Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 141:

  DRAG DROP

  Select and Place:

  

  

• Question 142:

  Which four types of VPN are supported using Cisco ISRs and Cisco ASA appliances? (Choose four.)

  A. SSL clientless remote-access VPNs
  B. SSL full-tunnel client remote-access VPNs
  C. SSL site-to-site VPNs
  D. IPsec site-to-site VPNs
  E. IPsec client remote-access VPNs
  F. IPsec clientless remote-access VPNs
  A. SSL clientless remote-access VPNs
  B. SSL full-tunnel client remote-access VPNs
  D. IPsec site-to-site VPNs
  E. IPsec client remote-access VPNs

  ---

  https://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/user/guide/ravpnbas.pdf

  SSL VPN Access Modes SSL VPN provides three modes of remote access on IOS routers: Clientless, Thin Client and Full Client. On ASA devices, there are two modes: Clientless (which includes Clientless and Thin Client port forwarding) and AnyConnect Client (a full client).

  Clientless Access Mode In Clientless mode, the remote user accesses the internal or corporate network using a Web browser on the client machine. No applet downloading is required. Clientless mode is useful for accessing most content that you would expect in a Web browser, such as Internet access, databases, and online tools that employ a Web interface. It supports Web browsing (using HTTP and HTTPS), file sharing using Common Internet File System (CIFS), and Outlook Web Access (OWA) email. For Clientless mode to work successfully, the remote user's PC must be running Windows 2000, Windows XP, or Linux operating systems. Browser-based SSL VPN users connecting from Windows operating systems can browse shared file systems and perform the following operations: view folders, view folder and file properties, create, move, copy, copy from the local host to the remote host, copy from the remote host to the local host, and delete. Internet Explorer indicates when a Web folder is accessible. Accessing this folder launches another window, providing a view of the shared folder, on which users can perform web folder functions, assuming the properties of the folders and documents permit them.

  Thin Client Access Mode Thin Client mode, also called TCP port forwarding, assumes that the client application uses TCP to connect to a well-known server and port. In this mode, the remote user downloads a Java applet by clicking the link provided on the portal page. The Java applet acts as a TCP proxy on the client machine for the services configured on the SSL VPN gateway. The Java applet starts a new SSL connection for every client connection. The Java applet initiates an HTTP request from the remote user client to the SSL VPN gateway. The name and port number of the internal email server is included in the HTTP request. The SSL VPN gateway creates a TCP connection to that internal email server and port. Thin Client mode extends the capability of the cryptographic functions of the Web browser to enable remote access to TCP-based applications such as Post Office Protocol version 3 (POP3), Simple Mail Transfer Protocol (SMTP), Internet Message Access protocol (IMAP), Telnet, and Secure Shell (SSH).

  Note The TCP port-forwarding proxy works only with Sun's Java Runtime Environment (JRE) version 1.4 or later. A Java applet is loaded through the browser that verifies the JRE version. The Java applet refuses to run if a compatible JRE version is not detected. When using Thin Client mode, you should be aware of the following: ?The remote user must allow the Java applet to download and install. ?For TCP port-forwarding applications to work seamlessly, administrative privileges must be enabled for remote users. ?You cannot use Thin Client mode for applications such as FTP, where the ports are negotiated dynamically. That is, you can use TCP port forwarding only with static ports. Full Tunnel Client Access Mode Full Tunnel Client mode enables access to the corporate network completely over an SSL VPN tunnel, which is used to move data at the network (IP) layer. This mode supports most IP-based applications, such as Microsoft Outlook, Microsoft Exchange, Lotus Notes E-mail, and Telnet. Being part of the SSL VPN is completely transparent to the applications run on the client. A Java applet is downloaded to handle the tunneling between the client host and the SSL VPN gateway. The user can use any application as if the client host was in the internal network. The tunnel connection is determined by the group policy configuration. The SSL VPN client (SVC) or AnyConnect client is downloaded and installed to the remote client, and the tunnel connection is established when the remote user logs in to the SSL VPN gateway. By default, the client software is removed from the remote client after the connection is closed, but you can keep it installed, if required. https://learningnetwork.cisco.com/servlet/JiveServlet/downloadBody/12870-102-1- 48375/Cisco%20VPN%20(5).pdf

  LAN-to-LAN IPsec Implementations LAN-to-LAN IPsec is a term often used to describe an IPsec tunnel created between two LANs. These are also called site to site IPsec VPNs. LAN-to-LAN VPNs are created when two private networks are merged across a public network such that the users on either of these networks can access resources on the other network as if they were on their own private network.

