Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 111:

  Which router management feature provides for the ability to configure multiple administrative views?

  A. role-based CLI
  B. virtual routing and forwarding
  C. secure config privilege {level}
  D. parser view view name
  A. role-based CLI

  ---

  http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtclivws.html

  Role-Based CLI Access

  The Role-Based CLI Access feature allows the network administrator to define "views," which are a set of operational commands and configuration capabilities that provide selective or partial access to Cisco IOS EXEC and configuration

  (Config) mode commands. Views restrict user access to Cisco IOS command-line interface (CLI) and configuration information; that is, a view can define what commands are accepted and what configuration information is visible. Thus,

  network administrators can exercise better control over access to Cisco networking devices.

• Question 112:

  In which stage of an attack does the attacker discover devices on a target network?

  A. reconnaissance
  B. gaining access
  C. maintaining access
  D. covering tracks
  A. reconnaissance

• Question 113:

  Which Cisco IPS product offers an inline, deep-packet inspection feature that is available in integrated services routers?

  A. Cisco iSDM
  B. Cisco AIM
  C. Cisco IOS IPS
  D. Cisco AIP-SSM
  C. Cisco IOS IPS

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/product_data_sheet0900aecd803137cf.html

  Product Overview

  In today's business environment, network intruders and attackers can come from outside or inside the network.

  They can launch distributed denial-of-service attacks, they can attack Internet connections, and they can exploit network and host vulnerabilities. At the same time, Internet worms and viruses can spread across the world in a matter of

  minutes. There is often no time to wait for human intervention-the network itself must possess the intelligence to recognize and mitigate these attacks, threats, exploits, worms and viruses.

  Cisco IOS Intrusion Prevention System (IPS) is an inline, deep-packet inspection-based solution that enables Cisco IOS Software to effectively mitigate a wide range of network attacks. While it is common practice to defend against attacks by

  inspecting traffic at data centers and corporate headquarters, distributing the network level defense to stop malicious traffic close to its entry point at branch or telecommuter offices is also critical.

  Cisco IOS IPS: Major Use Cases and Key Benefits

  IOS IPS helps to protect your network in 5 ways:

  

  Key Benefits ?Provides network-wide, distributed protection from many attacks, exploits, worms and viruses exploiting vulnerabilities in operating systems and applications ?Eliminates the need for a standalone IPS device at branch and telecommuter offices as well as small and medium-sized business networks ?Unique, risk rating based signature event action processor dramatically improves the ease of management of IPS policies ?Offers field-customizable worm and attack signature set and event actions ?Offers inline inspection of traffic passing through any combination of router LAN and WAN interfaces in both directions ?Works with Cisco IOS?Firewall, control-plane policing, and other Cisco IOS Software security features to protect the router and networks behind the router ?Supports more than 3700 signatures from the same signature database available for Cisco Intrusion Prevention System (IPS) appliances

• Question 114:

  DRAG DROP

  Select and Place:

  

  

• Question 115:

  Which two characteristics represent a blended threat? (Choose two.)

  A. man-in-the-middle attack
  B. trojan horse attack
  C. pharming attack
  D. denial of service attack
  E. day zero attack
  B. trojan horse attack
  E. day zero attack

  ---

  http://www.cisco.com/web/IN/about/network/threat_defense.html

  Rogue developers create such threats by using worms, viruses, or application-embedded attacks. Botnets can be used to seed an attack, for example, rogue developers can use worms or application-embedded attacks, that is an attack that is hidden within application traffic such as web traffic or peer-to-peer shared files, to deposit "Trojans". This combination of attack techniques - a virus or worm used to deposit a Trojan, for example-is relatively new and is known as a blended attack. A blended attack can also occur in phases: an initial attack of a virus with a Trojan that might open up an unsecured port on a computer, disable an access control list (ACL), or disarm antivirus software, with the goal of a more devastating attack to follow soon after. Host Firewall on servers and desktops/ laptops, day zero protection and intelligent behavioral based protection from application vulnerability and related flaws (within or inserted by virus, worms or Trojans) provided great level of confidence on what is happening within an organization on a normal day and when there is a attack situation, which segment and what has gone wrong and gives flexibility and control to stop such situations by having linkages of such devices with monitoring, log-analysis and event co-relation system.

• Question 116:

  Scenario:

  You are the security admin for a small company. This morning your manager has supplied you with a list of Cisco ISR and CCP configuration questions. Using CCP, your job is to navigate the pre-configured CCP in order to find answers to

  your business question.

  

  Which four properties are included in the inspection Cisco Map OUT_SERVICE? (Choose four)

  A. FTP
  B. HTTP
  C. HTTPS
  D. SMTP
  E. P2P
  F. ICMP
  A. FTP
  B. HTTP
  E. P2P
  F. ICMP

  ---

  First option:

  

  Second option:

  

• Question 117:

  Which wildcard mask is associated with a subnet mask of /27?

