system has to check every incoming ACK against state tablesC.&nbsp;&nbsp;&nbsp; NO state is kept on the server machine state but is embedded in the initial sequence numberD.&nbsp;&nbsp;&nbsp; SYN cookies do not help to protect against SYN flood attacks Answer: C QUESTION 76Refer to the exhibit. R1 and R2 are connected across and ASA with MD5 authentication. Which statement about eBGP peering between the routers could be true? A.&nbsp;&nbsp;&nbsp; eBGP peering will fail because ASA is transit lacks BGP support.B.&nbsp;&nbsp;&nbsp; eBGP peering will be successful.C.&nbsp;&nbsp;&nbsp; eBGP peering will fail because the two routers must be directly connected to allow peering.D.&nbsp;&nbsp;&nbsp; eBGP peering will fail because of the TCP random sequence number feature. Answer: QUESTION 77What is the maximum pattern length supported by FPM searches within a packet? A.&nbsp;&nbsp;&nbsp; 256 bytesB.&nbsp;&nbsp;&nbsp; 1500 bytesC.&nbsp;&nbsp;&nbsp; 512 bytesD.&nbsp;&nbsp;&nbsp; 128 bytes Answer: A QUESTION 78Refer to the exhibit. What are three effect of the given firewall configuration? (Choose three.) A.&nbsp;&nbsp;&nbsp; The firewall allows Echo Request packets from any source to pass server.B.&nbsp;&nbsp;&nbsp; The firewall allows time Exceeded error messages from any source to pass to the server.C.&nbsp;&nbsp;&nbsp; PCs outside the firewall are unable to communicate with the server over HTTP.D.&nbsp;&nbsp;&nbsp; The firewall allows Echo Reply packets from any source to pass to the server.E.&nbsp;&nbsp;&nbsp; The firewall allows Destination Unreachable error messages from any source to pass to the server.F.&nbsp;&nbsp;&nbsp; The firewall allows Packet too big error messages from any source to pass to the server. Answer: ADF QUESTION 79Refer to the exhibit Flexible NetFlow is failing to export flow records from RouterA to your flow collector. What action can you take to allow the IPv6 flow records to be sent to the collect? A.&nbsp;&nbsp;&nbsp; Set the NetFlow export protocol to v5B.&nbsp;&nbsp;&nbsp; Configure the output-features command for the IPV4-EXPORTERC.&nbsp;&nbsp;&nbsp; Add the ipv6 cef command to the configurationD.&nbsp;&nbsp;&nbsp; Remove the ip cef command from the configurationE.&nbsp;&nbsp;&nbsp; Create a new flow exporter with an IPv6 destination and apply it to the flow monitor Answer: D QUESTION 80Drag and Drop QuestionDrag each type of spoofing attack on the left to an action you can take to prevent it on the right. Answer: QUESTION 81When you configure an ASA with RADIUS authentication and authorization, which attribute is used to differentiate user roles? A.&nbsp;&nbsp;&nbsp; login-ip-hostB.&nbsp;&nbsp;&nbsp; cisco-priv-levelC.&nbsp;&nbsp;&nbsp; service-typeD.&nbsp;&nbsp;&nbsp; termination-actionE.&nbsp;&nbsp;&nbsp; tunnel-type Answer: C QUESTION 82Which two statement about the IPv6 Hop-by-Hop option extension header (EH) are true? (Choose two.) A.&nbsp;&nbsp;&nbsp; The Hop-by-Hop EH is processed in hardware at the source and the destination devices only.B.&nbsp;&nbsp;&nbsp; If present, network devices must process the Hop-by-Hop EH first.C.&nbsp;&nbsp;&nbsp; The Hop-by-Hop extension header is processed by the CPU by network devices.D.&nbsp;&nbsp;&nbsp; The Hop-by-Hop EH is processed in hardware by all intermediate network devices.E.&nbsp;&nbsp;&nbsp; The Hop-by-Hop EH is encrypted by the Encapsulating Security Header.F.&nbsp;&nbsp;&nbsp; If present the Hop-by-Hop EH must follow the Mobility EH. Answer: BC QUESTION 83Refer to the exhibit. Which configuration option will correctly process network authentication and authorization using both single port? A. B. C. D. Answer: B QUESTION 84Which two current RFCs discuss special use IP addresses that may be used as a checklist of invalid routing prefixes for IPv4 and IPv6 addresses? (Choose two.) A.