Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 191:

  

  Scenario:

  You are the security admin for a small company. This morning your manager has supplied you with a list of Cisco ISR and CCP configuration questions. Using CCP, your job is to navigate the pre-configured CCP in order to find answers to

  your business question.

  

  What is included in the Network Object Group INSIDE? (Choose two)

  A. Network 192.168.1.0/24
  B. Network 175.25.133.0/24
  C. Network 10.0.10.0/24
  D. Network 10.0.0.0/8
  E. Network 192.168.1.0/8
  B. Network 175.25.133.0/24
  C. Network 10.0.10.0/24

• Question 192:

  How many crypto map sets can you apply to a router interface?

  A. 3
  B. 2
  C. 4
  D. 1
  D. 1

  ---

  Crypto Map Guidelines You can apply only one crypto map set to a single interface. The crypto map set can include a combination of IPsec/IKE and IPsec/manual entries. Multiple interfaces can share the same crypto map set if you want to apply the same policy to multiple interfaces. Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/ asr1000/sec-sec-for-vpns-w-ipsec-xe-3s-asr1000-book/sec-cfg-vpn-ipsec.html

• Question 193:

  Which command enables subnet 192.168.8.4/30 to communicate with subnet 192.168.8.32/27 on IP protocol 50?

  A. permit esp 192.168.8.4 255.255.255.252 192.168.8.32 255.255.255.224
  B. permit esp 192.168.8.4 0.0.0.31 192.168.8.32 0.0.0.31
  C. permit esp 192.168.8.4 255.255.255.252 224.168.8.32 255.255.255.192
  D. permit esp 192.168.8.4 0.0.0.3 192.168.8.32 0.0.0.31
  D. permit esp 192.168.8.4 0.0.0.3 192.168.8.32 0.0.0.31

  ---

  Access lists use inverse wildcard masks, so a /30 subnet translates to 0.0.0.3, where as a standard wildcard mask used in static routes would be 255.255.255.252. Similarly, a /27 would be .0.0.0.31, which is the opposite of a /27 255.255.255.224 used in static routes.

• Question 194:

  Which three statements about access lists are true? (Choose three.)

  A. Extended access lists should be placed as near as possible to the destination.
  B. Extended access lists should be placed as near as possible to the source.
  C. Standard access lists should be placed as near as possible to the destination.
  D. Standard access lists should be placed as near as possible to the source.
  E. Standard access lists filter on the source address.
  F. Standard access lists filter on the destination address.
  B. Extended access lists should be placed as near as possible to the source.
  C. Standard access lists should be placed as near as possible to the destination.
  E. Standard access lists filter on the source address.

• Question 195:

  When a company puts a security policy in place, what is the effect on the company's business?

  A. minimizing risk
  B. minimizing total cost of ownership
  C. minimizing liability
  D. maximizing compliance
  A. minimizing risk

• Question 196:

  Which source port does IKE use when NAT has been detected between two VPN gateways?

  A. TCP 4500
  B. TCP 500
  C. UDP 4500
  D. UDP 500
  C. UDP 4500

• Question 197:

  Which statement is a benefit of using Cisco IOS IPS?

  A. It uses the underlying routing infrastructure to provide an additional layer of security.
  B. It works in passive mode so as not to impact traffic flow.
  C. It supports the complete signature database as a Cisco IPS sensor appliance.
  D. The signature database is tied closely with the Cisco IOS image.
  A. It uses the underlying routing infrastructure to provide an additional layer of security.

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/product_data_sheet0900aecd803137cf.html

  Product Overview In today's business environment, network intruders and attackers can come from outside or inside the network. They can launch distributed denial-of-service attacks, they can attack Internet connections, and they can exploit network and host vulnerabilities. At the same time, Internet worms and viruses can spread across the world in a matter of minutes. There is often no time to wait for human intervention-the network itself must possess the intelligence to recognize and mitigate these attacks, threats, exploits, worms and viruses. Cisco IOS Intrusion Prevention System (IPS) is an inline, deep-packet inspection-based solution that enables Cisco IOS Software to effectively mitigate a wide range of network attacks. While it is common practice to defend against attacks by inspecting traffic at data centers and corporate headquarters, distributing the network level defense to stop malicious traffic close to its entry point at branch or telecommuter offices is also critical.

