[Free] Download New Updated (October 2016) Cisco 350-018 Real Exam 211-220

Ensurepass

QUESTION 211

Which four configuration steps are required to implement a zone-based policy firewall configuration on a Cisco IOS router? (Choose four.)

 

A.

Create the security zones and security zone pairs.

B.

Create the self zone.

C.

Create the default global inspection policy.

D.

Create the type inspect class maps and policy maps.

E.

Assign a security level to each security zone.

F.

Assign each router interface to a security zone.

G.

Apply a type inspect policy map to each zone pair.

 

Correct Answer: ADFG

 

 

QUESTION 212

Which Cisco IPS appliance signature engine defines events that occur in a related manner, within a sliding time interval, as components of a combined signature?

 

A.

Service engine

B.

Sweep engine

C.

Multistring engine

D.

Meta engine

 

Correct Answer: D

 

 

QUESTION 213

Which three options are the types of zones that are defined for anomaly detection on the Cisco IPS Sensor? (Choose three.)

 

A.

inside

B.

outside

C.

internal

D.

external

E.

illegal

F.

baseline

 

Correct Answer: CDE

 

 

QUESTION 214

Which three statements are true regarding RFC 5176 (Change of Authorization)? (Choose three.)

 

A.

It defines a mechanism to allow a RADIUS server to initiate a communication inbound to a NAD.

B.

It defines a wide variety of authorization actions, including “reauthenticate.”

C.

It defines the format for a Change of Authorization packet.

D.

It defines a DM.

E.

It specifies that TCP port 3799 be used for transport of Change of Authorization packets.

 

Correct Answer: ACD

 

 

QUESTION 215

Refer to the exhibit. The client is protected by a firewall. An IPv6 SMTP connection from the client to the server on TCP port 25 will be subject to which action?

 

clip_image002

A.

pass action by the HTTP_CMAP

B.

inspection action by the TCP_CMAP

C.

inspection action by the SMTP_CMAP

D.

drop action by the default class

E.

pass action by the HTTP_CMAP

 

Correct Answer: C

 

 

QUESTION 216

Which three statements are true regarding Security Group Tags? (Choose three.)

 

A.

When using the Cisco ISE solution, the Security Group Tag gets defined as a separate authorization result.

B.

When using the Cisco ISE solution, the Security Group Tag gets defined as part of a standard authorization profile.

C.

Security Group Tags are a supported network authorization result using Cisco ACS 5.x.

D.

Security Group Tags are a supported network authorization result for 802.1X, MAC Authentication Bypass, and WebAuth methods of authentication.

E.

A Security Group Tag is a variable length string that is returned as an authorization result.

 

Correct Answer: ACD

 

 

QUESTION 217

Refer to the exhibit. What is the cause of the issue that is reported in this debug output?

 

clip_image004

 

A.

The identity of the peer is not acceptable.

B.

There is an esp transform mismatch.

C.

There are mismatched ACLs on remote and local peers.

D.

The SA lifetimes are set to 0.

 

Correct Answer: C

 

 

QUESTION 218

Which two certificate enrollment methods can be completed without an RA and require no direct connection to a CA by the end entity? (Choose two.)

 

A.

SCEP

B.

TFTP

C.

manual cut and paste

D.

enrollment profile with direct HTTP

E.

PKCS#12 import/export

 

Correct Answer: CE

 

 

QUESTION 219

Refer to the exhibit, which shows a partial configuration for the EzVPN server. Which three missing ISAKMP profile options are required to support EzVPN using DVTI? (Choose three.)

 

clip_image006

clip_image008

clip_image010

 

A.

match identity group

B.

trustpoint

C.

virtual-interface

D.

keyring

E.

enable udp-encapsulation

F.

isakmp authorization list

G.

virtual-template

 

Correct Answer: AFG

 

 

QUESTION 220

Which four techniques can you use for IP data plane security? (Choose four.)

 

A.

Control Plane Policing

B.

interface ACLs

C.

uRPF

D.

MD5 authentication

E.

FPM

F.

QoS

 

Correct Answer: BCEF

 

Free VCE & PDF File for Cisco 350-018 Real Exam

Instant Access to Free VCE Files: CCNA | CCNP | CCIE …
Instant Access to Free PDF Files: CCNA | CCNP | CCIE …