Cisco Actualtests Exam Questions & Answers

Transcription

1 Cisco Actualtests Exam Questions & Answers Number: Passing Score: 800 Time Limit: 120 min File Version: Cisco Exam Questions & Answers Exam Name: Security Solutions for Systems Engineers SSSE For Full Set of Questions please visit:

2 Actualtests QUESTION 1 Which two questions should you ask when assessing an organization's security needs? (Choose two.) A. Are you exploring new cloud business models? B. Are you enforcing the same security policies consistently across your organization? C. Are you using the latest hardware and software versions for your security devices? D. Are you using single-vendor security equipment? E. What are the operating hours of your security response team? B : QUESTION 2 Which four features are provided by the Cisco AnyConnect client for Windows? (Choose four.) A. SSL VPN B. IPsec VPN C. Host intrusion prevention system D. Presence E. MACsec encryption F. Antivirus G. Personal firewall H. Cisco ScanSafe integration BEH : QUESTION 3 Which two statements about the capabilities of the Cisco AnyConnect 3.0 Secure Mobility Client for Windows are true? (Choose two.) A. It supports always-on connectivity by automatically establishing a VPN connection as needed. If multiple VPN gateways exist, load sharing occurs in a Round-robin fashion. B. It supports session persistence after hibernation or standby. C. Trusted Network Detection allows the connection to be established without any user intervention (authentication), if the client is located inside the office. D. It is exclusively configured by central policies; no local configuration is possible. E. The order of policy enforcement is as follows: dynamic access policy, user attributes, tunnel group, group policy attributes. Correct Answer: BC

3 : QUESTION 4 Which two components are 802.1X components? (Choose two.) A. Client B. Authenticator C. Authentication server D. User? E. Accounting server Correct Answer: BC : QUESTION 5 Which statement about 802.1X is true? A. MAB allows clients that do not support 802.1X to be authenticated based on their MAC address. B. MDA does not allow multiple clients to be independently authenticated at the same switch port if they are in different domains, or VLANs. C. EAP-TLS requires a client certificate. D. PEAP-MSCHAPv2 requires a client certificate. : QUESTION 6 Which statement about wireless LAN security is true? A. Cisco CleanAir is a technology that allows you to detect the distance of a wireless device from an access point. B. Cisco Aironet 3500 and 3600 Series Access Points do not have an integrated spectrum analyzer that detects interferers. C. Classification occurs at the access point; interference impact and data are then sent to the wireless LAN controller. D. The wireless LAN controller stores data for location, history, and troubleshooting purposes. Correct Answer: C

4 : QUESTION 7 Which statement about wireless intrusion prevention and rogue access point detection is true? A. A local mode access point provides power to wireless clients. B. A monitor mode access point performs background scanning in order to detect rogue access points. C. A monitor mode access point is dedicated to scanning (listen-only). D. A monitor mode access point can distribute a white list of all known access points. E. Any access point that broadcasts the same RF group name or is part of the same mobility group is considered to be a rogue access point. Correct Answer: C : QUESTION 8 Which of these products is the best choice to prevent undesired content from being sent through a guest connection? A. Cisco ISR G2 or Cisco ASA and ScanSafe B. Host IPS via Cisco ISE posture C. IPS D. Personal firewall via ISE posture : QUESTION 9 What are two advantages of IKEv2 and Cisco FlexVPN? (Choose two.) A. IKEv2 is backwards compatible with IKEv1. B. Cisco FlexVPN supports interoperability, dynamic routing, direct spoke-to-spoke communication, remote access, source failover, per-peer QoS, and Full AAA management. C. IKEv2 consolidates several VPN key management features and standards into one new standard. D. The anticlogging cookie feature from IKEv1 has been improved. E. IKEv2 uses IP protocol numbers 50 and 51. Correct Answer: BC :

5 QUESTION 10 A customer wants to use the Cisco ASA for a VPN to interconnect the central site and three branches. Which type of VPN would you recommend? A. IPsec site-to-site VPN B. IPsec remote access VPN C. SSL remote access VPN D. SSL site-to-site VPN : QUESTION 11 Which application is the most critical one regarding malicious content? A. Ping B. traceroute C. SFTP and SSH D. Correct Answer: D : QUESTION 12 Which two attacks target the data link layer in a switched environment? (Choose two.) A. VLAN attacks B. IP source routing C. MAC address floods D. DHCP-based IP redirection attacks E. Spanning-tree attacks Correct Answer: CE : QUESTION 13 Which two configurations are performed on Cisco IOS routers when using Cisco AutoSecure? (Choose two.) A. ICMP is globally disabled. B. Directed broadcasts are globally disabled. C. Source routing is globally disabled. D. Proxy ARP is disabled on all interfaces.

6 Correct Answer: CD : QUESTION 14 Which statement about IPsec and IPv6 is true? A. IPsec is available only with IPv6. B. IPsec support is mandatory in IPv4. C. IPsec support is mandatory in IPv6. D. In order to use IPsec with IPv6, IPv6 must be tunneled over IPv4. Correct Answer: C : QUESTION 15 Which statement about Cisco ASA performance and services is true? A. In Cisco ASA 5500-X product series deployment, a separate IPS and VPN hardware accelerator is required. B. The Cisco ASA 5555-X scales up to 16 Gbps of firewall throughput. C. When using BYOD in conjunction with Cisco ASA AnyConnect, an additional VPN hardware module is required. D. Cisco ASA IPS works in conjunction with Cisco SIO in order to provide botnet protection. Correct Answer: D : QUESTION 16 Which statement best describes Cisco ScanSafe? A. ScanSafe is a centralized software-based web proxy that runs in the customer data center. B. ScanSafe is a cloud-based web security service that provides web filtering and web security. C. ScanSafe is a service that runs on the Cisco ASA CX. D. ScanSafe consists of a server and a client component; the server component is implemented in the data center, and the client component is part of the Cisco AnyConnect client. Correct Answer: B : QUESTION 17

7 Which two statements about the Cisco IronPort Security architecture are true? (Choose two.) A. A key component of the Cisco IronPort Security architecture is the compromised domain list. B. A key component of the Cisco IronPort Security architecture is the HTTP Inspection Engine. C. Inbound security includes spam defense and virus defense. D. Inbound security includes secure messaging via SSH, S-MIME, and POP over TLS. E. Outbound control includes data loss prevention and secure messaging. Correct Answer: CE : QUESTION 18 Which statement about EoMPLS and VPLS is true? A. EoMPLS is based on the Pseudowire Reference Model. B. EoMPLS does not provide point-to-point connections. C. VPLS emulates a point-to-multipoint IPsec VPN over MPLS. D. VPLS supports only partially meshed and hub-and-spoke topologies. : QUESTION 19 Which two virtual networking services are provided by a Cisco Nexus 1000V? (Choose two.) A. Cisco Virtual Security Gateway B. Cisco ASA 1000V C. Cisco Virtual ScanSafe D. Cisco Virtual IPS B : QUESTION 20 Which statement is true when comparing Cisco ASA and Cisco ASA CX? A. Cisco ASA fits better to the core and data center. B. Cisco ASA provides better application control. C. Cisco ASA does not support multitenant deployments. D. Cisco ASA CX provides better AAA support.

8 : QUESTION 21 Which one of these is a Cisco Nexus 1010 virtual blade? A. VSM B. MAN C. VSE D. ASA 7000 : QUESTION 22 Which three are features of an intrusion prevention system? (Choose three.) A. Attack obfuscation B. Detection of behavioral anomalies C. Detection of protocol anomalies D. Flexible content filtering E. Forensic capturing F. VPN termination Correct Answer: BCE : QUESTION 23 Which one is an additional feature of Cisco IPS Manager Express as compared to Cisco IPS Device Manager? A. Support for a single IPS device B. Intuitive user interface C. More powerful event management D. Health and performance tools Correct Answer: C : QUESTION 24 Which statement about Cisco Prime is true?

9 A. It provides simple and efficient management across architectures, networks, and services. B. It provides simple and efficient management of security services. C. It provides management services for all TrustSec products. D. It is an expert-level monitoring and troubleshooting tool based on Cisco SIO. : QUESTION 25 Which statement about the OfficeExtend Access Point solution is true? A. It does not allow the end user to securely connect to the corporate network via a corporate WLAN SSID. B. The router that connects the access point to the Internet establishes an Easy VPN tunnel to the corporate network. C. The local access point establishes a DTLS tunnel to the OfficeExtend Access Point controller that is located at the corporate network?. D. It does not allow the end user to provision a private, locally usable WLAN SSID for Internet access. Correct Answer: C : QUESTION 26 The Cisco SecureX Architecture is built on which three foundational principles? (Choose three.) A. Context-aware policy B. Virtual office management C. Network management D. Content access control E. Context-aware security enforcement F. Network and global intelligence EF :

10 QUESTION 27 Which two features are available with Cisco Secure ACS? (Choose two.) A. Authorization based on identity and time B. Guest access services, including user account delivery via print, , or SMS C. Authorization based on identity and access type D. Accounting E. MAC-based authorization C