  Cisco IOS IPS: Major Use Cases and Key Benefits IOS IPS helps to protect your network in 5 ways:

  

  Key Benefits ?Provides network-wide, distributed protection from many attacks, exploits, worms and viruses exploiting vulnerabilities in operating systems and applications ?Eliminates the need for a standalone IPS device at branch and telecommuter offices as well as small and medium-sized business networks ?Unique, risk rating based signature event action processor dramatically improves the ease of management of IPS policies ?Offers field-customizable worm and attack signature set and event actions ?Offers inline inspection of traffic passing through any combination of router LAN and WAN interfaces in both directions ?Works with Cisco IOS?Firewall, control-plane policing, and other Cisco IOS Software security features to protect the router and networks behind the router ?Supports more than 3700 signatures from the same signature database available for Cisco Intrusion Prevention System (IPS) appliances

• Question 198:

  If a router configuration includes the line aaa authentication login default group tacacs+ enable, which events will occur when the TACACS+ server returns an error? (Choose two.)

  A. The user will be prompted to authenticate using the enable password
  B. Authentication attempts to the router will be denied
  C. Authentication will use the router`s local database
  D. Authentication attempts will be sent to the TACACS+ server
  A. The user will be prompted to authenticate using the enable password
  D. Authentication attempts will be sent to the TACACS+ server

  ---

  The method argument refers to the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. To specify that the authentication should succeed even if all methods return an error, specify none as the final method in the command line.

  Reference: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/ scfathen.html

• Question 199:

  Refer to the exhibit.

  

  Which three statements about these three show outputs are true? (Choose three.)

  A. Traffic matched by ACL 110 is encrypted.
  B. The IPsec transform set uses SHA for data confidentiality.
  C. The crypto map shown is for an IPsec site-to-site VPN tunnel.
  D. The default ISAKMP policy uses a digital certificate to authenticate the IPsec peer.
  E. The IPsec transform set specifies the use of GRE over IPsec tunnel mode.
  F. The default ISAKMP policy has higher priority than the other two ISAKMP policies with a priority of 1 and 2
  A. Traffic matched by ACL 110 is encrypted.
  C. The crypto map shown is for an IPsec site-to-site VPN tunnel.
  D. The default ISAKMP policy uses a digital certificate to authenticate the IPsec peer.

  ---

  http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_s3.html

  Show crypto map Field Descriptions

  Peer

  Possible peers that are configured for this crypto map entry.

  Extended IP access list Access list that is used to define the data packets that need to be encrypted. Packets that are denied by this access list are forwarded but not encrypted. The "reverse" of this access list is used to check the inbound

  return packets, which are also encrypted. Packets that are denied by the "reverse" access list are dropped because they should have been encrypted but were not.

  Extended IP access check

  Access lists that are used to more finely control which data packets are allowed into or out of the IPsec tunnel. Packets that are allowed by the "Extended IP access list" ACL but denied by the "Extended IP access list check" ACL are dropped.

  Current peer Current peer that is being used for this crypto map entry.

  Security association lifetime

  Number of bytes that are allowed to be encrypted or decrypted or the age of the security association before new encryption keys must be negotiated.

  PFS

  (Perfect Forward Secrecy) If the field is marked as `Yes', the Internet Security Association and Key Management Protocol (ISAKMP) SKEYID-d key is renegotiated each time security association (SA) encryption keys are renegotiated

  (requires another Diffie-Hillman calculation). If the field is marked as `No', the same ISAKMP SKEYID-d key is used when renegotiating SA encryption keys. ISAKMP keys are renegotiated on a separate schedule, with a default time of 24

  hours.

  Transform sets

  List of transform sets (encryption, authentication, and compression algorithms) that can be used with this crypto map. Interfaces using crypto map test Interfaces to which this crypto map is applied. Packets that are leaving from this interface

  are subject to the rules of this crypto map for encryption. Encrypted packets may enter the router on any interface, and they are decrypted. Nonencrypted packets that are entering the router through this interface are subject to the "reverse"

  crypto access list check.

• Question 200:

  What hash type does Cisco use to validate the integrity of downloaded images?

  A. Sha1
  B. Sha2
  C. Md5
  D. Md1
  C. Md5