Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 121:

  Which two options are physical security threats? (Choose two.)

  A. hardware
  B. environment
  C. access lists
  D. device configurations
  E. software version
  A. hardware
  B. environment

• Question 122:

  Which two options are characteristics of the Cisco Configuration Professional Security Audit wizard? (Choose two.)

  A. displays a screen with fix-it check boxes to let you choose which potential security-related configuration changes to implement
  B. has two modes of operation: interactive and non-interactive
  C. automatically enables Cisco IOS firewall and Cisco IOS IPS to secure the router
  D. uses interactive dialogs and prompts to implement role-based CLI
  E. requires users to first identify which router interfaces connect to the inside network and which connect to the outside network
  A. displays a screen with fix-it check boxes to let you choose which potential security-related configuration changes to implement
  E. requires users to first identify which router interfaces connect to the inside network and which connect to the outside network

  ---

  http://www.cisco.com/en/US/docs/net_mgmt/cisco_configuration_professional/v2_7/olh/ccp.pdf

  Perform Security Audit

  This option starts the Security Audit wizard. The Security Audit wizard tests your router configuration to determine if any potential security problems exist in the configuration, and then presents you with a screen that lets you determine which

  of those security problems you want to fix. Once determined, the Security Audit wizard will make the necessary changes to the router configuration to fix those problems

  To have Cisco CP perform a security audit and then fix the problems it has found:

  Step 1

  In the Feature bar, select Configure > Security > Security Audit.

  Step 2

  Click Perform Security Audit.

  The Welcome page of the Security Audit wizard appears.

  Step 3

  Click Next>.

  The Security Audit Interface Configuration page appears.

  Step 4

  The Security Audit wizard needs to know which of your router interfaces connect to your inside network and which connect outside of your network. For each interface listed, check either the Inside or Outside check box to indicate where the

  interface connects.

  Step 5

  Click Next> .

  The Security Audit wizard tests your router configuration to determine which possible security problems may exist. A screen showing the progress of this action appears, listing all of the configuration options being tested for, and whether or

  not the current router configuration passes those tests. If you want to save this report to a file, click Save Report.

  Step 6

  Click Close.

  The Security Audit Report Card screen appears, showing a list of possible security problems.

  Step 7

  Check the Fix it boxes next to any problems that you want Cisco Configuration Professional (Cisco CP) to fix.

  For a description of the problem and a list of the Cisco IOS commands that will be added to your configuration, click the problem description to display a help page about that problem.

  Step 8

  Click Next>.

  Step 9

  The Security Audit wizard may display one or more screens requiring you to enter information to fix certain problems. Enter the information as required and click Next> for each of those screens.

  Step 10

  The Summary page of the wizard shows a list of all the configuration changes that Security Audit will make.

  Click Finish to deliver those changes to your router.

• Question 123:

  Which option describes the purpose of Diffie-Hellman?

  A. used between the initiator and the responder to establish a basic security policy
  B. used to verify the identity of the peer
  C. used for asymmetric public key encryption
  D. used to establish a symmetric shared key via a public key exchange process
  D. used to establish a symmetric shared key via a public key exchange process

  ---

  http://www.cisco.com/en/US/docs/routers/access/cisco_router_and_security_device_manager/25/software/user/guide/IKE.html

  D-H Group

  Diffie-Hellman (D-H) Group. Diffie-Hellman is a public-key cryptography protocol that allows two routers to establish a shared secret over an unsecure communications channel. The options are as follows:

  ?group1 -- 768-bit D-H Group. D-H Group 1.

  ?group2 -- 1024-bit D-H Group. D-H Group 2. This group provides more security than group 1, but requires more processing time. ?group5 -- 1536-bit D-H Group. D-H Group 5. This group provides more security than group 2, but requires

  more processing time.

  Note

  ?If your router does not support group5, it will not appear in the list.

  ?Easy VPN servers do not support D-H Group 1.

