400-251 試験問題を無料オンラインアクセス

A sneaky employee using an Android phone on your network has disabled DHCP, enabled its firewall, and modified its HTTP user-agent header, to fool ISE into profiling it as a Windows 10 machine connected to the wireless network. This user can now get authorization for unrestricted network access using his Active Directory credentials because your policy states that a Windows device using AD credentials should be able to get full network access. However, an Android device should only get access to the web proxy. Which two steps can you take to avoid this sort of rogue behavior? (Choose two)

• A.Chain an authorization policy to the Windows authorization policy that performs additional NMAP scans to verify the machine type before access is allowed.
• B.Add an authorization policy before the Windows authorization policy that redirects a user with a static IP to a web portal for authentication.
• C.Perform CoA to push a restricted access when the machine is acquiring address using DHCP.
• D.Create an authentication rule that allows only a session with a specific HTTP user-agent header.
• E.Allow only certificate - based authentication from Windows endpoints, such as EAP-TLS or PEAP-TLS. If the endpoint uses MSCHAPv2 (EAP or PEAP), the user is given only restricted access.
• F.Modify the authorization policy to allow only Windows machines that have passed machine authentication to get full network access.

There is no ICMP connectivity from VPN_PC to Server 1 and Server 2. What could be the possible cause?

• A.The network address of the servers is configured incorrectly in the access rule
• B.The server network has incorrect mask in the access rule
• C.The zone configuration missing in the access rule
• D.The VLAN tags configuration missing in the access rule
• E.The destination port configuration missing in the access rule
• F.The source network is incorrect in the access rule
• G.The action is incorrect in the access rule

Which is true regarding Authentication Proxy?

• A.It does not apply the DACL for the traffic passing through the device
• B.It prompts user with a web-based authentication if user authentication information found
• C.It triggers on HTTP, HTTPS and FTP connections
• D.It triggers only on HTTP connection
• E.It applies a global ACL If the user authentication information not found
• F.It first checks if the NAT entry exists for the destination host

Which of the following statements correctly describe how DMVPN can be used to provide network segmentation over public transport networks?

• A.DMVPN can be used to transport MPLS packets inside of an mGRE tunnel
• B.The vrf forwarding command under the tunnel interface is used to associate encrypted packets with a VRF
• C.The front door VRF for DMVPN is defined under the isakmp profile
• D.The tunnel vrf command under the tunnel interface is used to associate clear text data packets with a VRF
• E.The DMVPN hub and spokes must use the same VRF for a given DMVOB cloud

Which of the following IOS IPsec transform-set configuration provides both encryption and integrity protection?

• A.esp-aes 256
• B.esp-sha512-hmac
• C.esp-gmac 128
• D.esp-sha256-hmac
• E.esp-gcm 128