[Full-Version!]Braindump2go 400-251 (CCIE Security) Exam Dump PDF Free Instant Download[Question16-Question25]

2017 CISCO Official News: 350-018 Exam is Replaced by 400-251 Written Exam Now!

2017 New 400-251: CCIE Security Written Exam v5.1 PDF and VCE Dumps Just Released Today by Braindump2go.com!

1.|2017 NEW 400-251 Written Exam Dumps (PDF & VCE) 1106Q&As  Download:
http://www.braindump2go.com/400-251.html

2.|2017 NEW 400-251 Written Exam Questions & Answers:
http://www.braindump2go.com/400-251.html

QUESTION 16
Which three statements about the keying methods used by MAC Sec are true (Choose Three)

A.    MKA is implemented as an EAPoL packet exchange
B.    SAP is enabled by default for Cisco TrustSec in manual configuration mode.
C.    SAP is supported on SPAN destination ports
D.    Key management for host-to-switch and switch-to-switch MACSec sessions is provided by MKA
E.    SAP is not supported on switch SVIs .
F.    A valid mode for SAP is NULL

Answer: ABF

QUESTION 17
Which two statements about Cisco ASA authentication using LDAP are true? (Choose two)

A.    It uses attribute maps to map the AD memberOf attribute to the cisco ASA Group-Poilcy attribute
B.    It uses AD attribute maps to assign users to group policies configured under the WebVPN context
C.    The Cisco ASA can use more than one AD memberOf attribute to match a user to multiple group policies
D.    It can assign a group policy to a user based on access credentials
E.    It can combine AD attributes and LDP attributes to configure group policies on the Cisco ASA
F.    It is a closed standard that manages directory-information services over distributed networks

Answer: AB

QUESTION 18
Drag and Drop Question
Drag each IPS signature engine on the left to its description on the right.
 
Answer:
 

QUESTION 19
With this configuration you notice that the IKE and IPsec SAs come up between the spoke and the hub, but NHRP registration fails Registration will continue to fail until you do which of these?
 

A.    Modify the NHRP network IDs to match on the hub and spoke.
B.    configure the ip nhrp caches non-authoritative command on the hub's tunnel interface.
C.    modify the tunnel keys to match on the hub and spoke.
D.    modify the NHRP hold time to match on the hub and spoke.

Answer: C

QUESTION 20
Which three statements are true regarding Security Group Tags? (Choose three.)

A.    When using the Cisco ISE solution, the Security Group Tag gets defined as a separate authorization result.
B.    When using the Cisco ISE solution, the Security Group Tag gets defined as part of a standard authorization profile.
C.    Security Group Tags are a supported network authorization result using Cisco ACS 5.x.
D.    Security Group Tags are a supported network authorization result for 802.1X, MAC Authentication Bypass, and WebAuth methods of authentication.
E.    A Security Group Tag is a variable length string that is returned as an authorization result.

Answer: ACD

QUESTION 21
Refer to the exhibit which two statement about the given IPV6 ZBF configuration are true? (Choose two)
 

A.    It provides backward compability with legacy IPv6 inspection
B.    It inspect TCP, UDP,ICMP and FTP traffic from Z1 to Z2.
C.    It inspect TCP, UDP,ICMP and FTP traffic from Z2 to Z1.
D.    It inspect TCP,UDP,ICMP and FTP traffic in both direction between z1 and z2.
E.    It passes TCP, UDP,ICMP and FTP traffic from z1 to z2.
F.    It provide backward compatibility with legacy IPv4 inseption.

Answer: AB

QUESTION 22
In which class of applications security threads does HTTP header manipulation reside?

A.    Session management
B.    Parameter manipulation
C.    Software tampering
D.    Exception managements

Answer: A

QUESTION 23
What is the most commonly used technology to establish an encrypted HTTP connection?

A.    the HTTP/1.1 Upgrade header
B.    the HTTP/1.0 Upgrade header
C.    Secure Hypertext Transfer Protocol
D.    HTTPS

Answer: D

QUESTION 24
What functionality is provided by DNSSEC?

A.    origin authentication of DNS data
B.    data confidentiality of DNS queries and answers
C.    access restriction of DNS zone transfers
D.    storage of the certificate records in a DNS zone file

Answer: A

QUESTION 25
What are the two mechanism that are used to authenticate OSPFv3 packets?(Choose two)

A.    MD5
B.    ESP
C.    PLAIN TEXT
D.    AH
E.    SHA

Answer: BD

1.|2017 NEW 400-251 Exam Dumps (PDF & VCE) 1106Q&As  Download:
http://www.braindump2go.com/400-251.html

2.|2017 NEW 400-251 Study Guide Video:

1. http://www.youtube.com/watch?v=GSXnXKIh834
2. http://www.youtube.com/watch?v=GSXnXKIh834