350-018 Exam Training Practice Tests (Cisco CCIE Security Written Exam v4.0)]

Question 1

Refer to the exhibit.
Which statement about this debug output is true?

A. It was generated by an access point when it send a join reply message to a LAN controller B. It was generated by an access point when it received a join request message from a LAN controller C. It was generated by a LAN controller when it responded to a join request from an access point D. It was generated by a LAN controller when it generated a join request to an access point

Correct Answer: C

Question 2

When configuring a switchport for port security that will support multiple devices and that has already been
configured for 802.1X support, which two commands need to be added? (Choose two.)

A. The 802.1X port configuration must be extended with the command dot1x port-security. B. The switchport configuration needs to include the command switchport port-security. C. The 802.1X port configuration needs to remain in port-control force-authorized rather than port-control auto. D. The switchport configuration needs to include the port-security aging command. E. The 802.1X port configuration must be extended with the command dot1x multiple-host.

Correct Answer: B,E

Question 3

Which two statements about dynamic ARP inspection are true? (Choose two.)

A. Dynamic ARP inspection checks invalid ARP packets against the trusted database. B. The trusted database to check for an invalid ARP packet is manually configured. C. Dynamic ARP inspection does not perform ingress security checking. D. Dynamic ARP inspection checks ARP packets on both trusted and untrusted ports. E. DHCP snooping must be enabled. F. Dynamic ARP inspection is only supported on access and trunk ports.

Correct Answer: A,E

Question 4

Refer to the exhibit.

What is the reason for the failure of the DMVPN session between R1 and R2?

A. IPsec phase-1 policy mismatch B. incorrect tunnel source interface on R1 C. IPsec phase-1 configuration missing peer address on R2 D. tunnel mode mismatch E. IPsec phase-2 policy mismatch

Correct Answer: A

Question 5

With the Cisco FlexVPN solution, which four VPN deployments are supported? (Choose four.)

A. IPsec group encryption using GDOI? B. site-to-site IPsec tunnels? C. hub-and-spoke IPsec tunnels? D. remote access from software or hardware IPsec clients? E. distributed full mesh IPsec tunnels? F. dynamic spoke-to-spoke IPSec tunnels? (partial mesh)

Correct Answer: B,C,D,F

Question 6

Which protocol is an extension to SSH 2.0 that provides security for data traffic?

A. Kerberos B. TKIP C. SFTP D. AES

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

When the RSA algorithm is used for signing a message from Alice to Bob, which statement best describes that
operation?

A. Alice signs the message with her private key, and Bob verifies that signature with his public key. B. Alice signs the message with Bob's private key, and Bob verifies that signature with his public key. C. Alice signs the message with her public key, and Bob verifies that signature with his private key. D. Alice signs the message with her public key, and Bob verifies that signature with Alice's private key. E. Alice signs the message with her private key, and Bob verifies that signature with Alice's public key. F. Alice signs the message with Bob's public key, and Bob verifies that signature with his private key.

Correct Answer: E

Question 8

Which three statements about OCSP are correct? (Choose three.)

A. OCSP uses only http as a transport. B. OCSP responders can use RSA and DSA signatures to validate that responses are from trusted entities. C. OCSP is an updated version SCEP. D. OCSP is defined in RFC2560. E. A response indicator may be good, revoked, or unknown.

Correct Answer: B,D,E

Question 9

Which three types of traffic are generally policed via CoPP policies? (Choose three.)

A. Routing protocol traffic B. Transit traffic C. Traffic from a management protocol such as Telnet or SNMP D. Traffic that is destined to any of the device's interfaces. E. IPsec traffic

Correct Answer: A,C,D

Question 10

Which three statements about triple DES are true? (Choose three.)

A. A 3DES key bundle is 192 bits long. B. A 3DES keyspace is168 bits. C. CBC, 64-bit CFB, OFB, and CTR are modes of 3DES. D. For 3DES, ANSI X9.52 describes three options for the selection of the keys in a bundle, where all keys are
independent. E. 3DES involves encrypting a 64-bit block of plaintext with the 3 keys of the key bundle.

Correct Answer: A,B,C

Cisco CCIE Security Written Exam v4.0 - 350-018 Exam Practice Test