web analytics

PassLeader 350-018 Exam Dumps Collection with VCE and PDF (Question 61 – Question 90)

New 350-018 exam questions from PassLeader 350-018 dumps! Welcome to download the newest PassLeader 350-018 VCE and PDF dumps: http://www.passleader.com/350-018.html (894 Q&As)

P.S. Free 350-018 dumps are available on Google Drive shared by PassLeader: https://drive.google.com/open?id=0B-ob6L_QjGLpfjE1cHRyNEtmX3JfdU9CUFlRZnVxNjZUbWxsSnBpNXM0QjZYZjBXZVgyOTQ

What feature on the Cisco ASA is used to check for the presence of an up-to-date antivirus vendor on an AnyConnect client?

A.    Dynamic Access Policies with no additional options
B.    Dynamic Access Policies with Host Scan enabled
C.    advanced endpoint assessment
D.    LDAP attribute maps obtained from Antivirus vendor

Answer: B

What type of attack consists of injecting traffic that is marked with the DSCP value of EF into the network?

A.    brute-force attack
B.    QoS marking attack
C.    DHCP starvation attack
D.    SYN flood attack

Answer: B

Which statement is true regarding Cisco ASA operations using software versions 8.3 and later?

A.    The global access list is matched first before the interface access lists.
B.    Both the interface and global access lists can be applied in the input or output direction.
C.    When creating an access list entry using the Cisco ASDM Add Access Rule window, choosing “global” as the interface will apply the access list entry globally.
D.    NAT control is enabled by default.
E.    The static CLI command is used to configure static NAT translation rules.

Answer: C

Which three multicast features are supported on the Cisco ASA? (Choose three.)

A.    PIM sparse mode
B.    IGMP forwarding
C.    Auto-RP
D.    NAT of multicast traffic
E.    PMI dense mode

Answer: ABD

Which three configuration tasks are required for VPN clustering of AnyConnect clients that are connecting to an FQDN on the Cisco ASA? (Choose three.)

A.    The redirect-fqdn command must be entered under the vpn load-balancing sub-configuration.
B.    Each ASA in the VPN cluster must be able to resolve the IP of all DNS hostnames that are used in the cluster.
C.    The identification and CA certificates for the master FQDN hostname must be imported into each VPN cluster-member device.
D.    The remote-access IP pools must be configured the same on each VPN cluster-member interface.

Answer: ABC

Which three statements are true about objects and object groups on a Cisco ASA appliance that is running Software Version 8.4 or later? (Choose three.)

A.    TCP, UDP, ICMP, and ICMPv6 are supported service object protocol types.
B.    IPv6 object nesting is supported.
C.    Network objects support IPv4 and IPv6 addresses.
D.    Objects are not supported in transparent mode.
E.    Objects are supported in single- and multiple-context firewall modes.

Answer: ACE

Which command is used to replicate HTTP connections from the Active to the Standby Cisco ASA appliance in failover?

A.    monitor-interface http
B.    failover link fover replicate http
C.    failover replication http
D.    interface fover replicate http standby
E.    No command is needed, as this is the default behavior

Answer: C

Refer to the exhibit.
policy-map type inspect ipv6 IPv6-map
match header routing-type range 0 255
class-map outside-class
match any
policy-map outside-policy
class outside-class
inspect ipv6 IPv6-map
service-policy outside-policy interface outside
Given the Cisco ASA configuration above, which commands need to be added in order for the Cisco ASA appliance to deny all IPv6 packets with more than three extension headers?

A.    policy-map type inspect ipv6 IPv6-map
match ipv6 header
count > 3
B.    policy-map outside-policy
class outside-class
inspect ipv6 header count gt 3
C.    class-map outside-class
match ipv6 header count greater 3
D.    policy-map type inspect ipv6 IPv6-map
match header count gt 3

Answer: D

Which C3PL configuration component is used to tune the inspection timers such as setting the tcp idle-time and tcp synwait-time on the Cisco ZBFW?

A.    class-map type inspect
B.    parameter-map type inspect
C.    service-policy type inspect
D.    policy-map type inspect tcp
E.    inspect-map type tcp

Answer: B

Which three NAT types support bidirectional traffic initiation? (Choose three.)

A.    static NAT
B.    NAT exemption
C.    policy NAT with nat/global
D.    static PAT
E.    identity NAT

Answer: ABD

Which IPS module can be installed on the Cisco ASA 5520 appliance?

D.    NME-IPS-K9
E.    IDSM-2

Answer: B

Which two options best describe the authorization process as it relates to network access? (Choose two.)

A.    the process of identifying the validity of a certificate, and validating specific fields in the certificate against an identity store
B.    the process of providing network access to the end user
C.    applying enforcement controls, such as downloadable ACLs and VLAN assignment, to the network access session of a user
D.    the process of validating the provided credentials

Answer: BC

If ISE is not Layer 2 adjacent to the Wireless LAN Controller, which two options should be configured on the Wireless LAN Controller to profile wireless endpoints accurately? (Choose two.)

A.    Configure the Call Station ID Type to be: “IP Address”.
B.    Configure the Call Station ID Type to be: “System MAC Address”.
C.    Configure the Call Station ID Type to be: “MAC and IP Address”.
D.    Enable DHCP Proxy.
E.    Disable DHCP Proxy.

Answer: BE

Refer to the exhibit. To configure the Cisco ASA, what should you enter in the Name field, under the Group Authentication option for the IPSec VPN client?

A.    group policy name
B.    crypto map name
C.    isakmp policy name
D.    crypto ipsec transform-set name
E.    tunnel group name

Answer: E

Refer to the exhibit. On R1, encrypt counters are incrementing. On R2, packets are decrypted, but the encrypt counter is not being incremented. What is the most likely cause of this issue?

