Cisco 350-018v4 Actual Free Exam Questions & Community Discussion

Exam Code/Number: 350-018v4
Exam Name/Title: CCIE Security Exam (4.0)
Certification Provider: Cisco
Corresponding Certification: CCIE

Exam Questions: 875
Updated On: Jun 02, 2026

Question #29

What entities decrypt a transmission sent by a GDOI group member?

A. the key server and the peer that is indicated by the key server

B. the peer that is indicated by the key server

C. the key server only

D. all group members

Discussion 0

Correct Answer: D Vote an answer

Question #30

What are two advantages of NBAR2 over NBAR? (Choose two)

A. Only NBAR2 supports Flexible NetFlow for extracting and exporting fields from the
Packet header

B. Only NBAR2 allows the administrator to apply individual PDL flies

C. Only NBAR2 can use Sampled NetFlow to extract pre-defined packet headers for reporting

D. Only NBAR2 supports PDLM to support new protocols

E. Only NBAR2 supports custom protocols based on HTTP URLS

Discussion 0

Correct Answer: A,E Vote an answer

Question #31

Which feature can you implement to protect against SYN-flooding DoS attacks?

A. CAR applied to ICMP packets

B. the ip verify unicast reverse-path command

C. TCP intercept

D. a null zero route

Discussion 0

Correct Answer: C Vote an answer

Question #32

Which three options correctly describe the AH protocol? (Choose three.)

A. The AH protocol supports tunnel mode only.

B. The AH protocol uses IP protocol 51.

C. The AH protocol provides protection against replay attacks.

D. The AH protocol encrypts the entire IP and upper layer protocols for security.

E. The AH protocol provides connectionless integrity and data origin authentication.

F. The AH protocol supports IPv4 only.

Discussion 0

Correct Answer: B,C,E Vote an answer

Question #33

Which three authentication types does OSPF support? (Choose three.)

A. MS-CHAP

B. MD5

C. PEAP

D. PAP

E. Null

F. Plaintext

Discussion 0

Correct Answer: B,E,F Vote an answer

Question #34

which two types of DNS attacks are associated with DoS and DDo S attacks?(Choose Two)

A. DNS open resolver attack

B. DNS amplification attacks

C. Resource utilization attacks

D. DNS reflection attacks

E. DNS cache poisoning attacks

Discussion 0

Correct Answer: C,E Vote an answer

Question #35

Which two statements about DHCP snooping are true? (Choose two)

A. DHCP servers connect to untrusted interface on the switch

B. Message sent from outside the service-provider network is untrusted

C. The binding database stores information about both IP and MAC addresses.

D. The binding database stores information about trusted interface

E. The lease time in the banding database is a pre-set value

Discussion 0

Correct Answer: C,E Vote an answer

Question #36

Refer the exhibit.

if R1 is acting as a DHCP server, what action can you take to enable the PC to receive an IP address assignment from
the DHCP server?

A. Configure DHCP option 82 on R1

B. Configure DHCP option 150 on R2

C. Configure the ip helper-address command on R1 to use R2's ip address

D. Configure the ip loca pool command on R1

E. Configure the ip helper-address command on R2 to use R1's IP address

F. configure the ip local pool command on R2

Discussion 0

Correct Answer: E Vote an answer

Question #37

Refer to the exhibit.

If R1 is connected upstream to R2 and R3 at different ISPs as shown, what action must be taken to prevent Unicast
Reverse Path Forwarding(uRPF)from dropping asymmetric traffic?

A. Configure Unicast RPF Strict Mode on R2 and R3 only

B. Configure Unicast RPF loose Mode on R2 and R3 only

C. Configure Unicast RPF Strict Mode on R1 only

D. Configure Unicast RPF Strict Mode on R1,R2 and R3

E. Configure Unicast RPF loose Mode on R1 only

Discussion 0

Correct Answer: A Vote an answer

Question #38

Which statement about DHCP snooping is true?

A. The dynamic ARP inspection feature must be enabled for DHCP snooping to work.

B. DHCP snooping is does not rate-limit DHCP traffic from trusted ports.

C. DHCP snooping builds a binding database using information that is extracted from intercepted ARP requests.

D. DHCP snooping is enabled on a per-port basis.

E. DHCP snooping is enabled on a per-VLAN basis.

Discussion 0

Correct Answer: E Vote an answer

Question #39

Which set of encryption algorithms is used by WPA and WPA2?

A. CAST and RC6

B. TKIP and AES

C. Blowfish and AES

D. TKIP and RC6

Discussion 0

Correct Answer: B Vote an answer

Question #40

What are three scanning engine that the Cisco IronPort dynamic vectoring and streaming engine can use to protect
against malware? (Choose three)

A. Symantec

B. Sophos

C. McAfee

D. TrendMicro

E. Webroot

F. F-Secure

Discussion 0

Correct Answer: B,C,E Vote an answer

Question #41

Which three statements about Dynamic ARP inspection on Cisco seithes are true? (Choose three)

A. The trusted database can be manually configured using the CLI

B. Dynamic ARP inspection is supported only on access ports

C. DHCP snooping is used to dynamically build the trusted database

D. Dynamic ARP inspection checks ARP packets on trusted and untrusted ports

E. Dynamic ARP inspection does no perform ingress security checking

F. Dynamic ARP inspection checks ARP packets against the trusted database

Discussion 0

Correct Answer: A,C,F Vote an answer

Question #42

During the establishment of an Easy VPN tunnel, when is XAUTH performed?

A. at the end of Phase 1 and before Phase 2 starts in IKEv1

B. at the end of IKEv1 Phase 2

C. at the beginning of IKEv1 Phase 1

D. at the end of Phase 1 and before Phase 2 starts in IKEv1 and IKEv2

Discussion 0

Correct Answer: A Vote an answer

Download Free Cisco 350-018v4 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 350-018v4 exam.