Cisco 400-251 Online Practice Questions and Exam Preparation

Cisco 400-251 Online Questions & Answers

• Question 11:

  Cisco ISE can assign a VLAN as a result of an 802.1x authentication and authorization request. What does the switch do if the VLAN assigned by ISE doesn't exist?

  A. Treat the 802.1x attempt as passed and assign the default VLAN.
  B. Request creation of the VLAN on the VTP Server.
  C. Create the VLAN locally.
  D. Send a RADIUS CoA NACK packet to ISE.
  E. Mark the 802.1x attempt as failed.
  D. Send a RADIUS CoA NACK packet to ISE.

• Question 12:

  Refer to the exhibit. Which three additional configuration elements must you apply to complete a functional FlexVPN deployment? (Choose three)

  A. crypto ikev2 keyring default peer PEER-ROUTER address 2001::101/64 interface virtual-template5 type tunnel ip nhrp network-id 10 ip nhrp shortcut loopback0
  B. interface loopback0 tunnel mode ipsec ipv6 tunnel protection ipsec profile default
  C. interface Tunnel0 bfd interval 50 min_rx 50 multiplier 3 no bfd echo
  D. crypto ikev2 keyring KEYS peer PEER-ROUTER address 2001::101/64 crypto ikev2 profile default aaa authorization group pak list ccie default
  E. interface virtual-template5 type tunnel ipv6 unnumbered loopback0 ipv6 eigrp 10 ipv6 enable interface loopback0 ipv6 eigrp 10
  F. aaa authorization network ccie local
  D. crypto ikev2 keyring KEYS peer PEER-ROUTER address 2001::101/64 crypto ikev2 profile default aaa authorization group pak list ccie default
  E. interface virtual-template5 type tunnel ipv6 unnumbered loopback0 ipv6 eigrp 10 ipv6 enable interface loopback0 ipv6 eigrp 10
  F. aaa authorization network ccie local

• Question 13:

  From the list below, which one is the major benefit of AMP Threat GRID?

  A. AMP Threat Gird learns ONLY form data you pass on your network and not form anything else to monitor for suspicious behavior. This makes
  B. AMP Threat Grid combines Static, and Dynamic Malware analysis with threat intelligence into one combined solution.
  C. AMP Threat Grid analyzes suspicious behavior in your network against exactly 400 behavioral indicators.
  D. AMP Threat Grid collects file information from customer servers and run tests on them to see if they are infected with viruses.
  B. AMP Threat Grid combines Static, and Dynamic Malware analysis with threat intelligence into one combined solution.

• Question 14:

  Which two options are unicast address types for IPv6 addressing? (Choose two)

  A. static
  B. link-local
  C. established
  D. dynamic
  E. global
  B. link-local
  E. global

• Question 15:

  What is a physical layer (Layer 1) bypass that allows inline paired IPS interfaces to go into bypass mode so that the hardware forwards packets between the inline port pairs without software intervention?

  A. EtherChannel
  B. Tap
  C. Fail-To-Wire
  D. Cluster
  E. Redundant interface
  C. Fail-To-Wire

• Question 16:

  Which statements correctly describes 3DES encryption algorithm?

  A. It uses a set of three keys for encryption and a different set of three keys for decryption.
  B. It is a block Cipher algorithm but weaker than DES due to smaller key size
  C. It is an asymmetric algorithm with a key size of 168 bits.
  D. It does decryption in reverse order with the same set of key used during encryption
  E. It is a block cipher algorithm with a key size of 56 bits
  F. It is a stream cipher algorithm with a key of 168 bits
  D. It does decryption in reverse order with the same set of key used during encryption

• Question 17:

  Which statement is true about VRF-lite implementation in a service provider network?

  A. It requires multiple links between CE and PE for each VPN connection to enable privacy
  B. It uses source address to differentiate routes for different VPNs on the CE device
  C. It can only support one VRF instance per CE device
  D. It can have multiple VRF instances associated with a single interface on a CE device
  E. It supports multiple VPNs at a CE device but their address spaces should not overlap
  F. It enables the sharing of one CE device among multiple customers
  F. It enables the sharing of one CE device among multiple customers

• Question 18:

  Which process is the most efficient to gennerate wildcard certificates in ISE and implement them on all nodes?

  A. Generate a CSR for a wildcard certificate on one node, install the received cerificate, export it without the private key, and then import it to all the other nodes
  B. Generate a CSR for a wildcard certificate on each node separately, install the received certificates, export tfie certificates with their private key, and then import each certificate on all the nodes individually along with their respective private keys.
  C. Generate a CSR for a wildcard certificate on one node, install the received certificate, then go to Administration > Deployment and click the Resynch button to synchronize across the deployment.
  D. Enable wildcard certificate synchronization, generate the CSR and import the certificate after it is received. ISE automatically copies the wildcard certificate on all the nodes.
  E. Generate a CSR for a wildcard certificate on one node, install the received certificate, export this certificate with the private key, and then import it to all other nodes using the exported private key.
  E. Generate a CSR for a wildcard certificate on one node, install the received certificate, export this certificate with the private key, and then import it to all other nodes using the exported private key.

• Question 19:

  Refer to the exhibit. What reason for the Dot1x session failure is true?

  

  A. Identify source has the user present but not enabled.
  B. Incorrect authorization condition.
  C. Incorrect authentication rule.
  D. Issue with identity source.
  E. Incorrect user group.
  F. Incorrect user string.
  G. Incorrect authorization permission.
  D. Issue with identity source.

  ---

  Exam E

• Question 20:

  Which of the following is used by WSA to extract session information from ISE and use that in access policies?

  A. RPC
  B. pxGrid
  C. SXP
  D. Proprietary protocol over TCP/8302
  E. EAP
  F. RADIUS
  B. pxGrid