Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 251:

  Which statements about reflexive access lists are true? (Choose three.)

  A. Reflexive access lists create a permanent ACE
  B. Reflexive access lists approximate session filtering using the established keyword
  C. Reflexive access lists can be attached to standard named IP ACLs
  D. Reflexive access lists support UDP sessions
  E. Reflexive access lists can be attached to extended named IP ACLs
  F. Reflexive access lists support TCP sessions
  D. Reflexive access lists support UDP sessions
  E. Reflexive access lists can be attached to extended named IP ACLs
  F. Reflexive access lists support TCP sessions

  ---

  Not A Reflexive ACL creates a temp ACE, created when session opens and removed when session ends Not B Extended and Standard ACL's uses the established parameter/keyword, Reflexive can though with TCP from what I've been reading Not C Reflexive ACLs are nested within an extended named IP access list

• Question 252:

  Which access list permits HTTP traffic sourced from host 10.1.129.100 port 3030 destined to host 192.168.1.10?

  A. access-list 101 permit tcp any eq 3030
  B. access-list 101 permit tcp 10.1.128.0 0.0.1 .255 eq 3030 192.1 68.1 .0 0.0.0.15 eq www
  C. access-list 101 permit tcp 10.1.129.0 0.0.0.255 eq www 192.168.1.10 0.0.0.0 eq www
  D. access-list 101 permit tcp host 192.1 68.1 .10 eq 80 10.1.0.0 0.0.255.255 eq 3030
  E. access-list 101 permit tcp 192.168.1.10 0.0.0.0 eq 80 10.1.0.0 0.0.255.255
  F. access-list 101 permit ip host 10.1.129.100 eq 3030 host 192.168.1.10 eq 80
  B. access-list 101 permit tcp 10.1.128.0 0.0.1 .255 eq 3030 192.1 68.1 .0 0.0.0.15 eq www

  ---

  www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

  Extended ACLs

  Extended ACLs were introduced in Cisco IOS Software Release 8.3. Extended ACLs control traffic by the comparison of the source and destination addresses of the IP packets to the addresses configured in the ACL.

  IP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} protocol source source-wildcard

  destination destination-wildcard [precedence precedence]

  [tos tos] [log|log-input] [time-range time-range-name]

  ICMP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} icmp source source-wildcard

  destination destination-wildcard

  [icmp-type [icmp-code] |icmp-message]

  [precedence precedence] [tos tos] [log|log-input]

  [time-range time-range-name]

  TCP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} tcp source source-wildcard [operator [port]]

  destination destination-wildcard [operator [port]]

  [established] [precedence precedence] [tos tos]

  [log|log-input] [time-range time-range-name]

  UDP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} udp source source-wildcard [operator [port]]

  destination destination-wildcard [operator [port]]

  [precedence precedence] [tos tos] [log|log-input]

  [time-range time-range-name]

• Question 253:

  Which statement about Cisco IOS IPS on Cisco IOS Release 12.4(11)T and later is true?

  A. uses Cisco IPS 5.x signature format
  B. requires the Basic or Advanced Signature Definition File
  C. supports both inline and promiscuous mode
  D. requires IEV for monitoring Cisco IPS alerts
  E. uses the built-in signatures that come with the Cisco IOS image as backup
  F. supports SDEE, SYSLOG, and SNMP for sending Cisco IPS alerts
  A. uses Cisco IPS 5.x signature format

  ---

  http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_ios_ips/configuration/12-4t/sec-ips5-sig-fsue.html

  Signature Categories

  Cisco IPS appliances and Cisco IOS IPS with Cisco 5.x format signatures operate with signature categories. All signatures are pregrouped into categories; the categories are hierarchical. An individual signature can belong to more than one

  category. Top-level categories help to define general types of signatures.

  Subcategories exist beneath each top-level signature category. (For a list of supported top-level categories, use your router CLI help (?).) Router Configuration Files and Signature Event Action Processor (SEAP)

  As of Cisco IOS Release 12.4(11)T, SDFs are no longer used by Cisco IOS IPS. Instead, routers access signature definition information through a directory that contains three configuration files--the default configuration, the delta

  configuration, and the SEAP configuration. Cisco IOS accesses this directory through the ip ips config location command.

• Question 254:

  Which one of the following items may be added to a password stored in MD5 to make it more secure?

