This page was exported from Lead2pass New Updated Exam Questions [ https://www.getfreevce.com ]

Export date:Sun Dec 22 3:34:19 2024 / +0000 GMT

___________________________________________________


Title: [2017 New] Free Download Lead2pass Cisco 400-251 VCE And PDF Dumps (251-275)

---------------------------------------------------


2017 August Cisco Official New Released 400-251 Dumps in Lead2pass.com!  100% Free Download! 100% Pass Guaranteed!  This dump is valid to pass Cisco 400-251 exam and don't just memorize the answer, you need to get through understanding of it because the question changed a little in the real exam. The material is to supplement your studies. Following questions and answers are all new published by Cisco Official Exam Center: https://www.lead2pass.com/400-251.html  QUESTION 251Which three Cisco attributes for LDAP authorization are supported on the ASA? (Choose three) A.&nbsp;&nbsp;&nbsp; L2TP-EncryptionB.&nbsp;&nbsp;&nbsp; Web-VPN-ACL-FiltersC.&nbsp;&nbsp;&nbsp; IPsec-Client-Firewall-Filter-NameD.&nbsp;&nbsp;&nbsp; Authenticated-User-Idle-TimeoutE.&nbsp;&nbsp;&nbsp; IPsec-Default-DomainF.&nbsp;&nbsp;&nbsp; Authorization-TypeAnswer: BDEExplanation:Something wrong with the question. All 6 options given are all supported by Cisco ASA. Check out this document for all attributes supported, they are all in the table 1-2http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ref_extserver.pdf QUESTION 252Which two options are system requirements for single sign-on on Cisco Unified Communications Manager? (Choose two) A.&nbsp;&nbsp;&nbsp; OpenAM must be deployed in a different domain Microsoft Active Directory.B.&nbsp;&nbsp;&nbsp; All participating entities must have their clocks synchronized.C.&nbsp;&nbsp;&nbsp; The local user profile on Cisco Unified Communications must be disabled.D.&nbsp;&nbsp;&nbsp; IWA and Kerberos authentication must be configured in the Windows domain.E.&nbsp;&nbsp;&nbsp; Microsoft Active Directory must be deployed in a domain-based configuration. Answer: BE QUESTION 253Which of the following statement is true about the ARP attack? A.&nbsp;&nbsp;&nbsp; Attackers sends the ARP request with the MAC address and IP address of a legitimate resource in the network.B.&nbsp;&nbsp;&nbsp; Attackers sends the ARP request with the MAC address and IP address of its own.C.&nbsp;&nbsp;&nbsp; ARP spoofing does not facilitate man-in-the middle attack of the attackers.D.&nbsp;&nbsp;&nbsp; Attackers sends the ARP request with its own MAC address and IP address of a legitimate resource in the network. Answer: D QUESTION 254During a DoS attacks all of the data is lost from a user's laptop and the user must now rebuild the system.Which tool can the user use to extract the outlook PST file from the Microsoft server database?  A.&nbsp;&nbsp;&nbsp; Eseutil. exeB.&nbsp;&nbsp;&nbsp; NTabackup.cexC.&nbsp;&nbsp;&nbsp; Exmerge.exeD.&nbsp;&nbsp;&nbsp; Ost2st.exe Answer: C QUESTION 255A Cisco Easy VPN software client is unable to access its local LAN devices once the VPN tunnel is established. What is the best way to solve this issue?  A.&nbsp;&nbsp;&nbsp; The IP address that is assigned by the Cisco Easy VPN Server to the client must be on the same network as the local LAN of the client.B.&nbsp;&nbsp;&nbsp; The Cisco Easy VPN Server should apply split-tunnel-policy excludespecified with a split-tunnel-list containing the local LAN addresses that are relevant to the client.C.