思科网络工程师题库201-327Q201.An organization is implementing URL blocking using Cisco UmbrellA. The users are able to go to some sites but other sites are not accessible due to an error. Why is the error occurring?A.Client computers do not have the Cisco Umbrella Root CA certificate installed.B.IP-Layer Enforcement is not configured.C.Client computers do not have an SSL certificate deployed from an internal CA server.D.Intelligent proxy and SSL decryption is disabled in the policy.Answer: AExplanation:Other features are dependent on SSL Decryption functionality, which requires the Cisco Umbrella root certificate. Having the SSL Decryption feature improves:Custom URL Blocking-Required to block the HTTPS version of a URL.Umbrellas Block Page and Block Page Bypass features present an SSL certificate to browsers that make connections to HTTPS sites. This SSL certificate matches the requested site but will be signed by the Cisco Umbrella certificate authority (CA). If the CA is not trusted by your browser, an error page may be displayed. Typical errors include The security certificate presented by this website was not issued by atrusted certificate authority (Internet Explorer), The sites security certificate is not trusted! (Google Chrome) or This Connection is Untrusted (Mozilla Firefox). Although the error page is expected, the message displayed can be confusing and you may wish to prevent it from appearing. To avoid these error pages, install the Cisco Umbrella root certificate into your browser or the browsers of your users-if youre a network admin.Reference:https:/docs.umbrell A.com/deployment-umbrella/docs/rebrand-cisco-certificate-import-informationQ202.Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)A.virtualizationB.middlewareC.operating systemsD.applicationsE.data Answer: DE Explanation:Customers must manage applications and data in PaaS.Q203.What is an attribute of the DevSecOps process?A.mandated security controls and check listsB.security scanning and theoretical vulnerabilitiesC.development securityD.isolated security team Answer: CExplanation:DevSecOps (development, security, and operations) is a concept used in recent years to describe how to move security activities to the start of the development life cycle and have built-in security practices in the continuous integration/continuous deployment (CI/CD) pipeline. Thus minimizing vulnerabilities and bringing security closer to IT and business objectives.Three key things make a real DevSecOps environment:+ Security testing is done by the development team.+ Issues found during that testing is managed by the development team.+ Fixing those issues stays within the development team.Q204.An engineer notices traffic interruption on the network. Upon further investigation, it is learned that broadcast packets have been flooding the network.What must be configured, based on a predefined threshold, to address this issue?A.Bridge Protocol Data Unit guardB.embedded event monitoringC.storm controlD.access control lists Answer: C Explanation:Storm control prevents traffic on a LAN from being disrupted by a broadcast, multicast, or unicast storm on one of the physical interfaces. A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation, mistakes in network configurations, or users issuing a denial-of-service attack can cause a storm. By using the storm-control broadcast level falling-threshold we can limit the broadcast traffic on the switch.Q205.Which two cryptographic algorithms are used with IPsec? (Choose two)A.AES-BACB.AES-ABCC.HMAC-SHA1/SHA2D.Triple AMC-CBCE.AES-CBC Answer: CE Explanation:Cryptographic algorithms defined for use with IPsec include:+ HMAC-SHA1/SHA2 for integrity protection and authenticity.+ TripleDES-CBC for confidentiality+ AES-CBC and AES-CTR for confidentiality.+ AES-GCM and ChaCha20-Poly1305 providing confidentiality and authentication together efficiently.Q206.In which type of attack does the attacker insert their machine between two hosts that are communicating with each other?A.LDAP injectionB.man-in-the-middleC.cross-site scriptingD.insecure API Answer: B Explanation:New Questions (added on 2nd-Jan-2021)Q207.Which Dos attack uses fragmented packets to crash a target machine?A.smurfB.MITMC.teardropD.LAND Answer: C Explanation:A teardrop attack is a denial-of-service (DoS) attack that involves sending fragmented packets to a target machine. Since the machine receiving such packets cannot reassemble them due to a bug in TCP/IP fragmentation re