NEW QUESTION 1
What two are data and voice protocols do ASA 5500 supports? (Choose two)

• A. CTIQBE Inspection
• B. H.323 Inspection
• C. MGCP Inspection
• D. RTSP Inspection
• E. SIP Inspection
• F. Skinny (SCCP) Inspection

Answer: BD

NEW QUESTION 2
What is the result of the default ip ssh server authenticate user command?

• A. It enables the public key, keyboard, and password authentication methods.
• B. It enables the public key authentication method only.
• C. It enables the keyboard authentication method only.
• D. It enables the password authentication method only.

Answer: A

NEW QUESTION 3
When configuring packet-tracer command from CLI, what is the first option that you set?

• A. source IP address
• B. destination IP address
• C. interface
• D. protocol (ip, tcp, udp)

Answer: C

NEW QUESTION 4
Which statement about Cisco IPS Manager Express is true?

• A. It provides basic device management for large-scale deployments.
• B. It provides a GUI for configuring IPS sensors and security modules.
• C. It enables communication with Cisco ASA devices that have no administrative access.
• D. It provides greater security than simple ACLs.

Answer: B

NEW QUESTION 5
Which is the minimum RSA crypto key generate for SSH2?

• A. 512
• B. 768
• C. 1024
• D. 2048

Answer: B

NEW QUESTION 6
Which two options are purposes of the packet-tracer command? (Choose two.)

• A. to filter and monitor ingress traffic to a switch
• B. to configure an interface-specific packet trace
• C. to simulate network traffic through a data path
• D. to debug packet drops in a production network
• E. to automatically correct an ACL entry in an ASA

Answer: CD

NEW QUESTION 7
Which action is needed to set up SSH on the Cisco ASA firewall?

• A. Create an ACL to aloew the SSH traffic to the Cisco ASA.
• B. Configure DHCP for the client that will connect via SSH.
• C. Generate a crypto key
• D. Specify the SSH version level as either 1 or 2.
• E. Enable the HTTP server to allow authentication.

Answer: C

NEW QUESTION 8
Which feature can suppress packet flooding in a network?

• A. PortFast
• B. BPDU guard
• C. Dynamic ARP Inspection
• D. storm control

Answer: D

NEW QUESTION 9
Which statement about Cisco ASA NetFlow v9 (NSEL) is true?

• A. NSEL events match all traffic classes in parallel
• B. NSEL is has a time interval locked at 20 seconds and is not user configurable
• C. NSEL tracks flow-create, flow-teardown, and flow-denied events and generates appropriate NSEL datarecords
• D. You cannot disable syslog messages that have become redundant because of NSEL
• E. NSEL tracks the flow continuously and provides updates every 10 second
• F. NSEL provides stateless IP flow tracking that exports all record od a specific flow

Answer: C

Explanation:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/monitor_nse l.html

NEW QUESTION 10
Refer to the exhibit.

Which destination receives an event if a flow has been terminated?
(there is 3 netflow config here, flow-creation destination to IP .226, flow-update destination to IP
.227, and all destination to IP .228.

• A. only 209.165.200.228
• B. both 209.165.200.227 and 209.265.200.228
• C. only 209.165.200.226
• D. both 209.165.200.226 and 209.265.200.228

Answer: A

NEW QUESTION 11
Which three Cisco ASA configuration commands are used to enable the Cisco ASA to log only the
debug output to syslog? (Choose three.)

• A. logging list test message 711001
• B. logging debug-trace
• C. logging trap debugging
• D. logging message 711001 level 7
• E. logging trap test

Answer: ABE

NEW QUESTION 12
What is the CLI command to enable SNMPv3 on the Cisco Web Security Appliance?

• A. snmpconfig
• B. snmpenable
• C. configsnmp
• D. enablesnmp

Answer: A

NEW QUESTION 13
Which configuration keyword will configure SNMPv3 with authentication but no encryption?

• A. Auth
• B. Priv
• C. No auth
• D. Auth priv

Answer: A

NEW QUESTION 14
Which three configurations are needed to enable SNMPv3 support on the Cisco ASA? (Choose three.)

• A. SNMPv3 Local EngineID
• B. SNMPv3 Remote EngineID
• C. SNMP Users
• D. SNMP Groups
• E. SNMP Community Strings
• F. SNMP Hosts

Answer: CDF

NEW QUESTION 15
An engineer suspects that client workstations are experiencing extremely poor response time due to
a man in middle attack. Which feature must be enabled and configured to provide relief from this type of attack?

• A. Internet Key Exchange
• B. Link Aggregation
• C. Reverse ARP
• D. Dynamic ARP Inspection
• E. private VLANs

Answer: D

NEW QUESTION 16
About snmp v3 encryption, which option we have to use?

• A. priv
• B. auth
• C. encrypted

Answer: A

Explanation: -Configure snmp group:snmp-server group [groupname {v1 | v2c | v3{auth | noauth | priv}}] [read readview] [write writeview] [notify notifyview] [access access-list]
-Configure snmp user: snmp-server user username group-name [remote host [udp-port port]] {v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password]} [access [ipv6 nacl] [priv {des | 3des | aes
{128 | 192 |256}} privpassword] {acl-number | acl-name}]
encrypet if the password are encrypted ex. insert password not in plain text for auth.

NEW QUESTION 17
Refer to the exhibit. An engineer has configured NAT rules on an ASA using ASDM. Which action does rule Number 1 accomplish?

• A. It allows the engineering VPN address pool to access the Internet through the tunnel
• B. It allows hosts in the address pool to reach other hosts in the engineering VPN address pool
• C. It allows hosts in the engineering VPN object to reach the hosts in the Sales VPN without being nat-ed
• D. It allows the connection between the engineering VPN address pool and the DMZ network

Answer: C

NEW QUESTION 18
Which statement about the Cisco ASA configuration is true?

• A. All input traffic on the inside interface is denied by the global ACL.
• B. All input and output traffic on the outside interface is denied by the global ACL.
• C. ICMP echo-request traffic is permitted from the inside to the outside, and ICMP echo-reply will be permitted from the outside back to inside.
• D. HTTP inspection is enabled in the global policy.
• E. Traffic between two hosts connected to the same interface is permitted.

Answer: B

NEW QUESTION 19
Which two statements about Cisco IDS are true? (Choose two.)

• A. It is preferred for detection-only deployment.
• B. It is used for installations that require strong network-based protection and that include sensor tuning.
• C. It is used to boost sensor sensitivity at the expense of false positives.
• D. It is used to monitor critical systems and to avoid false positives that block traffic.
• E. It is used primarily to inspect egress traffic, to filter outgoing threats.

Answer: AD