Free 400-251 Questions for Cisco CCIE Security Written Exam (v5.0) 400-251 Exam as PDF & Practice Test Engine

Exam Code/Number: 400-251
Exam Name/Title: CCIE Security Written Exam (v5.0)
Certification Provider: Cisco
Corresponding Certification: CCIE Security

Exam Questions: 125
Updated On: Jul 18, 2026

Question #1

Which two of the following probes can be configured on Cisco Identity service engine? (Choose two)

A. RADIUS

B. SXP

C. FTP

D. CTS

E. HTTP

F. DHCP

Discussion 0

Correct Answer: E,F Vote an answer

Question #2

Which statements is true regarding ESA HAT configuration for the incoming mail?

A. It points to the address of ESA management interface

B. It points to the address of ESA listener interface

C. It points to the recipient address

D. It points to the sender address

E. It points to the address of DNS server

F. It points to the address of recipient mail server

Discussion 0

Correct Answer: D Vote an answer

Question #3

All your employees are required to authenticate their devices to the network, be it company owned or employee owned assets, with ISE as the authentication server. The primary identity store used is Microsoft Active directory, with username and password authentication. To ensure the security of your enterprise, your security policy dictates that only company owned assets should be able to get access to the enterprise network, while personal assets should have restricted access. Which option would allow you to enforce this policy using only ISE and Active Directory?

A. Configure an Authorization policy that checks against the MAC address database of company assets in ISE endpoint identity store to determine the level of access depending on the device.

B. This would require deployment of a Mobile Device Management (MDM) solution, which can be used to register all devices against the MDM server, and use that to assign appropriate access levels.

C. Configure an authentication policy that uses the computer credentials in Active Directory to determine whether the device is company owned or personal.

D. Configure an authorization policy that assigns the device the appropriate profile based on whether the device passes Machine Authentication or not.

E. Configure an authentication policy that checks against the MAC address database of company assets in ISE endpoints identity store to determine the level of access depending on the device.

Discussion 0

Correct Answer: D Vote an answer

Question #4

Which three protocols are used by the management plane in a Cisco IOS device? (Choose three)

A. CHAP

B. 3DES

C. RIP

D. PAP

E. SSH

F. Telnet

G. TLS

H. HTTPS

I. DHCP

Discussion 0

Correct Answer: E,F,H Vote an answer

Question #5

Refer to the exhibit.

The AMP cloud is configured to report AMP Connector scan events from Windows machines that belong to the Audit group to the FMC However, the scanned events are not showing up in the FMC. Which possible cause true?

A. The AMP cloud is pointing to an incorrect FMC address.

B. An incorrect group is selected for the events export in the AMP cloud for FMC.

C. The DNS address is misconfigured on the FMC.

D. There is a possible issue with certificate download from the AMP cloud for FMC integration.

E. The event must be viewed as a malware event in the FMC.

F. The FMC is pointing to an incorrect AMP cloud address.

Discussion 0

Correct Answer: B Vote an answer

Question #6

Which three of the following Cisco VPN technologies allow for secure transport and encryption of multicast traffic? (Choose three)

A. Stabe Crypto Map

B. Dynamic Crypto map

C. FlexVPN

D. GETVPN

E. DMVPN

Discussion 0

Correct Answer: C,D,E Vote an answer

Question #7

Refer to the exhibit.

The FMC with address 161.1.7.16 is not seeing AMP Connector scan events that are reported to the AMP cloud for the "test pc" Windows machine that belongs to "protect" group. Which cause to the issue is true?

A. The Event must be viewed as a Connection event in the FMC.

B. The Windows machine is not reporting events to the FMC

C. The Windows machine is not reporting scan events to the AMP cloud.

D. The Windows machine belongs to an incorrect group in the AMP cloud policy

E. The incorrect group is selected for the events export in the AMP cloud for the FMC.

F. The AMP cloud was not added in the FMC.

G. The FMC was not added in the AMP cloud.

Discussion 0

Correct Answer: G Vote an answer

Question #8

Which two descriptions of the encoding formats supports by RESTCONF and NETCONF are true?

A. NETCONF supports XML encoding

B. NETCONF supports JSON encoding

C. NETCONF supports JSON and XML encoding

D. RESTCONF supports JSON encoding

E. RESTCONF supports JSON and XML encoding

F. RESTCONF supports XML encoding

Discussion 0

Correct Answer: A,E Vote an answer

Free 400-251 Questions for Cisco CCIE Security Written Exam (v5.0) 400-251 Exam as PDF & Practice Test Engine

Download Free Cisco 400-251 Demo