Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 221:

  DRAG DROP

  Select and Place:

  

  

• Question 222:

  Which statement about Control Plane Policing is true?

  A. Control Plane Policing allows QoS filtering to protect the control plane against DoS attacks.
  B. Control Plane Policing classifies traffic into three categories to intercept malicious traffic.
  C. Control Plane Policing allows ACL-based filtering to protect the control plane against DoS attacks.
  D. Control Plane Policing intercepts and classifies all traffic.
  A. Control Plane Policing allows QoS filtering to protect the control plane against DoS attacks.

  ---

  The Control Plane Policing feature allows you to configure a quality of service (QoS) filter that manages the traffic flow of control plane packets to protect the control plane of routers and switches against reconnaissance and denial-of-service (DoS) attacks. In this way, the control plane (CP) can help maintain packet forwarding and protocol states despite an attack or heavy traffic load on the router or switch. Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_plcshp/ configuration/xe-3s/asr1000/qos-plcshp-xe-3s-asr-1000-book/qos-plcshp-ctrl-pln-plc.html

• Question 223:

  Which statement is true about vishing?

  A. Influencing users to forward a call to a toll number (for example, a long distance or international number)
  B. Influencing users to provide personal information over a web page
  C. Using an inside facilitator to intentionally forward a call to a toll number (for example, a long distance or international number)
  D. Influencing users to provide personal information over the phone
  D. Influencing users to provide personal information over the phone

  ---

  Vishing (voice phishing) uses telephony to glean information, such as account details, directly from users. Because many users tend to trust the security of a telephone versus the security of the web, some users are more likely to provide confidential information over the telephone. User education is the most effective method to combat vishing attacks.

• Question 224:

  Which two types of access lists can be used for sequencing? (Choose two.)

  A. reflexive
  B. standard
  C. dynamic
  D. extended
  B. standard
  D. extended

  ---

  Users can apply sequence numbers to permit or deny statements and also reorder, add, or remove such statements from a named IP access list. This feature makes revising IP access lists much easier. Prior to this feature, users could add access list entries to the end of an access list only; therefore needing to add statements anywhere except the end required reconfiguring the access list entirely. Restrictions for IP Access List Entry Sequence Numbering

  •

  This feature does not support dynamic, reflexive, or firewall access lists.

  •

  This feature does not support old-style numbered access lists, which existed before named access lists. Keep in mind that you can name an access list with a number, so numbers are allowed when they are entered in the standard or extended named access list (NACL) configuration mode. Reference: http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsaclseq.html

• Question 225:

  What is the default STP priority on a switch?

  A. 4096
  B. 24576
  C. 16384
  D. 32768
  D. 32768

• Question 226:

  Which protocol secures router management session traffic?

  A. SSTP
  B. POP
  C. Telnet
  D. SSH
  D. SSH

  ---

  http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml

  Encrypting Management Sessions

  Because information can be disclosed during an interactive management session, this traffic must be encrypted so that a malicious user cannot gain access to the data being transmitted. Encrypting the traffic allows a secure remote access connection to the device. If the traffic for a management session is sent over the network in cleartext, an attacker can obtain sensitive information about the device and the network. An administrator is able to establish an encrypted and secure remote access management connection to a device by using the SSH or HTTPS (Secure Hypertext Transfer Protocol) features. Cisco IOS software supports SSH version 1.0 (SSHv1), SSH version 2.0 (SSHv2), and HTTPS that uses Secure Sockets Layer (SSL) and Transport Layer Security (TLS) for authentication and data encryption. Note that SSHv1 and SSHv2 are not compatible.

  Cisco IOS software also supports the Secure Copy Protocol (SCP), which allows an encrypted and secure connection for copying device configurations or software images. SCP relies on SSH. This example configuration enables SSH on a Cisco IOS device: ! ip domain-name example.com ! crypto key generate rsa modulus 2048 ! ip ssh time-out 60 ip ssh authentication-retries 3 ip ssh source-interface GigabitEthernet 0/1 ! line vty 0 4 transport input ssh !

• Question 227:

  Which command provides phase 1 and phase 2 status for all active sessions of an IPsec VPN on a Cisco router?

  A. show crypto map
  B. show crypto ipsec sa
  C. show crypto isakmp sa
  D. show crypto session
  D. show crypto session

• Question 228:

  DRAG DROP

  Refer to the exhibit. Drag the port(s) from the left and drop them on the correct STP roles on the right. Not all options on the left are used.

