Introducing The New!
Surepassexam Collection
Get Unlimited Access to all
Surepassexam's PREMIUM files
Q1. All 30 users on a single floor of a building are complaining about network slowness. After investigating the access switch, the network administrator notices that the MAC address table is full (10,000 entries) and all traffic is being flooded out of every port. Which action can the administrator take to prevent this from occurring?
A. Configure port-security to limit the number of mac-addresses allowed on each port
B. Upgrade the switch to one that can handle 20,000 entries
C. Configure private-vlans to prevent hosts from communicating with one another
D. Enable storm-control to limit the traffic rate
E. Configure a VACL to block all IP traffic except traffic to and from that subnet
Answer: A
Q2. A network administrator is creating an ASA-CX administrative user account with the following parameters:
The user will be responsible for configuring security policies on network devices.
The user needs read-write access to policies.
The account has no more rights than necessary for the job.
What role will the administrator assign to the user?
A. Administrator
B. Security administrator
C. System administrator
D. Root Administrator
E. Exec administrator
Answer: B
Q3. You have installed a web server on a private network. Which type of NAT must you implement to enable access to the web server for public Internet users?
A. static NAT
B. dynamic NAT
C. network object NAT
D. twice NAT
Answer: A
Q4. When configured in accordance to Cisco best practices, the ip verify source command can mitigate which two types of Layer 2 attacks? (Choose two.)
A. rogue DHCP servers
B. ARP attacks
C. DHCP starvation
D. MAC spoofing
E. CAM attacks
F. IP spoofing
Answer: D,F
Q5. Which statement about the Cisco Security Manager 4.4 NAT Rediscovery feature is true?
A. It provides NAT policies to existing clients that connect from a new switch port.
B. It can update shared policies even when the NAT server is offline.
C. It enables NAT policy discovery as it updates shared polices.
D. It enables NAT policy rediscovery while leaving existing shared polices unchanged.
Answer: D
Q6. What is the default behavior of an access list on a Cisco ASA?
A. It will permit or deny traffic based on the access list criteria.
B. It will permit or deny all traffic on a specified interface.
C. It will have no affect until applied to an interface, tunnel-group or other traffic flow.
D. It will allow all traffic.
Answer: C
Q7. What is the result of the default ip ssh server authenticate user command?
A. It enables the public key, keyboard, and password authentication methods. B. It enables the public key authentication method only.
C. It enables the keyboard authentication method only.
D. It enables the password authentication method only.
Answer: A
Q8. Which VTP mode supports private VLANs on a switch?
A. transparent
B. server
C. client
D. off
Answer: A
Q9. When it is configured in accordance to Cisco best practices, the switchport port-security maximum command can mitigate which two types of Layer 2 attacks? (Choose two.)
A. rogue DHCP servers
B. ARP attacks
C. DHCP starvation
D. MAC spoofing
E. CAM attacks
F. IP spoofing
Answer: C,E
Q10. When a Cisoc ASA CX module is managed by Cisco prime Security Manager in Multiple Device Mode , which mode does the firewall use?
A. Multi mode
B. Unmanaged mode
C. Single mode
D. Managed mode
Answer: D
Explanation: http://www.cisco.com/c/en/us/td/docs/security/asacx/9-1/user/guide/b_User_Guide_for_ASA_CX_and_PRSM_9_1b_User_Guide_for_ASA_CX_a nd_PR SM_9_1_chapter_011 0.html#task_7E648F43AD724DA2983699B12E92A528
Q11. Which statement about traffic storm control behavior is true?
A. Traffic storm control cannot determine if the packet is unicast or broadcast.
B. If you enable broadcast and multicast traffic storm control and the combined broadcast and multicast traffic exceeds the level within a 1 second traffic storm interval, storm control drops all broadcast and multicast traffic until the end of the storm interval
C. Traffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.
D. Traffic storm control monitors incoming traffic levels over a 10 second traffic storm control interval
Answer: B
Q12. Which three statements about the software requirements for a firewall failover configuration are true? (Choose three.)
A. The firewalls must be in the same operating mode.
B. The firewalls must have the same major and minor software version.
C. The firewalls must be in the same context mode.
D. The firewalls must have the same major software version but can have different minor versions.
E. The firewalls can be in different context modes.
F. The firewalls can have different Cisco AnyConnect images.
Answer: A,B,C
Q13. CORRECT TEXT
You are the network security engineer for the Secure-X network. The company has recently detected Increase of traffic to malware Infected destinations. The Chief Security Officer deduced that some PCs in the internal networks are infected with malware and communicate with malware infected destinations.
The CSO has tasked you with enable Botnet traffic filter on the Cisco ASA to detect and deny further connection attempts from infected PCs to malware destinations. You are also required to test your configurations by initiating connections through the Cisco ASA and then display and observe the Real-Time Log Viewer in ASDM.
To successfully complete this activity, you must perform the following tasks:
* Download the dynamic database and enable use of it.
. Enable the ASA to download of the dynamic database
. Enable the ASA to download of the dynamic database.
. Enable DNS snooping for existing DNS inspection service policy rules..
. Enable Botnet Traffic Filter classification on the outside interface for All Traffic.
. Configure the Botnet Traffic Filter to drop blacklisted traffic on the outside interface. Use the default Threat Level settings
NOTE: The database files are stored in running memory; they are not stored in flash memory.
NOTE: DNS is enabled on the inside interface and set to the HQ-SRV (10.10.3.20).
NOTE: Not all ASDM screens are active for this exercise.
. Verify that the ASA indeed drops traffic to blacklisted destinations by doing the following:
. From the Employee PC, navigate to http://www.google.com to make sure that access to the Internet is working.
. From the Employee PC, navigate to http://bot-sparta.no-ip.org. This destination is classified as malware destination by the Cisco SIO database.
. From the Employee PC, navigate to http://superzarabotok-gid.ru/. This destination is classified as malware destination by the Cisco SIO database.
. From Admin PC, launch ASDM to display and observe the Real-Time Log Viewer.
You have completed this exercise when you have configured and successfully tested Botnet traffic filter on the Cisco ASA.
Answer: See the explanation for detailed answer to this sim question.
Q14. Refer to the exhibit. Which command can produce this packet tracer output on a firewall?
A. packet-tracer input INSIDE tcp 192.168.1.100 88 192.168.2.200 3028
B. packet-tracer output INSIDE tcp 192.168.1.100 88 192.168.2.200 3028
C. packet-tracer input INSIDE tcp 192.168.2.200 3028 192.168.1.100 88
D. packet-tracer output INSIDE tcp 192.168.2.200 3028 192.168.1.100 88
Answer: A
Q15. A network printer has a DHCP server service that cannot be disabled. How can a layer 2 switch be configured to prevent the printer from causing network issues?
A. Remove the ip helper-address
B. Configure a Port-ACL to block outbound TCP port 68
C. Configure DHCP snooping
D. Configure port-security
Answer: C