  A. Ciphertext
  B. Salt
  C. Cryptotext
  D. Rainbow table
  B. Salt

  ---

  Making an Md5 Hash More Secure To make the md5 hash more secure we need to add what is called "salt". Salt in this sense of the meaning is random data appended to the password to make the hash more complicated and difficult to reverse engineer. Without knowing what the salt is, rainbow table attacks are mostly useless. Reference: http://www.marksanborn.net/php/creating-a-secure-md5-hash-for-storing-passwords-in-a-database/

• Question 255:

  Refer to the exhibit and partial configuration.

  

  Which statement is true?

  A. All traffic destined for network 172.16.150.0 will be denied due to the implicit deny all.
  B. All traffic from network 10.0.0.0 will be permitted.
  C. Access-list 101 will prevent address spoofing from interface E0.
  D. This is a misconfigured ACL resulting in traffic not being allowed into the router in interface S0.
  E. This ACL will prevent any host on the Internet from spoofing the inside network address as the source address for packets coming into the router from the Internet.
  C. Access-list 101 will prevent address spoofing from interface E0.

  ---

  http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml

  Transit ACL Sections In general, a transit ACL is composed of four sections. Special-use address and anti-spoofing entries that deny illegitimate sources and packets with source addresses that belong within your network from entering the network from an external source NotE. RFC 1918 leavingcisco.com defines reserved address space that is not a valid source address on the Internet. RFC 3330 leavingcisco.com defines special-use addresses that might require filtering. RFC 2827 leavingcisco.com provides anti-spoofing guidelines. Explicitly permitted return traffic for internal connections to the Internet Explicitly permitted externally sourced traffic destined to protected internal addresses Explicit deny statement NotE. Although all ACLs contain an implicit deny statement, Cisco recommends use of an explicit deny statemen, for example, deny ip any any. On most platforms, such statements maintain a count of the number of denied packets that can be displayed using the show access-list command.

• Question 256:

  Which type of Cisco ASA access list entry can be configured to match multiple entries in a single statement?

  A. nested object-class
  B. class-map
  C. extended wildcard matching
  D. object groups
  D. object groups

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/objectgroups.html

  Information About Object Groups

  By grouping like objects together, you can use the object group in an ACE instead of having to enter an ACE for each object separately. You can create the following types of object groups:

  •

  Protocol

  •

  Network

  •

  Service

  •

  ICMP type

  For example, consider the following three object groups:

  •

  MyServices — Includes the TCP and UDP port numbers of the service requests that are allowed access to the internal network.

  •

  TrustedHosts — Includes the host and network addresses allowed access to the greatest range of services and servers.

  •

  PublicServers — Includes the host addresses of servers to which the greatest access is provided.

  After creating these groups, you could use a single ACE to allow trusted hosts to make specific service requests to a group of public servers.

  You can also nest object groups in other object groups.

• Question 257:

  When configuring SSL VPN on the Cisco ASA appliance, which configuration step is required only for Cisco AnyConnect full tunnel SSL VPN access and not required for clientless SSL VPN?

  A. user authentication
  B. group policy
  C. IP address pool
  D. SSL VPN interface
  E. connection profile
  C. IP address pool

  ---

  http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_sslvpn/configuration/15-2mt/sec-conn-sslvpnssl-vpn.html

  Cisco AnyConnect VPN Client Full Tunnel Support

  Remote Client Software from the SSL VPN Gateway

  Address Pool

  Manual Entry to the IP Forwarding Table

  Remote Client Software from the SSL VPN Gateway

  The Cisco AnyConnect VPN Client software package is pushed from the SSL VPN gateway to remote clients when support is needed. The remote user (PC or device) must have either the Java Runtime Environment for Windows (version 1.4

  later), or the browser must support or be configured to permit Active X controls.

  In either scenario, the remote user must have local administrative privileges.

  Address Pool

  The address pool is first defined with the ip local pool command in global configuration mode. The standard configuration assumes that the IP addresses in the pool are reachable from a directly connected network.

  Address Pools for Nondirectly Connected Networks

  If you need to configure an address pool for IP addresses from a network that is not directly connected, perform the following steps:

  Create a local loopback interface and configure it with an IP address and subnet mask from the address pool.

