Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 181:

  Which three statements about the IPsec ESP modes of operation are true? (Choose three.)

  A. Tunnel mode is used between a host and a security gateway.
  B. Tunnel mode is used between two security gateways.
  C. Tunnel mode only encrypts and authenticates the data.
  D. Transport mode authenticates the IP header.
  E. Transport mode leaves the original IP header in the clear.
  A. Tunnel mode is used between a host and a security gateway.
  B. Tunnel mode is used between two security gateways.
  E. Transport mode leaves the original IP header in the clear.

  ---

  http://www.cisco.com/en/US/docs/net_mgmt/vpn_solutions_center/2.0/ip_security/provisioning/guide/IPsecPG1.html

  The Encapsulating Security Payload (ESP)

  The Encapsulating Security Payload (ESP) contains six parts as described below. The first two parts are not encrypted, but they are authenticated. Those parts are as follows:

  ?The Security Parameter Index (SPI) is an arbitrary 32-bit number that tells the device receiving the packet what group of security protocols the sender is using for communication. Those protocols include the particular algorithms and keys,

  and how long those keys are valid. ?The Sequence Number is a counter that is incremented by 1 each time a packet is sent to the same address and uses the same SPI. The sequence number indicates which packet is which, and how many

  packets have been sent with the same group of parameters. The sequence number also protects against replay attacks.

  Replay attacks involve an attacker who copies a packet and sends it out of sequence to confuse communicating devices. The remaining four parts of the ESP are all encrypted during transmission across the network. Those parts are as

  follows:

  ?The Payload Data is the actual data that is carried by the packet.

  ?The Padding, from 0 to 255 bytes of data, allows certain types of encryption algorithms to require the data to be a multiple of a certain number of bytes. The padding also ensures that the text of a message terminates on a four-byte boundary

  (an architectural requirement within IP).

  ?The Pad Length field specifies how much of the payload is padding rather than data.

  ?The Next Header field, like a standard IP Next Header field, identifies the type of data carried and the protocol.

  The ESP is added after a standard IP header. Because the packet has a standard IP header, the network can route it with standard IP devices. As a result, IPsec is backwards-compatible with IP routers and other equipment even if that

  equipment isn't designed to use IPsec. ESP can support any number of encryption protocols. It's up to the user to decide which ones to use. Different protocols can be used for every person a user communicates with. However, IPsec

  specifies a basic DES-Cipher Block Chaining mode (CBC) cipher as the default to ensure minimal interoperability among IPsec networks. ESP's encryption capability is designed for symmetric encryption algorithms. IPsec employs

  asymmetric algorithms for such specialized purposes as negotiating keys for symmetric encryption.

  Tunneling with ESP

  Tunneling takes an original IP packet header and encapsulates it within the ESP. Then, it adds a new IP header containing the address of a gateway device to the packet. Tunneling allows a user to send illegal IP addresses through a public

  network (like the Internet) that otherwise would not accept them. Tunneling with ESP offers the advantage of hiding original source and destination addresses from users on the public network. Hiding these addresses reduces the power of

  traffic analysis attacks. A traffic analysis attack employs network monitoring techniques to determine how much data and what type of data is being communicated between two users.

• Question 182:

  What does the MD5 algorithm do?

  A. takes a message less than 2^64 bits as input and produces a 160-bit message digest
  B. takes a variable-length message and produces a 168-bit message digest
  C. takes a variable-length message and produces a 128-bit message digest
  D. takes a fixed-length message and produces a 128-bit message digest
  C. takes a variable-length message and produces a 128-bit message digest

  ---

  http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a0080094203.shtml

  Message Digest 5 (MD5) -- This is a one way hashing algorithm that produces a 128-bit hash. Both MD5 and Secure Hash Algorithm (SHA) are variations on MD4, which is designed to strengthen the security of this hashing algorithm. SHA is more secure than MD4 and MD5. Cisco uses hashes for authentication within the IPsec framework.

• Question 183:

  Which type of address translation should be used when a Cisco ASA is in transparent mode?

  A. Static NAT
  B. Dynamic NAT
  C. Overload
  D. Dynamic PAT
  A. Static NAT

• Question 184:

  What is a possible reason for the error message?Router(config)#aaa server?% Unrecognized command

  A. The command syntax requires a space after the word "server"
  B. The command is invalid on the target device
  C. The router is already running the latest operating system
  D. The router is a new device on which the aaa new-model command must be applied before continuing
  D. The router is a new device on which the aaa new-model command must be applied before continuing

• Question 185:

  Which option is a key difference between Cisco IOS interface ACL configurations and Cisco ASA appliance interface ACL configurations?

  A. The Cisco IOS interface ACL has an implicit permit-all rule at the end of each interface ACL.
  B. Cisco IOS supports interface ACL and also global ACL. Global ACL is applied to all interfaces.
  C. The Cisco ASA appliance interface ACL configurations use netmasks instead of wildcard masks.
  D. The Cisco ASA appliance interface ACL also applies to traffic directed to the IP addresses of the Cisco ASA appliance interfaces.
  E. The Cisco ASA appliance does not support standard ACL. The Cisco ASA appliance only support extended ACL.
  C. The Cisco ASA appliance interface ACL configurations use netmasks instead of wildcard masks.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/acl_extended.html Additional Guidelines and Limitations The following guidelines and limitations apply to creating an extended access list:

  •

  When you enter the access-list command for a given access list name, the ACE is added to the end of the access list unless you specify the line number.

