400-251 Exam Dumps | Which best practice can limit inbound TTL expiry attacks?

Home
Cisco
CCIE Security Written Exam (v5.0)
Cisco.400-251.v2018-10-19.q138
Question 19

Valid 400-251 Dumps shared by EduDump.com for Helping Passing 400-251 Exam! EduDump.com now offer the newest 400-251 exam dumps, the EduDump.com 400-251 exam questions have been updated and answers have been corrected get the newest EduDump.com 400-251 dumps with Test Engine here:

Access 400-251 Dumps Premium Version
(125 Q&As Dumps, 35%OFF Special Discount Code: freecram)

<< Prev Question Next Question >>

Question 19/138

Which best practice can limit inbound TTL expiry attacks?

A. Setting the TTL value to more than the longest path in the network.

B. Setting the TTL value to zero.

C. Setting the TTL value to less than the longest path in the network.

D. Setting the TTL value equal to the longest path in the network.

Correct Answer: C

Explanation/Reference:
Explanation:
Security controls should filter packets with low TTL values to protect an enterprise network from TTL expiry attacks. In practice, filtering packets whereby TTL value is less than the value that is needed to traverse the longest path across the network will completely mitigate this attack vector. For example, if the width of a network is six routed hops, an enterprise should filter packets that enter the network with TTL values of six and below.
Reference:http://www.cisco.com/c/en/us/about/security-center/ttl-expiry-attack.html