  Configure the address pool with the ip local pool command. The range of addresses must fall under the subnet mask configured in Step 1. Set up the route. If you are using the Routing Information Protocol (RIP), configure the router rip

  command and then the network command, as usual, to specify a list of networks for the RIP process. If you are using the Open Shortest Path First (OSPF) protocol, configure the ip ospf network point-to-point command in the loopback

  interface. As a third choice (instead of using the RIP or OSPF protocol), you can set up static routes to the network.

  Configure the svc address-pool command with the name configured in Step 2.

  Manual Entry to the IP Forwarding Table

  If the SSL VPN software client is unable to update the IP forwarding table on the PC of the remote user, the following error message will be displayed in the router console or syslog:

  Error : SSL VPN client was unable to Modify the IP forwarding table ......

  This error can occur if the remote client does not have a default route. You can work around this error by performing the following steps:

  Open a command prompt (DOS shell) on the remote client.

  Enter the route print command.

  If a default route is not displayed in the output, enter the route command followed by the add and mask keywords. Include the default gateway IP address at the end of the route statement. See the following example:

  C:\>route ADD 0.0.0.0 MASK 0.0.0.0 10.1.1.1

• Question 258:

  Which command will configure a Cisco ASA firewall to authenticate users when they enter the enable syntax using the local database with no fallback method?

  A. aaa authentication enable console LOCAL SERVER_GROUP
  B. aaa authentication enable console SERVER_GROUP LOCAL
  C. aaa authentication enable console local
  D. aaa authentication enable console LOCAL
  D. aaa authentication enable console LOCAL

• Question 259:

  Which statement is true when you have generated RSA keys on your Cisco router to prepare for secure device management?

  A. You must then zeroize the keys to reset secure shell before configuring other parameters.
  B. The SSH protocol is automatically enabled.
  C. You must then specify the general-purpose key size used for authentication with the crypto key generate rsa general-keys modulus command.
  D. All vty ports are automatically enabled for SSH to provide secure management.
  B. The SSH protocol is automatically enabled.

  ---

  http://www.cisco.com/en/US/tech/tk583/tk617/technologies_tech_note09186a00800949e2.shtml Generate an RSA key pair for your router, which automatically enables SSH. carter(config)#crypto key generate rsa Refer to crypto key generate rsa - Cisco IOS Security Command Reference, Release 12.3 for more information on the usage of this command.

• Question 260:

  Which single Cisco IOS ACL entry permits IP addresses from 172.16.80.0 to 172.16.87.255?

  A. permit 172.16.80.0 0.0.3.255
  B. permit 172.16.80.0 0.0.7.255
  C. permit 172.16.80.0 0.0.248.255
  D. permit 176.16.80.0 255.255.252.0
  E. permit 172.16.80.0 255.255.248.0
  F. permit 172.16.80.0 255.255.240.0
  B. permit 172.16.80.0 0.0.7.255

  ---

  www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml ACL Summarization Note. Subnet masks can also be represented as a fixed length notation. For example, 192.168.10.0/24 represents 192.168.10.0 255.255.255.0. This list describes how to summarize a range of networks into a single network for ACL optimization. Consider these networks. 192.168.32.0/24 192.168.33.0/24 192.168.34.0/24 192.168.35.0/24 192.168.36.0/24 192.168.37.0/24 192.168.38.0/24 192.168.39.0/24

  The first two octets and the last octet are the same for each network. This table is an explanation of how to summarize these into a single network.

  The third octet for the previous networks can be written as seen in this table, according to the octet bit position and address value for each bit.

  Decimal 128 64 32 16 8 4 2 1 32 0 0 1 0 0 0 0 0 33 0 0 1 0 0 0 0 1 34 0 0 1 0 0 0 1 0 35 0 0 1 0 0 0 1 1 36 0 0 1 0 0 1 0 0 37 0 0 1 0 0 1 0 1 38 0 0 1 0 0 1 1 0 39 0 0 1 0 0 1 1 1 M M M M M D D D

  Since the first five bits match, the previous eight networks can be summarized into one network (192.168.32.0/21 or 192.168.32.0 255.255.248.0). All eight possible combinations of the three low-order bits are relevant for the network ranges in question. This command defines an ACL that permits this network. If you subtract 255.255.248.0 (normal mask) from 255.255.255.255, it yields 0.0.7.255. access-list acl_permit permit ip 192.168.32.0 0.0.7.255