Free Cisco 350-018 Practice Test & Real Exam Questions

Exam Code/Number: 350-018
Exam Name/Title: CCIE Security Written Exam v4.0
Certification Provider: Cisco
Corresponding Certification: CCIE

Exam Questions: 875
Updated On: Aug 11, 2026

Question #1

Which two statements about PCI DSS are true?(Choose two)

A. it is an IETF standard for companies to protect credit, debit ,and ATM cardholder information.

B. it is a proprietary security standard that defines a framework for credit, debit ,and ATM cardholder information.

C. it is a US government standard that defines ISP security compliance

D. it is a criminal act of cardholder information fraud.

E. it has as one of its objectives to restrict physical access to credit, debit ,and ATM cardholder information.

Discussion 0

Correct Answer: B,E Vote an answer

Question #2

Refer to the exhibit.

You have configured two route-map instances on R1. which passes traffic from switch 1 on both VLAN 1 and VLAN 2
You wish to ensure that * The first route-map instance matches packets from VLAN 1 and sets the next hop to
3232:2/128. * The second route-map instance matches packets from VLAN 2 and sets the next hop to 3232:3/128.
What feature can you implement on R1 to make this configuration possible?

A. BGP local-preference

B. GLBP

C. VSSP

D. BGP next-hop

E. PBR

Discussion 0

Correct Answer: E Vote an answer

Question #3

Which three statements about the IANA are true? (Choose three.)

A. IANA oversees global IP address allocation.

B. IANA defines URI schemes for use on the Internet.

C. IANA is a department that is operated by the IETF.

D. IANA managed the root zone in the DNS.

E. IANA is administered by the ICANN.

Discussion 0

Correct Answer: A,D,E Vote an answer

Question #4

policy-map type inspect ipv6 IPv6-map
match header routing-type range 0 255
drop
class-map outside-class
match any
policy-map outside-policy
class outside-class
inspect ipv6 IPv6-map
service-policy outside-policy interface outside
Refer to the exhibit.

Given the Cisco ASA configuration above, which commands need to be added in order for the Cisco ASA appliance to
deny all IPv6 packets with more than three extension headers?

A. policy-map type inspect ipv6 IPv6-map
match header count gt 3
drop

B. class-map outside-class
match ipv6 header count greater 3

C. policy-map type inspect ipv6 IPv6-map
match ipv6 header
count > 3

D. policy-map outside-policy
class outside-class
inspect ipv6 header count gt 3

Discussion 0

Correct Answer: A Vote an answer

Question #5

Which statement is correct about the Cisco IOS Control Plane Protection feature?

A. The open-port option of a port-filtering policy allows access to all TCP/UDP based services that are configured on
the router.

B. Control Plane Protection is restricted to the IPv4 or IPv6 input path.

C. Traffic that is destined to the router with IP options will be redirected to the host control plane.

D. Disabling CEF will remove all active control-plane protection policies. Aggregate control-plane policies will continue
to operate.?

Discussion 0

Correct Answer: D Vote an answer

Question #6

Refer to the exhibit.

Which statement about the configuration commands is true?

A. Changing the default order of authentication does not introduce additional authentication traffic in the network.

B. By default, the switch attempts MAB and then Dot1x.

C. These commands return an error because of a mismatch between the Dot1x order and priority.

D. These are valid configuration commands and the switch accepts them.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #7

Hierarchical priority queuing is used on the interfaces on which you enable a traffic-shaping queue. Which two
statements about hierarchical priority queuing are true? (Choose two.)

A. For IPsec-encrypted packets, you cannot match traffic based on the DSCP or precedence setting.

B. IPsec over TCP is supported for priority traffic classification.

C. IPsec over TCP is not supported for priority traffic classification.

D. Priority packets are never dropped from the shape queue unless the sustained rate of priority traffic exceeds the
shape rate.

E. For IPsec-encrypted packets, you can match traffic based only on the DSCP or precedence setting.

Discussion 0

Correct Answer: C,E Vote an answer

Question #8

What is an RFC 2827 recommendation for protecting your network against DoS attacks with IP address spoofing?

A. Use the TLS protocol to secure the network against eavesdropping

B. Use ingress traffic filtering to limit traffic from a downstream network to known advertised prefixes.

C. Brower-based applications should be filtered on the source to protect your network from know advertised prefix

D. Advertise only assigned global IP addresses to the internet

Discussion 0

Correct Answer: B Vote an answer

Question #9

Refer to the exhibit.

Which three command sets are required to complete this IPv6 IPsec site-to-site VTI? (Choose three.)

A. interface Tunnel0
ipv6 enable

B. interface Tunnel0
ipv6 enable-ipsec

C. interface Tunnel0
tunnel mode ipsec ipv6

D. ipv6 unicast-routing

E. crypto isakmp-profile
match identity address ipv6 any

Discussion 0

Correct Answer: A,C,D Vote an answer

Question #10

Which statement about the ASA redundant interface is true?

A. The redundant interface uses the MAC address of the second physical interface in the pair.

B. It is a logical interface that combines two physical interfaces, both of which are active.

C. By default, the first physical interface that is configured in the pair is the active interface.

D. It can only be used for failover links.

Discussion 0

Correct Answer: C Vote an answer

Question #11

Which two statements about SSL VPN smart tunnels on a Cisco IOS device are true? (Choose two.)

A. They can be started in more than one Web browser at the same time.

B. They are incompatible with split tunneling.

C. They do not support FTP.

D. They support private socket libraries.

E. They are incompatible with MAPI proxy.

Discussion 0

Correct Answer: B,E Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Download Free Cisco 350-018 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 350-018 exam.