Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 151:

  During role-based CLI configuration, what must be enabled before any user views can be created?

  A. multiple privilege levels
  B. usernames and passwords
  C. aaa new-model command
  D. secret password for the root user
  E. HTTP and/or HTTPS server
  F. TACACS server group
  C. aaa new-model command

  ---

  http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtclivws.html

  Configuring a CLI View

  Use this task to create a CLI view and add commands or interfaces to the view, as appropriate.

  Prerequisites

  Before you create a view, you must perform the following tasks:

  •

  Enable AAA via the aaa new-model command. (For more information on enabling AAA, see the chapter "Configuring Authentication" in the Cisco IOS Security Configuration Guide, Release 12.3.

  •

  Ensure that your system is in root view — not privilege level 15.

  SUMMARY STEPS

  1.

  enable view

  2.

  configure terminal

  3.

  parser view view-name

  4.

  secret 5 encrypted-password

  5.

  commands parser-mode {include | include-exclusive | exclude} [all] [interface interface-name | command]

  6.

  exit

  7.

  exit

  8.

  enable [privilege-level] [view view-name]

  9.

  show parser view [all]

• Question 152:

  Which Cisco IOS command is used to verify that either the Cisco IOS image, the configuration files, or both have been properly backed up and secured?

  A. show archive
  B. show secure bootset
  C. show flash
  D. show file systems
  E. dir
  F. dir archive
  B. show secure bootset

  ---

  http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_resil_config_ps6922_TSD_Products_Configuration_Guide_Chapter.html

  Restrictions for Cisco IOS Resilient Configuration

  •

  This feature is available only on platforms that support a Personal Computer Memory Card International Association (PCMCIA) Advanced Technology Attachment (ATA) disk. There must be enough space on the storage device to accommodate at least one Cisco IOS image (two for upgrades) and a copy of the running configuration. IOS Files System (IFS) support for secure file systems is also needed by the software.

  •

  It may be possible to force removal of secured files using an older version of Cisco IOS software that does not contain file system support for hidden files.

  •

  This feature can be disabled only by using a console connection to the router. With the exception of the upgrade scenario, feature activation does not require console access.

  •

  You cannot secure a bootset with an image loaded from the network. The running image must be loaded from persistent storage to be secured as primary.

  •

  Secured files will not appear on the output of a dir command issued from an executive shell because the IFS prevents secure files in a directory from being listed. ROM monitor (ROMMON) mode does not have any such restriction and can be used to list and boot secured files. The running image and running configuration archives will not be visible in the Cisco IOS dir command output. Instead, use the show secure bootset command to verify archive existence.

• Question 153:

  What is the transition order of STP states on a Layer 2 switch interface?

  A. listening, learning, blocking, forwarding, disabled
  B. listening, blocking, learning, forwarding, disabled
  C. blocking, listening, learning, forwarding, disabled
  D. forwarding, listening, learning, blocking, disabled
  C. blocking, listening, learning, forwarding, disabled

  ---

  Explanation: Each Layer 2 interface on a switch using spanning tree exists in one of these states:

  Blocking -- The interface does not participate in frame forwarding.

  Listening -- The first transitional state after the blocking state when the spanning tree determines that the interface should participate in frame forwarding.

  Learning -- The interface prepares to participate in frame forwarding.

  Forwarding -- The interface forwards frames.

  Disabled -- The interface is not participating in spanning tree because of a shutdown port, no link on the port, or no spanning-tree instance running on the port

  Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12- 1_22_ea11x/configuration/guide/scg/swstp.html

• Question 154:

  DRAG DROP

  Select and Place:

  

  

• Question 155:

  Which security zone is automatically defined by the system?

  A. The source zone
  B. The self zone
  C. The destination zone
  D. The inside zone
  B. The self zone

  ---

  Reference: http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/ security_manager/3-3-1/configuration/example/ZBF_ConfigExample.html

• Question 156:

  Which two countermeasures can mitigate STP root bridge attacks? (Choose two.)

  A. root guard
  B. BPDU filtering
  C. Layer 2 PDU rate limiter
  D. BPDU guard
  A. root guard
  D. BPDU guard

  ---

  The BPDU guard feature is designed to allow network designers to keep the active network topology predictable. BPDU guard is used to protect the switched network from the problems that may be caused by the receipt of BPDUs on ports that should not be receiving them. The receipt of unexpected BPDUs may be accidental or may be part of an unauthorized attempt to add a switch to the network. BPDU guard is best deployed toward user-facing ports to prevent rogue switch network extensions by an attacker. The root guard feature of Cisco switches is designed to provide a way to enforce the placement of root bridges in the network. Root guard limits the switch ports out of which the root bridge may be negotiated. If a root-guard-enabled port receives BPDUs that are superior to those that the current root bridge is sending, then that port is moved to a root-inconsistent state, which is effectively equal to an STP listening state, and no data traffic is forwarded across that port.

