Master the 400-251 CCIE Security Written Exam content and be ready for exam day success quickly with this Testking 400-251 actual exam. We guarantee it!We make it a reality and give you real 400-251 questions in our Cisco 400-251 braindumps.Latest 100% VALID Cisco 400-251 Exam Questions Dumps at below page. You can use our Cisco 400-251 braindumps and pass your exam.
2026 New 400-251 Exam Dumps with PDF and VCE Free: https://www.surepassexam.com/400-251-exam-dumps.html
Q1. Which three Cisco attributes for LDAP authorization are supported on the ASA? (Choose three)
A. L2TP-Encryption
B. Web-VPN-ACL-Filters
C. IPsec-Client-Firewall-Filter-Name
D. Authenticated-User-Idle-Timeout
E. IPsec-Default-Domain
F. Authorization-Type
Answer: B,D,E
Q2. Which two of the following ICMP types and code should be allowed in a firewall to enable traceroute? (Choose two)
A. Destination Unreachable-protocol Unreachable
B. Destination Unreachable-port Unreachable
C. Time Exceeded-Time to Live exceeded in Transit
D. Redirect-Redirect Datagram for the Host
E. Time Exceeded-Fragment Reassembly Time Exceeded
F. Redirect-Redirect Datagram for the Type of service and Host
Answer: B,C
Q3. DRAG DROP
Drag and drop the desktop-security terms from the left onto their right definitions on the right?
Answer:
Explanation:
governance = directing and controlling information and communications technology penetration testing = using hacking techniques to attempt to bypass existing security phishing = attempting to elict information from users by sending targeted emails
SSO = allowing users to sign in to multiple systems without reentering their credentials two factor authentication = using more than one mechanism to verify a user login
Q4. You have configured an authenticator switch in access mode on a network configured with NEAT what radius attribute must the ISE server return to change the switch’s port mode to trunk?
A. device-traffic-class=switch
B. device-traffic-class=trunk
C. framed-protocol=1
D. EAP-message-switch
E. Authenticate=Administrative
F. Acct-Authentic=radius
Answer: A
Q5. Which configuration is the correct way to change VPN key Encryption key lifetime to 10800 seconds on the key server?
A)
B)
C)
D)
E)
A. Option A
B. Option B
C. Option C
D. Option D
Answer: A
Q6. DRAG DROP
Drag each IP transmission and fragmentation term on the left to the matching statement on the right?
Answer:
Explanation: DF bit: A value in the IP header that indicates whether packet fragmentation is permitted.
Fragment offset: A value in the IP packet that indicates the location of a fragment in the datagram.
MF bit: Indicates that this is last packet with the biggest offset.
MSS: The amount of data that the receiving host can accept in each TCP segment. MTU: A value representing the maximum acceptable length of a packet to be transmitted over a link. PMTUD: A technology used to prevent fragmentation as data travels between two end points.
Tunnel: A logical interface allows packet to be encapsulated inside a passenger protocol for transmission across a
different carrier protocol.
Q7. What message does the TACACS+ daemon send during the AAA authentication process to request additional authentication information?
A. ACCEPT
B. REJECT
C. CONTINUE
D. ERROR
E. REPLY
Answer: C
Q8. The computer at 10.10.10.4 on your network has been infected by a botnet that directs traffic to a malware site at 168.65.201.120. Assuming that filtering will be performed on a Cisco ASA, What command can you use to block all current and future connections from the infected host?
A. ip access-list extended BLOCK_BOT_OUT deny ip any host 10.10.10.4
B. shun 10.10.10.4 168.65.201.120 6000 80
C. ip access-list extended BLOCK_BOT_OUT deny ip host 10.10.10.4 host 168.65.201.120
D. ip access-list extended BLOCK_BOT_OUT deny ip host 168.65.201.120 host 10.10.10.4
E. shun 168.65.201.120 10.10.10.4 6000 80
Answer: C
Q9. Refer to the exhibit.
What are two TLS inspection methods you could implement for outbond internet traffic that can prevent the given untrusted error? (Choose two)
Refer to the exhibit What are two TLS inspection methods you could implement for- outbound Internet traffic that can prevent the given error? (Choose two)
A. Add the self-signed CA certificate from the inspection appliance to the Trusted Root Certification Authority on the client
B. Apply an intermediate CA certificate from a trusted authority on the inspection appliance.
C. Download a copy of the private key from the content provider,
D. Update your organizational procedures to instruct users to click "I Understand the Risks" to accept the error and continue
E. Conditionally decrypt traffic based c$ trust level Store private keys in a FIPS Level 2 HSM on the inspection appliance
Answer: A,B
Q10. DRAG DROP
Drag each ISE probe on the left to the matching statement on the right.
Answer: