Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 131:

  Which two countermeasures can mitigate ARP spoofing attacks? (Choose two.)

  A. port security
  B. DHCP snooping
  C. IP source guard
  D. dynamic ARP inspection
  B. DHCP snooping
  D. dynamic ARP inspection

• Question 132:

  DRAG DROP

  Select and Place:

  

  

• Question 133:

  Which aaa accounting command is used to enable logging of the start and stop records for user terminal sessions on the router?

  A. aaa accounting network start-stop tacacs+
  B. aaa accounting system start-stop tacacs+
  C. aaa accounting exec start-stop tacacs+
  D. aaa accounting connection start-stop tacacs+
  E. aaa accounting commands 15 start-stop tacacs+
  C. aaa accounting exec start-stop tacacs+

  ---

  http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html

  aaa accounting To enable authentication, authorization, and accounting (AAA) accounting of requested services for billing or security purposes when you use RADIUS or TACACS+, use the aaa accounting command in global configuration mode or template configuration mode. To disable AAA accounting, use the no form of this command. aaa accounting {auth-proxy | system | network | exec | connection | commands level | dot1x} {default | list-name | guarantee-first} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] {radius | group group-name} no aaa accounting {authproxy | system | network | exec | connection | commands level | dot1x} {default | listname | guarantee-first} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] {radius | group group-name} exec Runs accounting for the EXEC shell session. start-stop Sends a "start" accounting notice at the beginning of a process and a "stop" accounting notice at the end of a process. The "start" accounting record is sent in the background. The requested user process begins regardless of whether the "start" accounting notice was received by the accounting server.

• Question 134:

  HOTSPOT

  

  Hot Area:

  

  

• Question 135:

  Which two options are advantages of an application layer firewall? (Choose two.)

  A. provides high-performance filtering
  B. makes DoS attacks difficult
  C. supports a large number of applications
  D. authenticates devices
  E. authenticates individuals
  B. makes DoS attacks difficult
  E. authenticates individuals

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_white_paper0900aecd8058ec85.html

  Adding Intrusion Prevention

  Gartner's definition of a next-generation firewall is one that combines firewall filtering and intrusion prevention systems (IPSs). Like firewalls, IPSs filter packets in real time. But instead of filtering based on user profiles and application policies,

  they scan for known malicious patterns in incoming code, called signatures. These signatures indicate the presence of malware, such as worms, Trojan horses, and spyware.

  Malware can overwhelm server and network resources and cause denial of service (DoS) to internal employees, external Web users, or both. By filtering for known malicious signatures, IPSs add an extra layer of security to firewall

  capabilities; once the malware is detected by the IPS, the system will block it from the network.

  Firewalls provide the first line of defense in any organization's network security infrastructure. They do so by matching corporate policies about users' network access rights to the connection information surrounding each access attempt. If the

  variables don't match, the firewall blocks the access connection. If the variables do match, the firewall allows the acceptable traffic to flow through the network.

  In this way, the firewall forms the basic building block of an organization's network security architecture. It pays to use one with superior performance to maximize network uptime for business-critical operations. The reason is that the rapid

  addition of voice, video, and collaborative traffic to corporate networks is driving the need for firewall engines that operate at very high speeds and that also support application-level inspection. While standard Layer 2 and Layer 3 firewalls

  prevent unauthorized access to internal and external networks, firewalls

  enhanced with application-level inspection examine, identify, and verify application types at Layer 7 to make sure unwanted or misbehaving application traffic doesn't join the network. With these capabilities, the firewall can enforce endpoint

  user registration and authentication and provide administrative control over the use of multimedia applications.

• Question 136:

  Which option is a characteristic of the RADIUS protocol?

  A. uses TCP
  B. offers multiprotocol support
  C. combines authentication and authorization in one process
  D. supports bi-directional challenge
  C. combines authentication and authorization in one process

  ---

  http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml

  Authentication and Authorization

  RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to decouple authentication and authorization.

  TACACS+ uses the AAA architecture, which separates AAA. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting. For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and accounting. After a NAS authenticates on a Kerberos server, it requests authorization information from a TACACS+ server without having to re-authenticate. The NAS informs the TACACS+ server that it has successfully authenticated on a Kerberos server, and the server then provides authorization information.

  During a session, if additional authorization checking is needed, the access server checks with a TACACS+ server to determine if the user is granted permission to use a particular command. This provides greater control over the commands that can be executed on the access server while decoupling from the authentication mechanism.