&nbsp;&nbsp;&nbsp; The Cisco Easy VPN Server must push down an interface ACL that permits the traffic to the local LAN from the client.D.&nbsp;&nbsp;&nbsp; The Cisco Easy VPN Server should apply a split-tunnel-policy tunnelall policy to the client.E.&nbsp;&nbsp;&nbsp; The Cisco Easy VPN client machine needs to have multiple NICs to support this. Answer: B QUESTION 256Which two statements about IKEv2 are true? (Choose two) A.&nbsp;&nbsp;&nbsp; It uses EAP authenticationB.&nbsp;&nbsp;&nbsp; It uses X.509 certificates for authenticationC.&nbsp;&nbsp;&nbsp; The profile is a collection of transforms used to negotiate IKE SAsD.&nbsp;&nbsp;&nbsp; It supports DPD and Nat-T by defaultE.&nbsp;&nbsp;&nbsp; The profile contains a repository of symmetric and asymmetric preshared keysF.&nbsp;&nbsp;&nbsp; At minimum, a complete proposal requires one encryption algorithm and one integrity algorithm Answer: AD QUESTION 257Which two OSPF network types support the concept of a designated router? (Choose two.) A.&nbsp;&nbsp;&nbsp; broadcastB.&nbsp;&nbsp;&nbsp; NBMAC.&nbsp;&nbsp;&nbsp; point-to-multipointD.&nbsp;&nbsp;&nbsp; point-to-multipoint nonbroadcastE.&nbsp;&nbsp;&nbsp; loopback Answer: AB QUESTION 258Given the IPv4 address 10.10.100.16, which two address are valid IPv4-compatible IPv6 addresses? (Choose twoChoose two) A.&nbsp;&nbsp;&nbsp; 0:0:0:0:0:10:10:100:16B.&nbsp;&nbsp;&nbsp; 0:0:10:10:10:16:0:0:0C.&nbsp;&nbsp;&nbsp; 0:0:10:10:100:16:0:0:0D.&nbsp;&nbsp;&nbsp; ::10:10:100:16E.&nbsp;&nbsp;&nbsp; :::A:A:64:10 Answer: AD QUESTION 259What technology can you implement on your network to allow IPv4-dependent applications to work with IPv6- capable application? A.&nbsp;&nbsp;&nbsp; NAT 6to4B.&nbsp;&nbsp;&nbsp; DS-liteC.&nbsp;&nbsp;&nbsp; NAT-PTD.&nbsp;&nbsp;&nbsp; ISATAPE.&nbsp;&nbsp;&nbsp; NAT64 Answer: E QUESTION 260Which three fields are part of the AH header? (Choose three) A.&nbsp;&nbsp;&nbsp; Destination addressB.&nbsp;&nbsp;&nbsp; Protocol IDC.&nbsp;&nbsp;&nbsp; Packet ICVD.&nbsp;&nbsp;&nbsp; SPI identifying SAE.&nbsp;&nbsp;&nbsp; Next headerF.&nbsp;&nbsp;&nbsp; Application portG.&nbsp;&nbsp;&nbsp; Source address Answer: CDE QUESTION 261What ASA feature can do use to restrict a user to a specific VPN group? A.&nbsp;&nbsp;&nbsp; A webtypeACLB.&nbsp;&nbsp;&nbsp; MPFC.&nbsp;&nbsp;&nbsp; A VPN filterD.&nbsp;&nbsp;&nbsp; Group-lock Answer: D QUESTION 262Which two statements about SGT Exchange Protocol are true? (Choose two) A.&nbsp;&nbsp;&nbsp; It propagates the IP-to-SGT binding table across network devices that do not have the ability to perform SGT tagging at Layer 2 to devices that support itB.&nbsp;&nbsp;&nbsp; SXP runs on UDP port 64999C.&nbsp;&nbsp;&nbsp; A connection is established between a "listener" and a "speaker"D.&nbsp;&nbsp;&nbsp; SXP is only supported across two hopsE.&nbsp;&nbsp;&nbsp; SXPv2 introduces connection security via TLS Answer: AC QUESTION 263Which three statements are true regarding RFC 5176 (Change of Authorization)? (Choose three.) A.&nbsp;&nbsp;&nbsp; It defines a mechanism to allow a RADIUS server to initiate a communication inbound to a NAD.B.&nbsp;&nbsp;&nbsp; It defines a wide variety of authorization actions, including "reauthenticate."C.&nbsp;&nbsp;&nbsp; It defines the format for a Change of Authorization packet.D.&nbsp;&nbsp;&nbsp; It defines a DM.E.&nbsp;&nbsp;&nbsp; It specifies that TCP port 3799 be used for transport of Change of Authorization packets. Answer: ACD QUESTION 264How does a wireless association flood attack create a DoS? A.&nbsp;&nbsp;&nbsp; It sends a high-power RF pulse that can damage the internals of the APB.