  Remote-Access Client IPsec Implementations Remote-access client IPsec VPNs are created when a remote user connects to an IPsec router or access server using an IPsec client installed on the remote user's machine. Generally, these remote-access machines connect to the public network or the Internet using dialup or some other similar means of connectivity. As soon as basic connectivity to the Internet is established, the IPsec client can set up an encrypted tunnel across the pubic network or the Internet to an IPsec termination device located at the edge of the private network to which the client wants to connect and be a part of. These IPsec termination devices are also known as IPsec remoteaccess concentrators.

• Question 143:

  Which statement describes a result of securing the Cisco IOS image using the Cisco IOS image resilience feature?

  A. The show version command does not show the Cisco IOS image file location.
  B. The Cisco IOS image file is not visible in the output from the show flash command.
  C. When the router boots up, the Cisco IOS image is loaded from a secured FTP location.
  D. The running Cisco IOS image is encrypted and then automatically backed up to the NVRAM.
  E. The running Cisco IOS image is encrypted and then automatically backed up to a TFTP server.
  B. The Cisco IOS image file is not visible in the output from the show flash command.

  ---

  http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html

  secure boot-config To take a snapshot of the router running configuration and securely archive it in persistent storage, use the secure boot-config command in global configuration mode. To remove the secure configuration archive and disable configuration resilience, use the no form of this command.

  secure boot-config [restore filename] no secure boot-config Usage Guidelines Without any parameters, this command takes a snapshot of the router running configuration and securely archives it in persistent storage. Like the image, the configuration archive is hidden and cannot be viewed or removed directly from the command-line interface (CLI) prompt . It is recommended that you run this command after the router has been fully configured to reach a steady state of operation and the running configuration is considered complete for a restoration, if required. A syslog message is printed on the console notifying the user of configuration resilience activation. The secure archive uses the time of creation as its filename. For example, .runcfg-20020616-081702.ar was created July 16 2002 at

  8:17:02.

  The restore option reproduces a copy of the secure configuration archive as the supplied filename

  (disk0:running-config, slot1:runcfg, and so on). The restore operation will work only if configuration resilience is enabled. The number of restored copies that can be created is unlimited.

  The no form of this command removes the secure configuration archive and disables configuration resilience.

  An enable, disable, enable sequence has the effect of upgrading the configuration archive if any changes were made to the running configuration since the last time the feature was disabled.

  The configuration upgrade scenario is similar to an image upgrade. The feature detects a different version of Cisco IOS and notifies the user of a version mismatch. The same command can be run to upgrade the configuration archive to a

  newer version after new configuration commands corresponding to features in the new image have been issued.

  The correct sequence of steps to upgrade the configuration archive after an image upgrade is as follows:

  •

  Configure new commands

  •

  Issue the secure boot-config command secure boot-image To enable Cisco IOS image resilience, use the secure boot-image command in global configuration mode. To disable Cisco IOS image resilience and release the secured image so that it can be safely removed, use the no form of this command.

  secure boot-image no secure boot-image Usage Guidelines This command enables or disables the securing of the running Cisco IOS image. The following two possible scenarios exist with this command.

  •

  When turned on for the first time, the running image (as displayed in the show version command output) is secured, and a syslog entry is generated. This command will function properly only when the system is configured to run an image

  from a disk with an Advanced Technology Attachment (ATA) interface. Images booted from a TFTP server cannot be secured. Because this command has the effect of "hiding" the running image, the image file will not be included in any

  directory listing of the disk. The no form of this command releases the image so that it can be safely removed.

  •

  If the router is configured to boot up with Cisco IOS resilience and an image with a different version of Cisco IOS is detected, a message similar to the following is displayed at bootup:

  ios resilience :Archived image and configuration version 12.2 differs from running version 12.3.

  Run secure boot-config and image commands to upgrade archives to running version.

  To upgrade the image archive to the new running image, reenter this command from the console. A message will be displayed about the upgraded image. The old image is released and will be visible in the dir command output.

• Question 144:

  You are troubleshooting a Cisco AnyConnect VPN on a firewall and issue the command "show webvpn anyconnect." The output shows the message "SSL VPN is not enabled" instead of showing the AnyConnect package. Which action can you take to resolve the problem?

  A. Issue the enable outside command.
  B. Issue the anyconnect enable command.
  C. Issue the enable inside command.
  D. Reinstall the AnyConnect image.
  B. Issue the anyconnect enable command.

  ---

  Configuring the ASA to Web-Deploy the Client The section describes the steps to configure the ASA to web-deploy the AnyConnect client. Detailed Steps Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/vpn_anyconnect.html

• Question 145:

  Which type of security control is defense in depth?

