Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 1:

  Which option represents a step that should be taken when a security policy is developed?

  A. Perform penetration testing.
  B. Determine device risk scores.
  C. Implement a security monitoring system.
  D. Perform quantitative risk analysis.
  D. Perform quantitative risk analysis.

  ---

  The security policy developed in your organization drives all the steps taken to secure network resources. The development of a comprehensive security policy prepares you for the rest of your security implementation. To create an effective

  security policy, it is necessary to do a risk analysis, which will be used to maximize the effectiveness of the policy and procedures that will be put in place. Also, it is essential that everyone be aware of the policy; otherwise, it is doomed to fail.

  Two types of risk analysis are of interest in information security:

  Quantitative: Quantitative risk analysis uses a mathematical model that assigns monetary values to assets, the cost of threats being realized, and so on.

  Quantitative risk analysis provides an actual monetary figure of expected losses, which is typically based on an annual cost. You can then use this number to justify proposed countermeasures. For example, if you can establish that you will

  lose $1,000,000 by doing nothing, you can justify spending $300,000 to reduce that risk by 50 percent to 75 percent.

  Qualitative: Qualitative risk analysis uses a scenario model. This approach is best for large cities, states, and countries to use because it is impractical for such entities to try to list all their assets, which is the starting point for any quantitative

  risk analysis. By the time a typical national government could list all of its assets, the list would have hundreds or thousands of changes and would no longer be accurate.

  Reference: http://www.ciscopress.com/articles/article.asp?p=1998559andseqNum=2

• Question 2:

  You use Cisco Configuration Professional to enable Cisco IOS IPS. Which state must a signature be in before any actions can be taken when an attack matches that signature?

  A. Enabled
  B. Unretired
  C. Successfully complied
  D. Successfully complied and unretired
  E. Successfully complied and enabled
  F. Unretired and enabled
  G. Enabled, unretired, and successfully complied
  G. Enabled, unretired, and successfully complied

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/prod_white_paper0900aecd8066d265.html

  Step 21. Verify the signatures are loaded properly by using this command at the router prompt:

  router#show ip ips signatures count

  Cisco SDF release version S353.0

  Trend SDF release version V0.0

  |

  snip

  |

  Total Signatures: 2363

  Total Enabled Signatures: 1025

  Total Retired Signatures: 1796

  Total Compiled Signatures: 567

  Total Obsoleted Signatures: 15

  Step 23. To retire/unretire and enable/disable signatures, select the Edit IPS tab, then select Signatures. Highlight the signature(s), and then click the Enable, Disable, Retire, or Unretire button. Notice the status changed in the Enabled or the

  Retired column. A yellow icon appears for the signature(s) in the column next to Enabled. The yellow icon means changes have been made to the signature, but have not been applied.

  Click the Apply Changes button to make the changes take effect.

  Retire/unretire is to select/de-select which signatures are being used by IOS IPS to scan traffic. Retiring a signature means IOS IPS will NOT compile that signature into memory for scanning. Unretiring a signature instructs IOS IPS to compile

  the signature into memory and use the signature to scan traffic.

  Enable/disable does NOT select/de-select signatures to be used by IOS IPS.

  Enabling a signature means that when triggered by a matching packet (or packet flow), the signature takes the appropriate action associated with it. However, only unretired AND successfully compiled signatures will take the action when they

  are enabled. In other words, if a signature is retired, even though it is enabled, it will not be compiled (because it is retired) and it will not take the action associated with it.

  Disabling a signature means that when triggered by a matching packet (or packet flow), the signature DOES NOT take the appropriate action associated with it. In other words, when a signature is disabled, even though it is unretired and

  successfully compiled, it will not take the action associated with it.

  

• Question 3:

  Which command configures a device to actively watch connection requests and provide immediate protection from DDoS attacks?

  A. router(config)# ip tcp intercept mode intercept
  B. router(config)# ip tcp intercept mode watch
  C. router(config)# ip tcp intercept max-incomplete high 100
  D. router(config)# ip tcp intercept drop-mode random
  A. router(config)# ip tcp intercept mode intercept

• Question 4:

  When configuring role-based CLI on a Cisco router, which step is performed first?

  A. Log in to the router as the root user.
  B. Create a parser view called "root view."
  C. Enable role-based CLI globally on the router using the privileged EXEC mode Cisco IOS command.
  D. Enable the root view on the router.
  E. Enable AAA authentication and authorization using the local database.
  F. Create a root local user in the local database.
  D. Enable the root view on the router.

  ---

  http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtclivws.html

  Role-Based CLI Access The Role-Based CLI Access feature allows the network administrator to define "views," which are a set of operational commands and configuration capabilities that provide selective or partial access to Cisco IOS EXEC and configuration (Config) mode commands. Views restrict user access to Cisco IOS command-line interface (CLI) and configuration information; that is, a view can define what commands are accepted and what configuration information is visible. Thus, network administrators can exercise better control over access to Cisco networking devices. Configuring a CLI View Prerequisites Before you create a view, you must perform the following tasks:

  •

  Enable AAA via the aaa new-model command. (For more information on enabling AAA, see the chapter "Configuring Authentication" in the Cisco IOS Security Configuration Guide, Release 12.3.