&nbsp;&nbsp;&nbsp; It spoofs disassociation frames from the access point.C.&nbsp;&nbsp;&nbsp; It uses a brute force attack to crack the encryption.D.&nbsp;&nbsp;&nbsp; It exhausts the access client association table. Answer: DExplanation:This question is very confusing because it doesn't state if it is DoS against access point or the client. If DoS is run against the AP then the right answer is D. Check the section “Denial of Service attacks against access points”http://www.cisco.com/c/en/us/td/docs/wireless/mse/3350/7-2/wIPS_Configuration/Guide/wIPS_72/msecg_appA_wIPS.htmlIf the attack targets wireless clients then the correct answer is B. Check the section “Denial of service attacks against client station” in the same document QUESTION 265Refer to the exhibit, you have configured two route-map instances on R1 which passes traffic from switch 1 on both VLAN 1 and VLAN 2.You wish to ensure that the first route-map instance matches packets from VLAN 1 and sets next hop to 3232::2/128. The second route-map instance matches packets from VLAN 2 and sets the next hop to 3232::3/128.What feature can you implement on R1 to make this configuration possible? &nbsp; A.&nbsp;&nbsp;&nbsp; PBRB.&nbsp;&nbsp;&nbsp; BGP local-preferenceC.&nbsp;&nbsp;&nbsp; BGP next-hopD.&nbsp;&nbsp;&nbsp; VSSPE.&nbsp;&nbsp;&nbsp; GLBP Answer: AExplanation:http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/configuration/xe-3s/iri-xe-3s-book/ip6-pbr-xe.html QUESTION 266What are two feature that can be used to drop incoming traffic with spoofed bogon address? (Choose two) A.&nbsp;&nbsp;&nbsp; Unicast RPFB.&nbsp;&nbsp;&nbsp; ingress ACLsC.&nbsp;&nbsp;&nbsp; flexible ACLsD.&nbsp;&nbsp;&nbsp; egress ACLsE.&nbsp;&nbsp;&nbsp; reflexive ACLsF.&nbsp;&nbsp;&nbsp; Source Specific Multicast Answer: AB QUESTION 267Refer to the exhibit, what is the effect of the given command sequence?  &nbsp; A.&nbsp;&nbsp;&nbsp; The router telnet to the on port 2002B.&nbsp;&nbsp;&nbsp; The AP console port is shut down.C.&nbsp;&nbsp;&nbsp; A session is opened between the router console and the AP.D.&nbsp;&nbsp;&nbsp; The router telnet to the router on port 2002. Answer: C QUESTION 268Which two statements about IPsec in a NAT-enabled environment are true? (Choose two) A.&nbsp;&nbsp;&nbsp; The hashes of each peer's IP address and port number are compared to determine whether NAT-T is requiredB.&nbsp;&nbsp;&nbsp; NAT-T is not supported when IPsec Phase 1 is set to Aggressive ModeC.&nbsp;&nbsp;&nbsp; The first two messages of IPsec Phase 2 are used to determine whether the remote host supports NAT-TD.&nbsp;&nbsp;&nbsp; NAT-T is not supported when IPsec Phase 1 is set to Main ModeE.&nbsp;&nbsp;&nbsp; IPsec packets are encapsulated in UDP 500 or UDP 10000 packetsF.&nbsp;&nbsp;&nbsp; To prevent translations from expiring, NAT keepalive messages that include a payload are sent between the peers Answer: AFExplanation:http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_dplane/configuration/15-1mt/sec-ipsec-nat-transp.html#GUID-54C3D921-581F-48B8-9641-5942C19DEA1F QUESTION 269Which statement about the Cisco Secure ACS Solution Engine TACACS+ AV pair is true? A.&nbsp;&nbsp;&nbsp; AV pairs are only required to be enabled on Cisco Secure ACS for successful implementation.B.&nbsp;&nbsp;&nbsp; The Cisco Secure ACS Solution Engine does not support accounting AV pairs.C.&nbsp;&nbsp;&nbsp; AV pairs are only string values.D.