• Question 157:

  Which Cisco Security Manager application collects information about device status and uses it to generate notifications and alerts?

  A. FlexConfig
  B. Device Manager
  C. Report Manager
  D. Health and Performance Monitor
  D. Health and Performance Monitor

  ---

  Health and Performance Monitor - Health and Performance Monitor (HPM) periodically polls monitored ASA devices, IPS devices, and ASA-hosted VPN services for key health and performance data, including critical and non-critical issues,

  such as memory usage, interface status, dropped packets, tunnel status, and so on. This information is used for alert generation and email notification, and to display trends based on aggregated data, which is available for hourly, daily, and

  weekly periods.

  Reference:

  http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/ security_manager/4-4/user/guide/CSMUserGuide_wrapper/wfplan.html

• Question 158:

  Which type of Layer 2 attack causes a switch to flood all incoming traffic to all ports?

  A. MAC spoofing attack
  B. CAM overflow attack
  C. VLAN hopping attack
  D. STP attack
  B. CAM overflow attack

  ---

  http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/white_paper_c11_603836.htmlSummary The MAC Address Overflow attack is effective if the proper mitigation techniques are not in place on the Cisco Catalyst 6500 series switch. By using publicly (free) and available Layer 2 attack tools found on the Internet, anyone who understands how to setup and run these tools could potentially launch an attack on your network.

  MAC address monitoring is a feature present on Cisco Catalyst 6500 Series switches. This feature helps mitigate MAC address flooding and other CAM overflow attacks by limiting the total number of MAC addresses learned by the switch on per-port or per-VLAN basis. With MAC Address Monitoring, a maximum threshold for the total number of MAC addresses can be configured and enforced on a per-port and/or per-VLAN basis.

  MAC address monitoring in Cisco IOS Software allows the definition of a single upper (maximum) threshold. In addition, the number of MAC addresses learned can only be monitored on a per-port or per-VLAN basis, and not a per-port-per-VLAN. By default, MAC address monitoring is disabled in Cisco IOS Software. However, the maximum threshold for all ports and VLANs is configured to 500 MAC address entries, and when the threshold is exceeded the system is set to generate a system message along with a syslog trap. These default values take effect only when MAC address monitoring is enabled. The system can be configured to notify or disable the port or VLAN every time the number of learned MAC addresses exceeds the predefined threshold. In our test, we used the "mac-address-table limit" command on the access layer port interface to configure the MAC address monitoring feature.

• Question 159:

  Which statement about asymmetric encryption algorithms is true?

  A. They use the same key for encryption and decryption of data.
  B. They use the same key for decryption but different keys for encryption of data.
  C. They use different keys for encryption and decryption of data.
  D. They use different keys for decryption but the same key for encryption of data.
  C. They use different keys for encryption and decryption of data.

  ---

  http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_12-4/124_ssh.html

  Transport Layer Protocol

  Server authentication occurs at the transport layer, based on the server possessing a public-private key pair. A server may have multiple host keys using multiple different asymmetric encryption algorithms. Multiple hosts may share the same

  host key. In any case, the server host key is used during key exchange to authenticate the identity of the host. For this authentication to be possible, the client must have presumptive knowledge of the server public host key. RFC 4251

  dictates two alternative trust models that can be used:

  The client has a local database that associates each host name (as typed by the user) with the corresponding public host key. This method requires no centrally administered infrastructure and no third-party coordination.

  The downside is that the database of name-to-key associations may become burdensome to maintain. The host name-to-key association is certified by a trusted Certification Authority (CA). The client knows only the CA root key and can

  verify the validity of all host keys certified by accepted CAs. This alternative eases the maintenance problem, because ideally only a single CA key needs to be securely stored on the client. On the other hand, each host key must be

  appropriately certified by a central authority before authorization is possible.

• Question 160:

  Scenario:

  You are the security admin for a small company. This morning your manager has supplied you with a list of Cisco ISR and CCP configuration questions. Using CCP, your job is to navigate the pre-configured CCP in order to find answers to

  your business question.

  

  Which Class Map is used by the INBOUND Rule?

  A. SERVICE_IN
  B. Class-map-ccp-cls-2
  C. Ccp-cts-2
  D. Class-map SERVICE_IN
  C. Ccp-cts-2