This page was exported from Braindump2go Free Exam Dumps with PDF and VCE Collection [ https://www.mcitpdump.com ]

Export date:Sat May 4 6:23:29 2024 / +0000 GMT

___________________________________________________


Title: [2017-New-Version]Exam 400-251 VCE and PDF Dumps 425q Free Offered by Braindump2go[337-353]

---------------------------------------------------


2017 March New | CCIE 400-251 Exam Dumps with PDF and VCE Free Updated in www.Braindump2go.com Today! 1.|2017 Version 400-251 Exam Dumsp (PDF &amp; VCE) 425Q&amp;As Download:http://www.braindump2go.com/400-251.html 2.|2017 Version 400-251 Exam Questions &amp; Answers Download:https://1drv.ms/f/s!AvI7wzKf6QBjgkdzKmReEoqH8Ov6 &nbsp; QUESTION 337Which two statements about SCEP are true? (Choose two) A.&nbsp;&nbsp;&nbsp; CA servers must support GetCACaps response messages in order to implement extended functionalityB.&nbsp;&nbsp;&nbsp; The GetCRL exchange is signed and encrypted only in the response direction.C.&nbsp;&nbsp;&nbsp; It is vulnerable to downgrade attacks on its cryptographic capabilitiesD.&nbsp;&nbsp;&nbsp; The GetCert exchange is signed and encrypted only in the response direction.E.&nbsp;&nbsp;&nbsp; The GetCACaps response message supports DES encryption and the SHA-128 hashing algorithm. Answer: AC QUESTION 338Which two events can cause a failover event on an active/standby setup? (Choose two.) A.&nbsp;&nbsp;&nbsp; The active unit experiences interface failure above the threshold.B.&nbsp;&nbsp;&nbsp; The unit that was previously active recovers.C.&nbsp;&nbsp;&nbsp; The stateful failover link fails.D.&nbsp;&nbsp;&nbsp; The failover link fails.E.&nbsp;&nbsp;&nbsp; The active unit fails Answer: AE QUESTION 339Which two statements about the MACsec security protocol are true? (choose two.) A.&nbsp;&nbsp;&nbsp; Stations broadcast an MKA heartbeat that contains the key server priorityB.&nbsp;&nbsp;&nbsp; The SAK is secured by 128 bit AES-GCM by defaultC.&nbsp;&nbsp;&nbsp; When switch-to-switch link security is configured in manual mode, the SAP operation mode must be set to GCMD.&nbsp;&nbsp;&nbsp; MACsec is not supported in MDA mode.E.&nbsp;&nbsp;&nbsp; MKA heartbeats are sent at a default interval of 3 seconds. Answer: AB QUESTION 340Which two options are benefits of network summarization? (Choose two.) A.&nbsp;&nbsp;&nbsp; It can summarize discontiguous IP addresses.B.&nbsp;&nbsp;&nbsp; It can easily be added to existing networksC.&nbsp;&nbsp;&nbsp; it can increase the convergence of the networkD.&nbsp;&nbsp;&nbsp; It reduces the number of routesE.&nbsp;&nbsp;&nbsp; It prevents unnecessary routing updates at the summarization boundary if one of the routes in the summary is unstable. Answer: DE QUESTION 341Refer to the exhibit. Which meaning of this error message on a Cisco ASA is true?&nbsp; A.&nbsp;&nbsp;&nbsp; The route map redistribution is configured incorrectly.B.&nbsp;&nbsp;&nbsp; The default route is undefined.C.&nbsp;&nbsp;&nbsp; A packet was denied and dropped by an ACL.D.&nbsp;&nbsp;&nbsp; The host is connected directly to the firewall Answer: B QUESTION 342Which two statements about uRPF are true? (Choose two.) A.&nbsp;&nbsp;&nbsp; The administrator can configure the allow-default command to force the routing table to use only the default routeB.&nbsp;&nbsp;&nbsp; It is not supported on the Cisco ASA security appliance.C.&nbsp;&nbsp;&nbsp; The administrator can configure the ip verify unicast source reachable-via any command to enable the RPF check to work routing groups.D.&nbsp;&nbsp;&nbsp; The administrator can use the show cef interface command to determine whether uRPF is enabledE.&nbsp;&nbsp;&nbsp; In strict mode, only one routing path can be available to reach network devices on a subnet Answer: DE QUESTION 343Which type of header attack is detected by Cisco ASA basic threat detection? A.&nbsp;&nbsp;&nbsp; connection limit exceededB.&nbsp;&nbsp;&nbsp; denial by access listC.&nbsp;&nbsp;&nbsp; failed application inspectionD.&nbsp;&nbsp;&nbsp; bad packet format Answer: D QUESTION 344Refer to the exhibit. A user authenticates to the NAS, which communicates to the VACACS+ server authentication. The TACACS+ SERVER Then accesses the Active Directory Server through the ASA firewall to validate the user credentials.Which protocol-port pair must be allowed access through the ASA firewall?&nbsp; A.&nbsp;&nbsp;&nbsp; SMB over TCP 455B.&nbsp;&nbsp;&nbsp; DNS over UDP 53C.&nbsp;&nbsp;&nbsp; LDAP over UDP 389D.&nbsp;&nbsp;&nbsp; global catalog over UDP 3268E.&nbsp;&nbsp;&nbsp; TACACS+ over TCP 49F.&nbsp;&nbsp;&nbsp; DNS over TCP 53 Answer: C QUESTION 345Which WEP configuration can be exploited by a weak IV attack? A.&nbsp;&nbsp;&nbsp; When the static WEP password has been stored without encryptionB.&nbsp;&nbsp;&nbsp; When a per-packet WEP key is in useC.&nbsp;&nbsp;&nbsp; When a 64-bit key is in useD.&nbsp;&nbsp;&nbsp; When the static WEP password has been given awayE.&nbsp;&nbsp;&nbsp; When a 40-bit key is in useF.&nbsp;&nbsp;&nbsp; When the same WEP key is used to create every pack Answer: E QUESTION 346Which two statements about Botnet Traffic Filter snooping are true? (Choose two) A.&nbsp;&nbsp;&nbsp; It requires DNS packet inspection to be enabled to filter domain names in the dynamic database.B.&nbsp;&nbsp;&nbsp; It requires the Cisco ASA DNS server to perform DNS lookups.C.&nbsp;&nbsp;&nbsp; It can inspect both IPv4 and IPv6 traffic.D.&nbsp;&nbsp;&nbsp; It can log and block suspicious connections from previously unknown bad domains and IP addressesE.&nbsp;&nbsp;&nbsp; It checks inbound traffic onlyF.&nbsp;&nbsp;&nbsp; It checks inbound and outbound traffic. Answer: AF QUESTION 347Which three statements about SXP are true? (Choose three ) A.&nbsp;&nbsp;&nbsp; It resides in the control plane, where connections can be initiated from a listenerB.&nbsp;&nbsp;&nbsp; Packets can be tagged with SGTs only with hardware supportC.&nbsp;&nbsp;&nbsp; Each VRF supports only one CTS-SXP connectionD.&nbsp;&nbsp;&nbsp; To enable an access device to use IP device tracking to learn source device IP addresses.DHCP snooping must be configured.E.&nbsp;&nbsp;&nbsp; The SGA ZBPF uses the SGT to apply forwarding decisionsF.&nbsp;&nbsp;&nbsp; Separate VRFs require different CTS-SXP peers, but they can use the same source IP addresses. Answer: ABC QUESTION 348Which file extensions are supported on the Firesight Management Center 3.1 file policies that can be analyzed dynamically using the Threat Grid Sandbox integration? A.&nbsp;&nbsp;&nbsp; MSEXE , MSOLE2 , NEW-OFFICE ,PDFB.&nbsp;&nbsp;&nbsp; DOCX , WAV , XLS , TXTC.&nbsp;&nbsp;&nbsp; TXT , MSOLE2 , WAV, PDFD.&nbsp;&nbsp;&nbsp; DOC, MSOLE2, XML, PDF Answer: A QUESTION 349Refer to the exhibit You applied this VPN cluster configuration to a Cisco ASA and the cluster failed to form How do you edit the configuration to correct the problem?&nbsp; A.&nbsp;&nbsp;&nbsp; Define the maximum allowable number of VPN connections.B.&nbsp;&nbsp;&nbsp; Define the master/slave relationship.C.&nbsp;&nbsp;&nbsp; Configure the cluster IP address.D.&nbsp;&nbsp;&nbsp; Enable load balancing. Answer: C QUESTION 350Which effect of the crypto pki authenticate command is true? A.&nbsp;&nbsp;&nbsp; It sets the certificate enrollment method.B.&nbsp;&nbsp;&nbsp; It retrieves and authenticates a CA certificate.C.&nbsp;&nbsp;&nbsp; It configures a CA trust point.D.&nbsp;&nbsp;&nbsp; It displays the current CA certificate. Answer: B QUESTION 351Which effect of the ip nhrp map multicast dynamic command is true? A.&nbsp;&nbsp;&nbsp; It configures a hub router to automatically add spoke routers to the multicast replication list of the hubB.&nbsp;&nbsp;&nbsp; It enables a GRE tunnel to operate without the IPsec peer or crypto ACLs.C.&nbsp;&nbsp;&nbsp; it enables a GRE tunnel to dynamically update the routing tables on the devices at each end of the tunnelD.&nbsp;&nbsp;&nbsp; It configures a hub router to reflect the routes it learns from a spoke back to other spokes through the same interface Answer: A QUESTION 352Which statement about VRF-aware GDOI group members is true? A.&nbsp;&nbsp;&nbsp; IPsec is used only to secure data traffic.B.&nbsp;&nbsp;&nbsp; The GM cannot route control traffic through the same VRF as data trafficC.&nbsp;&nbsp;&nbsp; Multiple VRFs are used to separate control traffic and data trafficD.&nbsp;&nbsp;&nbsp; Registration traffic and rekey traffic must operate on different VRFs Answer: A QUESTION 353Refer to the exhibit. Which data format is used in this script?&nbsp; A.&nbsp;&nbsp;&nbsp; APIB.&nbsp;&nbsp;&nbsp; JavaScriptC.&nbsp;&nbsp;&nbsp; JSOND.&nbsp;&nbsp;&nbsp; YANGE.&nbsp;&nbsp;&nbsp; XML Answer: E   !!!RECOMMEND!!!  1.|2017 Version 400-251 Exam Dumsp (PDF &amp; VCE) 425Q&amp;As Download:http://www.braindump2go.com/400-251.html 2.|2017 Version 400-251 Study Guide Video: YouTube Video: YouTube.com/watch?v=YaNeWF28hfc 

---------------------------------------------------


Images: 

---------------------------------------------------




---------------------------------------------------


Post date: 2017-03-23 03:23:29

Post date GMT: 2017-03-23 03:23:29

Post modified date: 2017-03-23 03:23:29

Post modified date GMT: 2017-03-23 03:23:29



____________________________________________________________________________________________


Export of Post and Page as text file has been powered by [ Universal Post Manager ] plugin from www.gconverters.com