400-251 試験問題を無料オンラインアクセス

Which three policies are building blocks of vSmart policies architecture? (Choose three)

• A.control policy
• B.bandwidth policy
• C.application aware policy
• D.site policy
• E.service policy
• F.data policy

A device on your internal network is hard-coded with two DNS server on the Internet (1.1.1.53,
2.2.2.53). However, you want to send all requests to your OpenDNS server (208.67.222.222). Which set of commands do you run on the ASA to achieve this goal?

• A.nat (inside, outside) source static any interface destination static Rogue-DNS OpenDNS service udp-DNS udp-DNs nat (inside, outside) source static any interface destination static Rogue-DNS OpenDNS service udp-DNS udp-DNS
• B.object network OpenDNS
  host 1.1.1.53
  object network Rogue1-DNS
  host 2.2.2.53
  !
  Object-group network rogue1-DNS
  Network-object object Rogue1-DNS
  Network-object object Rogue2-DNS
  !
  Object service udp-DNS
  Service udp destination eq domain
  !
  Object service tcp-DNS
  Service tcp destination eq domain
  !
  Nat (inside, outside) source static any interface destination static OpenDNS Rogue-DNS service udp-DNS udp-DNS Nat (inside, outside) source static any interface destination static OpenDNS Rogue-DNS service tcp-DNS tcp-DNS
• C.Object network OpenDNS
  Host 208.67.222.222
  !
  Object network Rogue1-DNS
  Host 1.1.1.53
  Object network Rogue2-DNS
  Host 2.2.2.53
  !
  Object-group network Rogue-DNS
  Network-object object Rogue1-DNS
  Network-object object Rogue2-DNS
  !
  object service udp-DNS
  Service udp destination eq domain
  !
  object service tcp-DNS
  Service tcp destination eq domain
  !
  nat(inside, outside) source static any interface destination static Rogue-DNS OpenDNS service udp-DNS udp-DNS nat(inside, outside) source static any interface destination static Rogue-DNS OpenDNS service tcp-DNS tcp-DNS
• D.Static (inside, outside) source any 1.1.1.53destination 208.61.222.222 eq domain Static (inside, outside) source any 2.2.2.53 destination 208.67.222.222 eq domain
• E.Static (inside, outside) source any 208.67.222.222destination 1.1.1.53 eq domain Static (inside, outside) source any 208.67.222.222 destination 2.2.2.53 eq domain
• F.Static (inside, outside) source any destination 208.67.222.222 eq domain
• G.Static (outside, inside) source any 208.67.222.222desination 1.1.1.56 eq domain Static (outside, inside) source any 208.67.222.222 destination 2.2.2.53 eq domain
• H.Net (inside, outside) source any 1.1.1.53 destination 208.67.222.222 eq domain Nat (inside, outside) source any 2.2.2.53 destination 208.67.222.222 eq domain

Refer to the exhibit. R2 is getting time synchronized from NTP server R1. It has been reported that clock on R2 cannot associate with the NTP server R1.Which possible cause is true?

• A.R2 has an incorrect trusted key binded with the NTP server
• B.R2 has incorrect NTP server address
• C.R2 should not have two trusted keys for the NTP authentication
• D.R1 has an incorrect NTP source interface defined
• E.R2 has connectivity issue with the NTP server
• F.R2 does not support NTP authentication

A university has hired you as a consultant to advise them on the best method to prevent DHCP starvation attacks in the campus. They have already implemented DHCP snooping and port security to control the situation but those do not fully contain the issue. Which two actions do you suggest to fix this issue? (Choose two.)

• A.Use the ip dhcp snooping verify mac-address command to ensure that the source MAC address in the DHCP request matches the client hardware address (CHADDR) sent to the DHCP server.
• B.Use the ip dhcp snooping verify mac-address command to ensure that the source MAC address in the DHCP request matches the client identifier (CLID) field sent to the DHCP server.
• C.Use the ip dhcp snooping limit rate command only to ensure that the source MAC address in the DHCP request matches the client identifier (CLID) field sent to the DHCP server.
• D.Use the ip dhcp snooping limit rate command only on Untrusted interfaces and set the rate to suitable values that are relevant to the interface.
• E.Use the ip dhcp snooping limit rate command on trusted and untrusted interfaces set to the rate same value.
• F.Use the ip dhcp snooping limit rate command on Trusted and Untrusted interfaces and set the rate to suitable values that are relevant to each interface respectively.

Policy Sets in ISE are used to

• A.To keep RADIUS and TACACS+ policies separate from each other
• B.To create exception rules
• C.Create different Authentication and Authorization policies for distinct use cases
• D.Create different Authentication policies for different use cases while using a single Authorization policy
• E.Create different Authorization Policies for a single authentication policy