Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 201:

  Which Cisco product can help mitigate web-based attacks within a network?

  A. Adaptive Security Appliance
  B. Web Security Appliance
  C. Email Security Appliance
  D. Identity Services Engine
  B. Web Security Appliance

• Question 202:

  Which authentication protocol does the Cisco AnyConnect VPN password management feature require to operate?

  A. MS-CHAPv1
  B. MS-CHAPv2
  C. CHAP
  D. Kerberos
  B. MS-CHAPv2

• Question 203:

  When STP mitigation features are configured, where should the root guard feature be deployed?

  A. toward ports that connect to switches that should not be the root bridge
  B. on all switch ports
  C. toward user-facing ports
  D. Root guard should be configured globally on the switch.
  A. toward ports that connect to switches that should not be the root bridge

  ---

  http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00800ae96b.shtml

  The root guard feature provides a way to enforce the root bridge placement in the network. The root guard ensures that the port on which root guard is enabled is the designated port. Normally, root bridge ports are all designated ports, unless two or more ports of the root bridge are connected together. If the bridge receives superior STP Bridge Protocol Data Units (BPDUs) on a root guard-enabled port, root guard moves this port to a root-inconsistent STP state. This root-inconsistent state is effectively equal to a listening state. No traffic is forwarded across this port. In this way, the root guard enforces the position of the root bridge.

• Question 204:

  What is the first command you enter to configure AAA on a new Cisco router?

  A. aaa configuration
  B. no aaa-configuration
  C. no aaa new-model
  D. aaa new-model
  D. aaa new-model

• Question 205:

  What does level 5 in this enable secret global configuration mode command indicate?

  router#enable secret level 5 password

  A. The enable secret password is hashed using MD5.
  B. The enable secret password is hashed using SHA.
  C. The enable secret password is encrypted using Cisco proprietary level 5 encryption.
  D. Set the enable secret command to privilege level 5.
  E. The enable secret password is for accessing exec privilege level 5.
  D. Set the enable secret command to privilege level 5.

  ---

  To configure the router to require an enable password, use either of the following commands in global configuration mode:

  Router(config)# enable password [level level] {password| encryption-type encrypted-password} Establishes a password for a privilege command mode.

  Router(config)# enable secret [level level] {password | encryption-type encrypted-password} Specifies a secret password, saved using a non-reversible encryption method. (If enable password and enable secret are both set, users must enter

  the enable secret password.)

  Use either of these commands with the level option to define a password for a specific privilege level. After you specify the level and set a password, give the password only to users who need to have access at this level. Use the privilege

  level configuration command to specify commands accessible at various levels.

  Reference: http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfpass.html

• Question 206:

  Which command will configure a Cisco router to use a TACACS+ server to authorize network services with no fallback method?

  A. aaa authorization exec default group tacacs+ none
  B. aaa authorization network default group tacacs+ none
  C. aaa authorization network default group tacacs+
  D. aaa authorization network default group tacacs+ local
  C. aaa authorization network default group tacacs+

• Question 207:

  DRAG DROP

  Select and Place:

  

  

• Question 208:

  Refer to the exhibit.

  

  You are a network manager for your organization. You are looking at your Syslog server reports. Based on the Syslog message shown, which two statements are true? (Choose two.)

  A. Service timestamps have been globally enabled.
  B. This is a normal system-generated information message and does not require further investigation.
  C. This message is unimportant and can be ignored.
  D. This message is a level 5 notification message.
  A. Service timestamps have been globally enabled.
  D. This message is a level 5 notification message.

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_55_se/configuration/guide/swlog.html

  System Log Message Format

  System log messages can contain up to 80 characters and a percent sign (%), which follows the optional sequence number or time-stamp information, if configured. Messages appear in this format:

  seq no:timestamp: %facility-severity-MNEMONIC:description (hostname-n)

  The part of the message preceding the percent sign depends on the setting of the service sequence-numbers, service timestamps log datetime, service timestamps log datetime [localtime] [msec] [show-timezone], or service timestamps log

  uptime global configuration command.

  seq no:

  Stamps log messages with a sequence number only if the service sequence-numbers global configuration command is configured. For more information, see the "Enabling and Disabling Sequence Numbers in Log Messages" section.

  timestamp formats:

  mm/dd hh:mm:ss

  or

  hh:mm:ss (short uptime)

  or

  d h (long uptime)

  Date and time of the message or event. This information appears only if the service timestamps log [datetime | log] global configuration command is configured. For more information, see the "Enabling and Disabling Time Stamps on Log

  Messages" section.facility The facility to which the message refers (for example, SNMP, SYS, and so forth). For a list of supported facilities, see Table 29-4.severity Single-digit code from 0 to 7 that is the severity of the message. For a

  description of the severity levels, see Table 29-3.

  MNEMONIC

  Text string that uniquely describes the message.

  description

  Text string containing detailed information about the event being reported.

  http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_55_se/configuration/guide/swlog.html This example shows part of a logging display with the service timestamps log datetime global configuration command

  enabled:

  *Mar 1 18:46:11: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) (Switch-2)

• Question 209:

  Which three actions can an inline IPS take to mitigate an attack? (Choose three.)

  A. modifying packets inline
  B. denying the connection inline
  C. denying packets inline
  D. resetting the connection inline
  E. modifying frames inline
  F. denying frames inline
  A. modifying packets inline
  B. denying the connection inline
  C. denying packets inline

• Question 210:

  Which option is a characteristic of a stateful firewall?

  A. can analyze traffic at the application layer
  B. allows modification of security rule sets in real time to allow return traffic
  C. will allow outbound communication, but return traffic must be explicitly permitted
  D. supports user authentication
  B. allows modification of security rule sets in real time to allow return traffic

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.1/user/guide/fwinsp.html

  Understanding Inspection Rules

  Inspection rules configure Context-Based Access Control (CBAC) inspection commands. CBAC inspects traffic that travels through the device to discover and manage state information for TCP and UDP sessions. The device uses this state

  information to create temporary openings to allow return traffic and additional data connections for permissible sessions.

  CBAC creates temporary openings in access lists at firewall interfaces. These openings are created when inspected traffic exits your internal network through the firewall. The openings allow returning traffic (that would normally be blocked)

  and additional data channels to enter your internal network back through the firewall. The traffic is allowed back through the firewall only if it is part of the same session as the original traffic that triggered inspection when exiting through the

  firewall.

  Inspection rules are applied after your access rules, so any traffic that you deny in the access rule is not inspected. The traffic must be allowed by the access rules at both the input and output interfaces to be inspected. Whereas access rules

  allow you to control connections at layer 3 (network, IP) or 4 (transport, TCP or UDP protocol), you can use inspection rules to control traffic using application-layer protocol session information. For all protocols, when you inspect the protocol,

  the device provides the following functions:

  ?Automatically opens a return path for the traffic (reversing the source and destination addresses), so that you do not need to create an access rule to allow the return traffic. Each connection is considered a session, and the device maintains

  session state information and allows return traffic only for valid sessions. Protocols that use TCP contain explicit session information, whereas for UDP applications, the device models the equivalent of a session based on the source and

  destination addresses and the closeness in time of a sequence of UDP packets.

  These temporary access lists are created dynamically and are removed at the end of a session. ?Tracks sequence numbers in all TCP packets and drops those packets with sequence numbers that are not within expected ranges. ?Uses

  timeout and threshold values to manage session state information, helping to determine when to drop sessions that do not become fully established. When a session is dropped, or reset, the device informs both the source and destination of

  the session to reset the connection, freeing up resources and helping to mitigate potential Denial of Service (DoS) attacks.