A network engineer is troubleshooting an NBAR-based QoS policy. The policy is supposed to prioritize Office 365 traffic, but it is not matching. The router runs IOS XE and has NBAR enabled. What is the most likely reason for the mismatch?

The traffic is encrypted and NBAR cannot classify it

The NBAR protocol pack is outdated and does not recognize the latest Office 365 signatures

The router does not support NBAR

The QoS policy is applied to the wrong interface

A router has a zone-based firewall and NAT configured. Internal users can access the internet, but when they try to access a server on the DMZ that is also behind the router, the connection fails. The DMZ server has a static NAT. The firewall has a zone pair from inside to DMZ with an inspect policy. What is the most likely cause?

The routing table is missing a route to the DMZ

The NAT configuration is missing a route for the inside-to-DMZ traffic

The zone-based firewall is blocking the traffic

A network architect is designing a zone-based firewall for a multi-tenant building. Each tenant has its own router, but they share a common internet uplink. The architect wants to ensure that tenants cannot communicate with each other, but each can access the internet. What is the best design?

Create a zone pair between tenant zones with a deny policy

Use ACLs on the shared uplink to block tenant-to-tenant traffic

Assign each tenant to a separate zone and create zone pairs only from each tenant zone to the internet zone

Put all tenants in the same zone and allow all traffic

A company's sales team uses a critical CRM application that must get priority over general web browsing on the internet link. The router runs IOS XE. The administrator has already enabled NBAR and confirmed the CRM traffic is classified correctly. What is the next step to ensure the CRM gets priority?

Use a static NAT entry for the CRM server

Create a class map matching the CRM application, then a policy map with bandwidth priority, and apply it to the interface

Enable NBAR protocol discovery on the interface to see the traffic

Configure a zone-based firewall policy to allow CRM traffic

A security engineer is configuring a zone-based firewall to inspect FTP traffic. They want to allow active FTP, which uses a dynamic data connection. What is the correct way to configure the policy to ensure FTP works?

Use the 'inspect' action for FTP in the policy map

Create a static ACL for FTP data ports

Disable FTP inspection and use TFTP instead

CCIE Security

Domain 1Objective 3

1.3 Security Features on Cisco IOS/IOS XE CCIE-SECURITY Practice Questions (Page 7)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

11concepts

20%of the exam

Questions 31–35

31expert · hard
A network engineer is troubleshooting an NBAR-based QoS policy. The policy is supposed to prioritize Office 365 traffic, but it is not matching. The router runs IOS XE and has NBAR enabled. What is the most likely reason for the mismatch?
Select an answer first
32expert · hard
A router has a zone-based firewall and NAT configured. Internal users can access the internet, but when they try to access a server on the DMZ that is also behind the router, the connection fails. The DMZ server has a static NAT. The firewall has a zone pair from inside to DMZ with an inspect policy. What is the most likely cause?
Select an answer first
33expert · hard
A network architect is designing a zone-based firewall for a multi-tenant building. Each tenant has its own router, but they share a common internet uplink. The architect wants to ensure that tenants cannot communicate with each other, but each can access the internet. What is the best design?
Select an answer first
34application · medium
A company's sales team uses a critical CRM application that must get priority over general web browsing on the internet link. The router runs IOS XE. The administrator has already enabled NBAR and confirmed the CRM traffic is classified correctly. What is the next step to ensure the CRM gets priority?
Select an answer first
35expert · hard
A security engineer is configuring a zone-based firewall to inspect FTP traffic. They want to allow active FTP, which uses a dynamic data connection. What is the correct way to configure the policy to ensure FTP works?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

1.3 Security Features on Cisco IOS/IOS XE CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

A network engineer is troubleshooting an NBAR-based QoS policy. The policy is supposed to prioritize Office 365 traffic, but it is not matching. The router runs IOS XE and has NBAR enabled. What is the most likely reason for the mismatch?

A network architect is designing a zone-based firewall for a multi-tenant building. Each tenant has its own router, but they share a common internet uplink. The architect wants to ensure that tenants cannot communicate with each other, but each can access the internet. What is the best design?

A security engineer is configuring a zone-based firewall to inspect FTP traffic. They want to allow active FTP, which uses a dynamic data connection. What is the correct way to configure the policy to ensure FTP works?

Keep studying — 1.0 Perimeter Security and Intrusion Prevention