Your email address will not be published. Required fields are marked *

Comment: *

Name: *

Email: *

Rating: *

Verification: *

Question List (138q): Question 1: A user attempts to browse the Internet through a CWS-integra...; Question 2: Refer to the exhibit. ASA2 is configured for the Clientless ...; Question 3: View the Exhibit. (Exhibit) Refer to the exhibit. Which effe...; Question 4: Witch two statements about ping flood attacks are true? (Cho...; Question 5: View the Exhibit. (Exhibit) Refer to the exhibit. For which ...; Question 6: Which command sequence do you enter to add the host 10.2.1.0...; Question 7: Which of the following is true regarding OSPFv2 configuratio...; Question 8: Which feature does Cisco VSG use to redirect traffic in a Ci...; Question 9: Which statement describes a hybrid SDN framework?...; Question 10: What are three features that are enabled by generating Chang...; Question 11: What are three technologies that can be used to trace the so...; Question 12: Which option is a data modeling language used to model confi...; Question 13: Which two statements about Cisco VSG are true? (Choose two.)...; Question 14: What is the purpose of the BGP TTL security check?...; Question 15: If multiple contexts share an ingress interface which would ...; Question 16: Which file extensions are supported on the Firesight Managem...; Question 17: Which statement is true about VRF-Lite implementation in a s...; Question 18: What are the major components of a Firepower health monitor ...; Question 19: Which best practice can limit inbound TTL expiry attacks?...; Question 20: What are two of the valid IPv6 extension headers? (Choose tw...; Question 21: View the Exhibit. (Exhibit) Refer to the exhibit. Which data...; Question 22: View the Exhibit. monitor session 1 source interface gigabit...; Question 23: Which command on Cisco ASA you can enter to send debug messa...; Question 24: Which statement correctly describes TAP mode deployment in I...; Question 25: What are the two most common methods that security auditors ...; Question 26: In which type of multicast does the Cisco ASA forward IGMP m...; Question 27: Which statement is correct regarding the SenderBase function...; Question 28: Which statement is true about Dual-Hub DMVPN implementation ...; Question 29: As an enterprise, you have decided to use Cisco Umbrella (Op...; Question 30: Which two statements about a wireless access point configure...; Question 31: What does NX-API use as its transport?...; Question 32: Which statement about NMAP scanning on the Cisco Firepower S...; Question 33: In OpenStack, which two statements about the NOVA component ...; Question 34: What is the best description of a docker file?...; Question 35: Which are two important guidelines to follow when implementi...; Question 36: Which two protocols are used by the management plane in a Ci...; Question 37: (Exhibit) Refer to the exhibit. What is the effect of the gi...; Question 38: Which of the following is part of DevOps Virtuous Cycle?...; Question 39: View the Exhibit. (Exhibit) Refer to the exhibit. Which effe...; Question 40: Which three authorization technologies does Cisco TrustSec s...; Question 41: Which three statements about PKI on Cisco IOS Software are t...; Question 42: The purpose of an authentication proxy is to force the user ...; Question 43: A client computer at 10.10.7.4 is trying to access a Linux s...; Question 44: What are the three scanning engines that the Cisco IronPort ...; Question 45: Which of the following correctly describes NVGRE functionali...; Question 46: View the Exhibit. (Exhibit) Refer to the exhibit. Which leve...; Question 47: Which description of SaaS is true?...; Question 48: Which two statements about NVGRE are true? (Choose two.)...; Question 49: Which four task items need to be performed for an effective ...; Question 50: Nexus 9000 platform supports the following configuration man...; Question 51: A university has hired you as a consultant to advise them on...; Question 52: Which three VSA attributes are present in a RADIUS WLAN Acce...; Question 53: Which of the following is true regarding ASA clustering requ...; Question 54: Which statement is true regarding SSL policy implementation ...; Question 55: On Nexus 9000, in Python interactive mode, which command is ...; Question 56: Which statement is true about the traffic substitution and i...; Question 57: Which two statements about role-based access control are tru...; Question 58: Which three types of addresses can the Botnet Traffic Filter...; Question 59: Which two options are benefits of network summarization? (Ch...; Question 60: For your enterprise ISE deployment, you are looking to use c...; Question 61: Which three ESMTP extensions are supported by the Cisco ASA?...; Question 62: What are two features that help to mitigate man-in-the-middl...; Question 63: Which three statements about SCEP are true? (Choose three.)...; Question 64: Which two statements about Botnet Traffic Filter snooping ar...; Question 65: Which three options are fields in a CoA Request code packet?...; Question 66: Which statement is true regarding x.509 certificate?...; Question 67: Which three Cisco attributes for LDAP authorization are supp...; Question 68: (Exhibit) Refer to the exhibit. Destination address with nam...; Question 69: Which statement describes a pure SDN framework environment?...; Question 70: A device on your internal network is hard-coded with two DNS...; Question 71: View the Exhibit. (Exhibit) Refer to the exhibit. Which effe...; Question 72: DRAG DROP Drag each component of an Adaptive Wireless IPS de...; Question 73: From the list below, which one is the major benefit of AMP T...; Question 74: All your employees are required to authenticate their device...; Question 75: Which two options are benefits of the Cisco ASA Identity Fir...; Question 76: Which statement about SMTP authentication in a Cisco ESA dep...; Question 77: When TCP Intercept is enabled in its default mode, how does ...; Question 78: Which of the following Cisco products gives ability to inter...; Question 79: Which statement correctly describes AES encryption algorithm...; Question 80: Which of the following is the correct rule with regards to Z...; Question 81: Which statement is true about a SMURF attack?...; Question 82: ISE can be integrated with an MDM to ensure that only regist...; Question 83: Which two options are important considerations when you use ...; Question 84: In FMC the correlation rule could be based on which two elem...; Question 85: Which two statements about MAB are true? (Choose two.)...; Question 86: Which three EAP protocols are supported in WPA and WPA2? (Ch...; Question 87: What IOS feature can prevent header attacks by using packet-...; Question 88: What are the three configurations in which SSL VPN can be im...; Question 89: Which three statements about the keying methods used by MACS...; Question 90: Which statement about SenderBase reputation scoring on an ES...; Question 91: Which two options are unicast address types for IPv6 address...; Question 92: (Exhibit) Refer to the exhibit. Which two statements about t...; Question 93: Which three statements are correct regarding EAP-Chaining? (...; Question 94: Which two statements about Cisco AMP for Web Security are tr...; Question 95: In your corporate environment, you have various Active Direc...; Question 96: AMP for Endpoints is supported on which of these platforms?...; Question 97: Which two statements about the TTL value in an IPv4 header a...; Question 98: In your network, you require all guests to authenticate to t...; Question 99: DRAG DROP Drag and drop the protocols on the left onto their...; Question 100: Which of the following is the correct statement regarding en...; Question 101: In which two situations is web authentication appropriate? (...; Question 102: Which statement is true regarding Dynamic ARP inspection (DA...; Question 103: DRAG DROP Drag the network scan type on the left to its defi...; Question 104: Refer to the exhibit. Users are unable to access web servers...; Question 105: Which protocol does ISE use to secure connection through the...; Question 106: View the Exhibit. (Exhibit) Refer to the exhibit. Which two ...; Question 107: Which two statements about SPAN sessions are true? (Choose t...; Question 108: View the Exhibit. (Exhibit) Refer to the exhibit. What are t...; Question 109: A new computer is not getting its IPv6 address assigned by t...; Question 110: (Exhibit) Refer to the exhibit. ASA at 150.1.7.43 is configu...; Question 111: Which two statements about Cisco AnyConnect VPN Client are t...; Question 112: How does Scavenger-class QoS mitigate DoS and worm attacks?...; Question 113: Which of the following is AMP Endpoints office engine for wi...; Question 114: View the Exhibit. Switch-A (config)# cgmp leave-processing R...; Question 115: Which two characteristics of DTLS are true? (Choose two.)...; Question 116: Which three statements about WCCP are true? (Choose three.)...; Question 117: The SAML Single Sign-On on ISE is supported by which four po...; Question 118: Which statement about VRF-aware GDOI group members is true?...; Question 119: Refer to the exhibit. (Exhibit) R9 is running FLEXVPN with p...; Question 120: Within Platform as a Service, which two components are manag...; Question 121: Which three statements about RLDP are true? (Choose three.)...; Question 122: Which two statements about 802.1X components are true? (Choo...; Question 123: A network architect has been tasked to mitigate a customer's...; Question 124: A server with IP address 209.165.202.150 is protected behind...; Question 125: Which three statements about SXP are true? (Choose three.)...; Question 126: Which two statements about ICMP redirect messages are true? ...; Question 127: Which statement is correct regarding Cisco VSG functionality...; Question 128: What would describe Cisco Virtual Topology System?...; Question 129: Which two statements about uRPF are true? (Choose two.)...; Question 130: Which two events can cause a failover event on an active/sta...; Question 131: Which three transports have been defined for SNMPv3? (Choose...; Question 132: View the Exhibit. (Exhibit) Refer to the exhibit. Which two ...; Question 133: Which three of these are properties of RC4? (Choose three.)...; Question 134: (Exhibit) Refer to the exhibit. Which two statements about a...; Question 135: Which two options are normal functionalities for ICMP? (Choo...; Question 136: View the Exhibit. %ASA-6-110001: No route to <desr_addres...; Question 137: Which three ISAKMP SA Message States can be output from the ...; Question 138: (Exhibit) Refer to the exhibit. Which two effects of this co...

