This page was exported from Free Download Lead2pass VCE And PDF Dumps [ https://www.pass4sureshared.com ]

Export date:Wed Jan 22 13:36:18 2025 / +0000 GMT

___________________________________________________


Title: [2017 New] Free Download Of Lead2pass 400-251 Real Exam Questions (51-75)

---------------------------------------------------


2017 July Cisco Official New Released 400-251 Dumps in Lead2pass.com!  100% Free Download! 100% Pass Guaranteed!  Are you worring about the 400-251 exam? With the complete collection of 400-251 exam questions and answers, Lead2pass has assembled to take you through your 400-251 exam preparation. Each Q &amp; A set will test your existing knowledge of 400-251 fundamentals, and offer you the latest training products that guarantee you passing 400-251 exam easily.  Following questions and answers are all new published by Cisco Official Exam Center: https://www.lead2pass.com/400-251.html  QUESTION 51What are feature that can stop man-in-the-middle attacks? (Choose two)  A.&nbsp;&nbsp;&nbsp; ARP sniffing on specific portsB.&nbsp;&nbsp;&nbsp; ARP spoofingC.&nbsp;&nbsp;&nbsp; Dynamic ARP inspectionD.&nbsp;&nbsp;&nbsp; DHCP snoopingE.&nbsp;&nbsp;&nbsp; destination MAC ACLs Answer: CD  QUESTION 52Which two statements about CoPP are true? (Choose two)  A.&nbsp;&nbsp;&nbsp; When a deny rule in an access list is used for MQC is matched, classification continues on the next classB.&nbsp;&nbsp;&nbsp; It allows all traffic to be rate limited and discardedC.&nbsp;&nbsp;&nbsp; Access lists that are used with MQC policies for CoPP should omit the log and log-input keywordsD.&nbsp;&nbsp;&nbsp; The mls qos command disables hardware acceleration so that CoPP handles all QoSE.&nbsp;&nbsp;&nbsp; Access lists that use the log keyword can provide information about the device's CPU usageF.&nbsp;&nbsp;&nbsp; The policy-map command defines the traffic class  Answer: AC  QUESTION 53Refer to the exhibit. Which effect of this configuration is true?  A.&nbsp;&nbsp;&nbsp; The WLC accepts self-signed certificates from the RADIUS server to authorize APs.B.&nbsp;&nbsp;&nbsp; The WLC adds the MAC addresses listed in the ssc ap-policy to its internal authorization list.C.&nbsp;&nbsp;&nbsp; The WLC adds the ssc access point to the auth-list internal authorization list.D.&nbsp;&nbsp;&nbsp; The WLC accepts the manufacture-installed certificate from the local access point.E.&nbsp;&nbsp;&nbsp; The WLC accepts self-signed certificates from devices added to itsa internal authorization list.  Answer: D  QUESTION 54Drag and Drop QuestionDrag each ip transmission and Fragmentation term on the left to the matching statement on right  Answer:  QUESTION 55Which two network protocols can operate on the Application Layer?(Choose two)  A.&nbsp;&nbsp;&nbsp; DNSB.&nbsp;&nbsp;&nbsp; UDPC.&nbsp;&nbsp;&nbsp; TCPD.&nbsp;&nbsp;&nbsp; NetBIOSE.&nbsp;&nbsp;&nbsp; DCCPF.&nbsp;&nbsp;&nbsp; SMB  Answer: AF  QUESTION 56Refer to the exhibit, which effect of this configuration is true?  A.&nbsp;&nbsp;&nbsp; The PMTUD value sets itself to 1452 bytes when the interface MTU is set to 1492 bytesB.&nbsp;&nbsp;&nbsp; SYN packets carries 1452 bytes in the payload when the Ethernet MTU of the interface is set to 1492 bytesC.&nbsp;&nbsp;&nbsp; The maximum size of TCP SYN+ACK packets passing the transient host is set to 1452 bytes and the IP MTU of the interface is set to 1492 bytesD.&nbsp;&nbsp;&nbsp; The MSS to TCP SYN packets is set to 1452 bytes and the IP MTU of the interface is set to 1492 bytesE.&nbsp;&nbsp;&nbsp; The minimum size of TCP SYN+ACL packets passing the router is set to 1452 bytes and the IP MTU of the interface is set to 1492 bytes  Answer: D  QUESTION 57Which of the following statement is true about the ARP spoofing attack?  A.