Cisco 500-260 Actual Free Exam Questions & Community Discussion

Exam Code/Number: 500-260
Exam Name/Title: Cisco ASA Express Security (SAEXS)
Certification Provider: Cisco
Corresponding Certification: Next-Generation Firewall Express Security Engineer

Exam Questions: 50
Updated On: Jun 01, 2026

Question #6

On Cisco ASA Software Version 8.3 and later, which two statements correctly describe the NAT table or NAT operations? (Choose two.)

A. Manual NAT configurations are found in the first (top) and/or the last (bottom) section(s) of the NAT table.

B. Auto NAT also is referred to as Object NAT.

C. Twice NAT is required for hosts on the inside to be accessible from the outside.

D. The NAT table has four sections.

E. The order of the NAT entries in the NAT table is not relevant to how the packets are matched against the NAT table.

F. Auto NAT configurations are found only in the first (top) section of the NAT table.

Discussion 0

Correct Answer: A,B Vote an answer

Question #7

You are configuring bookmarks for the clientless SSL VPN portal without the use of plug-ins. Which three bookmark types are supported? (Choose three.)

A. RDP

B. HTTP

C. SSH

D. Telnet

E. CIFS

F. FTP

Discussion 0

Correct Answer: B,E,F Vote an answer

Question #8

Refer to the exhibit.

Which traffic is permitted on the inside interface without any interface ACLs configured?

A. No input traffic is permitted on the inside interface

B. any IP traffic input to the inside interface destined to any lower security level interfaces

C. No output traffic is permitted on the inside interface

D. any IP traffic input to the inside interface

E. only HTTP traffic input to the inside interface

F. only HTTP traffic output from the inside interface

Discussion 0

Correct Answer: E Vote an answer

Question #9

An access policy that uses URL reputation values is defined. Which option best describes what happens if a reputation is not available for a URL?

A. The URL check is not triggered and, by default, the user is prompted to take an action to permit or deny.

B. The URL check fails, and the traffic is dropped.

C. The URL check is not triggered, and the default policy action is applied.

D. The URL check is unknown, and the traffic is quarantined.

Discussion 0

Correct Answer: C Vote an answer

Question #10

In one custom dynamic application, the inside client connects to an outside server using TCP port 4444 and negotiates return client traffic in the port range of 5000 to 5500. The server then starts streaming UDP data to the client on the negotiated port in the specified range. Which Cisco ASA feature or command supports this custom dynamic application?

A. established command

B. ip verify command

C. tcp-map and tcp-options commands

D. TCP normalizer

E. TCP intercept

F. set connection advanced-options command

Discussion 0

Correct Answer: A Vote an answer

Download Free Cisco 500-260 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 500-260 exam.