Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 101:

  Which three applications comprise Cisco Security Manager? (Choose three.)

  A. Configuration Manager
  B. Packet Tracer
  C. Device Manager
  D. Event Viewer
  E. Report Manager
  F. Syslog Monitor
  A. Configuration Manager
  D. Event Viewer
  E. Report Manager

  ---

  The Security Manager client includes three main applications:

  •

  Configuration Manager — This is the primary application. You use Configuration Manager to manage the device inventory, create and edit local and shared policies, manage VPN configurations, and deploy policies to devices. Configuration Manager is the largest of the applications and most of the documentation addresses this application. If a procedure does not specifically mention an application, the procedure is using Configuration Manager.

  •

  Event Viewer — This is an event monitoring application, where you can view and analyze events generated from IPS, ASA, and FWSM devices that you have configured to send events to Security Manager.

  •

  Report Manager — This is a reporting application, where you can view and create reports of aggregated information on device and VPN statistics. Much of the information is derived from events available through Event Viewer, but some of the VPN statistics are obtained by communicating directly with the device.

  Reference: http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/4-1/user/guide/CSMUserGuide_wrapper/wfplan.html

• Question 102:

  SIMULATION

  

  Correct Answer. Here is the solution below
  Here is the solution below

  ---

  Switch1>enable Switch1#config tSwitch1(config)#interface fa0/12Switch1(config-if)#switchport mode accessSwitch1(config-if)#switchport port-security maximum 2Switch1(config-if)#switchport port-security violation shutdownSwitch1(config-if)#no shutSwitch1(config-if)#endSwitch1#copy run start

• Question 103:

  Which security measure must you take for native VLANs on a trunk port?

  A. Native VLANs for trunk ports should never be used anywhere else on the switch.
  B. The native VLAN for trunk ports should be VLAN 1.
  C. Native VLANs for trunk ports should match access VLANs to ensure that cross-VLAN traffic from multiple switches can be delivered to physically disparate switches.
  D. Native VLANs for trunk ports should be tagged with 802.1Q.
  A. Native VLANs for trunk ports should never be used anywhere else on the switch.

  ---

  http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a008013159f.shtml

  Double Encapsulation Attack

  When double-encapsulated 802.1Q packets are injected into the network from a device whose VLAN happens to be the native VLAN of a trunk, the VLAN identification of those packets cannot be preserved from end to end since the 802.1Q

  trunk would always modify the packets by stripping their outer tag. After the external tag is removed, the internal tag permanently becomes the packet's only VLAN identifier. Therefore, by double encapsulating packets with two different tags,

  traffic can be made to hop across VLANs.

  This scenario is to be considered a misconfiguration, since the 802.1Q standard does not necessarily force the users to use the native VLAN in these cases. As a matter of fact, the proper configuration that should always be used is to clear

  the native VLAN from all 802.1Q trunks (alternatively, setting them to 802.1q-all- tagged mode achieves the exact same result). In cases where the native VLAN cannot be cleared, then always pick an unused VLAN as native VLAN of all the

  trunks; don't use this VLAN for any other purpose.

  Protocols like STP, DTP, and UDLD (check out [3]) should be the only rightful users of the native VLAN and their traffic should be completely isolated from any data packets.

• Question 104:

  When AAA login authentication is configured on Cisco routers, which two authentication methods should be used as the final method to ensure that the administrator can still log in to the router in case the external AAA server fails? (Choose two.)

  A. group RADIUS
  B. group TACACS+
  C. local
  D. krb5
  E. enable
  F. if-authenticated
  C. local
  E. enable

  ---

  http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scftplus.html

  TACACS+ Authentication Examples The following example shows how to configure TACACS+ as the security protocol for PPP authentication: aaa new-model aaa authentication ppp test group tacacs+ local tacacs-server host 10.1.2.3 tacacs-server key goaway interface serial 0 ppp authentication chap pap test The lines in the preceding sample configuration are defined as follows:

  •

  The aaa new-model command enables the AAA security services.

