Cisco 400-251 Actual Free Exam Questions & Community Discussion

Exam Code/Number: 400-251
Exam Name/Title: CCIE Security Written Exam (v5.0)
Certification Provider: Cisco
Corresponding Certification: CCIE Security

Exam Questions: 125
Updated On: May 28, 2026

Question #13

Which three of the following statements are true about the Security Group Tag (SGT)? (Choose three)

A. Dynamic SGT is a global value binded to all the ports

B. SGT can only be assigned statically

C. SGT can be assigned manually at the port level

D. SGT can be assigned dynamically and be downloaded as the result of an ISE authorization

E. SGT can only be assigned dynamically

F. SGT can be mapped to IP address and downloaded to SGT-capable devices

Discussion 0

Correct Answer: C,D,F Vote an answer

Question #14

Which describes a capability of StealthWatch?

A. It uses the TCP SYN packets to detect anomalies in the network devices

B. Target Index (TI) is same as Concern (CI) but it works on file sharing activities

C. StealthWatch Flow sensor component is responsible to increment Concern Index (CI)

D. It triggers an alerts as soon as the Concern Index (CI) value goes down by one point

E. It uses the baseline of normal behavior pre-configured by the user

F. It uses the Concern Index to detect host anomalies

Discussion 0

Correct Answer: F Vote an answer

Question #15

Which statement about Remote Triggered Black Hole Filtering feature is true?

A. It drops malicious traffic at the customer edge router by forwarding it to a Null0 interface

B. In RTBH filtering, the trigger device is always an ISP edge router

C. IN RTBH filtering, the trigger device redistributes dynamic routes of the eBGP peers

D. The Null0 interface used for filtering able to receive the traffic but never forwards it

E. It works in conjunction with QoS to drop the traffic that has a lower priority

F. It helps mitigate DDOS attack based only on destination address

Discussion 0

Correct Answer: F Vote an answer

Question #16

Which function of MSE in the WIPS architecture is true?

A. scans channels without impacting data-serving radios

B. provides view of security threats

C. channel to connect with ISE to implement CoA

D. detects rogue Aps

E. applies rogue policy to mitigate rogue threats

F. detects over-the-air traffic network anomalies and attacks

G. performs the correlation of security events

Discussion 0

Correct Answer: G Vote an answer

Question #17

If a packet capture is taken between ISE and an endpoint to capture an EAP-TLS session, you will be able to see

A. Certificate and associated private keys from endpoint only

B. Certificates from ISE and the endpoint

C. Certificates from ISE only

D. Certificate and associated private keys from ISE only

Discussion 0

Correct Answer: B Vote an answer

Question #18

Which statement about NVGRE functionality is true?

A. In an NVGRE network, VSID s is used to identify Layer 3 network address space

B. It tunnels PPP frames inside an IP packet over a physical network

C. In a NVGRE network, the endpoints are not responsible for the NVGRE encapsulation removal

D. It tunnels Ethernet frames inside an IP packet over a virtual network

E. In an NVGRE network, VSID must be unique

F. It allows physical Layer 2 topologies to be created on a physical Layer 3 network

G. It allows physical Layer2 topologies to be created on a virtual Layer 3 network

Discussion 0

Correct Answer: E Vote an answer

Download Free Cisco 400-251 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 400-251 exam.