A security analyst notices that the NSEL export from an ASA is not showing any records for connections that were denied by an ACL. The ASA is configured to send NSEL to a collector, and other NSEL events (like session creations) are being received. What is the most likely cause?

The ASA is not configured to export ACL deny events in the NSEL policy.

The ASA is using IPFIX instead of NSEL for export.

The ACL is not applied to the interface where the traffic is denied.

The collector does not support NSEL event types for ACL denies.

A network administrator is configuring SNMPv3 on a router for monitoring. The NMS requires authentication and encryption, but the router's SNMP configuration is limited to a single user. The administrator wants to ensure that the NMS can poll and receive traps securely. Which configuration is correct?

Use SNMPv2c with a community string and rely on IPsec for security.

Configure SNMPv3 with noAuthNoPriv and use a VPN for encryption.

Create two SNMPv3 users: one for polling and one for traps.

Create an SNMPv3 user with authPriv and use the same user for polling and traps.

An NMS is configured to receive SNMP traps from a router, but the NMS is not receiving any traps. The router can be polled successfully via SNMP. What is the most likely cause?

The NMS is using SNMPv3 and the router is using SNMPv2c.

The router's SNMP agent is not running.

The NMS is not listening on the correct UDP port.

The router is not configured to send traps to the NMS IP address.

A security team is centralizing syslog from multiple devices. They notice that some devices are sending logs with incorrect timestamps, making correlation difficult. The devices are in different time zones. What is the best practice to ensure consistent timestamps?

Rely on the syslog server to adjust timestamps.

Set the local time zone on each device.

Use SNTP to synchronize clocks, but keep local time zones.

Configure all devices to use UTC for logging.

A network engineer is configuring syslog on a router to send logs to a central server. The engineer wants to ensure that only messages with severity 'warning' and higher are sent, and that the router also logs to a local buffer for troubleshooting. Which configuration is correct?

Set logging trap warnings and logging buffered warnings.

Set logging trap debugging and logging buffered warnings.

Set logging trap informational and logging buffered warnings.

Set logging trap warnings and logging buffered debugging.

CCIE Security

Domain 3Objective 6

3.6 Monitoring Protocols CCIE-SECURITY Practice Questions (Page 6)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

11concepts

15%of the exam

Questions 26–30

26expert · hard
A security analyst notices that the NSEL export from an ASA is not showing any records for connections that were denied by an ACL. The ASA is configured to send NSEL to a collector, and other NSEL events (like session creations) are being received. What is the most likely cause?
Select an answer first
27expert · medium
A network administrator is configuring SNMPv3 on a router for monitoring. The NMS requires authentication and encryption, but the router's SNMP configuration is limited to a single user. The administrator wants to ensure that the NMS can poll and receive traps securely. Which configuration is correct?
Select an answer first
28expert · medium
An NMS is configured to receive SNMP traps from a router, but the NMS is not receiving any traps. The router can be polled successfully via SNMP. What is the most likely cause?
Select an answer first
29expert · medium
A security team is centralizing syslog from multiple devices. They notice that some devices are sending logs with incorrect timestamps, making correlation difficult. The devices are in different time zones. What is the best practice to ensure consistent timestamps?
Select an answer first
30expert · medium
A network engineer is configuring syslog on a router to send logs to a central server. The engineer wants to ensure that only messages with severity 'warning' and higher are sent, and that the router also logs to a local buffer for troubleshooting. Which configuration is correct?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.