Free Cisco 350-018 Practice Test & Real Exam Questions

Exam Code/Number: 350-018
Exam Name/Title: CCIE Security Written Exam v4.0
Certification Provider: Cisco
Corresponding Certification: CCIE

Exam Questions: 875
Updated On: Aug 20, 2026

Question #34

What Cisco IOS feature prevents an attacker from filling up the MTU cache for locally generated traffic when using
path MTU discovery?

A. Enable flow-label switching to track IPv6 packets in the MPLS cloud.

B. Use NetFlow information to export data to a workstation.

C. Force all traffic to send 1280-byte Packets by hard coding the MSS.

D. Enable flow-label marking to track packet destination.

E. Always use packets of 1500-byte size or larger.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #35

Which statement about ACS rule-based policies is true?

A. Permission for rule-bases polices are associated with user group.

B. The permissions for rule-based policies are defined in authentication profile.

C. Rule-based polices can apply different permission to the same user under different condition

D. TACACS+ is one of the attributes included in the authorization profile

Discussion 0

Correct Answer: A Vote an answer

Question #36

Attacks can originate from multicast receivers. Any receiver that sends an IGMP or MLD report typically creates state
on which router?

A. first-hop

B. customer

C. source

D. RP

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #37

Troubleshooting the web authentication fallback feature on a Cisco Catalyst switch shows that clients with the 802.1X
supplicant are able to authenticate, but clients without the supplicant are not able to use web authentication. Which
configuration option will correct this issue?

A. switch(config)# ip http server

B. switch(config-if)# webauth

C. switch(config-if)# authentication host-mode multi-auth

D. switch(config-if)# authentication priority webauth dot1x

E. switch(config)# aaa accounting auth-proxy default start-stop group radius

Discussion 0

Correct Answer: A Vote an answer

Question #38

Which two statements about DNSSEC are true? (Choose two)

A. It can protect bulk data as is it transmitted between DNS servers.

B. It supports spilt-horizon DNS to prevent attackers from enumerating the names in a zone

C. It supports data integrity for DNS clients.

D. It can protect all types of data published in the DNS

E. It support data confidentiality for DNS client

Discussion 0

Correct Answer: C,D Vote an answer

Question #39

CCMP(CCM mode Protocol) is based on which algorithm?

A. 3DES

B. Blowfish

C. IDEA

D. AES

E. RCS

Discussion 0

Correct Answer: D Vote an answer

Question #40

Refer to the exhibit.

Which statement about this Cisco Catalyst switch 802.1X configuration is true?

A. If an IP phone behind the switch port has an 802.1X supplicant, 802.1X authentication will be used to authenticate
the IP phone.

B. Using the authentication host-mode multi-domain command will allow up to eight PCs connected behind the IP
phone via a hub to be individually authentication using 802.1X.

C. The authentication host-mode multi-domain command enables the PC connected behind the IP phone to bypass
802.1X authentication.

D. If an IP phone behind the switch port has an 802.1X supplicant, MAC address bypass will still be used to
authenticate the IP Phone.

Discussion 0

Correct Answer: A Vote an answer

Question #41

Refer to the exhibit. What type of attack is represented in the given Wireshark packet capture?

A. a duplicate ACK

B. spoofing

C. a SYN flood

D. TCP congestion control

E. a shrew attack

Discussion 0

Correct Answer: C Vote an answer

Question #42

Which three routing characteristics are relevant for DMVPN Phase 3? (Choose three.)

A. Hubs must preserve the original IP next-hop.

B. Spokes are only routing neighbors with hubs.

C. Spokes are routing neighbors with hubs and other spokes.

D. Hubs are routing neighbors with other hubs and must use the same routing protocol as that used on hub-spoke
tunnels.

E. Hubs must not preserve the original IP next-hop.

F. Split-horizon must be turned off for RIP and EIGRP.

Discussion 0

Correct Answer: B,E,F Vote an answer

Question #43

Why is the IPv6 type 0 routing header vulnerable to attack?

A. It allows the receiver of a packet to modify the source IP address

B. It allows the sender to generate multiple ARP requests for each packet

C. it allows the sender of a packet to control its flow.

D. It allows the sender to generate multiple NDP requests for each packet

E. It allows the receiver of a packet to control its flow

Discussion 0

Correct Answer: C Vote an answer

Question #44

Which two ISE Probes would be required to distinguish accurately the difference between an iPad and a MacBook
Pro? (Choose two.)

A. DHCP TRAP

B. SNMPTRAP

C. SNMPQUERY

D. DHCP or DHCPSPAN

E. NESSUS

F. HTTP

Discussion 0

Correct Answer: D,F Vote an answer

Download Free Cisco 350-018 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 350-018 exam.