Free Cisco 350-018 Practice Test & Real Exam Questions

Exam Code/Number: 350-018
Exam Name/Title: CCIE Security Written Exam v4.0
Certification Provider: Cisco
Corresponding Certification: CCIE

Exam Questions: 875
Updated On: Aug 20, 2026

Question #45

Refer to the exhibit.

Which effect of this configuration is true?

A. The MSS of TCP SYN packets is set to 1452 bytes and the IP MTU of the interface is set to 1942 bytes

B. The PMTUD values sets itself to 1452 bytes when the interface MTU is set to 1492 bytes

C. SYN packets carries 1452 bytes in the payload when the Ethernet MTU of the interface is to 1492 bytes

D. The maximum size of TCP SYN+ACK packets passing the transient host is set to 1452 bytes and the IP MTU of the
interface is set to 1492 bytes

E. The maximum size of TCP SYN+ACK packets passing the router is set to 452 bytes and the IP MTU of the interface is
set to 1492 bytes

Discussion 0

Correct Answer: A Vote an answer

Question #46

Which three of these are true statements about TLS? (Choose three.)

A. It can be used to secure SIP.

B. If a third-party (man-in-the-middle) observes the entire handshake between client and server, the third-party can decrypt the encrypted data that passes between them.

C. It is a secure protocol encapsulated within SSL.

D. It cannot be used for HTTPS.

E. It allows for client authentication via certificates.

F. It is a more recent version of SSL.

Discussion 0

Correct Answer: A,E,F Vote an answer

Question #47

Which three LSA types are used by OSPFv3? (Choose three.)

A. Interarea-prefix LSA for ASBRs

B. Autonomous system external LSA

C. Link LSA

D. Intra-Area Prefix LSA

E. Internetwork LSA

Discussion 0

Correct Answer: B,C,D Vote an answer

Question #48

Which two statements about dynamic ARP inspection are true? (Choose two.)

A. The trusted database to check for an invalid ARP packet is manually configured.

B. Dynamic ARP inspection does not perform ingress security checking.

C. Dynamic ARP inspection checks ARP packets on both trusted and untrusted ports.

D. Dynamic ARP inspection checks invalid ARP packets against the trusted database.

E. DHCP snooping must be enabled.

F. Dynamic ARP inspection is only supported on access and trunk ports.

Discussion 0

Correct Answer: D,E Vote an answer

Question #49

Which two statements about BPDU guard and root guard are true? (Choose two.)

A. When a port on a switch configured with root guard enters the errdisable state, the administrator must manually re-enable the port.

B. Root guard should always be implemented at the network edge.

C. A switch configured with root guard disables any port that receives a superior BPDU.

D. BPDU guard is enabled by default for all ports on which PortFast is enabled.

E. When a port on a switch configured with BPDU guard enters the errdisable state, it can recover automatically if the errdisable recovery timeout is configured.

F. A switch configured with BPDU guard disables any port with PortFast enabled if the port receives a BPDU.

Discussion 0

Correct Answer: A,D Vote an answer

Question #50

Which two statements about IPv6 path MTU discovery are true? (Choose two.)

A. If the destination host receives an ICMPv6 Packet Too Big message from a router, it reduces its path MTU.

B. If the source host receives an ICMPv6 Packet Too Big message from a router, it reduces its path MTU.

C. During the discovery process, the DF bit is set to 1.

D. I can allow fragmentation when the minimum MTU is below a configured value.

E. The discover packets are dropped if there is congestion on the link.

F. The initial path MTU is the same as the MTU of the original node's link layer interface.

Discussion 0

Correct Answer: B,F Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #51

From what type of server can you to transfer files to ASA's internal memory?

A. Netlogon

B. SFTP

C. SMB

D. SSH

Discussion 0

Correct Answer: C Vote an answer

Question #52

Which three statements about VRF aware Cisco Firewall are true? (Choose three)

A. It enables service providers to deploy firewall on customer device

B. It can generate syslog message that are visible only to individual VPN

C. It can run as more than one instance

D. Its can support VPN network with overlapping address range without NAT

E. It enables service providers to implement firewall on PE devices

F. Its support both global and per-VRF commands and DOS parameter

Discussion 0

Correct Answer: B,C,E Vote an answer

Question #53

Which statement about DNS is true?

A. In the DNS header, the Rcode value is set to 0 for format error.

B. The client-server architecture is based on push-pull messages.

C. In the DNS header, an Opcode value of 2 represents a server status request.

D. Query and response messages have different format.

E. In the DNS message header, the QR flag set to 1 indicates a query.

Discussion 0

Correct Answer: C Vote an answer

Question #54

Which IPv4 header field usually increments for each subsequent packet sent?

A. Fragment Offset

B. Time To Live

C. Flag

D. Identification

Discussion 0

Correct Answer: D Vote an answer

Question #55

Which field in an HTTPS server certificate is compared to a server name in the URL?

A. Issuer Name

B. Organization

C. Organizational Unit

D. Common Name

Discussion 0

Correct Answer: D Vote an answer

Download Free Cisco 350-018 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 350-018 exam.