Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 171:

  Which three TACACS+ server-authentication protocols are supported on Cisco ASA firewalls? (Choose three.)

  A. EAP
  B. ASCII
  C. PAP
  D. PEAP
  E. MS-CHAPv1
  F. MS-CHAPv2
  B. ASCII
  C. PAP
  E. MS-CHAPv1

• Question 172:

  Which network device does NTP authenticate?

  A. Only the time source
  B. Only the client device
  C. The firewall and the client device
  D. The client device and the time source
  A. Only the time source

  ---

  NTP authentication is used to authenticate the time source, not the recipient. Reference: http://www.ine.com/resources/ntp-authentication.htm

• Question 173:

  Which technology is the most effective choice for locally mirroring ports to support data investigation for a single device at the data layer?

  A. RMON
  B. SPAN
  C. RSPAN
  D. ERSPAN
  B. SPAN

• Question 174:

  Which Cisco Security Manager feature enables the configuration of unsupported device features?

  A. Deployment Manager
  B. FlexConfig
  C. Policy Object Manager
  D. Configuration Manager
  B. FlexConfig

• Question 175:

  Which two options are two of the built-in features of IPv6? (Choose two.)

  A. VLSM
  B. native IPsec
  C. controlled broadcasts
  D. mobile IP
  E. NAT
  B. native IPsec
  D. mobile IP

  ---

  http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-tunnel.html

  IPv6 IPsec Site-to-Site Protection Using Virtual Tunnel Interface

  The IPv6 IPsec feature provides IPv6 crypto site-to-site protection of all types of IPv6 unicast and multicast traffic using native IPsec IPv6 encapsulation. The IPsec virtual tunnel interface (VTI) feature provides this function, using IKE as the

  management protocol. An IPsec VTI supports native IPsec tunneling and includes most of the properties of a physical interface. The IPsec VTI alleviates the need to apply crypto maps to multiple interfaces and provides a routable interface.

  The IPsec VTI allows IPv6 routers to work as security gateways, establish IPsec tunnels between other security gateway routers, and provide crypto IPsec protection for traffic from internal network when being transmitting across the public

  IPv6 Internet.

  http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-mobile.html

  Mobile IPv6 Overview

  Mobile IPv4 provides an IPv4 node with the ability to retain the same IPv4 address and maintain uninterrupted network and application connectivity while traveling across networks. In Mobile IPv6, the IPv6 address space enables Mobile IP

  deployment in any kind of large environment. No foreign agent is needed to use Mobile IPv6.

  System infrastructures do not need an upgrade to accept Mobile IPv6 nodes. IPv6 autoconfiguration simplifies mobile node (MN) Care of Address (CoA) assignment.

  Mobile IPv6 benefits from the IPv6 protocol itself; for example, Mobile IPv6 uses IPv6 option headers (routing, destination, and mobility) and benefits from the use of neighbor discovery.

  Mobile IPv6 provides optimized routing, which helps avoid triangular routing. Mobile IPv6 nodes work transparently even with nodes that do not support mobility (although these nodes do not have route optimization).

  Mobile IPv6 is fully backward-compatible with existing IPv6 specifications. Therefore, any existing host that does not understand the new mobile messages will send an error message, and communications with the mobile node will be able to

  continue, albeit without the direct routing optimization.

• Question 176:

  Which statement about PVLAN Edge is true?

  A. PVLAN Edge can be configured to restrict the number of MAC addresses that appear on a single port.
  B. The switch does not forward any traffic from one protected port to any other protected port.
  C. By default, when a port policy error occurs, the switchport shuts down.
  D. The switch only forwards traffic to ports within the same VLAN Edge.
  B. The switch does not forward any traffic from one protected port to any other protected port.

  ---

  http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a008017acad.shtml NotE. Some switches (as specified in the Private VLAN Catalyst Switch Support Matrix ) currently support only the PVLAN Edge

  feature. The term "protected ports" also refers to this feature. PVLAN Edge ports have a restriction that prevents communication with other protected ports on the same switch. Protected ports on separate switches, however, can communicate

  with each other. Do not confuse this feature with the normal PVLAN configurations that this document shows. For more information on protected ports, refer to the Configuring Port Security section of the document Configuring Port-Based

  Traffic Control. http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swtrafc.html

  Configuring Protected Ports

  Some applications require that no traffic be forwarded between ports on the same switch so that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use of protected ports ensures that there is no

  exchange of unicast, broadcast, or multicast traffic between these ports on the switch.

  Protected ports have these features:

  A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a protected port. Traffic cannot be forwarded between protected ports at Layer 2; all traffic passing between protected ports must be

  forwarded through a Layer 3 device.

