Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 241:

  What are three of the security conditions that Cisco Configuration Professional One-Step Lockdown can automatically detect and correct on a Cisco router? (Choose three.)

  A. One-Step Lockdown can set the enable secret password.
  B. One-Step Lockdown can disable unused ports.
  C. One-Step Lockdown can disable the TCP small servers service.
  D. One-Step Lockdown can enable IP Cisco Express Forwarding.
  E. One-Step Lockdown can enable DHCP snooping.
  F. One-Step Lockdown can enable SNMP version 3.
  A. One-Step Lockdown can set the enable secret password.
  C. One-Step Lockdown can disable the TCP small servers service.
  D. One-Step Lockdown can enable IP Cisco Express Forwarding.

  ---

  One-Step Lockdown This option tests you router configuration for any potential security problems and automatically makes any necessary configuration changes to correct any problems found. The conditions checked for and, if needed, corrected are as follows: ?Disable Finger Service ?Disable PAD Service ?Disable TCP Small Servers Service ?Disable UDP Small Servers Service ?Disable IP BOOTP Server Service ?Disable IP Identification Service ?Disable CDP ?Disable IP Source Route ?Enable Password Encryption Service ?Enable TCP Keepalives for Inbound Telnet Sessions ?Enable TCP Keepalives for Outbound Telnet Sessions ?Enable Sequence Numbers and Time Stamps on Debugs ?Enable IP CEF ?Disable IP Gratuitous ARPs ?Set Minimum Password Length to Less Than 6 Characters ?Set Authentication Failure Rate to Less Than 3 Retries ?Set TCP Synwait Time ?Set Banner ?Enable Logging ?Set Enable Secret Password ?Disable SNMP ?Set Scheduler Interval ?Set Scheduler Allocate ?Set Users ?Enable Telnet Settings ?Enable NetFlow Switching ?Disable IP Redirects ?Disable IP Proxy ARP ?Disable IP Directed Broadcast ?Disable MOP Service ?Disable IP Unreachables ?Disable IP Mask Reply ?Disable IP Unreachables on NULL Interface ?Enable Unicast RPF on Outside Interfaces ?Enable Firewall on All of the Outside Interfaces ?Set Access Class on HTTP Server Service ?Set Access Class on VTY Lines ?Enable SSH for Access to the Router

  Reference: http://www.cisco.com/c/en/us/td/docs/routers/access/cisco_router_and_security_device_manager/24/software/user/guide/SAudt.html

• Question 242:

  DRAG DROP

  Select and Place:

  

  

• Question 243:

  Which network security framework is used to set up access control on Cisco Appliances?

  A. RADIUS
  B. AAA
  C. TACACS+
  D. NAS
  B. AAA

  ---

  AAA is a security framework that can be used to set up access control on Cisco routers, switches, firewalls, and other network appliances. AAA provides the ability to control who is allowed to access network devices and what services the

  user should be allowed to access. AAA services are commonly used to control telnet or console access to network devices.

  Reference: http://www.freeccnastudyguide.com/study-guides/ccna/ch8/aaa-security/

• Question 244:

  Refer to the exhibit.

  

  Which statement is correct based on the show login command output shown?

  A. When the router goes into quiet mode, any host is permitted to access the router via Telnet, SSH, and HTTP, since the quiet-mode access list has not been configured.
  B. The login block-for command is configured to block login hosts for 93 seconds.
  C. All logins from any sources are blocked for another 193 seconds.
  D. Three or more login requests have failed within the last 100 seconds.
  D. Three or more login requests have failed within the last 100 seconds.

  ---

  http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_login_enhance_ps6922_TSD_Products_Configuration_Guide_Chapter.html Showing login Parameters: Example The following sample output from the show login command verifies that the router is in quiet mode. In this example, the login block-for command was configured to block login hosts for 100 seconds if 3 or more login requests fail within 100 seconds.

  Router# show login

  A default login delay of 1 seconds is applied.

  No Quiet-Mode access list has been configured.

  All successful login is logged and generate SNMP traps.

  All failed login is logged and generate SNMP traps.

  Router enabled to watch for login Attacks.

  If more than 2 login failures occur in 100 seconds or less, logins will be disabled for 100 seconds. Router presently in Quiet-Mode, will remain in Quiet-Mode for 93 seconds, Denying logins from all sources.

• Question 245:

  Which option is the resulting action in a zone-based policy firewall configuration with these conditions?

  

  A. no impact to zoning or policy
  B. no policy lookup (pass)
  C. drop
  D. apply default policy
  C. drop

  ---

  http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/xe-3s/sec-zone-pol-fw.html Zone Pairs

  A zone pair allows you to specify a unidirectional firewall policy between two security zones. To define a zone pair, use the zone-pair security command. The direction of the traffic is specified by source and destination zones. The source and destination zones of a zone pair must be security zones. You can select the default or self zone as either the source or the destination zone. The self zone is a systemdefined zone which does not have any interfaces as members. A zone pair that includes the self zone, along with the associated

  policy, applies to traffic directed to the device or traffic generated by the device. It does not apply to traffic through the device.