&nbsp;&nbsp;&nbsp; AV pairs are of two types: string and integer. Answer: C QUESTION 270Which statement about Sarbanes-Oxley (SOX) is true?  A.&nbsp;&nbsp;&nbsp; SOX is an IEFT compliance procedure for computer systems security.B.&nbsp;&nbsp;&nbsp; SOX is a US law.C.&nbsp;&nbsp;&nbsp; SOX is an IEEE compliance procedure for IT management to produce audit reports.D.&nbsp;&nbsp;&nbsp; SOX is a private organization that provides best practices for financial institution computer systems.E.&nbsp;&nbsp;&nbsp; Section 404 of SOX is only related to IT compliance. Answer: BE QUESTION 271Which Cisco ASA firewall mode supports ASDM one-time-password authentication using RSA SecurID? A.&nbsp;&nbsp;&nbsp; Network translation modeB.&nbsp;&nbsp;&nbsp; Single-context routed modeC.&nbsp;&nbsp;&nbsp; Multiple-context modeD.&nbsp;&nbsp;&nbsp; Transparent mode Answer: B QUESTION 272What protocol is responsible for issuing certificates? A.&nbsp;&nbsp;&nbsp; SCEPB.&nbsp;&nbsp;&nbsp; DTLSC.&nbsp;&nbsp;&nbsp; ESPD.&nbsp;&nbsp;&nbsp; AHE.&nbsp;&nbsp;&nbsp; GET Answer: A QUESTION 273Which category to protocol mapping for NBAR is correct? A.&nbsp;&nbsp;&nbsp; Category: internetProtocol: FTP, HTTP, TFTPB.&nbsp;&nbsp;&nbsp; Category: Network managementProtocol: ICMP, SNMP, SSH, telentC.&nbsp;&nbsp;&nbsp; Category: network mail servicesProtocol: mapi, pop3, smtpD.&nbsp;&nbsp;&nbsp; Category: Enterprise applicationsProtocal: citrixICA, PCAnywhere, SAP, IMAP Answer: A QUESTION 274You have discovered unwanted device with MAC address 001c.0f12.badd on port FastEthernet1/1 on VLAN 4.What command or command sequence can you enter on the switch to prevent the MAC address from passing traffic on VLAN 4? A.&nbsp;&nbsp;&nbsp;&nbsp; B.&nbsp;&nbsp;&nbsp;&nbsp; C.&nbsp;&nbsp;&nbsp;&nbsp; D.&nbsp;&nbsp;&nbsp;&nbsp; E.&nbsp;&nbsp;&nbsp;&nbsp;  Answer: EExplanation:In order for VLAN access-map to drop a specific MAC address it has to use access-list with permit entry.http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3550-series-switches/64844-mac-acl-block-arp.html QUESTION 275Which two options are benefits the Cisco ASA Identity Firewall?(Choose two) A.&nbsp;&nbsp;&nbsp; It supports an AD server module to verify identity data.B.&nbsp;&nbsp;&nbsp; It can operate completely independently of other servers.C.&nbsp;&nbsp;&nbsp; It decouples security policies from the network topology.D.&nbsp;&nbsp;&nbsp; It can apply security policies on an individual user or user-group basisE.&nbsp;&nbsp;&nbsp; It can identify threats quickly based on their URLs. Answer: CD About 90% questions are from this 400-251 dump. One thing you need to pay attention is the questions are rephrased in the real 400-251 exam. And btw selections are jumbled so you must remember the answer itself not the letter of choice. 400-251 new questions on Google Drive: https://drive.google.com/open?id=0B3Syig5i8gpDMERESjlYcVlZNWs  2017 Cisco 400-251 exam dumps (All 470 Q&amp;As) from Lead2pass:  https://www.lead2pass.com/400-251.html [100% Exam Pass Guaranteed]

---------------------------------------------------


Images: 

---------------------------------------------------




---------------------------------------------------


Post date: 2017-08-10 04:03:36

Post date GMT: 2017-08-10 04:03:36

Post modified date: 2017-08-10 04:03:36

Post modified date GMT: 2017-08-10 04:03:36



____________________________________________________________________________________________


Export of Post and Page as text file has been powered by [ Universal Post Manager ] plugin from www.gconverters.com