  •

  Ensure that your system is in root view—not privilege level 15. SUMMARY STEPS

  1.

  enable view

  2.

  configure terminal

  3.

  parser view view-name

  4.

  secret 5 encrypted-password

  5.

  commands parser-mode {include | include-exclusive | exclude} [all] [interface interface-name | command]

  6.

  exit

  7.

  exit

  8.

  enable [privilege-level] [view view-name]

  9.

  show parser view [all] DETAILED STEPS Step 1 Enable view Router> enable view Enables root view.

• Question 5:

  Which Cisco management tool provides the ability to centrally provision all aspects of device configuration across the Cisco family of security products?

  A. Cisco Configuration Professional
  B. Security Device Manager
  C. Cisco Security Manager
  D. Cisco Secure Management Server
  C. Cisco Security Manager

  ---

  Cisco Security Manager 4.4 Data Sheet Cisco Security Manager is a comprehensive management solution that enables advanced management and rapid troubleshooting of multiple security devices. Cisco Security Manager provides scalable, centralized management from which administrators can efficiently manage a wide range of Cisco security devices, gain visibility across the network deployment, and securely share information with other essential network services such as compliance systems and advanced security analysis systems. Designed to maximize operational efficiency, Cisco Security Manager also includes a powerful suite of automated capabilities, such as health and performance monitoring, software image management, auto-conflict detection, and integration with ticketing systems. Reference: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5739/ps6498/data_sheet_c78-27090.html

• Question 6:

  Which two options are symmetric-key algorithms that are recommended by Cisco? (Choose two.)

  A. Twofish
  B. Advanced Encryption Standard
  C. Blowfish
  D. Triple Data Encryption Standard
  B. Advanced Encryption Standard
  D. Triple Data Encryption Standard

  ---

  Recommendations for Cryptographic Algorithms

  

  Symmetric key algorithms use the same key for encryption and decryption. Examples include 3DES and AES. 3DES, which consists of three sequential Data Encryption Standard (DES) encryption-decryptions, is a legacy algorithm. This designation means 3DES provides a marginal but acceptable security level, but its keys should be renewed relatively often. Because of its small key size, DES is no longer secure and should be avoided. RC4 should be avoided as well. AES with 128-bit keys provides adequate protection for sensitive information. AES with 256-bit keys is required to protect classified information of higher importance. Reference: http://www.cisco.com/web/about/security/intelligence/nextgen_crypto.html

• Question 7:

  Which type of Cisco IOS access control list is identified by 100 to 199 and 2000 to 2699?

  A. standard
  B. extended
  C. named
  D. IPv4 for 100 to 199 and IPv6 for 2000 to 2699
  B. extended

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_9_ea1/ configuration/guide/swacl.html

  ACL Numbers The number you use to denote your ACL shows the type of access list that you are creating. Table 23-2 lists the access list number and corresponding type and shows whether or not they are supported by the switch. The Catalyst 2950 switch supports IP standard and IP extended access lists, numbers 1 to 199 and 1300 to 2699. 1-99 IP standard access list 100-199 IP extended access list 200-299 Protocol type-code access list 300-399 DECnet access list 400-499 XNS standard access list 500-599 XNS extended access list 600-699 AppleTalk access list 700-799 48-bit MAC address access list 800-899 IPX standard access list 900-999 IPX extended access list 1000-1099 IPX SAP access list 1100-1199 Extended 48-bit MAC address access list 1200-1299 IPX summary address access list 1300-1999 IP standard access list (expanded range) 2000-2699 IP extended access list (expanded range)

• Question 8:

  Which two protocols are used in a server-based AAA deployment? (Choose two.)

  A. RADIUS
  B. TACACS+
  C. HTTPS
  D. WCCP E. HTTP
  A. RADIUS
  B. TACACS+

  ---

  Remote Security Database Standards Supported by Cisco Several remote security database standards have been written to provide uniform access control for network equipment and users. A variety of applications have been developed as shareware and as commercial products to conform to the standards. Cisco network equipment supports the three primary security server protocols: TACACS+, RADIUS, and Kerberos. TACACS+ and RADIUS are the predominant security server protocols used for AAA with network access servers, routers, and firewalls. These protocols are used to communicate access control information between the security server and the network equipment. Cisco has also developed the CiscoSecure ACS family of remote security databases to support the TACACS+ and RADIUS protocols. Reference: http://www.ciscopress.com/articles/article.asp?p=25471andseqNum=6

• Question 9:

  When a company puts a security policy in place, what is the effect on the company's business?

  A. Minimizing risk
  B. Minimizing total cost of ownership
  C. Minimizing liability
  D. Maximizing compliance
  A. Minimizing risk

• Question 10:

  On which protocol number does Encapsulating Security Payload operate?

  A. 06
  B. 47
  C. 50
  D. 51
  C. 50

  ---

  Encapsulating Security Payload (ESP) is a member of the IPsec protocol suite. In IPsec it provides origin authenticity, integrity and confidentiality protection of packets. ESP also supports encryption-only and authentication-only configurations, but using encryption without authentication is strongly discouraged because it is insecure. Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. However, in Tunnel Mode, where the entire original IP packet is encapsulated with a new packet header added, ESP protection is afforded to the whole inner IP packet (including the inner header) while the outer header (including any outer IPv4 options or IPv6 extension headers) remains unprotected. ESP operates directly on top of IP, using IP protocol number 50. Reference: http://en.wikipedia.org/wiki/IPsec