QUESTION 133 You have installed a web server on a private network. Which type of NAT must you implement to enable access to the web server for public Internet users?
A. static NAT B. dynamic NAT C. network object NAT D. twice NAT
QUESTION 134 Which type of object group will allow configuration for both TCP 80 and TCP 443?
A. service B. network C. time range D. user group
QUESTION 135 When you configure a Botnet Traffic Filter on a Cisco firewall, what are two optional tasks? (Choose two.)
A. Enable the use of dynamic databases. B. Add static entries to the database. C. Enable DNS snooping. D. Enable traffic classification and actions. E. Block traffic manually based on its syslog information.
QUESTION 136 Refer to the exhibit. What is the effect of this configuration?
A. The firewall will inspect IP traffic only between networks 192.168.1.0 and 192.168.2.0. B. The firewall will inspect all IP traffic except traffic to 192.168.1.0 and 192.168.2.0. C. The firewall will inspect traffic only if it is defined within a standard ACL. D. The firewall will inspect all IP traffic.
QUESTION 137 When you configure a Cisco firewall in multiple context mode, where do you allocate interfaces?
A. in the system execution space B. in the admin context C. in a user-defined context D. in the global configuration
QUESTION 138 At which layer does Dynamic ARP Inspection validate packets?
A. Layer 2 B. Layer 3 C. Layer 4 D. Layer 7
QUESTION 139 Which feature can suppress packet flooding in a network?
A. PortFast B. BPDU guard C. Dynamic ARP Inspection D. storm control
QUESTION 140 What is the default violation mode that is applied by port security?
A. restrict B. protect C. shutdown D. shutdown VLAN
QUESTION 141 What are two security features at the access port level that can help mitigate Layer 2 attacks? (Choose two.)
A. DHCP snooping B. IP Source Guard C. Telnet D. Secure Shell E. SNMP
QUESTION 142 At which layer does MACsec provide encryption?
A. Layer 1 B. Layer 2 C. Layer 3 D. Layer 4
QUESTION 143 What are two enhancements of SSHv2 over SSHv1? (Choose two.)
A. VRF-aware SSH support B. DH group exchange support C. RSA support D. keyboard-interactive authentication E. SHA support
QUESTION 119 Which two configurations are necessary to enable password-less SSH login to an IOS router? (Choose two.)
A. Enter a copy of the administrator’s public key within the SSH key-chain B. Enter a copy of the administrator’s private key within the SSH key-chain C. Generate a 512-bit RSA key to enable SSH on the router D. Generate an RSA key of at least 768 bits to enable SSH on the router E. Generate a 512-bit ECDSA key to enable SSH on the router F. Generate a ECDSA key of at least 768 bits to enable SSH on the router
QUESTION 120 Which two features does Cisco Security Manager provide? (Choose two.)
A. Configuration and policy deployment before device discovery B. Health and performance monitoring C. Event management and alerting D. Command line menu for troubleshooting E. Ticketing management and tracking
QUESTION 121 An administrator installed a Cisco ASA that runs version 9.1. You are asked to configure the firewall through Cisco ASDM. When you attempt to connect to a Cisco ASA with a default configuration, which username and password grants you full access?
A. admin / admin B. asaAdmin / (no password) C. It is not possible to use Cisco ASDM until a username and password are created via the username usernamepassword password CLI command. D. enable_15 / (no password) E. cisco / cisco
QUESTION 122 Which three options are default settings for NTP parameters on a Cisco ASA? (Choose three.)
A. NTP authentication is enabled. B. NTP authentication is disabled. C. NTP logging is enabled. D. NTP logging is disabled. E. NTP traffic is not restricted. F. NTP traffic is restricted.
QUESTION 123 Which two options are purposes of the packet-tracer command? (Choose two.)
A. to filter and monitor ingress traffic to a switch B. to configure an interface-specific packet trace C. to simulate network traffic through a data path D. to debug packet drops in a production network E. to automatically correct an ACL entry in an ASA
QUESTION 124 Refer to the exhibit. Server A is a busy server that offers these services: – World Wide Web – DNS Which command captures http traffic from Host A to Server A?
A. capture traffic match udp host 10.1.1.150 host 10.2.2.100 B. capture traffic match 80 host 10.1.1.150 host 10.2.2.100 C. capture traffic match ip 10.2.2.0 255.255.255.192 host 10.1.1.150 D. capture traffic match tcp host 10.1.1.150 host 10.2.2.100 E. capture traffic match tcp host 10.2.2.100 host 10.1.1.150 eq 80
QUESTION 125 Your company is replacing a high-availability pair of Cisco ASA 5550 firewalls with the newer Cisco ASA 5555-X models. Due to budget constraints, one Cisco ASA 5550 will be replaced at a time. Which statement about the minimum requirements to set up stateful failover between these two firewalls is true?
A. You must install the USB failover cable between the two Cisco ASAs and provide a 1 Gigabit Ethernet interface for state exchange. B. It is not possible to use failover between different Cisco ASA models. C. You must have at least 1 Gigabit Ethernet interface between the two Cisco ASAs for state exchange. D. You must use two dedicated interfaces. One link is dedicated to state exchange and the other link is for heartbeats.
QUESTION 126 In which two modes is zone-based firewall high availability available? (Choose two.)
A. IPv4 only B. IPv6 only C. IPv4 and IPv6 D. routed mode only E. transparent mode only F. both transparent and routed modes
QUESTION 127 You are the administrator of a multicontext transparent-mode Cisco ASA that uses a shared interface that belongs to more than one context. Because the same interface will be used within all three contexts, which statement describes how you will ensure that return traffic will reach the correct context?