  Forwarding behavior between a protected port and a nonprotected port proceeds as usual.

  The default is to have no protected ports defined.

• Question 177:

  Which type of attack can be prevented by setting the native VLAN to an unused VLAN?

  A. VLAN-hopping attacks
  B. CAM-table overflow
  C. denial-of-service attacks
  D. MAC-address spoofing
  A. VLAN-hopping attacks

  ---

  Another type of VLAN attack is a double-tagging(or double-encapsulated) VLAN hopping attack. This type of attack takes advantage of the way that hardware on most switches operates. Most switches perform only one level of 802.1Q deencapsulation, which allows an attacker to embed a hidden 802.1Q tag inside the frame. This tag allows the frame to be forwarded to a VLAN that the original 802.1Q tag did not specify. The best approach to mitigating double-tagging attacks is to ensure that the native VLAN of the trunk ports is different from the VLAN of any user ports. In fact, it is considered a security best practice to use a fixed VLAN that is distinct from all user VLANs in the switched network as the native VLAN for all 802.1Q trunks. Reference: http://www.ciscopress.com/articles/article.asp?p=2181837andseqNum=10

• Question 178:

  HOTSPOT

  

  Hot Area:

  

  

• Question 179:

  What does the secure boot-config global configuration accomplish?

  A. enables Cisco IOS image resilience
  B. backs up the Cisco IOS image from flash to a TFTP server
  C. takes a snapshot of the router running configuration and securely archives it in persistent storage
  D. backs up the router running configuration to a TFTP server
  E. stores a secured copy of the Cisco IOS image in its persistent storage
  C. takes a snapshot of the router running configuration and securely archives it in persistent storage

  ---

  http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html

  secure boot-config To take a snapshot of the router running configuration and securely archive it in persistent storage, use the secure boot-config command in global configuration mode. To remove the secure configuration archive and disable configuration resilience, use the no form of this command.

  secure boot-config [restore filename] no secure boot-config Usage Guidelines Without any parameters, this command takes a snapshot of the router running configuration and securely archives it in persistent storage. Like the image, the configuration archive is hidden and cannot be viewed or removed directly from the command-line interface (CLI) prompt . It is recommended that you run this command after the router has been fully configured to reach a steady state of operation and the running configuration is considered complete for a restoration, if required. A syslog message is printed on the console notifying the user of configuration resilience activation. The secure archive uses the time of creation as its filename. For example, .runcfg-20020616-081702.ar was created July 16 2002 at

  8:17:02.

  The restore option reproduces a copy of the secure configuration archive as the supplied filename

  (disk0:running-config, slot1:runcfg, and so on). The restore operation will work only if configuration resilience is enabled. The number of restored copies that can be created is unlimited.

  The no form of this command removes the secure configuration archive and disables configuration resilience.

  An enable, disable, enable sequence has the effect of upgrading the configuration archive if any changes were made to the running configuration since the last time the feature was disabled.

  The configuration upgrade scenario is similar to an image upgrade. The feature detects a different version of Cisco IOS and notifies the user of a version mismatch. The same command can be run to upgrade the configuration archive to a

  newer version after new configuration commands corresponding to features in the new image have been issued.

  The correct sequence of steps to upgrade the configuration archive after an image upgrade is as follows:

  •

  Configure new commands

  •

  Issue the secure boot-config command

  secure boot-image

  To enable Cisco IOS image resilience, use the secure boot-image command in global configuration mode. To disable Cisco IOS image resilience and release the secured image so that it can be safely removed, use the no form of this

  command.

  secure boot-image

  no secure boot-image

  Usage Guidelines

  This command enables or disables the securing of the running Cisco IOS image. The following two possible scenarios exist with this command.

  •

  When turned on for the first time, the running image (as displayed in the show version command output) is secured, and a syslog entry is generated. This command will function properly only when the system is configured to run an image

  from a disk with an Advanced Technology Attachment (ATA) interface. Images booted from a TFTP server cannot be secured. Because this command has the effect of "hiding" the running image, the image file will not be included in any

  directory listing of the disk. The no form of this command releases the image so that it can be safely removed.

  •

  If the router is configured to boot up with Cisco IOS resilience and an image with a different version of Cisco IOS is detected, a message similar to the following is displayed at bootup:

  ios resilience :Archived image and configuration version 12.2 differs from running version 12.3.

  Run secure boot-config and image commands to upgrade archives to running version.

  To upgrade the image archive to the new running image, reenter this command from the console. A message will be displayed about the upgraded image. The old image is released and will be visible in the dir command output.

• Question 180:

  Which sensor mode can deny attackers inline?

  A. IPS
  B. fail-close
  C. IDS
  D. fail-open
  A. IPS