Cisco CCIE Security Written Exam (v5.0) - 400-251 Exam Practice Test

A. URL Filtering

B. Identity and Access Management

C. TLS Decryption

D. Net Flow Analytics

E. IPS

F. Advanced Malware Protection

G. Security Intelligence

A. It tunnels Ethernet frames inside an IP packet over a virtual network

B. In an NVGRE network, VSID s is used to identify Layer 3 network address space

C. In a NVGRE network, the endpoints are not responsible for the NVGRE encapsulation removal

D. It allows physical Layer2 topologies to be created on a virtual Layer 3 network

E. It allows physical Layer 2 topologies to be created on a physical Layer 3 network

F. It tunnels PPP frames inside an IP packet over a physical network

G. In an NVGRE network, VSID must be unique

A. The Windows machine belongs to an incorrect group in the AMP cloud policy

B. The Windows machine is not reporting scan events to the AMP cloud.

C. The Windows machine is not reporting events to the FMC

D. The incorrect group is selected for the events export in the AMP cloud for the FMC.

E. The AMP cloud was not added in the FMC.

F. The FMC was not added in the AMP cloud.

G. The Event must be viewed as a Connection event in the FMC.

A. Enable change of authorization on MDM

B. Enable Period compliance checking on ISE

C. The MDM agent automatically disconnects the device from the network when it is noncompliant

D. Enable Change of authorization on ISE

E. Fire-AMP connector scan can be used to relay posture information to ISE via FireAMP cloud

F. The MDM agent periodically sends a packet with compliance info that the wireless controller can be used to limit network access

A. It provides network layer encryption on a wired network

B. The Switch uses session keys to calculate encrypted packet ICV value for the frame integrity check

C. It secures connection between two supplicant clients

D. It is implemented after a successful MAB authentication of supplicant

E. The ISAKMP protocol is used to manage MACSec encryption keys

F. A Switch configured for MACSec can accept MACSec frames from the MACSec client

A. Add an authorization policy before the Windows authorization policy that redirects a user with a static IP to a web portal for authentication.

B. Modify the authorization policy to allow only Windows machines that have passed machine authentication to get full network access.

C. Chain an authorization policy to the Windows authorization policy that performs additional NMAP scans to verify the machine type before access is allowed.

D. Perform CoA to push a restricted access when the machine is acquiring address using DHCP.

E. Allow only certificate - based authentication from Windows endpoints, such as EAP-TLS or PEAP-TLS. If the endpoint uses MSCHAPv2 (EAP or PEAP), the user is given only restricted access.

F. Create an authentication rule that allows only a session with a specific HTTP user-agent header.

A. Chef

B. Puppet

C. Jenkins

D. Ansible

E. Salt

A. MAB should be used for port authentication and authorization

B. User is not Authorized

C. Issue with assigned SGT to the sessions

D. User is not authenticated

E. Issue with assigned VLAN to the session

F. Issue with the DACL pushed for the session