  A. threat mitigation
  B. risk analysis
  C. botnet mitigation
  D. overt and covert channels
  A. threat mitigation

  ---

  http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/SAFE_RG/chap1.html

  SAFE Design Blueprint The Cisco SAFE uses the infrastructure-wide intelligence and collaboration capabilities provided by Cisco products to control and mitigate well-known and zero-day attacks. Under the Cisco SAFE design blueprints, intrusion protection systems, firewalls, network admission control, endpoint protection software, and monitoring and analysis systems work together to identify and dynamically respond to attacks. As part of threat control and containment, the designs have the ability to identify the source of a threat, visualize its attack path, and to suggest, and even dynamically enforce, response actions. Possible response actions include the isolation of compromised systems, rate limiting, packet filtering, and more.

  Control is improved through the actions of harden, isolate, and enforce. Following are some of the objectives of the Cisco SAFE design blueprints:

  •

  Adaptive response to real-time threats — Source threats are dynamically identified and may be blocked in realtime.

  •

  Consistent policy enforcement coverage — Mitigation and containment actions may be enforced at different places in the network for defense in-depth.

  •

  Minimize effects of attack — Response actions may be dynamically triggered as soon as an attack is detected, minimizing damage.

  •

  Common policy and security management — A common policy and security management platform simplifies control and administration, and reduces operational expense.

• Question 146:

  Which IPsec transform set provides the strongest protection?

  A. crypto ipsec transform-set 1 esp-3des esp-sha-hmac
  B. crypto ipsec transform-set 2 esp-3des esp-md5-hmac
  C. crypto ipsec transform-set 3 esp-aes 256 esp-sha-hmac
  D. crypto ipsec transform-set 4 esp-aes esp-md5-hmac
  E. crypto ipsec transform-set 5 esp-des esp-sha-hmac
  F. crypto ipsec transform-set 6 esp-des esp-md5-hmac
  C. crypto ipsec transform-set 3 esp-aes 256 esp-sha-hmac

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/

  security_manager/4.1/user/guide/vpipsec.html

  Table 22-2 IKEv2 Proposal Dialog Box

  Name The name of the policy object. A maximum of 128 characters is allowed.

  Description A description of the policy object. A maximum of 1024 characters is allowed. Priority The priority value of the IKE proposal. The priority value determines the order of the IKE proposals compared by the two negotiating peers when

  attempting to find a common security association (SA). If the remote IPsec peer does not support the parameters selected in your first priority policy, the device tries to use the parameters defined in the policy with the next lowest priority

  number. Valid values range from 1 to 65535. The lower the number, the higher the priority. If you leave this field blank, Security Manager assigns the lowest unassigned value starting with 1, then 5, then continuing in increments of 5.

  Encryption Algorithm

  The encryption algorithm used to establish the Phase 1 SA for protecting Phase 2 negotiations. Click Select and select all of the algorithms that you want to allow in the VPN:

  ?AES -- Encrypts according to the Advanced Encryption Standard using 128-bit keys.

  ?AES-192 -- Encrypts according to the Advanced Encryption Standard using 192-bit keys. ?AES-256 -- Encrypts according to the Advanced Encryption Standard using 256-bit keys.

  ?DES -- Encrypts according to the Data Encryption Standard using 56-bit keys.

  ?3DES -- Encrypts three times using 56-bit keys. 3DES is more secure than DES, but requires more processing for encryption and decryption. It is less secure than AES. A 3DES license is required to use this option.

  ?Null -- No encryption algorithm.

  Integrity (Hash) Algorithm

  The integrity portion of the hash algorithm used in the IKE proposal. The hash algorithm creates a message digest, which is used to ensure message integrity.

  Click Select and select all of the algorithms that you want to allow in the VPN:

  ?SHA (Secure Hash Algorithm) -- Produces a 160-bit digest. SHA is more resistant to brute-force attacks than MD5. ?MD5 (Message Digest 5) -- Produces a 128-bit digest. MD5 uses less processing time than SHA. Prf Algorithm The

  pseudo-random function (PRF) portion of the hash algorithm used in the IKE proposal. In IKEv1, the Integrity and PRF algorithms are not separated, but in IKEv2, you can specify different algorithms for these elements. Click Select and select

  all of the algorithms that you want to allow in the VPN:

  ?SHA (Secure Hash Algorithm) -- Produces a 160-bit digest. SHA is more resistant to brute-force attacks than MD5. ?MD5 (Message Digest 5) -- Produces a 128-bit digest. MD5 uses less processing time than SHA.