&nbsp;&nbsp;&nbsp; RFC 5156B.&nbsp;&nbsp;&nbsp; RFC 5735C.&nbsp;&nbsp;&nbsp; RFC 3330D.&nbsp;&nbsp;&nbsp; RFC 1918E.&nbsp;&nbsp;&nbsp; RFC 2827 Answer: AB QUESTION 85What are two protocols that HTTP can use to secure sessions? (Choose two.) A.&nbsp;&nbsp;&nbsp; HTTPSB.&nbsp;&nbsp;&nbsp; AESC.&nbsp;&nbsp;&nbsp; TLSD.&nbsp;&nbsp;&nbsp; AHE.&nbsp;&nbsp;&nbsp; SSL Answer: AE QUESTION 86Which three statements about the IANA are true? (Choose three.) A.&nbsp;&nbsp;&nbsp; IANA is a department that is operated by the IETF.B.&nbsp;&nbsp;&nbsp; IANA oversees global IP address allocation.C.&nbsp;&nbsp;&nbsp; IANA managed the root zone in the DNS.D.&nbsp;&nbsp;&nbsp; IANA is administered by the ICANN.E.&nbsp;&nbsp;&nbsp; IANA defines URI schemes for use on the Internet. Answer: BCD QUESTION 87A cloud service provider is designing a large multilenant data center to support thousands of tenants. The provider is concerned about the scalability of the Layer 2 network and providing Layer 2 segmentation to potentially thousands of tenants. Which Layer 2 technology is best suited in this scenario? A.&nbsp;&nbsp;&nbsp; LDPB.&nbsp;&nbsp;&nbsp; VXLANC.&nbsp;&nbsp;&nbsp; VRFD.&nbsp;&nbsp;&nbsp; Extended VLAN ranges Answer: B QUESTION 88Refer to the exhibit. Which effect of this configuratioin is true? A.&nbsp;&nbsp;&nbsp; The router sends PIM messages only to other routers on the same LAN.B.&nbsp;&nbsp;&nbsp; The router sends PIM messages, but it rejects any PIM message it receives.C.&nbsp;&nbsp;&nbsp; The router acts as a stub multicast router for the EIGRP routing protocol.D.&nbsp;&nbsp;&nbsp; The router accepts all PIM control messages.E.&nbsp;&nbsp;&nbsp; The router acts as the DR and DF for all bidir-PIM group ranges. Answer: E QUESTION 89What is the purpose of enabling the IP option selective Drop feature on your network routers? A.&nbsp;&nbsp;&nbsp; To protect the internal network from IP spoofing attacks.B.&nbsp;&nbsp;&nbsp; To drop IP fragmented packets.C.&nbsp;&nbsp;&nbsp; To drop packet with a TTL value of Zero.D.&nbsp;&nbsp;&nbsp; To protect the network from DoS attacks. Answer: D QUESTION 90Which two answers describe provisions of the SOX Act and its international counterpart Acts? (Choose two.) A.&nbsp;&nbsp;&nbsp; confidentiality and integrity of customer records and credit card informationB.&nbsp;&nbsp;&nbsp; accountability in the event of corporate fraudC.&nbsp;&nbsp;&nbsp; financial information handled by entities such as banks, and mortgage and insurance brokersD.&nbsp;&nbsp;&nbsp; assurance of the accuracy of financial recordsE.&nbsp;&nbsp;&nbsp; US Federal government informationF.&nbsp;&nbsp;&nbsp; security standards that protect healthcare patient data Answer: BD    Download the newest PassLeader 400-251 dumps from passleader.com now! 100% Pass Guarantee! 400-251 PDF dumps &amp; 400-251 VCE dumps: http://www.passleader.com/400-251.html (366 Q&amp;As) (New Questions Are 100% Available and Wrong Answers Have Been Corrected! Free VCE simulator!) p.s. Free 400-251 dumps download from Google Drive: https://drive.google.com/open?id=0B-ob6L_QjGLpd3JLalNVS0VWbms

---------------------------------------------------


Images: 

---------------------------------------------------




---------------------------------------------------


Post date: 2017-02-13 09:40:21

Post date GMT: 2017-02-13 09:40:21

Post modified date: 2017-02-13 09:40:21

Post modified date GMT: 2017-02-13 09:40:21



____________________________________________________________________________________________


Export of Post and Page as text file has been powered by [ Universal Post Manager ] plugin from www.gconverters.com