Q1. Which IPS engine detects ARP spoofing? 

A. Atomic ARP Engine 

B. Service Generic Engine 

C. ARP Inspection Engine 

D. AIC Engine 

View Answer

Q2. Which three statements about Cisco CWS are true? (Choose three.) 

A. It provides protection against zero-day threats. 

B. Cisco SIO provides it with threat updates in near real time. 

C. It supports granular application policies. 

D. Its Roaming User Protection feature protects the VPN from malware and data breaches. 

E. It supports local content caching. 

F. Its Cognitive Threat Analytics feature uses cloud-based analysis and detection to block threats outside the network. 

View Answer

Q3. The Web Cache Communication Protocol (WCCP) is a content-routing protocol that can facilitate the redirection of traffic flows in real time. Your organization has deployed WCCP to redirect web traffic that traverses their Cisco Adaptive Security Appliances (ASAs) to their Cisco Web Security Appliances (WSAs). 

The simulator will provide access to the graphical user interfaces of one Cisco ASA and one Cisco WSA that are participating in a WCCP service. Not all aspects of the GUIs are implemented in the simulator. The options that have been implemented are sufficient to determine the best answer to each of the questions that are presented. 

Your task is to examine the details available in the simulated graphical user interfaces and select the best answer. 

Between the Cisco ASA configuration and the Cisco WSA configuration, what is true with respect to redirected ports? 

A. Both are configured for port 80 only. 

B. Both are configured for port 443 only. 

C. Both are configured for both port 80 and 443. 

D. Both are configured for ports 80, 443 and 3128. 

E. There is a configuration mismatch on redirected ports. 

View Answer

Q4. An ASA with an IPS module must be configured to drop traffic matching IPS signatures and block all traffic if the module fails. Which describes the correct configuration? 

A. Inline Mode, Permit Traffic 

B. Inline Mode, Close Traffic 

C. Promiscuous Mode, Permit Traffic 

D. Promiscuous Mode, Close Traffic 

View Answer

Q5. Which two practices are recommended for implementing NIPS at enterprise Internet edges? (Choose two.) 

A. Integrate sensors primarily on the more trusted side of the firewall (inside or DMZ interfaces). 

B. Integrate sensors primarily on the less trusted side of the firewall (outside interfaces). 

C. Implement redundant IPS and make data paths symmetrical. 

D. Implement redundant IPS and make data paths asymmetrical. 

E. Use NIPS only for small implementations. 

View Answer

Q6. What are the two policy types that can use a web reputation profile to perform reputation-based processing? (Choose two.) 

A. profile policies 

B. encryption policies 

C. decryption policies 

D. access policies 

View Answer