  Modulus Group

  The Diffie-Hellman group to use for deriving a shared secret between the two IPsec peers without transmitting it to each other. A larger modulus provides higher security but requires more processing time. The two peers must have a

  matching modulus group. Click Select and select all of the groups that you want to allow in the

  VPN:

  ?1 -- Diffie-Hellman Group 1 (768-bit modulus).

  ?2 -- Diffie-Hellman Group 2 (1024-bit modulus). This is the minimum recommended setting. ?5 -- Diffie-Hellman Group 5 (1536-bit modulus, considered good protection for 128-bit keys). Select this option if you are using AES encryption.

  Lifetime

  The lifetime of the security association (SA), in seconds. When the lifetime is exceeded, the SA expires and must be renegotiated between the two peers. As a general rule, the shorter the lifetime (up to a point), the more secure your IKE

  negotiations will be. However, with longer lifetimes, future IPsec security associations can be set up more quickly than with shorter lifetimes.

  You can specify a value from 120 to 2147483647 seconds. The default is 86400.

  Category The category assigned to the object. Categories help you organize and identify rules and objects.

• Question 147:

  You have configured a standard access control list on a router and applied it to interface Serial 0 in an outbound direction. No ACL is applied to Interface Serial 1 on the same router. What happens when traffic being filtered by the access list does not match the configured ACL statements for Serial 0?

  A. The resulting action is determined by the destination IP address.
  B. The resulting action is determined by the destination IP address and port number.
  C. The source IP address is checked, and, if a match is not found, traffic is routed out interface Serial 1.
  D. The traffic is dropped.
  D. The traffic is dropped.

  ---

  http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml Introduction

  This document provides sample configurations for commonly used IP Access Control Lists (ACLs), which filter IP packets based on:

  Source address

  Destination address

  Type of packet

  Any combination of these items

  In order to filter network traffic, ACLs control whether routed packets are forwarded or blocked at the router interface. Your router examines each packet to determine whether to forward or drop the packet based on the criteria that you specify

  within the ACL. ACL criteria include:

  Source address of the traffic

  Destination address of the traffic

  Upper-layer protocol

  Complete these steps to construct an ACL as the examples in this document show:

  Create an ACL.

  Apply the ACL to an interface.

  The IP ACL is a sequential collection of permit and deny conditions that applies to an IP packet. The router tests packets against the conditions in the ACL one at a time.

  The first match determines whether the Cisco IOS?Software accepts or rejects the packet. Because the Cisco IOS Software stops testing conditions after the first match, the order of the conditions is critical. If no conditions match, the router

  rejects the packet because of an implicit deny all clause.

• Question 148:

  Which two countermeasures can mitigate MAC spoofing attacks? (Choose two.)

  A. IP source guard
  B. port security
  C. root guard
  D. BPDU guard
  A. IP source guard
  B. port security

  ---

  Use the port security feature to mitigate MAC spoofing attacks. Port security provides the capability to specify the MAC address of the system connected to a particular port. This also provides the ability to specify an action to take if a port security violation occurs. IP source guard is a security feature that filters traffic based on the DHCP snooping binding database and on manually configured IP source bindings in order to restrict IP traffic on non-routed Layer 2 interfaces. You can use IP source guard to prevent traffic attacks caused when a host tries to use the IP address of its neighbor. IP source guard prevents IP/MAC spoofing Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/72846-layer2-secftrs-catl3fixed.html#ipsourceguard

• Question 149:

  Which of the following are features of IPsec transport mode? (Choose three.)

  A. IPsec transport mode is used between end stations
  B. IPsec transport mode is used between gateways
  C. IPsec transport mode supports multicast
  D. IPsec transport mode supports unicast
  E. IPsec transport mode encrypts only the payload
  F. IPsec transport mode encrypts the entire packet
  A. IPsec transport mode is used between end stations
  D. IPsec transport mode supports unicast
  E. IPsec transport mode encrypts only the payload

• Question 150:

  Which location is recommended for extended or extended named ACLs?

  A. an intermediate location to filter as much traffic as possible
  B. a location as close to the destination traffic as possible
  C. when using the established keyword, a location close to the destination point to ensure that return traffic is allowed
  D. a location as close to the source traffic as possible
  D. a location as close to the source traffic as possible

  ---

  www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

  Apply ACLs

  You can define ACLs without applying them. But, the ACLs have no effect until they are applied to the interface of the router. It is a good practice to apply the ACL on the interface closest to the source of the traffic.