  •

  Enter the access list name in uppercase letters so that the name is easy to see in the configuration. You might want to name the access list for the interface (for example, INSIDE), or you can name it for the purpose for which it is created (for example, NO_NAT or VPN).

  •

  Typically, you identify the ip keyword for the protocol, but other protocols are accepted. For a list of protocol names, see the "Protocols and Applications" section.

  •

  Enter the host keyword before the IP address to specify a single address. In this case, do not enter a mask. Enter the any keyword instead of the address and mask to specify any address.

  •

  You can specify the source and destination ports only for the tcp or udp protocols. For a list of permitted keywords and well-known port assignments, see the "TCP and UDP Ports" section. DNS, Discard, Echo, Ident, NTP, RPC, SUNRPC, and Talk each require one definition for TCP and one for UDP. TACACS+ requires one definition for port 49 on TCP.

  •

  You can specify the ICMP type only for the icmp protocol. Because ICMP is a connectionless protocol, you either need access lists to allow ICMP in both directions (by applying access lists to the source and destination interfaces), or you need to enable the ICMP inspection engine. (See the "Adding an ICMP Type Object Group" section.) The ICMP inspection engine treats ICMP sessions as stateful connections. To control ping, specify echo-reply (0) (ASA to host) or echo (8) (host to ASA). See the "Adding an ICMP Type Object Group" section for a list of ICMP types.

  •

  When you specify a network mask, the method is different from the Cisco IOS software access-list command. The ASA uses a network mask (for example, 255.255.255.0 for a Class C mask). The Cisco IOS mask uses wildcard bits (for example, 0.0.0.255).

  •

  To make an ACE inactive, use the inactive keyword. To reenable it, enter the entire ACE without the inactive keyword. This feature enables you to keep a record of an inactive ACE in your configuration to make reenabling easier.

  •

  Use the disable option to disable logging for a specified ACE.

• Question 186:

  For what purpose is the Cisco ASA appliance web launch SSL VPN feature used?

  A. to enable split tunneling when using clientless SSL VPN access
  B. to enable users to login to a web portal to download and launch the AnyConnect client
  C. to enable smart tunnel access for applications that are not web-based
  D. to optimize the SSL VPN connections using DTLS
  E. to enable single-sign-on so the SSL VPN users need only log in once
  B. to enable users to login to a web portal to download and launch the AnyConnect client

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/administration/guide/ac01intro.html

  AnyConnect Standalone and WebLaunch Options

  The user can use the AnyConnect Client in the following modes:

  ?Standalone mode -- Lets the user establish a Cisco AnyConnect VPN client connection without the need to use a web browser. If you have permanently installed the AnyConnect client on the user's PC, the user can run in standalone mode.

  In standalone mode, a user opens the AnyConnect client just like any other application and enters the username and password credentials into the fields of the AnyConnect GUI. Depending on how you configure the system, the user might

  also be required to select a group. When the connection is established, the security appliance checks the version of the client on the user's PC and, if necessary, downloads the latest version.

  ?WebLaunch mode -- Lets the user enter the URL of the security appliance in the Address or Location field of a browser using the https protocol. The user then enters the username and password information on a Logon screen and selects

  the group and clicks submit. If you have specified a banner, that information appears, and the user acknowledges the banner by clicking Continue.

  The portal window appears. To start the AnyConnect client, the user clicks Start AnyConnect on the main pane. A series of documentary windows appears. When the Connection Established dialog box appears, the connection is working, and

  the user can proceed with online activities. Whether connecting via standalone mode or WebLaunch mode, the AnyConnect client package must be installed on the security appliance in order for the client to connect. This ensures that the

  security appliance is the single point of enforcement as to which versions of the client can establish a session, even if you deploy the client with an enterprise software deployment system. When you load a client package on the security

  appliance, you enforce a policy that only versions as new as the one loaded can connect. AnyConnect users must upgrade their clients by loading the latest version of the client with the latest security features on the security appliance.

• Question 187:

  Under which higher-level policy is a VPN security policy categorized?

  A. application policy
  B. DLP policy
  C. remote access policy
  D. compliance policy
  E. corporate WAN policy
  C. remote access policy

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.0/user/guide/ravpnpag.html

  Remote Access VPN Policy Reference

  The Remote Access VPN policy pages are used to configure remote access VPNs on Cisco IOS security routers, PIX Firewalls, Catalyst 6500 /7600 devices, and Adaptive Security Appliance (ASA) devices.

• Question 188:

  Which type of NAT is used where you translate multiple internal IP addresses to a single global, routable IP address?

