350-018v4試験無料問題集（875題）「Cisco CCIE Security Exam (4.0) 認定」

出題：1

Which three attributes may be configured as part of the Common Tasks panel of an authorization profile in the Cisco
ISE solution? (Choose three.)

A. dACL name

B. VLAN

C. SGT

D. voice VLAN

E. voice domain permission

正解：A,B,E 解答を投票する

出題：2

What action will be taken by a Cisco IOS router if a TCP packet, with the DF bit set, is larger than the egress interface MTU?

A. Transmit the packet unmodified.

B. Split the packet into two packets, so that neither packet exceeds the egress interface MTU, and forward them out.

C. Respond to the sender with an ICMP Type 3 , Code 4.

D. Respond to the sender with an ICMP Type 12, Code 2.

正解：C 解答を投票する

出題：3

Which three new capabilities were added to HTTP v1.1 over HTTP v1.0? (Choose three.)

A. HTTP pipelining

B. POST method

C. HTTP cookies

D. chunked transfer encoding

E. keepalive mechanism

正解：A,D,E 解答を投票する

出題：4

Using Cisco IOS, which two object-group options will permit networks 10.1.1.0/24 and 10.1.2.0/24 to host 192.168.5.1
port 80 and 443? (Choose 2.)

A. object-group network SOURCE
10.1.1.0 255.255.255.0
10.1.2.0 255.255.255.0
object-group network DESTINATION
host 192.168.5.1
object-group service HTTP
tcp eq www
tcp eq 443
!
ip access-list extended ACL-NEW
permit object-group SOURCE object-group DESTINATION object-group HTTP

B. object-group network SOURCE
10.1.1.0 255.255.255.0
10.1.2.0 255.255.255.0
object-group network DESTINATION
host 192.168.5.1
object-group service HTTP
tcp eq www
tcp eq 443
tcp source gt 1024
!
ip access-list extended ACL-NEW
permit object-group HTTP object-group SOURCE object-group DESTINATION

C. object-group network SOURCE
10.1.1.0 0.0.0.255
10.1.2.0 0.0.0.255
object-group network DESTINATION
host 192.168.5.1
object-group service HTTP
tcp eq www
tcp eq 443
!
ip access-list extended ACL-NEW
permit object-group SOURCE object-group DESTINATION object-group HTTP

D. object-group network SOURCE
range 10.1.1.0 10.1.2.255
object-group network DESTINATION
host 192.168.5.1
object-group service HTTP
tcp eq www
tcp eq 443
tcp source gt 1024
!
access-list 101 permit object-group HTTP object-group SOURCE object-group DESTINATION

正解：B,D 解答を投票する

出題：5

Regarding VSAs, which statement is true?

A. Each VSA is defined in an RFC and is considered to be a standard.

B. VSAs may be implemented on any RADIUS server.

C. VSAs are proprietary, and therefore may only be used on the RADIUS server of that vendor. For example, a Cisco
VSA may only be used on a Cisco RADIUS server, such as ACS or ISE.

D. VSAs do not apply to RADIUS; they are a TACACS attribute.

正解：B 解答を投票する

出題：6

Which option describes the purpose of the RADIUS VAP-ID attribute?

A. It sets the minimum bandwidth for the connection.

B. It identifies the VLAN interface to which the client will be associated.

C. It sets the maximum bandwidth for the connection.

D. It specifies the priority of the client.

E. It specifies the ACL ID to be matches against the client.

F. It specifies the WLAN ID of the wireless LAN to which the client belongs.

正解：F 解答を投票する

出題：7

Which two statements about an authoritative server in a DNS system are true? (Choose two.)

A. It has a ratio of exactly one authoritative name server per domain.

B. It indicates that it is authoritative for a name by setting the AA bit in responses.

C. It cannot cache or respond to queries from domains outside its authority.

D. It has a direct connection to one of the root name servers.

E. It has a ratio of at least one authoritative name server per domain.

正解：B,E 解答を投票する

出題：8

Which Cisco product solution is designed for workload mobility between public-public and Private-public clouds?

A. Cisco Intercloudfubric

B. Cisco Unified Cloud

C. Cisco Cloud Orthestrator

D. Cisco metapod

正解：A 解答を投票する

出題：9

What Cisco IOS feature prevents an attacker from filling up the MTU cache for locally generated traffic when using
path MTU discovery?

A. Enable flow-label switching to track IPv6 packets in the MPLS cloud.

B. Use NetFlow information to export data to a workstation.

C. Force all traffic to send 1280-byte Packets by hard coding the MSS.

D. Always use packets of 1500-byte size or larger.

E. Enable flow-label marking to track packet destination.

正解：E 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

Which option explains the passive scan technique that is used by wireless clients to discover available wireless
networks?

A. listening for access point probe response frames that contain available wireless networks

B. sending a null probe request

C. sending a null association request

D. listening for access point beacons that contain available wireless networks

正解：D 解答を投票する

出題：11

Which three NAT types support bidirectional traffic initiation? (Choose three.)

A. identity NAT

B. NAT exemption

C. policy NAT with nat/global

D. static PAT

E. static NAT

正解：B,D,E 解答を投票する

出題：12

Refer to the exhibit.

Which two statements about the given IPv6 ZBF configuration are true?
(Choose two)
. /

A. It passes TCP,UDP,ICMP, and FTP traffic in both directions between z1 and z2.

B. It inspects TCP,UDP,ICMP and FTP traffic from z2 to z1.

C. It inspects TCP,UDP,ICMP and FTP traffic from z1 to z2

D. It passes TCP,UDP,ICMP, and FTP traffic from z1 to z2.

E. It provides backward compatibility with legacy IPv4 inspection.

F. It provides backward compatibility with legacy IPv6 inspection.

正解：C,F 解答を投票する

出題：13

Which statement best describes a key difference in IPv6 fragmentation support compared to IPv4?

A. In IPv6, IP fragmentation is performed only by the source node of a large packet, and not by any other devices in
the data path.

B. In IPv6, PMTUD is no longer performed by the source node of an IP packet.

C. In IPv6, PMTUD is no longer performed by any node since the don't fragment flag is removed from the IPv6 header.

D. In IPv6, IP fragmentation is no longer needed because all Internet links must have an IP MTU of 1280 bytes or
greater.

E. In IPv6, IP fragmentation is no longer needed since all nodes must perform PMTUD and send packets equal to or
smaller than the minimum discovered path MTU.

正解：A 解答を投票する

350-018v4試験無料問題集「Cisco CCIE Security Exam (4.0) 認定」