NEW QUESTION 1
Which Cisco ASA configuration command drops traffic if the Cisco ASACX module fails?

• A. no fail-open
• B. fail-close
• C. fail-close auth-proxy
• D. auth-proxy

Answer: B

NEW QUESTION 2
Which Cisco ASA platform should be selected if the requirements are to support 35,000 connections per second, 600,000 maximum connections, and traffic shaping?

• A. A.5540B.5550C.5580-20D.5580-40

Answer:

NEW QUESTION 3
Drag and drop the steps on the left into the correct order on the right to configure a Cisco ASA NGFW with multiple security contexts.

Answer:

Explanation: Reference:
http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/sec urity_manager/4-4/user/guide/CSMUserGuide_wrapper/pxcontexts.pdf (page 2 to 4)

NEW QUESTION 4
A web security appliance is inspecting inbound traffic. In which sequence is inbound https traffic inspected?

• A. Routing Policy > Decryption Policy > Access Policy
• B. Access Policy > Decryption Policy > Routing Policy
• C. Routing Policy > Access Policy > Decryption Policy
• D. Decryption Policy > Access Policy > Routing Policy
• E. Decryption Policy > Routing Policy > Access Policy
• F. Access Policy > Routing Policy > Decryption Policy

Answer: B

NEW QUESTION 5
Which role does Passive Identity Management play in the Cisco Cloud Web Security architecture?

• A. It provides user-level information that is received from Active Directory.
• B. It enables the administrator to control web access for users and user groups.
• C. It defines a standard for exchanging authentication and authorization data.
• D. It controls content that passes into and out of the network.

Answer: A

NEW QUESTION 6
Which command applies WCCP redirection on the inside interface of a Cisco ASA 5500-x firewall?

• A. wccp interface inside 90 redirect in
• B. web-cache interface inside 90 redirect in
• C. wccp interface inside redirect out
• D. wccp web-cache

Answer: A

NEW QUESTION 7
Which option is a benefit of Cisco Email Security virtual appliance over the Cisco ESA appliance?

• A. global threat intelligence updates from Talos
• B. reduced space and power requirements
• C. outbound message protection
• D. automated administration

Answer: B

NEW QUESTION 8
Which Cisco ESA component receives connections from external mail servers?

• A. MTA
• B. public listener
• C. private listener
• D. recipient access table
• E. SMTP incoming relay agent

Answer: B

NEW QUESTION 9
An engineer is deploying the Cisco Firepower NGIPSv for vMware. Which two aspects are unsupported during this deployment? (Choose two.)

• A. vCenter
• B. restoring a backup
• C. vCloud Director
• D. vMware tool
• E. cloning a virtual machine

Answer: AC

NEW QUESTION 10
What is the correct deployment for an IPS appliance in a network where traffic identified as threat traffic should be blocked and all traffic is blocked if the IPS fails?

• A. Inline; fail open
• B. Inline; fail closed
• C. Promiscuous; fail open
• D. Promiscuous; fail closed

Answer: B

NEW QUESTION 11
An enginner manages a Cisco Intrusion Prevention System via IME. A new user must be able to tune signatures, but must not be able to create new users. Which role for the new user is correct?

• A. viewer
• B. service
• C. operator
• D. administrator

Answer: C

NEW QUESTION 12
What is a limitation of the AMP Threatgrid Sandbox?

• A. delayed software updates
• B. the requirement of fully assembled malware
• C. single point of failure
• D. complex setup

Answer: A

NEW QUESTION 13
Which two pieces of information are required to implement transparent user identification using context Directory Agent? (Choose two.)

• A. the shared secret
• B. the server name where Context Directory Agent is installed
• C. the server name of the global catalog domaint controller
• D. the syslog server IP address

Answer: AB

NEW QUESTION 14
Which three pieces of information are required to implement transparent user identification using Context Directory Agent? (Choose three.)

• A. the server name of the global catalog domain controller
• B. the server name where Context Directory Agent is installed
• C. the backup Context Directory Agent
• D. the primary Context Directory Agent
• E. the shared secret
• F. the syslog server IP address

Answer: BDE

NEW QUESTION 15
Which option is omitted from a query on a ESA virtual appliance?

• A. raidrable
• B. FailoverHealthy
• C. keyExpiration
• D. CPUUtilizationExceeded

Answer: A

NEW QUESTION 16
Which settings are required when deploying Cisco IPS in high-availability mode using EtherChannel load balancy?

• A. ECLB IPS appliances must be in on-a-stick mode, ECLB IPS solution maintains state if a sensor goes down, and TCP flow is forced through the same IPS appliance.
• B. ECLB IPS appliances must not be in on-a-stick mode, ECLB IPS solution maintains state if a sensor goes down, and TCP flow is forced through the same IPS appliance flow
• C. ECLB IPS appliances must be in on-a-stick mode, ECLB IPS solution does not maintain state if a sensor goes down, and TCP flow is forced through a different IPS appliance.
• D. ECLB IPS appliances must not be in on-a-stick mode, ECLB IPS solution does not maintain state if a sensor goes down, and TCP flow is forced through a different IPS appliance.

Answer: C

Explanation: http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186 a0080671a8d.shtml

NEW QUESTION 17
A user wants to configure high availability with their Cisco Firepower deployment. Which platforms allow for clustering?

• A. All platforms support clustering
• B. Virtual NGIPS
• C. FirePower Threat Defense for ISR
• D. Cisco FirePower appliance

Answer: A

NEW QUESTION 18
Which antispam technology assumes that email from server A, which has a history of distributing spam, is more likely to be spam than email from server B, which does not have a history of distributing spam?

• A. Reputation-based filtering
• B. Context-based filtering
• C. Cisco ESA multilayer approach
• D. Policy-based filtering

Answer: A