  A. policy NAT
  B. dynamic PAT
  C. static NAT
  D. dynamic NAT
  E. policy PAT
  B. dynamic PAT

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_dynamic.html

  Task Flow for Configuring Dynamic NAT and PAT

  Use the following guidelines to configure either Dynamic NAT or PAT:

  ?First configure a nat command, identifying the real addresses on a given interface that you want to translate. ?Then configure a separate global command to specify the mapped addresses when exiting another interface. (In the case of PAT,

  this is one address.) Each nat command matches a global command by comparing the NAT ID, a number that you assign to each command. Note The configuration for dynamic NAT and PAT are almost identical; for NAT you specify a range

  of mapped addresses, and for PAT you specify a single address.

  Figure 29-9 shows a typical dynamic NAT scenario. Only translated hosts can create a NAT session, and responding traffic is allowed back. The mapped address is dynamically assigned from a pool defined by the global command.

  

  Figure 29.9 Dynamic NAT

  Figure 29-10 shows a typical dynamic PAT scenario. Only translated hosts can create a NAT session, and responding traffic is allowed back. The mapped address defined by the global command is the same for each translation, but the port is dynamically assigned. Figure 29-10 Dynamic PAT

  

• Question 189:

  Refer to the exhibit.

  

  Using a stateful packet firewall and given an inside ACL entry of permit ip 192.16.1.0 0.0.0.255 any, what would be the resulting dynamically configured ACL for the return traffic on the outside ACL?

  A. permit tcp host 172.16.16.10 eq 80 host 192.168.1.11 eq 2300
  B. permit ip 172.16.16.10 eq 80 192.168.1.0 0.0.0.255 eq 2300
  C. permit tcp any eq 80 host 192.168.1.11 eq 2300
  D. permit ip host 172.16.16.10 eq 80 host 192.168.1.0 0.0.0.255 eq 2300
  A. permit tcp host 172.16.16.10 eq 80 host 192.168.1.11 eq 2300

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/user/guide/fwinsp.html

  Understanding Inspection Rules

  Inspection rules configure Context-Based Access Control (CBAC) inspection commands. CBAC inspects traffic that travels through the device to discover and manage state information for TCP and UDP sessions. The device uses this state

  information to create temporary openings to allow return traffic and additional data connections for permissible sessions.

  CBAC creates temporary openings in access lists at firewall interfaces. These openings are created when inspected traffic exits your internal network through the firewall. The openings allow returning traffic (that would normally be blocked)

  and additional data channels to enter your internal network back through the firewall. The traffic is allowed back through the firewall only if it is part of the same session as the original traffic that triggered inspection when exiting through the

  firewall.

  Inspection rules are applied after your access rules, so any traffic that you deny in the access rule is not inspected. The traffic must be allowed by the access rules at both the input and output interfaces to be inspected. Whereas access rules

  allow you to control connections at layer 3 (network, IP) or 4 (transport, TCP or UDP protocol), you can use inspection rules to control traffic using application-layer protocol session information.

  For all protocols, when you inspect the protocol, the device provides the following functions:

  •

  Automatically opens a return path for the traffic (reversing the source and destination addresses), so that you do not need to create an access rule to allow the return traffic. Each connection is considered a session, and the device maintains session state information and allows return traffic only for valid sessions. Protocols that use TCP contain explicit session information, whereas for UDP applications, the device models the equivalent of a session based on the source and destination addresses and the closeness in time of a sequence of UDP packets.

  These temporary access lists are created dynamically and are removed at the end of a session.

  •

  Tracks sequence numbers in all TCP packets and drops those packets with sequence numbers that are not within expected ranges.

  •

  Uses timeout and threshold values to manage session state information, helping to determine when to drop sessions that do not become fully established. When a session is dropped, or reset, the device informs both the source and destination of the session to reset the connection, freeing up resources and helping to mitigate potential Denial of Service (DoS) attacks.

• Question 190:

  Which technology provides an automated digital certificate management system for use with IPsec?

  A. ISAKMP
  B. public key infrastructure
  C. Digital Signature Algorithm
  D. Internet Key Exchange
  B. public key infrastructure

  ---

  A PKI is composed of the following entities: ?Peers communicating on a secure network ?At least one certification authority (CA) that grants and maintains certificates ?Digital certificates, which contain information such as the certificate validity period, peer identity information, encryption keys that are used for secure communication, and the signature of the issuing CA ?An optional registration authority (RA) to offload the CA by processing enrollment requests ?A distribution mechanism (such as Lightweight Directory Access Protocol [LDAP] or HTTP) for certificate revocation lists (CRLs) PKI provides customers with a scalable, secure mechanism for distributing, managing, and revoking encryption and identity information in a secured data network. Each entity (router or PC) participating in the secure communication is enrolled, a process by which the entity generates a Rivest, Shamir, and Adelman (RSA) key pair (one private key and one public key) and has its identity validated by a trusted entity (also known as a CA). After each entity enrolls in a PKI, every peer (also known as an end host) in a PKI is granted a digital certificate that has been issued by a CA. When peers must negotiate a secured communication session, they exchange their digital certificates. Using the information in the certificate, a peer can validate the identity of another peer and establish an encrypted session with the public keys contained in the certificate. Reference: http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/layered-perimeter-security-managedservices/ prod_white_paper0900aecd805249e3.html