  •

  The aaa authentication command defines a method list, "test," to be used on serial interfaces running PPP. The keyword group tacacs+ means that authentication will be done through TACACS+. If TACACS+ returns an ERROR of some sort during authentication, the keyword local indicates that authentication will be attempted using the local database on the network access server. http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800946a3.shtml Authentication Start to configure TAC+ on the router. Enter enable mode and type configure terminal before the command set. This command syntax ensures that you are not locked out of the router initially, providing the tac_plus_executable is not running: !--- Turn on TAC+. aaa new-model enable password whatever !--- These are lists of authentication methods. !--- "linmethod", "vtymethod", "conmethod", and !--- so on are names of lists, and the methods !--- listed on the same lines are the methods !--- in the order to be tried. As used here, if !--- authentication fails due to the !--- tac_plus_executable not being started, the !--- enable password is accepted because !--- it is in each list. ! aaa authentication login linmethod tacacs+ enable aaa authentication login vtymethod tacacs+ enable aaa authentication login conmethod tacacs+ enable

• Question 105:

  Which type of firewall technology is considered the versatile and commonly used firewall technology?

  A. static packet filter firewall
  B. application layer firewall
  C. stateful packet filter firewall
  D. proxy firewall
  E. adaptive layer firewall
  C. stateful packet filter firewall

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5710/ps1018/

  product_implementation_design_guide09186a00800fd670.html

  Cisco IOS Firewall includes multiple security features:

  ?Cisco IOS Firewall stateful packet inspection provides true firewall capabilities to protect networks against unauthorized traffic and control legitimate business- critical data.

  ?Authentication proxy controls access to hosts or networks based on user credentials stored in an authentication, authorization, and accounting (AAA) server. ?Multi-VRF firewall offers firewall services on virtual routers with virtual routing and

  forwarding (VRF), accommodating overlapping address space to provide multiple isolated private route spaces with a full range of security services.

  ?Transparent firewall adds stateful inspection without time-consuming, disruptive IP addressing modifications. ?Application inspection controls application activity to provide granular policy enforcement of application usage, protecting

  legitimate application protocols from rogue applications and malicious activity.

• Question 106:

  Refer to the exhibit.

  

  

  This Cisco IOS access list has been configured on the FA0/0 interface in the inbound direction.

  Which four TCP packets sourced from 10.1.1.1 port 1030 and routed to the FA0/0 interface are permitted? (Choose four.)

  A. destination ip address: 192.168.15.37 destination port: 22
  B. destination ip address: 192.168.15.80 destination port: 23
  C. destination ip address: 192.168.15.66 destination port: 8080
  D. destination ip address: 192.168.15.36 destination port: 80
  E. destination ip address: 192.168.15.63 destination port: 80
  F. destination ip address: 192.168.15.40 destination port: 21
  B. destination ip address: 192.168.15.80 destination port: 23
  C. destination ip address: 192.168.15.66 destination port: 8080
  D. destination ip address: 192.168.15.36 destination port: 80
  E. destination ip address: 192.168.15.63 destination port: 80

  ---

  http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml

  Extended ACLs (registered customers only) control traffic by comparing the source and destination addresses of the IP packets to the addresses configured in the ACL. You can also make extended ACLs more granular and configured to filter

  traffic by criteria such as:

  Protocol

  Port numbers

  Differentiated services code point (DSCP) value

  Precedence value

  State of the synchronize sequence number (SYN) bit

  The command syntax formats of extended ACLs are:

  IP

  access-list access-list-number [dynamic dynamic-name [timeout minutes]]

  {deny | permit} protocol source source-wildcard destination

  destination-wildcard

  [precedence precedence] [tos tos] [log | log-input]

  [time-range time-range-name][fragments]

  Internet Control Message Protocol (ICMP)

  access-list access-list-number [dynamic dynamic-name [timeout minutes]]

