Our pass rate is high to 98.9% and the similarity percentage between our 400-251 study guide and real exam is 90% based on our seven-year educating experience. Do you want achievements in the Cisco 400-251 exam in just one try? I am currently studying for the Cisco 400-251 exam. Latest Cisco 400-251 Test exam practice questions and answers, Try Cisco 400-251 Brain Dumps First.
2026 New 400-251 Exam Dumps with PDF and VCE Free: https://www.surepassexam.com/400-251-exam-dumps.html
Q1. Which two statements about RFC 2827 are true? (Choose two.)
A. RFC 2827 defines egress packet filtering to safeguard against IP spoofing.
B. A corresponding practice is documented by the IEFT in BCP 38.
C. RFC 2827 defines ingress packet filtering for the multihomed network.
D. RFC 2827 defines ingress packet filtering to defeat DoS using IP spoofing.
E. A corresponding practice is documented by the IEFT in BCP 84.
Answer: B,D
Q2. What port has IANA assigned to the GDOI protocol?
A. UDP 4500
B. UDP 500
C. UDP 1812
D. UDP 848
Answer: D
Q3. On Which encryption algorithm is CCMP based?
A. IDEA
B. BLOWFISH
C. RCS
D. 3DES
E. AES
Answer: E
Q4. Refer to the exhibit. What type of attack is represented in the given Wireshark packet capture?
A. a SYN flood
B. spoofing
C. a duplicate ACK
D. TCP congestion control
E. a shrew attack
Answer: A
Q5. Refer to the exhibit . What is the meaning of the given error message?
A. The PFS groups are mismatched.
B. The pre-shared keys are mismatched.
C. The mirrored crypto ACLs are mismatched.
D. IKE is disabled on the remote peer.
Answer: B
Q6. Which feature can you implement to protect against SYN-flooding DoS attacks?
A. the ip verify unicast reverse-path command
B. a null zero route
C. CAR applied to icmp packets
D. TCP Intercept
Answer: B
Q7. Which command sets the Key-length for the IPv6 send protocol?
A. IPv6 nd ns-interval
B. Ipv6 ndra-interval
C. IPv6 nd prefix
D. IPv6 nd inspection
E. IPv6 nd secured
Answer: E
Q8. DRAG DROP
Drag and drop the DNS record types from the left to the matching descriptions to the right
Answer:
Explanation:
DNSkEY: contains a public key for use by the resolver NSEC: Link to the zone's next record name
NSEC3 : contains a hashed link to the zone's next record name PRSIG: contains the record set's DNSSEC signature
NSEC3PARAM : used by authoritative DNS servers when responding to DNSSEC requests
DS : holds the delegated zone's name
Q9. Which two commands would enable secure logging on Cisco ASA to a syslog server at 10.0.0.1? (Choose two)
A. logging host inside 10.0.0.1 TCP/1500 secure
B. logging host inside 10.0.0.1 UDP/514 secure
C. logging host inside 10.0.0.1 TCP/1470 secure
D. logging host inside 10.0.0.1 UDP/500 secure
E. logging host inside 10.0.0.1 UDP/447 secure
Answer: A,C
Q10. Refer to the exhibit.
A. Modify the tunnel keys to match on the hub and spoke
B. Configure the ipnhrp cache non-authoritative command on the hub’s tunnel interface
C. Modify the NHRP hold times to match on the hub and spoke
D. Modify the NHRP network IDs to match on the hub and spoke
Answer: A