The Secret of Cisco 300-206 exam question

Q1. Which configuration on a switch would be unsuccessful in preventing a DHCP starvation attack? 

A. DHCP snooping 

B. Port security 

C. Source Guard 

D. Rate Limiting 

View Answer

Q2. Which feature is a limitation of a Cisco ASA 5555-X running 8.4.5 version with multiple contexts? 

A. Deep packet inspection 

B. Packet tracer 

C. IPsec 

D. Manual/auto NAT 

E. Multipolicy packet capture 

View Answer

Q3. Which three commands can be used to harden a switch? (Choose three.) 

A. switch(config-if)# spanning-tree bpdufilter enable 

B. switch(config)# ip dhcp snooping 

C. switch(config)# errdisable recovery interval 900 

D. switch(config-if)# spanning-tree guard root 

E. switch(config-if)# spanning-tree bpduguard disable 

F. switch(config-if)# no cdp enable 

View Answer

Q4. Which three statements about the software requirements for a firewall failover configuration are true? (Choose three.) 

A. The firewalls must be in the same operating mode. 

B. The firewalls must have the same major and minor software version. 

C. The firewalls must be in the same context mode. 

D. The firewalls must have the same major software version but can have different minor versions. 

E. The firewalls can be in different context modes. 

F. The firewalls can have different Cisco AnyConnect images. 

View Answer

Q5. What is the primary purpose of stateful pattern recognition in Cisco IPS networks? 

A. mitigating man-in-the-middle attacks 

B. using multipacket inspection across all protocols to identify vulnerability-based attacks and to thwart attacks that hide within a data stream 

C. detecting and preventing MAC address spoofing in switched environments 

D. identifying Layer 2 ARP attacks 

View Answer

Q6. When you configure a Botnet Traffic Filter on a Cisco firewall, what are two optional tasks? (Choose two.) 

A. Enable the use of dynamic databases. 

B. Add static entries to the database. 

C. Enable DNS snooping. 

D. Enable traffic classification and actions. 

E. Block traffic manually based on its syslog information. 

View Answer

Q7. For which management session types does ASDM allow a maximum simultaneous connection limit to be set? 

A. ASDM, Telnet, SSH 

B. ASDM, Telnet, SSH, console 

C. ASDM, Telnet, SSH, VTY 

D. ASDM, Telnet, SSH, other 

View Answer

Q8. IPv6 addresses in an organization's network are assigned using Stateless Address Autoconfiguration. What is a security concern of using SLAAC for IPv6 address assignment? 

A. Man-In-The-Middle attacks or traffic interception using spoofed IPv6 Router Advertisements 

B. Smurf or amplification attacks using spoofed IPv6 ICMP Neighbor Solicitations 

C. Denial of service attacks using TCP SYN floods 

D. Denial of Service attacks using spoofed IPv6 Router Solicitations 

View Answer

Q9. What is the default behavior of an access list on a Cisco ASA? 

A. It will permit or deny traffic based on the access list criteria. 

B. It will permit or deny all traffic on a specified interface. 

C. It will have no affect until applied to an interface, tunnel-group or other traffic flow. 

D. It will allow all traffic. 

View Answer

Q10. Which statement about the configuration of Cisco ASA NetFlow v9 (NSEL) is true? 

A. Use a sysopt command to enable NSEL on a specific interface. 

B. To view bandwidth usage for NetFlow records, you must have QoS feature enabled 

C. NSEL tracks the flow continuously and provides updates every 10 seconds. 

D. You must define a flow-export event type under a policy. 

E. NSEL can be used without a collector configured. 

View Answer