Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 161:

  Which IPsec component takes an input message of arbitrary length and produces a fixed-length output message?

  A. the transform set
  B. the group policy
  C. the hash
  D. the crypto map
  C. the hash

• Question 162:

  If the native VLAN on a trunk is different on each end of the link, what is a potential consequence?

  A. The interface on both switches may shut down.
  B. STP loops may occur.
  C. The switch with the higher native VLAN may shut down.
  D. The interface with the lower native VLAN may shut down.
  B. STP loops may occur.

• Question 163:

  Which command causes a Layer 2 switch interface to operate as a Layer 3 interface?

  A. no switchport nonnegotiate
  B. switchport
  C. no switchport mode dynamic auto
  D. no switchport
  D. no switchport

• Question 164:

  Which option is the most effective placement of an IPS device within the infrastructure?

  A. Inline, behind the internet router and firewall
  B. Inline, before the internet router and firewall
  C. Promiscuously, after the Internet router and before the firewall
  D. Promiscuously, before the Internet router and the firewall
  A. Inline, behind the internet router and firewall

• Question 165:

  A clientless SSL VPN user who is connecting on a Windows Vista computer is missing the menu option for Remote Desktop Protocol on the portal web page. Which action should you take to begin troubleshooting?

  A. Ensure that the RDP2 plug-in is installed on the VPN gateway
  B. Reboot the VPN gateway
  C. Instruct the user to reconnect to the VPN gateway
  D. Ensure that the RDP plug-in is installed on the VPN gateway
  A. Ensure that the RDP2 plug-in is installed on the VPN gateway

  ---

  

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/ asa_84_cli_config/vpn_clientless_ssl.html

• Question 166:

  Which two functions are required for IPsec operation? (Choose two.)

  A. using SHA for encryption
  B. using PKI for pre-shared key authentication
  C. using IKE to negotiate the SA
  D. using AH protocols for encryption and authentication
  E. using Diffie-Hellman to establish a shared-secret key
  C. using IKE to negotiate the SA
  E. using Diffie-Hellman to establish a shared-secret key

  ---

  http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a0080094203.shtml

  Configure ISAKMP IKE exists only to establish SAs for IPsec. Before it can do this, IKE must negotiate an SA (an ISAKMP SA) relationship with the peer. Since IKE negotiates its own policy, it is possible to configure multiple policy statements with different configuration statements, then let the two hosts come to an agreement. ISAKMP negotiates: Oakley This is a key exchange protocol that defines how to acquire authenticated keying material. The basic mechanism for Oakley is the Diffie-Hellman key exchange algorithm. You can find the standard in RFC 2412: The OAKLEY Key Determination Protocol leavingcisco.com.

• Question 167:

  Which Cisco IOS command will verify authentication between a router and a AAA server?

  A. debug aaa authentication
  B. test aaa group
  C. test aaa accounting
  D. aaa new-model
  B. test aaa group

  ---

  To validate that the Cisco IOS device can access and securely communicate with the RADIUS server the "test aaa" exec mode command can be used:

  switch#test aaa group radius user1 cisco new-code User successfully authenticated

  Reference: http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/whitepaper_C11-731907.html

• Question 168:

  On which protocol number does the authentication header operate?

  A. 06
  B. 47
  C. 50
  D. 51
  D. 51

  ---

  Authentication Header (AH) is a member of the IPsec protocol suite. AH guarantees connectionless integrity and data origin authentication of IP packets. Further, it can optionally protect against replay attacks by using the sliding window

  technique and discarding old packets (see below). In IPv4, the AH protects the IP payload and all header fields of an IP datagram except for mutable fields (i.e. those that might be altered in transit), and also IP options such as the IP Security

  Option (RFC-1108). Mutable (and therefore unauthenticated) IPv4 header fields are DSCP/ToS, ECN, Flags, Fragment Offset, TTL and Header Checksum.

  In IPv6, the AH protects most of the IPv6 base header, AH itself, non-mutable extension headers after the AH, and the IP payload. Protection for the IPv6 header excludes the mutable fields: DSCP, ECN, Flow Label, and Hop Limit.

  AH operates directly on top of IP, using IP protocol number 51.

  Reference: http://en.wikipedia.org/wiki/IPsec

• Question 169:

  Which statement is true about configuring access control lists to control Telnet traffic destined to the router itself?

  A. The ACL is applied to the Telnet port with the ip access-group command.
  B. The ACL should be applied to all vty lines in the in direction to prevent an unwanted user from connecting to an unsecured port.
  C. The ACL applied to the vty lines has no in or out option like ACL being applied to an interface.
  D. The ACL must be applied to each vty line individually.
  B. The ACL should be applied to all vty lines in the in direction to prevent an unwanted user from connecting to an unsecured port.

  ---

  http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/12-4t/sec-cntrl-acc-vtl.html

  Controlling Access to a Virtual Terminal Line

  You can control who can access the virtual terminal lines (vtys) to a router by applying an access list to inbound vtys. You can also control the destinations that the vtys from a router can reach by applying an access list to outbound vtys.

  Benefits of Controlling Access to a Virtual Terminal Line

  By applying an access list to an inbound vty, you can control who can access the lines to a router. By applying an access list to an outbound vty, you can control the destinations that the lines from a router can reach.

• Question 170:

  Which options are filtering options used to display SDEE message types? (Choose two.)

  A. stop
  B. none
  C. error
  D. all
  C. error
  D. all

  ---

  SDEE Messages

  Choose the SDEE message type to display:

  All -- SDEE error, status, and alert messages are shown.

  Error -- Only SDEE error messages are shown.

  Status -- Only SDEE status messages are shown.

  Alerts -- Only SDEE alert messages are shown.

  Reference: http://www.cisco.com/c/en/us/td/docs/routers/access/ cisco_router_and_security_device_manager/24/software/user/guide/IPS.html#wp1083698