[×]

Download PDF File

Enter your email address to download Cisco.400-251.v2018-10-19.q138.pdf

Email:

Disclaimer:
Freecram doesn't offer Real GIAC Exam Questions. Freecram doesn't offer Real SAP Exam Questions. Freecram doesn't offer Real (ISC)² Exam Questions. Freecram doesn't offer Real CompTIA Exam Questions. Freecram doesn't offer Real Microsoft Exam Questions.
Oracle and Java are registered trademarks of Oracle and/or its affiliates.
Freecram material do not contain actual actual Oracle Exam Questions or material.
Microsoft®, Azure®, Windows®, Windows Vista®, and the Windows logo are registered trademarks of Microsoft Corporation.
Freecram Materials do not contain actual questions and answers from Cisco's Certification Exams. The brand Cisco is a registered trademark of CISCO, Inc.
CFA Institute does not endorse, promote or warrant the accuracy or quality of these questions. CFA® and Chartered Financial Analyst® are registered trademarks owned by CFA Institute.
Freecram does not offer exam dumps or questions from actual exams. We offer learning material and practice tests created by subject matter experts to assist and help learners prepare for those exams. All certification brands used on the website are owned by the respective brand owners. Freecram does not own or claim any ownership on any of the brands.

Question 19/138

LEAVE A REPLY

Download PDF File