Implementing and Operating Cisco Security Core Technologies Practice Questions & Answers • ExamPrepare

50 questions in this view

Page 1 of 9

Question 1

Refer to the exhibit. During the rollout of a new site-to-site VPN between a headquarters Cisco Secure Firewall Threat Defense and a partner Firewall, the tunnel never completes IKEv1 Phase 1 and stays in MM_WAIT_MSG_6. Reachability between firewalls over internet is verified, ISAKMP UDP-500 is permitted end-to-end, and the IKE phase1 policy parameters including encryption, hashing, DH Group and lifetime matches exactly on both ends. Which configuration action must be done to resolve the issue?

configure matching peer identity values under each tunnel-group on both endpoints
implement identical Diffie-Hellman group numbers within the active IKEv1 policy
add the same pre-shared key on both peers within their tunnel-group attributes
apply equivalent transform sets and lifetimes inside the crypto map entries

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Which Cisco IOS XE command rejects packets with a source IP address that fails a reverse path forwarding prefix check on the ingress interface?

ip verify unicast source reachable-via tx
ip verify unicast source reachable-via rx
ip verify unicast source reachable-via any
ip verify unicast source reachable-via both

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Which security principle advocates rapid cryptographic algorithm replacement to defend against quantum-computing threats?

Key escrow
Crypto agility
Zero trust
Network slicing

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

A network engineer is configuring NTP authentication on a Cisco Catalyst Switch to ensure secure time synchronization. The engineer configures the client and NTP server by running the ntp authentication-key 10 md5 CiscoR45745212 command. The engineer must associate the NTP client at IP address 10.10.10.2 with the NTP server at IP address 10.10.10.1 using the correct key. Which configuration completes the requirement?

ntp peer 10.10.10.1 key 10
ntp server 10.10.10.2 key 10
ntp peer 10.10.10.2 key 10
ntp server 10.10.10.1 key 10

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A company wants to enforce security policy using Cisco Secure Access SIA. The design requirements are:

•Block adult content and gambling categories for all users

•Inspect file downloads for malware

•Bypass TLS decryption for financial and healthcare domains due to compliance

•Allow the marketing department to use social media, while keeping file scanning active for downloads from those sites.

Which two configuration actions must the engineer make on Cisco Secure Access SIG to meet the requirements? (Choose two.)

implement a single global policy blocking adult and gambling categories, add a web application allow rule for social networking
disable TLS decryption globally to rely on DNS-layer reputation for blocking adult content and gambling sites
create a global policy blocking adult content and gambling with TLS enabled with Marketing policy that has higher precedence to allow social networking sites
use destination allow lists for financial and healthcare sites to prevent SSL inspection with malware scanning enabled in full inspection mode for all traffic
configure Marketing policy with higher precedence to allow social networking sites. apply decryption bypass list for financial and healthcare domains

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Which protocol does the BYOD component in Cisco ISE use to obtain a unique device certificate from an internal CA?

CMP
SCEP
OCSP
SFTP

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.