Cisco 400-251 Online Practice Questions and Exam Preparation

Cisco 400-251 Online Questions & Answers

• Question 521:

  Which of the following statements about Cisco TrustSec is incorrect?

  A. SGT Exchange Protocol (SXP) is required for SGT propagation
  B. Cisco TrustSec enforcement points can be a router, switch, or firewall
  C. Cisco TrustSec uses the Security Group Tag (SGT) to enforce group access policies
  D. A Cisco Firewall can perform stateful packet inspection based on SGT rules
  E. IKEv2 can be used to negotiate and inform Ipsec about SGT capability
  D. A Cisco Firewall can perform stateful packet inspection based on SGT rules

• Question 522:

  Which statement of DKIM signing in ESA is true?

  A. The receiving server gets the signing public key from ISE
  B. The ESA does not allow the creation of a signing key pair
  C. The signing public key is required by the sending server
  D. The singing private key is required by the reeving server
  E. The receiving server gets the public from the DNS.
  F. The domain profile is used to associate the receiving domain with the signing key
  D. The singing private key is required by the reeving server

• Question 523:

  What are the two available firewall modes on the Cisco NGFW? (Choose two.)

  A. Transparent
  B. ERSPAN
  C. Inline Pair
  D. Passive
  E. Routed
  F. Inline Tap
  A. Transparent
  E. Routed

• Question 524:

  What one policy element is mandatory to create a Posture Requirement in ISE?

  A. Posture Condition
  B. Posture Remediation Action
  C. Posture Policy
  D. Authorization Profile
  A. Posture Condition

• Question 525:

  Which statement about zone-based policy firewall implementation is true?

  A. If an interface belongs to a zone, then the traffic to and from that interface is always allowed
  B. All the interfaces of the device cannot be the part of the same zone
  C. A zone pair can have a zone as both source and destination
  D. An interface can be member of multiple zones
  E. If default zone is enabled, then traffic from zone interface to non-zone interface is dropped
  F. By default, traffic between the interfaces in the same zone is dropped
  C. A zone pair can have a zone as both source and destination

• Question 526:

  Which statement about Local Web Authentication is true?

  A. It can use VLANs arid ACLs to enforce authorization
  B. It supports Change of Authorization and VLAN enforcement
  C. It supports posture and profiling services W
  D. The ISE serves web pages
  E. The network device handles guest authentication
  F. The Web portal can be customized locally or managed by the ISE
  E. The network device handles guest authentication

• Question 527:

  Which statement is not true about Passive Authentication using WMI?

  A. The session directory information can be shared with ecosystem partners, such as firewalls and web security appliances.
  B. The identity is not a part of the Kerberos authentication that occurs as part of the normal Active Directory processes.
  C. The AD authentication triggers a notification through WMI.
  D. ISE is subscribed to those WMI messages and learns about the authentication event, the user ID, and the source IP address of that authentication.
  E. ISE performs an AD lookup and learns the user's group membership, adding the information to the session directory.
  B. The identity is not a part of the Kerberos authentication that occurs as part of the normal Active Directory processes.

• Question 528:

  How does a Cisco ISE server determine whether a client supports EAP chaining?

  A. It sends an identity-type TLV to the client and analyzes the response.
  B. It analyzes the options field in the TCP header of the first packet it receives from the client
  C. It analyzes the X.509 certificate it received from the client through the TLS tunnel.
  D. It sends an MD5 challenge to the client and analyzes the response
  E. It analyzes the EAPoL message the client sends during the initial handshake
  A. It sends an identity-type TLV to the client and analyzes the response.

• Question 529:

  DRAG DROP

  Drag each EAP variant in the 802.lx framework to the matching statement on the right.

  Select and Place:

  

  

• Question 530:

  Which are two of the valid IPv6 extension headers? (Choose two)

  A. Options
  B. Authentication Header
  C. Mobility
  D. Protocol
  E. Next Header
  F. Hop Limit
  B. Authentication Header
  C. Mobility