  

  Select and Place:

  

  

• Question 229:

  Which two services are provided by IPsec? (Choose two.)

  A. Confidentiality
  B. Encapsulating Security Payload
  C. Data Integrity
  D. Authentication Header
  E. Internet Key Exchange
  A. Confidentiality
  C. Data Integrity

  ---

  http://www.cisco.com/en/US/docs/net_mgmt/vpn_solutions_center/2.0/ip_security/provisioning/guide/IPsecPG1.html IPsec Overview A secure network starts with a strong security policy that defines the freedom of access to information and dictates the deployment of security in the network. Cisco Systems offers many technology solutions for building a custom security solution for Internet, extranet, intranet, and remote access networks. These scalable solutions seamlessly interoperate to deploy enterprise-wide network security. Cisco System's IPsec delivers a key technology component for providing a total security solution. Cisco's IPsec offering provides privacy, integrity, and authenticity for transmitting sensitive information over the Internet.

  Cisco's end-to-end offering allows customers to implement IPsec transparently into the network infrastructure without affecting individual workstations or PCs. Cisco IPsec technology is available across the entire range of computing infrastructurE. Windows 95, Windows NT 4.0, and Cisco IOS software.

  IPsec is a framework of open standards for ensuring secure private communications over the Internet. Based on standards developed by the Internet Engineering Task Force (IETF), IPsec ensures confidentiality, integrity, and authenticity of data communications across a public network. IPsec provides a necessary component of a standards-based, flexible solution for deploying a network-wide security policy.

• Question 230:

  Which two statements about SSL-based VPNs are true? (Choose two.)

  A. Asymmetric algorithms are used for authentication and key exchange.
  B. SSL VPNs and IPsec VPNs cannot be configured concurrently on the same router.
  C. The application programming interface can be used to modify extensively the SSL client software for use in special applications.
  D. The authentication process uses hashing technologies.
  E. Both client and clientless SSL VPNs require special-purpose client software to be installed on the client machine.
  A. Asymmetric algorithms are used for authentication and key exchange.
  D. The authentication process uses hashing technologies.

  ---

  http://www.cisco.com/en/US/docs/routers/access/cisco_router_and_security_device_manager/25/software/user/guide/IKE.html

  Add or Edit IKE Policy

  Priority

  An integer value that specifies the priority of this policy relative to the other configured IKE policies. Assign the lowest numbers to the IKE policies that you prefer that the router use. The router will offer those policies first during negotiations.

  Encryption

  The type of encryption that should be used to communicate this IKE policy. Cisco SDM supports a variety of encryption types, listed in order of security. The more secure an encryption type, the more processing time it requires.

  Note If your router does not support an encryption type, the type will not appear in the list.

  Cisco SDM supports the following types of encryption:

  •

  Data Encryption Standard (DES) — This form of encryption supports 56-bit encryption.

  •

  Triple Data Encryption Standard (3DES) — This is a stronger form of encryption than DES, supporting 168-bit encryption.

  •

  AES-128 — Advanced Encryption Standard (AES) encryption with a 128-bit key. AES provides greater security than DES and is computationally more efficient than triple DES.

  •

  AES-192 — Advanced Encryption Standard (AES) encryption with a 192-bit key.

  •

  AES-256 — Advanced Encryption Standard (AES) encryption with a 256-bit key.

  Hash

  The authentication algorithm to be used for the negotiation. There are two options:

  •

  Secure Hash Algorithm (SHA)

  •

  Message Digest 5 (MD5)

  Authentication

  The authentication method to be used.

  •

  Pre-SHARE. Authentication will be performed using pre-shared keys.

  •

  RSA_SIG. Authentication will be performed using digital signatures.

  D-H Group

  Diffie-Hellman (D-H) Group. Diffie-Hellman is a public-key cryptography protocol that allows two routers to establish a shared secret over an unsecure communications channel. The options are as follows:

  •

  group1 — 768-bit D-H Group. D-H Group 1.

  •

  group2 — 1024-bit D-H Group. D-H Group 2. This group provides more security than group 1, but requires

  more processing time.

  •

  group5 — 1536-bit D-H Group. D-H Group 5. This group provides more security than group 2, but requires more processing time.

  Note

  •

  If your router does not support group5, it will not appear in the list.

  •

  Easy VPN servers do not support D-H Group 1.

  Lifetime This is the lifetime of the security association, in hours, minutes and seconds. The default is one day, or 24:00:00.