400-251 by Cisco Actual Free Exam Q&As

Question 1

ISE can be integrated with an MDM to ensure that only registered devices are allowed on the network, and use the MDM to push policies to the device. Devices can go in and out of compliance either due to policy changes on the MDM server, or another reason. Consider a device that has already authenticated on the network, and stays connected, but fails out of compliance. Which action can you take to ensure that a noncompliant device is checked periodically and re-assessed before allowing access to the network?

A. The MDM agent automatically disconnects the device from the network when it is noncompliant B. Enable Change of authorization on ISE C. Enable Period compliance checking on ISE D. Enable change of authorization on MDM E. Fire-AMP connector scan can be used to relay posture information to ISE via FireAMP cloud F. The MDM agent periodically sends a packet with compliance info that the wireless controller can be used to limit network access

Discussion 0

Correct Answer: B Vote an answer

Question 2

Which markup language is used to format Ansible's playbook?

A. XML B. ADML C. HTML D. NAML E. YAML

Discussion 0

Correct Answer: E Vote an answer

Question 3

Which of the following security services is available on Cisco Email Security Appliance (ESA)?

A. Cisco Image Analysis B. HTTP load-balancing C. Virus Offload Filters D. Trend Micro Anti-Virus Engine

Discussion 0

Correct Answer: A Vote an answer

Question 4

You have been tasked with configuring URL Redirect for Cisco ISE posture Validation. You need to create the URL Redirect ACL's on Cisco Switches and Cisco WLC You will

A. Permit traffic to ISE on both the switch and the WLC ACLs B. Deny traffic to ISE on the switch ACL and permit traffic to ISE in the WLC ACL C. Deny traffic to ISE on both the switch and the WLC ACLs D. Permit traffic to ISE on the switch ACL and deny traffic to ISE in the WLC ACL

Discussion 0

Correct Answer: B Vote an answer

Question 5

Which configuration management tools does the Cisco Nexus 9000 platform support?

A. Chef B. Salt C. Jenkins D. Ansible E. Puppet

Discussion 0

Correct Answer: E Vote an answer

Question 6

Refer to the exhibit.

15 is building a Site-to-Site IPsec certificate-based VPN tunnel with the peer at 20.1.7.16. The CA is running at port 80 on address 172.16.100.18 . R15 has a BGP peer at 20.6.1.18 doing an authenticated session to establish reachability with the VPN remote site.
The VPN tunnel secures traffic between 192.168.15.0/24 and 192.168.16.0/24 networks. It has been reported that VPN tunnel is not coming up with remote site, what could be the issues? (Choose two)

A. Incorrect ISAKMP policy configuration B. Incorrect BGP peer Configuration C. Incorrect crypto map configuration D. Incorrect truspoint configuration E. Incorrect static route F. Incorrect ACL defined for the traffic encryption G. Incorrect transform set configuration H. The crypto map is not applied on the correct interface

Discussion 0

Correct Answer: B,D Vote an answer

Question 7

A customer has configured Cisco ISE to assign a Downloadable Access-List as a result of successful 802.1x authentication. When they check the switch after a successful authentication, they do not see the DACL applied. They also notice that ISE logs do not contain the Framed-IP-Address value from the RAIDUS exchange. What is the most likely fix?

A. Apply a default ACL on the switchport B. Add the "aaa accounting dot1x default" command on the switch C. Add source IP address on the DACL in ISE D. Enable IDPT on the switch

Discussion 0

Correct Answer: D Vote an answer

Question 8

A university has hired you as a consultant to advise them on the best method to prevent DHCP starvation attacks in the campus. They have already implemented DHCP snooping and port security to control the situation but those do not fully contain the issue. Which two actions do you suggest to fix this issue? (Choose two.)

A. Use the ip dhcp snooping limit rate command only on Untrusted interfaces and set the rate to suitable values that are relevant to the interface. B. Use the ip dhcp snooping limit rate command only to ensure that the source MAC address in the DHCP request matches the client identifier (CLID) field sent to the DHCP server. C. Use the ip dhcp snooping verify mac-address command to ensure that the source MAC address in the DHCP request matches the client hardware address (CHADDR) sent to the DHCP server. D. Use the ip dhcp snooping verify mac-address command to ensure that the source MAC address in the DHCP request matches the client identifier (CLID) field sent to the DHCP server. E. Use the ip dhcp snooping limit rate command on trusted and untrusted interfaces set to the rate same value. F. Use the ip dhcp snooping limit rate command on Trusted and Untrusted interfaces and set the rate to suitable values that are relevant to each interface respectively.

Discussion 0

Correct Answer: C,F Vote an answer

Question 9

What are the three types of CoA we use in ISE? (Choose three)

A. Reauth B. PoD (Packet of Disconnect) C. Port Bounce D. No CoA (Change of authorization) E. Terminate

Discussion 0

Correct Answer: A,C,D Vote an answer

Cisco CCIE Security Written Exam (v5.0) - 400-251 Exam Practice Test