• Question 124:

  What is the most common Cisco Discovery Protocol version 1 attack?

  A. denial of service
  B. MAC-address spoofing
  C. CAM-table overflow
  D. VLAN hopping
  A. denial of service

• Question 125:

  Which two protocols enable Cisco Configuration Professional to pull IPS alerts from a Cisco ISR router? (Choose two.)

  A. syslog
  B. SDEE
  C. FTP
  D. TFTP
  E. SSH
  F. HTTPS
  B. SDEE
  F. HTTPS

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/prod_white_paper0900aecd805c4ea8.html

  Step 4: Enabling IOS IPS

  The fourth step is to configure IOS IPS using the following sequence of steps:

  Step 4.1: Create a rule name (This will be used on an interface to enable IPS)

  ip ips name < optional ACL>

  router#configure terminal router(config)# ip ips name iosips

  You can specify an optional extended or standard access control list (ACL) to filter the traffic that will be scanned by this rule name. All traffic that is permitted by the ACL is subject to inspection by the IPS. Traffic that is denied by the ACL is

  not inspected by the IPS.

  router(config)#ip ips name ips list ?

  <1-199> Numbered access list

  WORD Named access list

  Step 4.2: Configure IPS signature storage location, this is the directory `ips' created in Step 2 ip ips config location flash:

  router(config)#ip ips config location flash:ips

  Step 4.3: Enable IPS SDEE event notification

  ip ips notify sdee router(config)#ip ips notify sdee

  To use SDEE, the HTTP server must be enabled (via the `ip http server' command). If the HTTP server is not enabled, the router cannot respond to the SDEE clients because it cannot see the requests. SDEE notification is disabled by default

  and must be explicitly enabled.

• Question 126:

  Which statement about ACL operations is true?

  A. The access list is evaluated in its entirety.
  B. The access list is evaluated one access-control entry at a time.
  C. The access list is evaluated by the most specific entry.
  D. The default explicit deny at the end of an access list causes all packets to be dropped.
  B. The access list is evaluated one access-control entry at a time.

• Question 127:

  Refer to the exhibit.

  

  Which statement about the aaa configurations is true?

  A. The authentication method list used by the console port is named test.
  B. The authentication method list used by the vty port is named test.
  C. If the TACACS+ AAA server is not available, no users will be able to establish a Telnet session with the router.
  D. If the TACACS+ AAA server is not available, console access to the router can be authenticated using the local database.
  E. The local database is checked first when authenticating console and vty access to the router.
  B. The authentication method list used by the vty port is named test.

  ---

  http://www.cisco.com/en/US/products/sw/iosswrel/ps1818/products_configuration_example09186a0080204528.shtml Configure AAA Authentication for Login

  To enable authentication, authorization, and accounting (AAA) authentication for logins, use the login authentication command in line configuration mode. AAA services must also be configured.

  Configuration Procedure

  In this example, the router is configured to retrieve users' passwords from a TACACS+ server when users attempt to connect to the router.

  From the privileged EXEC (or "enable") prompt, enter configuration mode and enter the commands to configure the router to use AAA services for authentication:

  router#configure terminal

  Enter configuration commands, one per line. End with CNTL/Z.

  router(config)#aaa new-model

  router(config)#aaa authentication login my-auth-list tacacs+

  router(config)#tacacs-server host 192.168.1.101

  router(config)#tacacs-server key letmein

  Switch to line configuration mode using the following commands. Notice that the prompt changes to reflect the current mode.

  router(config)#line 1 8

  router(config-line)#

  Configure password checking at login.

  router(config-line)#login authentication my-auth-list

  Exit configuration mode.

  router(config-line)#end

  router#

  %SYS-5-CONFIG_I: Configured from console by console

• Question 128:

  When using a stateful firewall, which information is stored in the stateful session flow table?

