CCIE Security Written Exam v4.0 (350-018) Free Practice Test

Question 1

When you configure ip-port-map http port 8080. What would be the output?
A)

B)

C)

A. Exhibit C

B. Exhibit B

C. Exhibit A

Correct Answer: C

Question 2

Which statement is true about SYN cookies?

A. SYN cookies do not help to protect against SYM flood attacks.

B. The state is kept on the server machine TCP stack.

C. No state is kept on the server machine state but is embedded in the initial sequence number.

D. A system has to check every incoming ACK against state tables.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

You are developing an application to manage the traffic flow of a switch using an OpenDaylight controller.Knowing you
use a Northbound which statement is true?

A. The applications are considered to be the clients , and the controller is considered to be the server

B. We must teach our applications about the Southbound protocol(s) used.

C. The server retains client state records

D. Different applications ,even in different languages ,cannot use the same functions in a REST API at the same time.

Correct Answer: A

Question 4

Refer to the exhibit.

Which statement about the exhibit is true?

A. The tunnel configuration is incomplete and the DMVPN session will fail between R1 and R2.

B. A DMVPN session will fail to establish because R2 is missing the ISAKMP peer address.

C. A DMVPN session will establish between R1 and R2 provided that the BGP configuration is correct.

D. A DMVPN session will establish between R1 and R2 provided that the BGP and EIGRP configurations are correct.

E. IPsec phase-2 will fail to negotiate due to a mismatch in parameters.

Correct Answer: D

Question 5

When is the supplicant considered to be clientless?

A. when the authenticator is missing the dot1x guest VLAN under the port with which the supplicant is connected.

B. when the authenticator is missing the reauthentication timeout configuration under the port with which the
supplicant is connected.

C. when the authentication server does not have credentials to authenticate.

D. when the supplicant fails EAP-MD5 challenge with the authentication server.

E. when the supplicant fails to respond to EAPOL messages from the authenticator.

Correct Answer: E

Question 6

Which method of output queuing is supported on the Cisco ASA appliance?

A. WFQ

B. custom queuing

C. MDRR

D. CBWFQ

E. priority queuing

Correct Answer: E

Question 7

Which two statements about ISO 27001 are true?(Choose two)

A. It is an information security management system specification

B. It is closely aligned to ISO 22000 standards

C. It is code of practice for information social management

D. It was formerly known as BS7799-2

E. It is an ISO 17799 code of practice

Correct Answer: A,D

Question 8

Which two commands would enable secure logging on Cisco ASA to a syslog server at 10.0.0.1? (Choose two.)

A. logging host inside 10.0.0.1 UDP/514 secure

B. logging host inside 10.0.0.1 TCP/1470 secure

C. logging host inside 10.0.0.1 TCP/1500 secure

D. logging host inside 10.0.0.1 UDP/500 secure

E. logging host inside 10.0.0.1 UDP/447 secure

Correct Answer: C,D

Question 9

What is the maximum pattern length supported by FPM searches within a packet?

A. 512 bytes

B. 128 bytes

C. 256 bytes

D. 1500 bytes

Correct Answer: C

Question 10

Which authentication mechanism is available to OSPFv3?

A. simple passwords

B. IPsec AH/ESP

C. MD5

D. IKEv2

E. null

Correct Answer: B

Question 11

What ASA feature can you use to restrict a user to a specific VPN group?

A. A VPN filter

B. group-lock

C. MPF

D. A Webtype ACL

Correct Answer: B

Welcome to TestSimulate

Cisco CCIE Security Written Exam v4.0 (350-018) Free Practice Test