  A. 0.0.0.31
  B. 0.0.027
  C. 0.0.0.224
  D. 0.0.0.255
  A. 0.0.0.31

• Question 118:

  A Cisco ASA appliance has three interfaces configured. The first interface is the inside interface with a security level of 100. The second interface is the DMZ interface with a security level of 50. The third interface is the outside interface with a security level of 0.

  By default, without any access list configured, which five types of traffic are permitted? (Choose five.)

  A. outbound traffic initiated from the inside to the DMZ
  B. outbound traffic initiated from the DMZ to the outside
  C. outbound traffic initiated from the inside to the outside
  D. inbound traffic initiated from the outside to the DMZ
  E. inbound traffic initiated from the outside to the inside
  F. inbound traffic initiated from the DMZ to the inside
  G. HTTP return traffic originating from the inside network and returning via the outside interface
  H. HTTP return traffic originating from the inside network and returning via the DMZ interface
  I. HTTP return traffic originating from the DMZ network and returning via the inside interface
  J. HTTP return traffic originating from the outside network and returning via the inside interface
  A. outbound traffic initiated from the inside to the DMZ
  B. outbound traffic initiated from the DMZ to the outside
  C. outbound traffic initiated from the inside to the outside
  G. HTTP return traffic originating from the inside network and returning via the outside interface
  H. HTTP return traffic originating from the inside network and returning via the DMZ interface

  ---

  Correct Answer: ABCGH

  http://www.cisco.com/en/US/docs/security/asa/asa70/configuration/guide/intparam.html

  Security Level Overview

  Each interface must have a security level from 0 (lowest) to 100 (highest). For example, you should assign your most secure network, such as the inside host network, to level 100. While the outside network connected to the Internet can be

  level 0. Other networks, such as DMZs can be in between. You can assign interfaces to the same security level. See the "Allowing Communication Between Interfaces on the Same Security Level" section for more information.

  The level controls the following behavior:

  ?Network access -- By default, there is an implicit permit from a higher security interface to a lower security interface (outbound). Hosts on the higher security interface can access any host on a lower security interface. You can limit access by

  applying an access list to the interface. If you enable communication for same security interfaces (see the "Allowing Communication Between Interfaces on the Same Security Level" section), there is an implicit permit for interfaces to access

  other interfaces on the same security level or lower.

  ?Inspection engines -- Some inspection engines are dependent on the security level. For same security interfaces, inspection engines apply to traffic in either direction.

  ?NetBIOS inspection engine -- Applied only for outbound connections.

  ?OraServ inspection engine -- If a control connection for the OraServ port exists between a pair of hosts, then only an inbound data connection is permitted through the security appliance.

  ?Filtering -- HTTP(S) and FTP filtering applies only for outbound connections (from a higher level to a lower level).

  For same security interfaces, you can filter traffic in either direction.

  ?NAT control -- When you enable NAT control, you must configure NAT for hosts on a higher security interface (inside) when they access hosts on a lower security interface (outside).

  Without NAT control, or for same security interfaces, you can choose to use NAT between any interface, or you can choose not to use NAT. Keep in mind that configuring NAT for an outside interface might require a special keyword.

  ?established command -- This command allows return connections from a lower security host to a higher security host if there is already an established connection from the higher level host to the lower level host.

  For same security interfaces, you can configure established commands for both directions.

• Question 119:

  Which three statements about RADIUS are true? (Choose three.)

  A. RADIUS uses TCP port 49.
  B. RADIUS uses UDP ports 1645 or 1812.
  C. RADIUS encrypts the entire packet.
  D. RADIUS encrypts only the password in the Access-Request packet.
  E. RADIUS is a Cisco proprietary technology.
  F. RADIUS is an open standard.
  B. RADIUS uses UDP ports 1645 or 1812.
  D. RADIUS encrypts only the password in the Access-Request packet.
  F. RADIUS is an open standard.

  ---

  

  Reference: http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-2/user/guide/acsuserguide/rad_tac_phase.html

• Question 120:

  Which two characteristics of the TACACS+ protocol are true? (Choose two.)

  A. uses UDP ports 1645 or 1812
  B. separates AAA functions
  C. encrypts the body of every packet
  D. offers extensive accounting capabilities
  E. is an open RFC standard protocol
  B. separates AAA functions
  C. encrypts the body of every packet

  ---

  http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml

  Packet Encryption RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party. TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. For debugging purposes, it is useful to have the body of the packets unencrypted. However, during normal operation, the body of the packet is fully encrypted for more secure communications. Authentication and Authorization RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to decouple authentication and authorization.

  TACACS+ uses the AAA architecture, which separates AAA. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting. For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and accounting. After a NAS authenticates on a Kerberos server, it requests authorization information from a TACACS+ server without having to re-authenticate. The NAS informs the TACACS+ server that it has successfully authenticated on a Kerberos server, and the server then provides authorization information.

  During a session, if additional authorization checking is needed, the access server checks with a TACACS+ server to determine if the user is granted permission to use a particular command. This provides greater control over the commands that can be executed on the access server while decoupling from the authentication mechanism.