Which two statements about Cisco IDS are true? (Choose two.)
A.
It is preferred for detection-only deployment.
B.
It is used for installations that require strong network-based protection and that include sensor
tuning.
C.
It is used to boost sensor sensitivity at the expense of false positives.
D.
It is used to monitor critical systems and to avoid false positives that block traffic.
E.
It is used primarily to inspect egress traffic, to filter outgoing threats.
I think the answers must be A and C, because IDS ist only for detection and it is more sensitive that IPS.
0
0
The answer is A and D, In critical production networks, false positives can cause serious deffect
0
0
NEW QUESTION 197
How much storage is allotted to maintain system,configuration , and image files on the Cisco ASA 1000V during OVF template file deployment?
A. 1GB
B. 5GB
C. 2GB
D. 10GB
Answer: C
NEW QUESTION 198
Which feature is a limitation of a Cisco ASA 5555-X running 8.4.5 version with multiple contexts?
A. Deep packet inspection
B. Packet tracer
C. IPsec
D. Manual/auto NAT
E. Multipolicy packet capture
Answer: C
NEW QUESTION 199
When access rule properties are configured within ASDM, which traffic direction type is required by global and management access rule?
A. Any
B. Both in and out
C. In
D. Out
Answer: C
NEW QUESTION 200
Which option is a different type of secondary VLAN?
A. Transparent
B. Promiscuous
C. Virtual
D. Community
Answer: B
NEW QUESTION 201
Refer to the exhibit. Which statement about this access list is true?
access-list test: extended premit ip 2001:DB5:7::/64
192.168.1.0 255.255.255.0
A. This access list does not work without 6to4 NAT
B. IPv6 to IPv4 traffic permitted on the Cisco ASA by default
C. This access list is valid and works without additional configuration
D. This access list is not valid and does not work at all
E. We can pass only IPv6 to IPv6 and IPv4 to IPv4 traffic
Answer: D
NEW QUESTION 202
Which option must be configured on a transparent Cisco ASA adaptive security appliance for it to be managed over Layer 3 networks?
A. Static routes
B. Routed interface
C. Security context
D. BVI
Answer: D
NEW QUESTION 203
Which statement about Dynamic ARP Inspection is true ?
A. In a typical network, you make all ports as trusted expect for the ports connection to switches , which are untrusted
B. DAI associates a trust state with each switch
C. DAI determines the validity of an ARP packet based on valid IP to MAC address binding from the DHCP snooping database
D. DAI intercepts all ARP requests and responses on trusted ports only
E. DAI cannot drop invalid ARP packets
Answer: C
NEW QUESTION 204
Which command is the first that you enter to check whether or not ASDM is installed on the ASA?
A. Show ip
B. Show running-config asdm
C. Show running-config boot
D. Show version
E. Show route
Answer: B
NEW QUESTION 205
Which option is the Cisco ASA on-box graphical management solution?
A. SSH
B. ASDM
C. Console
D. CSM
Answer: B
NEW QUESTION 206
……
P.S. These New 300-206 Exam Questions Were Just Updated From The Real 300-206 Exam, You Can Get The Newest 300-206 Dumps In PDF And VCE From — http://bitly.com/1Pg5mjR (222q)
Good Luck !!!
0
0
NEW QUESTION – 20x
Refer the the exhibit. Which options describe the expected result of the capture ACL?
Exhibit: access-list cap permit ip any host 192.168.1.5
A. The capture is applied, but we cannot see any packet in the capture
B. The capture does not get applied and we get an error about mixed policy
C. The capture gets applied and we can see the packets in the capture
D. The capture is not applied because we must have a host IP as the source
Answer: some of the websites or sources are saying the right answer is C but I think is wrong. The correct answer is B and I will explain why. I tried running a capture using the above mentioned acl and I received the “mixed policy” message and it didn’t worked. The trick is that the word “any” implies IPv4 or IPv6, therefore the “mixed policy message. If the key word “any4” would have been used instead of “any” than C would have been a correct answer. I tested that on live ASA box ver 9.0.x.