  {deny | permit}

  icmp source source-wildcard destination destination-wildcard [icmp-type

  [icmp-code] | [icmp-message]] [precedenceprecedence] [tos tos] [log |

  log-input] [time-range time-range-name][fragments]

  Transport Control Protocol (TCP)

  access-list access-list-number [dynamic dynamic-name [timeout minutes]]

  {deny | permit} tcp

  source source-wildcard [operator [port]] destination destination-wildcard

  [operator [port]] [established] [precedence precedence] [tos tos] [log |

  log-input] [time-range time-range-name][fragments]

  User Datagram Protocol (UDP)

  access-list access-list-number [dynamic dynamic-name [timeout minutes]]

  {deny | permit} udp

  source source-wildcard [operator [port]] destination destination-wildcard

  [operator [port]] [precedence precedence] [tos tos] [log | log-input]

  [time-range time-range-name][fragments]

• Question 107:

  How are Cisco IOS access control lists processed?

  A. Standard ACLs are processed first.
  B. The best match ACL is matched first.
  C. Permit ACL entries are matched first before the deny ACL entries.
  D. ACLs are matched from top down.
  E. The global ACL is matched first before the interface ACL.
  D. ACLs are matched from top down.

  ---

  http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

  Process ACLs Traffic that comes into the router is compared to ACL entries based on the order that the entries occur in the router. New statements are added to the end of the list. The router continues to look until it has a match. If no matches are found when the router reaches the end of the list, the traffic is denied. For this reason, you should have the frequently hit entries at the top of the list. There is an implied deny for traffic that is not permitted. A single-entry ACL with only one deny entry has the effect of denying all traffic. You must have at least one permit statement in an ACL or all traffic is blocked. These two ACLs (101 and 102) have the same effect.

• Question 108:

  Which two features are supported by Cisco IronPort Security Gateway? (Choose two.)

  A. Spam protection
  B. Outbreak intelligence
  C. HTTP and HTTPS scanning
  D. Email encryption
  E. DDoS protection
  A. Spam protection
  D. Email encryption

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps10128/ps10154/data-sheet-c78-729751.html

  Product Overview Over the past 20 years, email has evolved from a tool used primarily by technical and research professionals to become the backbone of corporate communications. Each day, more than 100 billion corporate email messages are exchanged. As the level of use rises, security becomes a greater priority. Mass spam campaigns are no longer the only concern. Today, spam and malware are just part of a complex picture that includes inbound threats and outbound risks. Cisco?Email Security solutions defend mission-critical email systems with appliance, virtual, cloud, and hybrid solutions. The industry leader in email security solutions, Cisco delivers: Fast, comprehensive email protection that can block spam and threats before they even hit your network Flexible cloud, virtual, and physical deployment options to meet your ever-changing business needs Outbound message control through on-device data-loss prevention (DLP), email encryption, and optional integration with the RSA enterprise DLP solution One of the lowest total cost of ownership (TCO) email security solutions available

• Question 109:

  Which command verifies phase 2 of an IPsec VPN on a Cisco router?

  A. show crypto map
  B. show crypto ipsec sa
  C. show crypto isakmp sa
  D. show crypto engine connection active
  B. show crypto ipsec sa

  ---

  show crypto isakmp sa [active | standby] Shows the ISAKMP/IKE Phase 1 management SAs; you can qualify the command with two parameters, where active displays only the active SAs and standby displays only the SAs in an "STDBY" (standby) state. show crypto ipsec sa [active | standby] Shows the ISAKMP/IKE Phase 2 data SAs; you can qualify this command with two parameters, which perform the same function as described in the last bullet point. Reference: https://sites.google.com/site/networkexams/tccnp-icsw1

• Question 110:

  Which two options are for securing NTP? (Choose two.)

  A. a stratum clock
  B. access lists
  C. Secure Shell
  D. authentication
  E. Telnet
  B. access lists
  D. authentication