Want to know Ucertify ccnp security senss 300 206 official cert guide Exam practice test features? Want to lear more about Cisco Implementing Cisco Edge Network Security Solutions certification experience? Study Downloadable Cisco ccnp security senss 300 206 official cert guide answers to Avant-garde ccnp security senss 300 206 official cert guide pdf questions at Ucertify. Gat a success with an absolute guarantee to pass Cisco 300 206 senss pdf (Implementing Cisco Edge Network Security Solutions) test on your first attempt.

Q31. A network engineer is asked to configure NetFlow to sample one of every 100 packets on a router's fa0/0 interface. Which configuration enables sampling, assuming that NetFlow is already configured and running on the router's fa0/0 interface? 

A. flow-sampler-map flow1 

mode random one-out-of 100 

interface fas0/0 

flow-sampler flow1 

B. flow monitor flow1 

mode random one-out-of 100 

interface fas0/0 

ip flow monitor flow1 

C. flow-sampler-map flow1 

one-out-of 100 

interface fas0/0 

flow-sampler flow1 

D. ip flow-export source fas0/0 one-out-of 100 

Answer: A 


Q32. Which two device types can Cisco Prime Security Manager manage in Multiple Device mode? (Choose two.) 

A. Cisco ESA 

B. Cisco ASA 

C. Cisco WSA 

D. Cisco ASA CX 

Answer: B,D 


Q33. Which option is a valid action for a port security violation? 

A. Reset 

B. Reject 

C. Restrict 

D. Disable 

Answer: C 


Q34. You have explicitly added the line deny ipv6 any log to the end of an IPv6 ACL on a router interface. Which two ICMPv6 packet types must you explicitly allow to enable traffic to traverse the interface? (Choose two.) 

A. router solicitation 

B. router advertisement 

C. neighbor solicitation 

D. neighbor advertisement 

E. redirect 

Answer: C,D 


Q35. Which policy map action makes a Cisco router behave as a stateful firewall for matching traffic? 

A. Log 

B. Inspect 

C. Permit 

D. Deny 

Answer: B 


Q36. Which statement about the configuration of Cisco ASA NetFlow v9 (NSEL) is true? 

A. Use a sysopt command to enable NSEL on a specific interface. 

B. To view bandwidth usage for NetFlow records, you must have QoS feature enabled 

C. NSEL tracks the flow continuously and provides updates every 10 seconds. 

D. You must define a flow-export event type under a policy. 

E. NSEL can be used without a collector configured. 

Answer: D 

Explanation: 

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_co nfig/ monitor_nsel.html 


Q37. CORRECT TEXT 

You are the network security engineer for the Secure-X network. The company has recently detected Increase of traffic to malware Infected destinations. The Chief Security Officer deduced that some PCs in the internal networks are infected with malware and communicate with malware infected destinations. 

The CSO has tasked you with enable Botnet traffic filter on the Cisco ASA to detect and deny further connection attempts from infected PCs to malware destinations. You are also required to test your configurations by initiating connections through the Cisco ASA and then display and observe the Real-Time Log Viewer in ASDM. 

To successfully complete this activity, you must perform the following tasks: 

* Download the dynamic database and enable use of it. 

. Enable the ASA to download of the dynamic database 

. Enable the ASA to download of the dynamic database. 

. Enable DNS snooping for existing DNS inspection service policy rules.. 

. Enable Botnet Traffic Filter classification on the outside interface for All Traffic. 

. Configure the Botnet Traffic Filter to drop blacklisted traffic on the outside interface. Use the default Threat Level settings 

NOTE: The database files are stored in running memory; they are not stored in flash memory. 

NOTE: DNS is enabled on the inside interface and set to the HQ-SRV (10.10.3.20). 

NOTE: Not all ASDM screens are active for this exercise. 

. Verify that the ASA indeed drops traffic to blacklisted destinations by doing the following: 

. From the Employee PC, navigate to http://www.google.com to make sure that access to the Internet is working. 

. From the Employee PC, navigate to http://bot-sparta.no-ip.org. This destination is classified as malware destination by the Cisco SIO database. 

. From the Employee PC, navigate to http://superzarabotok-gid.ru/. This destination is classified as malware destination by the Cisco SIO database. 

. From Admin PC, launch ASDM to display and observe the Real-Time Log Viewer. 

You have completed this exercise when you have configured and successfully tested Botnet traffic filter on the Cisco ASA. 

Answer: See the explanation for detailed answer to this sim question. 


Q38. An SNMP host is an IP address to which SNMP notifications and traps are sent. To configure SNMFV3 hosts, which option must you configure in addition to the target IP address? 

A. the Cisco ASA as a DHCP server, so the SNMFV3 host can obtain an IP address 

B. a username, because traps are only sent to a configured user 

C. SSH, so the user can connect to the Cisco ASA 

D. the Cisco ASA with a dedicated interface only for SNMP, to process the SNMP host traffic. 

Answer: B 

Explanation: The username can be seen here on the ASDM simulator screen shot: 


Q39. Refer to the exhibit. 

This command is used to configure the SNMP server on a Cisco router. Which option is the encryption password for the SNMP server? 

A. Sha 

B. Snmp 

C. Group-1 

D. Snmpv3 

Answer: B 


Q40. Which Layer 2 security feature prevents traffic on a LAN from being disrupted by a broadcast,multicat, or unicast storm on one physical interface? 

A. Bridge protocol Data Unit Guard 

B. Storm Control 

C. Embedded event monitoring 

D. Access control lists 

Answer: B