Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 211:

  Which option is the correct representation of the IPv6 address 2001:0000:150C:0000:0000:41B1:45A3:041D?

  A. 2001::150c::41b1:45a3:041d
  B. 2001:0:150c:0::41b1:45a3:04d1
  C. 2001:150c::41b1:45a3::41d
  D. 2001:0:150c::41b1:45a3:41d
  D. 2001:0:150c::41b1:45a3:41d

  ---

  The first area to address is how to represent these 128 bits. Due to the size of the numbering space, hexadecimal numbers and colons were chosen to represent IPv6 addresses. An example IPv6 address is:

  2001:0DB8:130F:0000:0000:7000:0000:140B

  Note the following:

  •

  There is no case sensitivity. Lower case “a” means the same as capital “A”.

  •

  There are 16 bits in each grouping between the colons.

  – 8 fields * 16 bits/field = 128 bits

  There are some accepted ways to shorten the representation of the above address:

  •

  Leading zeroes can be omitted, so a field of zeroes can be represented by a single 0.

  •

  Trailing zeroes must be represented.

  •

  Successive fields of zeroes can be shortened down to “::”. This shorthand representation can only occur once in the address.

  Taking these rules into account, the address shown above can be shortened to:

  2001:0DB8:130F:0000:0000:7000:0000:140B

  2001:DB8:130F:0:0:7000:0:140B (Leading zeroes)

  2001:DB8:130F:0:0:7000:0:140B (Trailing zeroes)

  2001:DB8:130F::7000:0:140B (Successive field of zeroes)

• Question 212:

  Which RADIUS server authentication protocols are supported on Cisco ASA firewalls? (Choose three.)

  A. EAP
  B. ASCII
  C. PAP
  D. PEAP
  E. MS-CHAPv1
  F. MS-CHAPv2
  C. PAP
  E. MS-CHAPv1
  F. MS-CHAPv2

  ---

  The ASA supports the following authentication methods with RADIUS servers:

  PAP -- For all connection types.

  CHAP and MS-CHAPv1 -- For L2TP-over-IPsec connections.

  MS-CHAPv2 -- For L2TP-over-IPsec connections, and for regular IPsec remote access connections when the password management feature is enabled. You can also use MS-CHAPv2 with clientless connections. Authentication Proxy modes

  -- For RADIUS-to Active-Directory, RADIUS-to-RSA/SDI, RADIUS- to-Token server, and RSA/SDI-to-RADIUS connections

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/ asa_91_general_config/aaa_radius.html

• Question 213:

  Which alert protocol is used with Cisco IPS Manager Express to support up to 10 sensors?

  A. SDEE
  B. Syslog
  C. SNMP
  D. CSM
  A. SDEE

• Question 214:

  DRAG DROP

  Drag from Left to Right in Correct Area.

  Select and Place:

  

  

• Question 215:

  HOTSPOT

  

  

  Hot Area:

  

  

• Question 216:

  If you are implementing VLAN trunking, which additional configuration parameter should be added to the trunking configuration?

  A. no switchport mode access
  B. no switchport trunk native VLAN 1
  C. switchport mode DTP
  D. switchport nonnegotiate
  D. switchport nonnegotiate

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/layer2.html

  Layer 2 LAN Port Modes

  Table 17-2 lists the Layer 2 LAN port modes and describes how they function on LAN ports. switchport mode access Puts the LAN port into permanent nontrunking mode and negotiates to convert the link into a nontrunk link. The LAN port

  becomes a nontrunk port even if the neighboring LAN port does not agree to the change.

  switchport mode dynamic desirable

  Makes the LAN port actively attempt to convert the link to a trunk link. The LAN port becomes a trunk port if the neighboring LAN port is set to trunk, desirable, or auto mode. This is the default mode for all LAN ports.

  switchport mode dynamic auto

  Makes the LAN port willing to convert the link to a trunk link. The LAN port becomes a trunk port if the neighboring LAN port is set to trunk or desirable mode. switchport mode trunk Puts the LAN port into permanent trunking mode and

  negotiates to convert the link into a trunk link. The LAN port becomes a trunk port even if the neighboring port does not agree to the change.

  switchport nonegotiate

  Puts the LAN port into permanent trunking mode but prevents the port from generating DTP frames. You must configure the neighboring port manually as a trunk port to establish a trunk link.

• Question 217:

  With which two NAT types can Cisco ASA implement address translation? (Choose two.)

  A. network object NAT
  B. destination NAT
  C. twice NAT
  D. source NAT
  E. double NAT
  A. network object NAT
  C. twice NAT

• Question 218:

  What are the primary attack methods of VLAN hopping? (Choose two.)

  A. VoIP hopping
  B. Switch spoofing
  C. CAM-table overflow
  D. Double tagging
  B. Switch spoofing
  D. Double tagging

  ---

  VLAN hopping describes when an attacker connects to a VLAN to gain access to traffic on other VLANs that would normally not be accessible. There are two VLAN hopping exploit methods: switch spoofing and double tagging.

  Reference: https://www.nlogic.co/understanding-vlan-hopping-attacks/

• Question 219:

  Which AAA feature can automate record keeping within a network?

  A. TACACS+
  B. authentication
  C. authorization
  D. accounting
  D. accounting

  ---

  In AAA, accounting refers to the record-keeping and tracking of user activities on a computer network. For a given time period this may include, but is not limited to, real-time accounting of time spent accessing the network, the network services employed or accessed, capacity and trend analysis, network cost allocations, billing data, login data for user authentication and authorization, and the data or data amount accessed or transferred. Reference: http:// www.techopedia.com/definition/24130/authentication-authorization-and-accounting-aaa

• Question 220:

  Refer to the exhibit.

  

  Which two changes must you make to the given IOS site-to-site VPN configuration to enable the routers to form a connection? (Choose two.)

  A. Configure a valid route on Router A.
  B. Configure the access list on Router B to mirror Router A.
  C. Configure Router B's ISAKMP policy to match the policy on Router A.
  D. Configure the tunnel modes on the two routers to match.
  B. Configure the access list on Router B to mirror Router A.
  D. Configure the tunnel modes on the two routers to match.

  ---

  You must configure symmetric crypto ACLs for use by IPsec. Both inbound and outbound traffic are evaluated against the same outbound IPsec ACL. The ACL criteria are applied in the forward direction to traffic exiting your router, and the reverse direction to traffic entering your router. When a router receives encrypted packets back from an IPsec peer, it uses the same ACL to determine which inbound packets to decrypt by viewing the source and destination addresses in the ACL in reverse order. Note Important: The crypto ACLs used by IPsec must mirror-image ACLs because both inbound and outbound traffic is evaluated against the same outbound IPsec ACL. Also, the tunnel modes must match on each end. Here we see that Router A is using

  transport mode while Router B is configured for tunnel mode.

  Reference: http://lonetsec.blogspot.com/2011/02/cisco-cli-site-to-site-ipsec-vpn.html