Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 91:

  Which characteristic is a potential security weakness of a traditional stateful firewall?

  A. It cannot support UDP flows.
  B. It cannot detect application-layer attacks.
  C. It cannot ensure each TCP connection follows a legitimate TCP three-way handshake.
  D. It works only in promiscuous mode.
  E. The status of TCP sessions is retained in the state table after the sessions terminate.
  F. It has low performance due to the use of syn-cookies.
  B. It cannot detect application-layer attacks.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5710/ps1018/product_implementation_design_guide09186a00800fd670.html Cisco IOS Firewall consists of several major subsystems: ?Stateful Packet Inspection provides a granular firewall engine ?Authentication Proxy offers a per-host access control mechanism ?Application Inspection features add protocol conformance checking and network use policy control Enhancements to these features extend these capabilities to VRF instances to support multiple virtual routers per device, and to Cisco Integrated Route-Bridging features to allow greater deployment flexibility, reduce implementation timelines, and ease requirements to add security to existing networks.

• Question 92:

  Which statement best represents the characteristics of a VLAN?

  A. Ports in a VLAN will not share broadcasts amongst physically separate switches.
  B. A VLAN can only connect across a LAN within the same building.
  C. A VLAN is a logical broadcast domain that can span multiple physical LAN segments.
  D. A VLAN provides individual port security.
  C. A VLAN is a logical broadcast domain that can span multiple physical LAN segments.

  ---

  http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/VLANs.html

  Configuring VLANs You can use virtual LANs (VLANs) to divide the network into separate logical areas. VLANs can also be considered as broadcast domains. Any switch port can belong to a VLAN, and unicast, broadcast, and multicast packets are forwarded and flooded only to end stations in that VLAN. Each VLAN is considered a logical network, and packets destined for stations that do not belong to the VLAN must be forwarded through a router.

• Question 93:

  Which IPS technique commonly is used to improve accuracy and context awareness, aiming to detect and respond to relevant incidents only and therefore, reduce noise?

  A. Attack relevancy
  B. Target asset value
  C. Signature accuracy
  D. Risk rating
  D. Risk rating

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0900aecd806e7299.html

  Risk Rating Calculation Risk rating is a quantitative measure of your network's threat level before IPS mitigation. For each event fired by IPS signatures, Cisco IPS Sensor Software calculates a risk rating number. The factors used to calculate risk rating are: ?Signature fidelity rating: This IPS-generated variable indicates the degree of attack certainty. ?Attack severity rating: This IPS-generated variable indicates the amount of damage an attack can cause. ?Target value rating: This user-defined variable indicates the criticality of the attack target. This is the only factor in risk rating that is routinely maintained by the user. You can assign a target value rating per IP address in Cisco IPS Device Manager or Cisco Security Manager. The target value rating can raise or lower the overall risk rating for a network device. You can assign the following target values: ?75: Low asset value ?100: Medium asset value ?200: Mission-critical asset value ?Attack relevancy rating: This IPS-generated value indicates the vulnerability of the attack target. ?Promiscuous deltA. The risk rating of an IPS deployed in promiscuous mode is reduced by the promiscuous delta. This is because promiscuous sensing is less accurate than inline sensing. The promiscuous delta can be configured on a per-signature basis, with a value range of 0 to 30. (The promiscuous delta was introduced in Cisco IPS Sensor Software Version 6.0.) ?Watch list rating: This IPS-generated value is based on data found in the Cisco Security Agent watch list. The Cisco Security Agent watch list contains IP addresses of devices involved in network scans or possibly contaminated by viruses or worms. If an attacker is found on the watch list, the watch list rating for that attacker is added to the risk rating. The value for this factor is between 0 and 35. (The watch list rating was introduced in Cisco IPS Sensor Software Version 6.0.) Risk rating can help enhance your productivity as it intelligently assesses the level of risk of each event and helps you focus on high-risk events.

• Question 94:

  Which option is a feature of Cisco ScanSafe technology?