  A. the outbound and inbound access rules (ACL entries)
  B. the source and destination IP addresses, port numbers, TCP sequencing information, and additional flags for each TCP or UDP connection associated with a particular session
  C. all TCP and UDP header information only
  D. all TCP SYN packets and the associated return ACK packets only
  E. the inside private IP address and the translated inside global IP address
  B. the source and destination IP addresses, port numbers, TCP sequencing information, and additional flags for each TCP or UDP connection associated with a particular session

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/intro.html

  Stateful Inspection Overview

  All traffic that goes through the ASA is inspected using the Adaptive Security Algorithm and either allowed through or dropped. A simple packet filter can check for the correct source address, destination address, and ports, but it does not

  check that the packet sequence or flags are correct. A filter also checks every packet against the filter, which can be a slow process.

  A stateful firewall like the ASA, however, takes into consideration the state of a packet:

  ?Is this a new connection?

  If it is a new connection, the ASA has to check the packet against access lists and perform other tasks to determine if the packet is allowed or denied. To perform this check, the first packet of the session goes through the "session

  management path," and depending on the type of traffic, it might also pass through the "control plane path."

  The session management path is responsible for the following tasks:

  ?Performing the access list checks

  ?Performing route lookups

  ?Allocating NAT translations (xlates)

  ?Establishing sessions in the";fast pat";

  The ASA creates forward and reverse flows in the fast path for TCP traffic; the ASA also creates connection state information for connectionless protocols like UDP, ICMP (when you enable ICMP inspection), so that they can also use the fast

  path.

  Some packets that require Layer 7 inspection (the packet payload must be inspected or altered) are passed on to the control plane path. Layer 7 inspection engines are required for protocols that have two or more channels:

  A data channel, which uses well-known port numbers, and a control channel, which uses different port numbers for each session. These protocols include FTP, H.323, and SNMP.

  ?Is this an established connection?

  If the connection is already established, the ASA does not need to re-check packets; most matching packets can go through the "fast" path in both directions. The fast path is responsible for the following tasks:

  ?IP checksum verification

  ?Session lookup

  ?TCP sequence number check

  ?NAT translations based on existing sessions

  ?Layer 3 and Layer 4 header adjustments

  Data packets for protocols that require Layer 7 inspection can also go through the fast path. Some established session packets must continue to go through the session management path or the control plane path. Packets that go through the

  session management path include HTTP packets that require inspection or content filtering. Packets that go through the control plane path include the control packets for protocols that require Layer 7 inspection.

• Question 129:

  When a network transitions from IPv4 to IPv6, how many bits does the address expand to?

  A. 64 bits
  B. 128 bits
  C. 96 bits
  D. 156 bits
  B. 128 bits

  ---

  IPv6 uses a 128-bit address, allowing 2128, or approximately 3.4?038 addresses, or more than 7.9?028 times as many as IPv4, which uses 32-bit addresses and provides approximately 4.3 billion addresses. Reference: http://en.wikipedia.org/wiki/IPv6

• Question 130:

  What is the best way to prevent a VLAN hopping attack?

  A. Encapsulate trunk ports with IEEE 802.1Q.
  B. Physically secure data closets.
  C. Disable DTP negotiations.
  D. Enable BDPU guard.
  C. Disable DTP negotiations.

  ---

  http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a008013159f.shtml 802.1Q and ISL Tagging Attack Tagging attacks are malicious schemes that allow a user on a VLAN to get unauthorized access to another VLAN. For example, if a switch port were configured as DTP auto and were to receive a fake DTP packet, it might become a trunk port and it might start accepting traffic destined for any VLAN. Therefore, a malicious user could start communicating with other VLANs through that compromised port. Sometimes, even when simply receiving regular packets, a switch port may behave like a full-fledged trunk port (for example, accept packets for VLANs different from the native), even if it is not supposed to. This is commonly referred to as "VLAN leaking" (see [5] for a report on a similar issue).