CCIE CCIE Security 2

Question 1

Which IKE version is recommended for modern IPsec VPN deployments due to improved security and mobility support?

Accepted Answer

IKEv2

Answer

IKEv1 aggressive mode

Answer

IKEv1 main mode

Answer

SSL VPN only

Question 2

In PKI, what is the role of the Certificate Authority (CA)?

Accepted Answer

Signing and issuing digital certificates that bind identities to public keys

Answer

Encrypting data in transit

Answer

Storing private keys for all devices

Answer

Managing firewall access control lists

Question 3

What type of attack does DHCP snooping protect against?

Accepted Answer

Rogue DHCP servers offering malicious IP configurations

Answer

ARP spoofing

Answer

MAC flooding

Answer

STP manipulation

Question 4

Which Cisco feature detects and blocks attempts to spoof ARP replies to redirect traffic?

Accepted Answer

Dynamic ARP Inspection (DAI)

Answer

DHCP snooping

Answer

IP Source Guard

Answer

Port Security

Question 5

What is the function of Cisco Stealthwatch (Cisco Secure Network Analytics)?

Accepted Answer

Network behavior analytics using NetFlow to detect threats

Answer

Firewall policy management

Answer

SSL certificate management

Answer

Endpoint patch management

Question 6

In Cisco ASA failover, which unit actively processes traffic while the standby unit monitors health?

Accepted Answer

Active unit

Answer

Primary unit

Answer

Secondary unit

Answer

Master unit