  A. spam protection
  B. consistent cloud-based policy
  C. DDoS protection
  D. RSA Email DLP
  B. consistent cloud-based policy

  ---

  Cisco Enterprise Branch Web Security The Cisco?Integrated Services Router G2 (ISR G2) Family delivers numerous security services, including firewall, intrusion prevention, and VPN. These security capabilities have been extended with Cisco ISR Web Security with Cisco ScanSafe for a simple, cost-effective, on-demand web security solution that requires no additional hardware. Organizations can deploy and enable market-leading web security quickly and easily, and can enable secure local Internet access for all sites and users, saving bandwidth, money, and resources. Figure 1. Typical Cisco ISR Web Security with Cisco ScanSafe Deployment Cisco ISR Web Security with Cisco ScanSafe enables branch offices to intelligently redirect web traffic to the cloud to enforce granular security and control policy over dynamic Web 2.0 content, protecting branch office users from threats such as Trojans, back doors, rogue scanners, viruses, and worms. The Cisco ISR Web Security with Cisco ScanSafe feature will be available in the Security SEC K9 license bundle Reference: http://www.cisco.com/en/US/prod/collateral/vpndevc/ ps6525/ps6538/ps6540/data_sheet_c78-655324.html

  

• Question 95:

  Which Layer 2 protocol provides loop resolution by managing the physical paths to given network segments?

  A. root guard
  B. port fast
  C. HSRP
  D. STP
  D. STP

  ---

  http://www.cisco.com/en/US/tech/tk389/tk621/technologies_configuration_example09186a008009467c.shtml

  Introduction Spanning Tree Protocol (STP) is a Layer 2 protocol that runs on bridges and switches. The specification for STP is IEEE 802.1D. The main purpose of STP is to ensure that you do not create loops when you have redundant paths in your network. Loops are deadly to a network.

• Question 96:

  Which command configures logging on a Cisco ASA firewall to include the date and time?

  A. logging facility
  B. logging enable
  C. logging timestamp
  D. logging buffered debugging
  C. logging timestamp

• Question 97:

  What will be disabled as a result of the no service password-recovery command?

  A. changes to the config-register setting
  B. ROMMON
  C. password encryption service
  D. aaa new-model global configuration command
  E. the xmodem privilege EXEC mode command to recover the Cisco IOS image
  B. ROMMON

  ---

  http://www.cisco.com/en/US/products/hw/routers/ps274/products_configuration_example09186a00801d8113.shtml

  Background

  ROMMON security is designed not to allow a person with physical access to the router view the configuration file. ROMMON security disables access to the ROMMON, so that a person cannot set the configuration register to ignore the startup configuration. ROMMON security is enabled when the router is configured with the no service password-recovery command.

  Caution: Because password recovery that uses ROMMON security destroys the configuration, it is recommended that you save the router configuration somewhere off the router, such as on a TFTP server.

  Risks

  If a router is configured with the no service password-recovery command, this disables all access to the ROMMON. If there is no valid Cisco IOS software image in the Flash memory of the router, the user is not able to use the ROMMON

  XMODEM command in order to load a new Flash image. In order to fix the router, you must get a new Cisco IOS software image on a Flash SIMM, or on a PCMCIA card, for example on the 3600 Series Routers. In order to minimize this risk,

  a customer who uses ROMMON security must also use dual Flash bank memory and put a backup Cisco IOS software image in a separate partition.

• Question 98:

  DRAG DROP

  Select and Place:

  

  

• Question 99:

  Which type of IPS can identify worms that are propagating in a network?

  A. signature-based IPS
  B. policy-based IPS
  C. anomaly-based IPS
  D. reputation-based IPS
  C. anomaly-based IPS

• Question 100:

  Which statement about rule-based policies in Cisco Security Manager is true?

  A. Rule-based policies contain one or more rules that are related to a device's security and operations parameters.
  B. Rule-based policies contain one or more rules that control how traffic is filtered and inspected on a device.
  C. Rule-based policies contain one or more user roles that are related to a device's security and operations parameters.
  D. Rule-based policies contain one or more user roles that control how user traffic is filtered and inspected on a device.
  B. Rule-based policies contain one or more rules that control how traffic is filtered and inspected on a device.