A.    a routing problem on R1
B.    a routing problem on R2
C.    incomplete IPsec SA establishment
D.    crypto engine failure on R2
E.    IPsec rekeying is occurring

Answer: B

Which two methods are used for forwarding traffic to the Cisco ScanSafe Web Security service? (Choose two.)

A.    Cisco AnyConnect VPN Client with Web Security and ScanSafe subscription
B.    Cisco ISR G2 Router with SECK9 and ScanSafe subscription
C.    Cisco ASA adaptive security appliance using DNAT policies to forward traffic to ScanSafe subscription servers
D.    Cisco Web Security Appliance with ScanSafe subscription

Answer: BC

Which four statements about SeND for IPv6 are correct? (Choose four.)

A.    It protects against rogue RAs.
B.    NDP exchanges are protected by IPsec SAs and provide for anti-replay.
C.    It defines secure extensions for NDP.
D.    It authorizes routers to advertise certain prefixes.
E.    It provides a method for secure default router election on hosts.
F.    Neighbor identity protection is provided by Cryptographically Generated Addresses that are derived from a Diffie-Hellman key exchange.
G.    It is facilitated by the Certification Path Request and Certification Path Response ND messages.

Answer: ACDE

What is the recommended network MACSec policy mode for high security deployments?

A.    should-secure
B.    must-not-secure
C.    must-secure
D.    monitor-only
E.    high-impact

Answer: A

Which three statements about NetFlow version 9 are correct? (Choose three.)

A.    It is backward-compatible with versions 8 and 5.
B.    Version 9 is dependent on the underlying transport; only UDP is supported.
C.    A version 9 export packet consists of a packet header and flow sets.
D.    Generating and maintaining valid template flow sets requires additional processing.
E.    NetFlow version 9 does not access the NetFlow cache entry directly.

Answer: CDE

Which three statements about VXLANs are true? (Choose three.)

A.    It requires that IP protocol 8472 be opened to allow traffic through a firewall.
B.    Layer 2 frames are encapsulated in IP, using a VXLAN ID to identify the source VM.
C.    A VXLAN gateway maps VXLAN IDs to VLAN IDs.
D.    IGMP join messages are sent by new VMs to determine the VXLAN multicast IP.
E.    A VXLAN ID is a 32-bit value.

Answer: BCD

Which two identifiers are used by a Cisco Easy VPN Server to reference the correct group policy information for connecting a Cisco Easy VPN Client? (Choose two.)

B.    OU field in a certificate that is presented by a client
C.    XAUTH username
D.    hash of the OTP that is sent during XAUTH challenge/response

Answer: AB

Which multicast routing mechanism is optimal to support many-to-many multicast applications?

A.    PIM-SM
E.    MSDP

Answer: D

Which three statements regarding VLANs are true? (Choose three.)

A.    To create a new VLAN on a Cisco Catalyst switch, the VLAN name, VLAN ID and VLAN type must all be specifically configured by the administrator.
B.    A VLAN is a broadcast domain.
C.    Each VLAN must have an SVI configured on the Cisco Catalyst switch for it to be operational.
D.    The native VLAN is used for untagged traffic on an 802.1Q trunk.
E.    VLANs can be connected across wide-area networks.

Answer: BDE

Which technology, configured on the Cisco ASA, allows Active Directory authentication credentials to be applied automatically to web forms that require authentication for clientless SSL connections?

A.    one-time passwords
B.    certificate authentication
C.    user credentials obtained during authentication
D.    Kerberos authentication

Answer: C

In what subnet does address reside?


Answer: D

Given the IPv4 address, which two addresses are valid IPv4-compatible IPv6 addresses? (Choose two.)

A.    :::A:A:64:10
B.    ::10:10:100:16
C.    0:0:0:0:0:10:10:100:16
D.    0:0:10:10:100:16:0:0:0

Answer: BC

Refer to the exhibit. Which three fields of the IP header labeled can be used in a spoofing attack? (Choose one.)

A.    6, 7, 11
B.    6, 11, 12
C.    3, 11, 12
D.    4, 7, 11

Answer: A

What is the size of a point-to-point GRE header, and what is the protocol number at the IP layer?

A.    8 bytes, and protocol number 74
B.    4 bytes, and protocol number 47
C.    2 bytes, and protocol number 71
D.    24 bytes, and protocol number 1
E.    8 bytes, and protocol number 47

Answer: B

When implementing WLAN security, what are three benefits of using the TKIP instead of WEP? (Choose three.)

A.    TKIP uses an advanced encryption scheme based on AES.
B.    TKIP provides authentication and integrity checking using CBC-MAC.
C.    TKIP provides per-packet keying and a rekeying mechanism.
D.    TKIP provides message integrity check.
E.    TKIP reduces WEP vulnerabilities by using a different hardware encryption chipset.
F.    TKIP uses a 48-bit initialization vector.

Answer: CDF

Which two statements about SHA are correct? (Choose two.)

A.    Five 32-bit variables are applied to the message to produce the 160-bit hash.
B.    The message is split into 64-bit blocks for processing.
C.    The message is split into 512-bit blocks for processing.
D.    SHA-2 and MD5 both consist of four rounds of processing.

Answer: AC

New 350-018 exam questions from PassLeader 350-018 dumps! Welcome to download the newest PassLeader 350-018 VCE and PDF dumps: http://www.passleader.com/350-018.html (894 Q&As)

P.S. Free 350-018 dumps are available on Google Drive shared by PassLeader: https://drive.google.com/open?id=0B-ob6L_QjGLpfjE1cHRyNEtmX3JfdU9CUFlRZnVxNjZUbWxsSnBpNXM0QjZYZjBXZVgyOTQ