1
0
I think it is option A.
ciscoasa(config)# access-list cap permit ip ? (old version 8.4 )
configure mode commands/options:
A.B.C.D Source IP address
any Abbreviation for source address and mask of 0.0.0.0
0.0.0.0
host Use this keyword to configure source host
interface Use interface address as source address
object Keyword to enter source object name
object-group Network object-group for source address
object-group-user User object-group for source address
user User for source address [\]
user-group User-group for source address
[\\]
ciscoasa(config)#
I applied the rule and test with the ip in the other end sending ping , not capture anything
We need to applied the capture
ciscoasa# ping 172.16.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/10 ms
ciscoasa# show access-list cap
access-list cap; 1 elements; name hash: 0xf034180f
access-list cap line 1 extended permit ip any host 172.16.0.1 (hitcnt=0) 0xee16bdb7
ciscoasa#
you need to apply the rule to one interface for that resson you will not see anything
-==
ciscoasa(config)# sh version
Cisco Adaptive Security Appliance Software Version 8.4(2)
Compiled on Wed 15-Jun-11 18:17 by builders
-==in version 9 we can see option any , any4 and any6 ( command will be accepted but access-list is not applied to interface so , no capture ) i tested in my house in ASA9 V
wwww5/pri/act(config)# access-list cap permit ip ?
configure mode commands/options:
A.B.C.D Source IP address
X:X:X:X::X/ Source IPv6 address/prefix
any Abbreviation for source address/mask of 0.0.0.0/0.0.0.0 OR source prefix ::/0
any4 Abbreviation of source address and mask of 0.0.0.0 0.0.0.0
any6 Abbreviation for source prefix ::/0
host Use this keyword to configure source host
interface Use interface address as source address
object Keyword to enter source object name
object-group Network object-group for source address
object-group-security Keyword to specify security object-group for source
object-group-user Keyword to specify user object-group for source
security-group Keyword to specify inline security-group
user Keyword to specify user for source
user-group Keyword to specify user-group for source
wwww/pri/act(config)# end
wwww5/pri/act# sh version
Cisco Adaptive Security Appliance Software Version 9.1(7)9
Device Manager Version 7.1(1)52
0
0
TESTED NO ERROR
ciscoasa(config)# sh version
Cisco Adaptive Security Appliance Software Version 9.5(1)201
Device Manager Version 7.5(1)
Compiled on Tue 29-Sep-15 22:08 PDT by builders
System image file is “boot:/asa951-201-smp-k8.bin”
ciscoasa(config)# access-list cap permit ip any host 192.168.0.12
ciscoasa(config)#
ciscoasa(config)#
ciscoasa(config)# access-list cap permit ip any?
configure mode commands/options:
any any4 any6
0
0
now another test looking further in version 8.4 (many test said that option C capture is applied and we can see the packets .)
look here
ciscoasa(config)# access-list cap permit ip any host 172.16.0.1
ciscoasa(config)# capture inside interface inside access-list cap ((___capture applied)
ciscoasa(config)# sh cap-========simulate traffic
capture inside type raw-data access-list cap interface inside [Capturing – 0 bytes]
ciscoasa(config)# ping 172.16.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/14/20 ms
ciscoasa(config)# sh cap -=========bytes increase see here
capture inside type raw-data access-list cap interface inside [Capturing – 650 bytes]
ciscoasa(config)#
ciscoasa# show capture inside (see here so C is the correct answer )
5 packets captured
1: 19:57:52.122460 172.16.0.2 > 172.16.0.1: icmp: echo request
2: 19:57:52.134056 172.16.0.2 > 172.16.0.1: icmp: echo request
3: 19:57:52.142174 172.16.0.2 > 172.16.0.1: icmp: echo request
4: 19:57:52.157508 172.16.0.2 > 172.16.0.1: icmp: echo request
5: 19:57:52.177572 172.16.0.2 > 172.16.0.1: icmp: echo request
5 packets shown
ciscoasa#
tricky question
0
0
access-list test: extended premit ip 2001:DB5:7::/64
192.168.1.0 255.255.255.0
A. This access list does not work without 6to4 NAT
B. IPv6 to IPv4 traffic permitted on the Cisco ASA by default
C. This access list is valid and works without additional configuration
D. This access list is not valid and does not work at all
E. We can pass only IPv6 to IPv6 and IPv4 to IPv4 traffic
Answer: D
doesn’t work in ASA 8.4 there was not ipv6 compatibility
ciscoasa(config)# access-list test: extended permit ip ?
configure mode commands/options:
A.B.C.D Source IP address
any Abbreviation for source address and mask of 0.0.0.0
0.0.0.0
host Use this keyword to configure source host
interface Use interface address as source address
object Keyword to enter source object name
object-group Network object-group for source address
object-group-user User object-group for source address
user User for source address [\]
user-group User-group for source address
[\\]
ciscoasa(config)# access-list test: extended premit ip 2001:DB5:7::/64 ?
ERROR: % Unrecognized command
in older version pass
note in older version like version 9 pass
0
0
What’s more, part of that new 270Q 300-206 dumps are available here:
https://drive.google.com/open?id=0B-ob6L_QjGLpflBDRGVtd3JJR2k3ZF9sOTAyOHQ0bW1fdlJsZjFwS2xxZmx1TGVrOEdraTA
Best Regards!
0
0