300-415 practice questions 31–40

1. Question 31 · 382 in bank

   At which layer does the application-aware firewall block applications on a WAN Edge?

   • A3
   • B5
   • C2
   • D7

   Show answer

   Answer: D

   Explanation

   You can create lists of individual applications or application families. A sequence that contains a specified application or application family list can be inspected. This inspect action is a Layer 4 action. Matching applications are blocked/denied. - If a match condition contains an Application or Application Family List, the action must be Inspect. This inspect action is a Layer 4 action. The action for a specific application is block/deny. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/ios-xe-16/security-book-xe/enterprise-firewall.html

   Source: Adapted from community discussion — she_ccie

   References

   • Cisco documentation

   Next question

2. Question 32 · 382 in bank

   What is a benefit of the application-aware firewall?

   • AIt blocks traffic by MTU of the packet
   • BIt blocks encrypted traffic
   • CIt blocks traffic by application
   • DIt blocks traffic by MAC address

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/xe-16-9/sec-data-zbf-xe-16-9-book/sec-data-zbf-xe-16-9- book_chapter_0100100.html

   Next question

3. Question 33 · 382 in bank

   

   Refer to the exhibit. Which QoS treatment results from this configuration after the access list acl-guest is applied inbound on the vpn1 interface?

   • AA TCP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped
   • BA UDP packet sourcing from 172.16.20.1 and destined to 172.16.10.1 is accepted
   • CA UDP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped
   • DA TCP packet sourcing from 172.16.20.1 and destined to 172.16.10.1 is accepted

   Show answer

   Answer: C

   Explanation

   A UDP packet sourcing from 172.16.10.1 and destined to 172.16.20.1 is dropped Protocol 6 is TCP as you can see here: https://www.cisco.com/c/en/us/td/docs/cable/serv_exch/serv_control/broadband_app/protocol_ref_guide/protocol_ref_guide/03_IP.pdf

   Source: Adapted from community discussion — Speirsington

   References

   • Cisco documentation

   Next question

4. Question 34 · 382 in bank

   Which on-the-box security feature is supported by the Cisco ISR 4451 SD-WAN device and not on vEdge?

   • AIPsec/GRE cloud proxy
   • Breverse proxy
   • CEnterprise Firewall with Application Awareness
   • DCloud Express service

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

5. Question 35 · 382 in bank

   Select 2

   Which two mechanisms are used to guarantee the integrity of data packets in the Cisco SD-WAN architecture data plane? (Choose two.)

   • Acertificates
   • Btransport locations
   • Cauthentication headers
   • Dencapsulation security payload
   • ETPM chip

   Show answer

   Answer: CD

   Explanation

   A number of components contribute to the integrity of data packets in the Viptela data plane: • ESP, which is the standard IPsec encryption protocol, protects (via encryption and authentication) the inner header, data packet payload, and ESP trailer in all data packets. • AH, which is the standard IPsec authentication protocol, protects (via authentication) the entire data packet, including the inner and outer headers, data packet payload, and ESP trailer

   Source: Adapted from community discussion — vicopo

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

6. Question 36 · 382 in bank

   Which value is verified in the certificates to confirm the identity of the physical WAN Edge device?

   • ASerial Number
   • BOTP
   • CSystem-IP
   • DChassis-ID

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

7. Question 37 · 382 in bank

   Which hardware component is involved in the Cisco SD-WAN authentication process for ISR platforms?

   • AZTP
   • BOTPC
   • CSUDI
   • DTPMD

   Show answer

   Answer: D

   Explanation

   - Hardware-based vEdge device certificate is stored in the on-board Tamper Proof Module (TPM) chip installed during manufacturing. - Hardware-based Cisco IOS-XE SD-WAN device certificate is stored in the on-board SUDI chip installed during manufacturing. - Virtual platform or Cisco IOS-XE SD-WAN devices do not have root certificates (such as the ASR1002-X platform) preinstalled on the device. For these devices, a One-Time Password (OTP) is provided by vManage to authenticate the device with the SD-WAN controllers.

   Source: Adapted from community discussion — nihithp

   Next question

8. Question 38 · 382 in bank

   A network administrator is configuring QoS on a WAN Edge 5000 router and needs to enable it on the transport side interface. Which policy setting must be selected to accomplish this goal?

   • ACloud QoS
   • BNetflow
   • CApplication
   • DCloud QoS Service side

   Show answer

   Answer: A

   Explanation

   Reference: https://www.coursehero.com/file/p5ai4be5/There-are-a-few-steps-to-take-when-configuring-QoS-on-vEdge-router-hardware-1/

   Source: Adapted from community discussion — EGD

   Next question

9. Question 39 · 382 in bank

   What is a benefit of the application-aware firewall feature in the Cisco SD-WAN solution?

   • Aapplication visibility
   • Bcontrol policy enforcement
   • Capplication monitoring
   • Dapplication malware protection

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/vedge/security-book/ent-firewall-app-aware.html#:~:text=Application% 20Firewall&text=This%20application%2Daware%20firewall%20feature,of%201400%2B%20layer%207%20applications

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

10. Question 40 · 382 in bank

    A large retail organization decided to move some of the branch applications to the AWS cloud. How does the network architect extend the in-house Cisco SD- WAN branch to cloud network into AWS?

    • ACreate virtual instances of vSmart Cloud through the AWS online software store
    • BCreate GRE tunnels to AWS from each branch over the Internet
    • CInstall the AWS Cloud Router in the main data center and provide the connectivity from each branch
    • DCreate virtual WAN Edge devices Cloud through the AWS online software store

    Show answer

    Answer: D

    Explanation

    Correct. With Cloud OnRamp for IaaS, vManage will automatically deploy SD-WAN edge virtual routers in a transit VPC, acting as virtual aggregation routers. https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/sd-wan/white-paper-c11-742817.html

    Source: Adapted from community discussion — Mr_Cipher

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-415 practice, question 31. 382 questions available.