&nbsp;&nbsp;&nbsp; Attacker sends the ARP request with the MAC address and IP address of the legitimate resource in the network.B.&nbsp;&nbsp;&nbsp; Attacker of ends the ARP request with MAC address and IP address of its own.C.&nbsp;&nbsp;&nbsp; ARP spoofing does not facilitate man in-the-middle attack for the attacker.D.&nbsp;&nbsp;&nbsp; Attacker sends the ARP request with its own MAC address and IP address of legitimate resource in the network.  Answer: D  QUESTION 58Which command can you enter to cause the locally-originated Multicast Source Discovery Protocol Source-Active to be prevented from going to specific peers?  A.&nbsp;&nbsp;&nbsp; ip msdp mesh-group mesh-name {&lt;peer-address&gt;|&lt;peer-name&gt;}B.&nbsp;&nbsp;&nbsp; ip msdp redistribute [list &lt;acl&gt;][asn as-access-list][route-map &lt;map&gt;]C.&nbsp;&nbsp;&nbsp; ip msdp sa-filter out &lt;peer&gt; [list&lt;acl&gt;] [route-map&lt;map&gt;]D.&nbsp;&nbsp;&nbsp; ip msdp default-peer {&lt;peer-address&gt; | &lt;peer-name&gt;}[prefix-list&lt;list&gt;]E.&nbsp;&nbsp;&nbsp; ip msdp sa-filter in &lt;peer&gt; [list&lt;acl&gt;][route-map &lt;map&gt;]  Answer: C  QUESTION 59CCMP (CCM mode Protocol) is based on which algorithm?  A.&nbsp;&nbsp;&nbsp; 3DESB.&nbsp;&nbsp;&nbsp; BlowfishC.&nbsp;&nbsp;&nbsp; RC5D.&nbsp;&nbsp;&nbsp; AESE.&nbsp;&nbsp;&nbsp; IDEA  Answer: D  QUESTION 60Drag and Drop QuestionDrag and drop each step in the SCEP process on the left into the correct order of operations on the right.  Answer:  QUESTION 61Which command can you enter on the Cisco ASA to disable SSH?  A.&nbsp;&nbsp;&nbsp; Crypto key generate ecdsa labelB.&nbsp;&nbsp;&nbsp; Crypto key generate rsa usage-keys noconfirmC.&nbsp;&nbsp;&nbsp; Crypto keys generate rsa general-keys modulus 768D.&nbsp;&nbsp;&nbsp; Crypto keys generate ecdsa noconfirmE.&nbsp;&nbsp;&nbsp; Crypto keys zeroize rsa noconfirm  Answer: E  QUESTION 62Which one of the foiling Cisco ASA adapts security appliance rule samples will send HTTP data to the AIP-SSM module to evaluate and stop HTTP attacks?  A.&nbsp;&nbsp;&nbsp; B.&nbsp;&nbsp;&nbsp; C.&nbsp;&nbsp;&nbsp; D.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Answer: D  QUESTION 63Why is the IPv6 type 0 routing header vulnerable to attack?  A.&nbsp;&nbsp;&nbsp; It allows the receiver of a packet to control its flow.B.&nbsp;&nbsp;&nbsp; It allows the sender to generate multiple NDP requests for each packet.C.&nbsp;&nbsp;&nbsp; It allows the sender of a packet to control its flow.D.&nbsp;&nbsp;&nbsp; It allows the sender to generate multiple ARP requests for each packet.E.&nbsp;&nbsp;&nbsp; It allows the receiver of a packet to modify the source IP address.  Answer: C  QUESTION 64What context-based access control (CBAC. command sets the maximum time that a router running Cisco IOS Will wait for a new TCP session to reach the established state?  A.&nbsp;&nbsp;&nbsp; IP inspect max-incompleteB.&nbsp;&nbsp;&nbsp; IP inspect tcp finwait-timeC.&nbsp;&nbsp;&nbsp; Ip inspect udp idle-timeD.&nbsp;&nbsp;&nbsp; Ip inspect tcpsynwait-timeE.&nbsp;&nbsp;&nbsp; Ip inspect tcp idle-time  Answer: D  QUESTION 65Which three statements about Cisco Flexible NetFlow are true? (Choose three.)  A.&nbsp;&nbsp;&nbsp; The packet information used to create flows is not configurable by the user.B.&nbsp;&nbsp;&nbsp; It supports IPv4 and IPv6 packet fields.C.&nbsp;&nbsp;&nbsp; It tracks all fields of an IPv4 header as well as sections of the data payload.D.&nbsp;&nbsp;&nbsp; It uses two types of flow cache, normal and permanent.E.&nbsp;&nbsp;&nbsp; It can be a useful tool in monitoring the network for attacks.  Answer: BCE  QUESTION 66Which best practice can limit inbound TTL expiry attacks?  A.&nbsp;&nbsp;&nbsp; Setting the TTL value to more than the longest path in the networkB.&nbsp;&nbsp;&nbsp; Setting the TTL value to zeroC.