A. Interfaces may not be shared between contexts in routed mode. B. Configure a unique MAC address per context with the no mac-address auto command. C. Configure a unique MAC address per context with the mac-address auto command. D. Use static routes on the Cisco ASA to ensure that traffic reaches the correct context.
QUESTION 128 A rogue device has connected to the network and has become the STP root bridge, which has caused a network availability issue. Which two commands can protect against this problem? (Choose two.)
A. switch(config)#spanning-tree portfast bpduguard default B. switch(config)#spanning-tree portfast bpdufilter default C. switch(config-if)#spanning-tree portfast D. switch(config-if)#spanning-tree portfast disable E. switch(config-if)#switchport port-security violation protect F. switch(config-if)#spanning-tree port-priority 0
QUESTION 129 According to Cisco best practices, which two interface configuration commands help prevent VLAN hopping attacks? (Choose two.)
A. switchport mode access B. switchport access vlan 2 C. switchport mode trunk D. switchport access vlan 1 E. switchport trunk native vlan 1 F. switchport protected
QUESTION 108 When you set a Cisco IOS Router as an SSH server, which command specifies the RSA public key of the remote peer when you set the SSH server to perform RSA-based authentication?
A. router(config-ssh-pubkey-user)#key B. router(conf-ssh-pubkey-user)#key-string C. router(config-ssh-pubkey)#key-string D. router(conf-ssh-pubkey-user)#key-string enable ssh
QUESTION 109 Enabling what security mechanism can prevent an attacker from gaining network topology information from CDP via a man-in-the-middle attack?
A. MACsec B. Flex VPN C. Control Plane Protection D. Dynamic Arp Inspection
QUESTION 110 On an ASA running version 9.0, which command is used to nest objects in a pre-existing group?
A. object-group B. network group-object C. object-group network D. group-object
QUESTION 11 Which ASA feature is used to keep track of suspected attackers who create connections to too many hosts or ports?
A. complex threat detection B. scanning threat detection C. basic threat detection D. advanced threat detection
QUESTION 112 What is the default behavior of an access list on a Cisco ASA?
A. It will permit or deny traffic based on the access list criteria. B. It will permit or deny all traffic on a specified interface. C. It will have no affect until applied to an interface, tunnel-group or other traffic flow. D. It will allow all traffic.
QUESTION 113 When configuring a new context on a Cisco ASA device, which command creates a domain for the context?
A. domain config name B. domain-name C. changeto/domain name change D. domain context 2
QUESTION 114 Which statement describes the correct steps to enable Botnet Traffic Filtering on a Cisco ASA version 9.0 transparent-mode firewall with an active Botnet Traffic Filtering license?
A. Enable DNS snooping, traffic classification, and actions. B. Botnet Traffic Filtering is not supported in transparent mode. C. Enable the use of the dynamic database, enable DNS snooping, traffic classification, and actions. D. Enable the use of dynamic database, enable traffic classification and actions.
QUESTION 115 Which Cisco switch technology prevents traffic on a LAN from being disrupted by a broadcast, multicast, or unicast flood on a port?
A. port security B. storm control C. dynamic ARP inspection D. BPDU guard E. root guard F. dot1x
QUESTION 116 You are a security engineer at a large multinational retailer. Your Chief Information Officer recently attended a security conference and has asked you to secure the network infrastructure from VLAN hopping. Which statement describes how VLAN hopping can be avoided?
A. There is no such thing as VLAN hopping because VLANs are completely isolated. B. VLAN hopping can be avoided by using IEEE 802.1X to dynamically assign the access VLAN to all endpoints and setting the default access VLAN to an unused VLAN ID. C. VLAN hopping is avoided by configuring the native (untagged) VLAN on both sides of an ISL trunk to an unused VLAN ID. D. VLAN hopping is avoided by configuring the native (untagged) VLAN on both sides of an IEEE 802.1Q trunk to an unused VLAN ID.
QUESTION 117 You are the administrator of a Cisco ASA 9.0 firewall and have been tasked with ensuring that the Firewall Admins Active Directory group has full access to the ASA configuration. The Firewall Operators Active Directory group should have a more limited level of access. Which statement describes how to set these access levels?
A. Use Cisco Directory Agent to configure the Firewall Admins group to have privilege level 15 access. Also configure the Firewall Operators group to have privilege level 6 access. B. Use TACACS+ for Authentication and Authorization into the Cisco ASA CLI, with ACS as the AAA server. Configure ACS CLI command authorization sets for the Firewall Operators group. Configure level 15 access to be assigned to members of the Firewall Admins group. C. Use RADIUS for Authentication and Authorization into the Cisco ASA CLI, with ACS as the AAA server. Configure ACS CLI command authorization sets for the Firewall Operators group. Configure level 15 access to be assigned to members of the Firewall Admins group. D. Active Directory Group membership cannot be used as a determining factor for accessing the Cisco ASA CLI.
QUESTION 118 A router is being enabled for SSH command line access. The following steps have been taken: – The vty ports have been configured with transport input SSH and login local. – Local user accounts have been created. – The enable password has been configured. What additional step must be taken if users receive a ‘connection refused’ error when attempting to access the router via SSH?
A. A RSA keypair must be generated on the router B. An access list permitting SSH inbound must be configured and applied to the vty ports C. An access list permitting SSH outbound must be configured and applied to the vty ports D. SSH v2.0 must be enabled on the router