• Question 137:

  Which statement describes how VPN traffic is encrypted to provide confidentiality when using asymmetric encryption?

  A. The sender encrypts the data using the sender's private key, and the receiver decrypts the data using the sender's public key.
  B. The sender encrypts the data using the sender's public key, and the receiver decrypts the data using the sender's private key.
  C. The sender encrypts the data using the sender's public key, and the receiver decrypts the data using the receiver's public key.
  D. The sender encrypts the data using the receiver's private key, and the receiver decrypts the data using the receiver's public key.
  E. The sender encrypts the data using the receiver's public key, and the receiver decrypts the data using the receiver's private key.
  F. The sender encrypts the data using the receiver's private key, and the receiver decrypts the data using the sender's public key.
  E. The sender encrypts the data using the receiver's public key, and the receiver decrypts the data using the receiver's private key.

  ---

  http://www.cisco.com/en/US/tech/tk1132/technologies_white_paper09186a00800e79cb.shtml

  Public-Key Cryptography and Asymmetric Encryption

  In asymmetric encryption, two different keys are used to render data illegible to anyone who may be eavesdropping on a conversation. The certificates contain the two components of asymmetric encryption:

  public key and private key.

  Data that is encrypted with the public key can be decrypted with the private key, and vice versa. However, data encrypted with the public key cannot be decrypted with the public key. The parties who need to encrypt their communications will

  exchange their public keys (contained in the certificate), but will not disclose their private keys. The sending party will use the public key of the receiving party to encrypt message data and forward the ciphertext (encrypted data) to the other

  party. The receiving party will then decrypt the ciphertext with their private key.

  Data encrypted with the public key cannot be decrypted with the public key. This prevents someone from compromising the ciphertext after acquiring both public keys by eavesdropping on the certificate exchange.

• Question 138:

  Which four methods are used by hackers? (Choose four.)

  A. footprint analysis attack
  B. privilege escalation attack
  C. buffer Unicode attack
  D. front door attacks
  E. social engineering attack
  F. Trojan horse attack
  A. footprint analysis attack
  B. privilege escalation attack
  E. social engineering attack
  F. Trojan horse attack

  ---

  https://learningnetwork.cisco.com/servlet/JiveServlet/download/15823-1-57665/CCNA%20Security%20(640-554)%20Portable%20Command%20Guide_ch01.pdf

  Thinking Like a Hacker

  The following seven steps may be taken to compromise targets and applications:

  Step 1 Perform footprint analysis

  Hackers generally try to build a complete profile of a target company's security posture using a broad range of easily available tools and techniques. They can discover organizational domain names, network blocks, IP addresses of systems,

  ports, services that are used, and more.

  Step 2 Enumerate applications and operating systems

  Special readily available tools are used to discover additional target information. Ping sweeps use Internet Control Message Protocol (ICMP) to discover devices on a network. Port scans discover TCP/UDP port status.

  Other tools include Netcat, Microsoft EPDump and Remote Procedure Call (RPC) Dump, GetMAC, and software development kits (SDKs).

  Step 3 Manipulate users to gain access

  Social engineering techniques may be used to manipulate target employees to acquire passwords. They may call or email them and try to convince them to reveal passwords without raising any concern or suspicion.

  Step 4 Escalate privileges

  To escalate their privileges, a hacker may attempt to use Trojan horse programs and get target users to unknowingly copy malicious code to their corporate system.

  Step 5 Gather additional passwords and secrets

  With escalated privileges, hackers may use tools such as the pwdump and LSADump applications to gather passwords from machines running Windows.

  Step 6 Install back doors

  Hacker may attempt to enter through the "front door," or they may use "back doors" into the system. The backdoor method means bypassing normal authentication while attempting to remain undetected. A common backdoor point is a

  listening port that provides remote access to the system.

  Step 7 Leverage the compromised system

  After hackers gain administrative access, they attempt to hack other systems.

• Question 139:

  Which security measures can protect the control plane of a Cisco router? (Choose two.)

  A. CCPr
  B. Parser views
  C. Access control lists
  D. Port security
  E. CoPP
  A. CCPr
  E. CoPP

  ---

  Reference: http://www.ciscopress.com/articles/article.asp?p=1924983andseqNum=3

• Question 140:

  Which syslog level is associated with LOG_WARNING?

  A. 1
  B. 2
  C. 3
  D. 4
  E. 5
  F. 6
  G. 7
  D. 4

  ---