  The most common usage of firewall is to apply them to traffic through a device, so you need at least two zones (that is, you cannot use the self zone).

  To permit traffic between zone member interfaces, you must configure a policy permitting (or inspecting) traffic between that zone and another zone. To attach a firewall policy map to the target zone pair, use the servicepolicy type inspect

  command.

  The figure below shows the application of a firewall policy to traffic flowing from zone Z1 to zone Z2, which means that the ingress interface for the traffic is a member of zone Z1 and the egress interface is a member of zone Z2.

  Figure 2. Zone Pairs

  

  If there are two zones and you require policies for traffic going in both directions (from Z1 to Z2 and Z2 to Z1), you must configure two zone pairs (one for each direction).

  If a policy is not configured between zone pairs, traffic is dropped. However, it is not necessary to configure a zone pair and a service policy solely for the return traffic. By default, return traffic is not allowed. If a service policy inspects the traffic in the forward direction and there is no zone pair and service policy for the return traffic, the return traffic is inspected. If a service policy passes the traffic in the forward direction and there is no zone pair and service policy for the return traffic, the return traffic is dropped. In both these cases, you need to configure a zone pair and a service policy to allow the return traffic. In the above figure, it is not mandatory that you configure a zone pair source and destination for allowing return traffic from Z2 to Z1. The service policy on Z1 to Z2 zone pair takes care of it.

• Question 246:

  Which command initializes a lawful intercept view?

  A. username cisco1 view lawful-intercept password cisco
  B. parser view cisco li-view
  C. li-view cisco user cisco1 password cisco
  D. parser view li-view inclusive
  C. li-view cisco user cisco1 password cisco

  ---

  Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cfg/configuration/xe-3s/asr1000/sec- usr-cfg-xe-3s-asr-1000-book/sec-role-base-cli.html#GUID-E73E7EA4-AD33-4E5D-A2FA-D5EF0B5AF61B

• Question 247:

  HOTSPOT

  

  

  Hot Area:

  

  

• Question 248:

  Which two protocols can SNMP use to send messages over a secure communications channel? (Choose two.)

  A. DTLS
  B. TLS
  C. ESP
  D. AH
  E. ISAKMP
  A. DTLS
  B. TLS

• Question 249:

  With Cisco IOS zone-based policy firewall, by default, which three types of traffic are permitted by the router when some of the router interfaces are assigned to a zone? (Choose three.)

  A. traffic flowing between a zone member interface and any interface that is not a zone member
  B. traffic flowing to and from the router interfaces (the self zone)
  C. traffic flowing among the interfaces that are members of the same zone
  D. traffic flowing among the interfaces that are not assigned to any zone
  E. traffic flowing between a zone member interface and another interface that belongs in a different zone
  F. traffic flowing to the zone member interface that is returned traffic
  B. traffic flowing to and from the router interfaces (the self zone)
  C. traffic flowing among the interfaces that are members of the same zone
  D. traffic flowing among the interfaces that are not assigned to any zone

  ---

  http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00808bc994.shtml

  Rules For Applying Zone-Based Policy Firewall

  Router network interfaces' membership in zones is subject to several rules that govern interface behavior, as is the traffic moving between zone member interfaces:

  A zone must be configured before interfaces can be assigned to the zone.

  An interface can be assigned to only one security zone.

  All traffic to and from a given interface is implicitly blocked when the interface is assigned to a zone, except traffic to and from other interfaces in the same zone, and traffic to any interface on the router.

  Traffic is implicitly allowed to flow by default among interfaces that are members of the same zone. In order to permit traffic to and from a zone member interface, a policy allowing or inspecting traffic must be configured between that zone and

  any other zone. The self zone is the only exception to the default deny all policy. All traffic to any router interface is allowed until traffic is explicitly denied. Traffic cannot flow between a zone member interface and any interface that is not a

  zone member. Pass, inspect, and drop actions can only be applied between two zones.

  Interfaces that have not been assigned to a zone function as classical router ports and might still use classical stateful inspection/CBAC configuration. If it is required that an interface on the box not be part of the zoning/firewall policy. It might

  still be necessary to put that interface in a zone and configure a pass all policy (sort of a dummy policy) between that zone and any other zone to which traffic flow is desired. From the preceding it follows that, if traffic is to flow among all the

  interfaces in a router, all the interfaces must be part of the zoning model (each interface must be a member of one zone or another).

  The only exception to the preceding deny by default approach is the traffic to and from the router, which will be permitted by default. An explicit policy can be configured to restrict such traffic.

• Question 250:

  DRAG DROP

  Select and Place: