200-301 practice questions 991–1,000

1. Question 991 · 1334 in bank

   What is a function of Cisco Advanced Malware Protection for a Next-Generation IPS?

   • Ainspecting specific files and file types for malware
   • Bauthorizing potentially compromised wireless traffic
   • Cauthenticating end users
   • DURL filtering

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

2. Question 992 · 1334 in bank

   What is a feature of WPA?

   • ATKIP/MIC encryption
   • Bsmall Wi-Fi application
   • Cpreshared key
   • D802.1x authentication

   Show answer

   Answer: A

   Explanation

   WPA also has a few other improvements over WEP, including the Temporal Key Integrity Protocol (TKIP) and the Message Integrity Code (MIC) WPA2 Enterprise uses IEEE 802.1X to deliver enterprise-grade authentication, and it was created specifically for use in businesses. WPA2-Personal is designed for use within the home and uses pre-shared keys (PSK). WPA3 uses Simultaneous Authentication of Equals (SAE) to provide stronger defenses against password guessing.

   Source: Adapted from community discussion — AbdullahMohammad251

   Next question

3. Question 993 · 1334 in bank

   Select 2

   Which two practices are recommended for an acceptable security posture in a network? (Choose two.)

   • AUse a cryptographic keychain to authenticate to network devices.
   • BPlace internal email and file servers in a designated DMZ.
   • CBack up device configurations to encrypted USB drives for secure retrieval.
   • DDisable unused or unnecessary ports, interfaces, and services.
   • EMaintain network equipment in a secure location.

   Show answer

   Answer: DE

   Explanation

   A,D Use a cryptographic keychain to authenticate to network devices is correct, think Maintain network equipment in a secure location should be for physical not for security posture

   Source: Adapted from community discussion — alejandro12

   Next question

4. Question 994 · 1334 in bank

   How does WPA3 improve security?

   • AIt uses SAE for authentication.
   • BIt uses RC4 for encryption.
   • CIt uses TKIP for encryption.
   • DIt uses a 4-way handshake for authentication.

   Show answer

   Answer: A

   Explanation

   (A). It uses SAE (Simultaneous Authentication of Equals) for authentication. WPA3 replaces the pre-shared key (PSK) authentication method used in WPA2 with SAE, which provides stronger protection against offline dictionary and brute-force attacks. SAE allows users to securely authenticate with the network without revealing their passwords and protects against various authentication-related vulnerabilities.

   Source: Adapted from community discussion — Cynthia2023

   Next question

5. Question 995 · 1334 in bank

   DRAG DROP - Drag and drop the statements about AAA from the left onto the corresponding AAA services on the right. Not all options are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Per user attributes sounds like authorization. As each user could be configured to have different authorizations to different software and applications.

   Source: Adapted from community discussion — RougePotatoe

   References

   • Cisco documentation

   

   Next question

6. Question 996 · 1334 in bank

   DRAG DROP - Drag and drop the elements of a security program from the left onto the corresponding descriptions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   security policy security standard education awareness training It fits better takes it or leave it. The nuances is too blurry I wish cisco went out of business.

   Source: Adapted from community discussion — RougePotatoe

   

   Next question

7. Question 997 · 1334 in bank

   A manager asks a network engineer to advise which cloud service models are used so employees do not have to waste their time installing, managing, and updating software that is only used occasionally. Which cloud service model does the engineer recommend?

   • Ainfrastructure-as-a-service
   • Bplatform-as-a-service
   • Cbusiness process as service to support different types of service
   • Dsoftware-as-a-service

   Show answer

   Answer: D

   Explanation

   Each model has the provider creating certain services. With IaaS, the provider does the: Networking, Hardware, Virtualisation. The client adds the O/S, Data, and Applications. With PaaS, the provider does the: Networking, Hardware, Virtualisation, and O/S. The client adds the Data, and Applications. With SaaS, the provider does the: Networking, Hardware, Virtualisation, O/S, Data and Application. The client just works on it.

   Source: Adapted from community discussion — PaddyInNZ

   Next question

8. Question 998 · 1334 in bank

   Which IPsec transport mode encrypts the IP header and the payload?

   • Apipe
   • Btransport
   • Ccontrol
   • Dtunnel

   Show answer

   Answer: D

   Explanation

   https://www.cloudflare.com/en-gb/learning/network-layer/what-is-ipsec/ IPsec tunnel mode is used between two dedicated routers, with each router acting as one end of a virtual "tunnel" through a public network. In IPsec tunnel mode, the original IP header containing the final destination of the packet is encrypted, in addition to the packet payload. To tell intermediary routers where to forward the packets, IPsec adds a new IP header. At each end of the tunnel, the routers decrypt the IP headers to deliver the packets to their destinations. In transport mode, the payload of each packet is encrypted, but the original IP header is not. Intermediary routers are thus able to view the final destination of each packet — unless a separate tunneling protocol (such as GRE) is used.

   Source: Adapted from community discussion — NewJeans

   Next question

9. Question 999 · 1334 in bank

   What is the default port-security behavior on a trunk link?

   • AIt places the port in the err-disabled state if it learns more than one MAC address.
   • BIt causes a network loop when a violation occurs.
   • CIt disables the native VLAN configuration as soon as port security is enabled.
   • DIt places the port in the err-disabled state after 10 MAC addresses are statically configured.

   Show answer

   Answer: A

   Explanation

   When you enable port security on a switch, by default only one MAC address can be learned. To allow more than one MAC address on a switch port simultaneously, use the command:port-security maximum .

   Source: Adapted from community discussion — rijstraket

   References

   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 1000 · 1334 in bank

    Which device separates networks by security domains?

    • Aintrusion protection system
    • Bfirewall
    • Cwireless controller
    • Daccess point

    Show answer

    Answer: B

    Explanation

    B. Firewall A firewall is a device that separates networks by security domains. It acts as a barrier between different parts of a network, controlling the flow of traffic based on a set of rules. Firewalls are commonly used to enforce security policies, prevent unauthorized access, and protect networks from various threats. They are a key component in network security architectures.

    Source: Adapted from community discussion — fd17639

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-301 practice, question 991. 1334 questions available.