&nbsp;&nbsp;&nbsp; Setting the TTL value to less than the longest path in the networkD.&nbsp;&nbsp;&nbsp; Setting the TTL value equal to the longest path in the network  Answer: C  QUESTION 67On Which encryption algorithm is CCMP based?  A.&nbsp;&nbsp;&nbsp; IDEAB.&nbsp;&nbsp;&nbsp; BLOWFISHC.&nbsp;&nbsp;&nbsp; RCSD.&nbsp;&nbsp;&nbsp; 3DESE.&nbsp;&nbsp;&nbsp; AES  Answer: E  QUESTION 68By defaults which amount of time does the ASA add to the TTL value of a DNS entry to determine the amount of time a DNS entry is valid?  A.&nbsp;&nbsp;&nbsp; 60 secondsB.&nbsp;&nbsp;&nbsp; 30 secondsC.&nbsp;&nbsp;&nbsp; 0 secondD.&nbsp;&nbsp;&nbsp; 180 secondsE.&nbsp;&nbsp;&nbsp; 120 secondsF.&nbsp;&nbsp;&nbsp; 100 seconds  Answer: A  QUESTION 69Drag and Drop QuestionDrag and drop the desktop-security terms from the left onto their right definitions on the right.  Answer:  QUESTION 70What is the name of the unique tool/feature in cisco security manager that is used to merge an access list based on the source/destination IP address service or combination of these to provide a manageable view of access policies?  A.&nbsp;&nbsp;&nbsp; merge rule toolB.&nbsp;&nbsp;&nbsp; policy simplification toolC.&nbsp;&nbsp;&nbsp; rule grouping toolD.&nbsp;&nbsp;&nbsp; object group toolE.&nbsp;&nbsp;&nbsp; combine rule tool  Answer: E  QUESTION 71Refer to the exhibit. Which statement about the effect of this configuration is true?  A.&nbsp;&nbsp;&nbsp; reply protection is disableB.&nbsp;&nbsp;&nbsp; It prevent man-in-the-middle attacksC.&nbsp;&nbsp;&nbsp; The replay window size is set to infinityD.&nbsp;&nbsp;&nbsp; Out-of-order frames are dropped  Answer: D  QUESTION 72when a host initiates a TCP session, what is the numerical range into which the initial sequence number must fail?  A.&nbsp;&nbsp;&nbsp; 0 to 65535B.&nbsp;&nbsp;&nbsp; 1 to 1024C.&nbsp;&nbsp;&nbsp; 0 to 4,294,967,295D.&nbsp;&nbsp;&nbsp; 1 to 65535E.&nbsp;&nbsp;&nbsp; 1 to 4,294,967,295F.&nbsp;&nbsp;&nbsp; 0 to 1024  Answer: C  QUESTION 73What port has IANA assigned to the GDOI protocol?  A.&nbsp;&nbsp;&nbsp; UDP 4500B.&nbsp;&nbsp;&nbsp; UDP 500C.&nbsp;&nbsp;&nbsp; UDP 1812D.&nbsp;&nbsp;&nbsp; UDP 848  Answer: D  QUESTION 74Drag and Drop QuestionDrag each Cisco TrustSec feature on the left to its description on the right.  Answer:  QUESTION 75Which statement is true about SYN cookies?  A.&nbsp;&nbsp;&nbsp; The state is kept on the server machine TCP stackB.&nbsp;&nbsp;&nbsp; A system has to check every incoming ACK against state tablesC.&nbsp;&nbsp;&nbsp; NO state is kept on the server machine state but is embedded in the initial sequence numberD.&nbsp;&nbsp;&nbsp; SYN cookies do not help to protect against SYN flood attacks  Answer: C  At Lead2pass, we are positive that our Cisco 400-251 dumps with questions and answers PDF provide most in-depth solutions for individuals that are preparing for the Cisco 400-251 exam. Our updated 400-251 braindumps will allow you the opportunity to know exactly what to expect on the exam day and ensure that you can pass the exam beyond any doubt.  400-251 new questions on Google Drive: https://drive.google.com/open?id=0B3Syig5i8gpDbkNSWnpMam9TWWM  2017 Cisco 400-251 exam dumps (All 449 Q&amp;As) from Lead2pass:  https://www.lead2pass.com/400-251.html [100% Exam Pass Guaranteed]

---------------------------------------------------


Images: 

---------------------------------------------------




---------------------------------------------------


Post date: 2017-07-21 01:52:36

Post date GMT: 2017-07-21 01:52:36

Post modified date: 2017-07-21 01:52:36

Post modified date GMT: 2017-07-21 01:52:36



____________________________________________________________________________________________


Export of Post and Page as text file has been powered by [ Universal Post Manager ] plugin from www.gconverters.com