Cisco 400-251 Online Practice Questions and Exam Preparation

Cisco 400-251 Online Questions & Answers

• Question 31:

  Refer to the exhibit. What is the effect of the given service policy configuration?

  

  A. It blocks all domains except facebook.com, msn.com, cisco.com, and google.com
  B. It blocks all domains except cisco.com, msn.com, and facebook.com
  C. It blocks facebook.com, msn.com, cisco.com, and google.com, and permits all other domains
  D. It blocks cisco.com, msn.com, and facebook.com and permits all other domains.
  B. It blocks all domains except cisco.com, msn.com, and facebook.com

• Question 32:

  Which statement about Nmap scanning on the Cisco Firepower System is true?

  A. It can scan IP addresses, address blocks, and address ranges on IPv4 and IPv6 networks
  B. It can leverage multiple proxy devices to increase scan speed
  C. It performs host discovery before each san to identify hosts that are online hosts and skips the full scan for hosts that are offline
  D. It supports custom fingerprinting to identify malware by its unique characteristics in your specific environment
  E. It can scan TCP and UDP ports, but TCP ports require significantly more resources
  F. The Fast Port Scan optionscans only the TCP ports that are listed in nmap-services file
  F. The Fast Port Scan optionscans only the TCP ports that are listed in nmap-services file

• Question 33:

  

  Refer to the exhibit. Firewall ASA1 and router R2 are running OSPF routing process in area 1 connected via 10.1.11.0/24 subnet in the inside zone. It has been reported that ASA1 is unable to see any OSPF learned routes, Which two possible issues are true? (Choose two)

  A. The R2 has mismatched message-digest key IDs
  B. ON ASA1 standby interface need to be disabled on Gi0/1 interface.
  C. On R2, an incorrect subnet defined for the Gi2 interface.
  D. On ASA1, a Gi0/1 interface must have security level at "0"
  E. On ASA1, an incorrect subnet mask is on the Gi0/1 interface
  F. On R2, the 172.16.100.0/24 subnet must not be in the OSPF routing process
  G. On R2, the 10.1.11.0/24 subnet must be in area "0" in OSPF routing process.
  A. The R2 has mismatched message-digest key IDs
  C. On R2, an incorrect subnet defined for the Gi2 interface.

• Question 34:

  Which statement about securing connection using MACsec is true?

  A. ISAKMP protocol is used to manage MACSec encryption keys
  B. It Is implemented after a successful MAB authentication of supplicant
  C. The Switch uses session keys to calculate encrypted packet ICV value for the frame Integrity check
  D. A Switch configured for MACSec can accept MACSec frames from the MACSec client
  E. It secures connection between two supplicant clients
  F. It provides network layer encryption on a wired network
  F. It provides network layer encryption on a wired network

• Question 35:

  Which three statements about Dynamic ARP inspection on Cisco switches are true? (Choose three)

  A. The trusted database can be manually configured using the CLI
  B. Dynamic ARP inspection is supported only on access ports
  C. Dynamic ARP inspection does no perform ingress security checking
  D. DHCP snooping is used to dynamically build the trusted database
  E. Dynamic ARP inspection checks ARP packets against the trusted database
  F. Dynamic ARP inspection checks ARP packets on trusted and untrusted ports
  A. The trusted database can be manually configured using the CLI
  D. DHCP snooping is used to dynamically build the trusted database
  E. Dynamic ARP inspection checks ARP packets against the trusted database

• Question 36:

  Which two options are open-source SDN controllers? (Choose two)

  A. Opendaylight
  B. Big Cloud Fabric
  C. Application Policy Infrastructure Controller
  D. OpenContrail
  E. Virtual Application Networks SDN Controller
  A. Opendaylight
  D. OpenContrail

• Question 37:

  Which ports need to be enabled outbound in order to integrate Cisco Email Security Appliance ESA with Cisco's APM and ThreatGrid Cloud services?

  A. TCP 32137 to both File reputation and File Analysis Servers
  B. TCP 443 or 32137 to File Reputation server, TCP 443 to File Analysis Server
  C. TCP to 443 to both File Reputation and File Analysis Servers
  D. TCP 32137 only to File Reputation Server, TCP 443 to File Analysis Server
  B. TCP 443 or 32137 to File Reputation server, TCP 443 to File Analysis Server

• Question 38:

  What are two characteristics of RPL, used in IoT environments?(Choose two)

  A. It is an Exterior Gateway Protocol
  B. It is a Interior Gateway Protocol
  C. It is a hybrid protocol
  D. It is link-state protocol
  E. It is a distance-vector protocol
  B. It is a Interior Gateway Protocol
  E. It is a distance-vector protocol

• Question 39:

  Which statement is an advantage of network segmentation?

  A. It improves network performance by having broadcast traffic not limited to local subnets.
  B. It takes less time to design a complex network with segmentation as one of the critical requirements.
  C. It enables users to access only the allowed network resources.
  D. It allows flat network design for better security implementation.
  E. It allows efficient containment of a security incident because the effect influences multiple subnets
  F. It allows users to access the resource even though they won't need to for better visibility.
  C. It enables users to access only the allowed network resources.

• Question 40:

  You are troubleshooting a FlexVPN deployment. You find that while the tunnels from the spokes to the hub are in the "up" state, communication is still broken. Upon further investigation, you determine that an ICMP echo that inrtiated from an endpoint in the spoke site is seen by the destination endpoint in the hub site, which sends an ICMP echo reply back, but this reply is not received on endpoint A. Your FlexVPN hub and spoke are behind a NAT device. Which option is a possible cause of this failure?

  A. UDP 500 is blocked outbound from the hub or inbound on the spoke.
  B. UDP 4500 is blocked outbound from the hub or inbound on the spoke.
  C. FlexVPN does not work with NAT
  D. UDP 4500 is blocked outbound from the spoke or inbound on the hub
  E. ESP is blocked outbound from the hub or inbound on the spoke.
  B. UDP 4500 is blocked outbound from the hub or inbound on the spoke.