Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 271:

  Refer to the exhibit.

  

  What does the option secret 5 in the username global configuration mode command indicate about the user password?

  A. It is hashed using SHA.
  B. It is encrypted using DH group 5.
  C. It is hashed using MD5.
  D. It is encrypted using the service password-encryption command.
  E. It is hashed using a proprietary Cisco hashing algorithm.
  F. It is encrypted using a proprietary Cisco encryption algorithm.
  C. It is hashed using MD5.

  ---

  Feature Overview Using the Enhanced Password Security feature, you can configure MD5 encryption for username passwords. Before the introduction of this feature there were two types of passwords associated with usernames. Type 0 is a clear text password visible to any user who has access to privileged mode on the router. Type 7 is a password with a weak, exclusive-or type encryption. Type 7 passwords can be retrieved from the encrypted text by using publicly available tools.

  MD5 encryption is a one-way hash function that makes reversal of an encrypted password impossible, providing strong encryption protection. Using MD5 encryption, you cannot retrieve clear text passwords. MD5 encrypted passwords cannot be used with protocols that require that the clear text password be retrievable, such as Challenge Handshake Authentication Protocol (CHAP).

  Use the username (secret) command to configure a user name and an associated MD5 encrypted secret. Configuring Enhanced Security Password Router(config)# username name secret 0 password Configures a username and encrypts a clear text password with MD5 encryption. or Router(config)# username name secret 5 encrypted-secret Configures a username and enters an MD5 encrypted text string which is stored as the MD5 encrypted password for the specified username.

  Reference: http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/120s_md5.html

• Question 272:

  Which statement about IPv6 address allocation is true?

  A. IPv6-enabled devices can be assigned only one IPv6 IP address.
  B. A DHCP server is required to allocate IPv6 IP addresses.
  C. IPv6-enabled devices can be assigned multiple IPv6 IP addresses.
  D. ULA addressing is required for Internet connectivity.
  C. IPv6-enabled devices can be assigned multiple IPv6 IP addresses.

• Question 273:

  Which command will block IP traffic to the destination 172.16.0.1/32?

  A. access-list 101 deny ip host 172.16.0.1 any
  B. access-list 101 deny ip any host 172.16.0.1
  C. access-list 101 deny ip any any
  D. access-list 11 deny host 172.16.0.1
  B. access-list 101 deny ip any host 172.16.0.1

  ---

  Here is a similar example:

  

  Reference: http://www.proprofs.com/mwiki/index.php/IP_Access_Control_List_Security

• Question 274:

  Which command will configure AAA accounting using the list of all RADIUS servers on a device to generate a reload event message when the device reloads?

  A. aaa accounting network default start-stop group radius
  B. aaa accounting auth-proxy default start-stop group radius
  C. aaa accounting system default start-stop group radius
  D. aaa accounting exec default start-stop group radius
  C. aaa accounting system default start-stop group radius

• Question 275:

  What is the Cisco preferred countermeasure to mitigate CAM overflows?

  A. port security
  B. dynamic port security
  C. IP source guard
  D. root guard
  B. dynamic port security

• Question 276:

  Under which option do you create an AAA authentication policy in Cisco Configuration Professional?

  A. Authentication Policies
  B. Authentication Policies ?Login
  C. AAA Servers and Groups
  D. AAA Summary
  B. Authentication Policies ?Login

  ---

  To configure an authentication policy, go to Configure > Router > AAA > Authentication Policies > Login Reference: Cisco Configuration Professional User Guide 2.5 PDF

• Question 277:

  Which components does HMAC use to determine the authenticity and integrity of a message? (Choose two.)

  A. The password
  B. The hash
  C. The key
  D. The transform set
  B. The hash
  C. The key

  ---

  Reference: https://supportforums.cisco.com/document/6531/hmac

• Question 278:

  Refer to the below.

  

  Which statement about this debug output is true?

  A. The requesting authentication request came from username GETUSER.
  B. The TACACS+ authentication request came from a valid user.
  C. The TACACS+ authentication request passed, but for some reason the user's connection was closed immediately.
  D. The initiating connection request was being spoofed by a different source address.
  B. The TACACS+ authentication request came from a valid user.

  ---

  http://www.cisco.com/en/US/docs/ios/12_2/debug/command/reference/dbfser.html

  debug tacacs To display information associated with the TACACS, use the debug tacacs privileged EXEC command. The no form of this command disables debugging output. debug tacacs no debug tacacs The following is sample output from the debug tacacs command for a TACACS login attempt that was successful, as indicated by the status PASS:

  Router# debug tacacs

  14:00:09:

  TAC+: Opening TCP/IP connection to 192.168.60.15 using source 10.116.0.79

  14:00:09:

  TAC+: Sending TCP/IP packet number 383258052-1 to 192.168.60.15 (AUTHEN/START)

  14:00:09:

  TAC+: Receiving TCP/IP packet number 383258052-2 from 192.168.60.15

  14:00:09:

  TAC+ (383258052): received authen response status = GETUSER

  14:00:10:

  TAC+: send AUTHEN/CONT packet

  14:00:10:

  TAC+: Sending TCP/IP packet number 383258052-3 to 192.168.60.15 (AUTHEN/CONT)

  14:00:10:

  TAC+: Receiving TCP/IP packet number 383258052-4 from 192.168.60.15

  14:00:10:

  TAC+ (383258052): received authen response status = GETPASS

  14:00:14:

  TAC+: send AUTHEN/CONT packet

  14:00:14:

  TAC+: Sending TCP/IP packet number 383258052-5 to 192.168.60.15 (AUTHEN/CONT)

  14:00:14:

  TAC+: Receiving TCP/IP packet number 383258052-6 from 192.168.60.15

  14:00:14:

  TAC+ (383258052): received authen response status = PASS

  14:00:14:

  TAC+: Closing TCP/IP connection to 192.168.60.15

• Question 279:

  Which statement correctly describes the function of a private VLAN?

  A. A private VLAN partitions the Layer 2 broadcast domain of a VLAN into subdomains.
  B. A private VLAN partitions the Layer 3 broadcast domain of a VLAN into subdomains.
  C. A private VLAN enables the creation of multiple VLANs using one broadcast domain.
  D. A private VLAN combines the Layer 2 broadcast domains of many VLANs into one major broadcast domain.
  A. A private VLAN partitions the Layer 2 broadcast domain of a VLAN into subdomains.

  ---

  A private VLAN partitions the Layer 2 broadcast domain of a VLAN into subdomains, allowing you to isolate the ports on the switch from each other. A subdomain consists of a primary VLAN and one or more secondary VLANs. All VLANs in a private VLAN domain share the same primary VLAN. The secondary VLAN ID differentiates one subdomain from another. The secondary VLANs may either be isolated VLANs or community VLANs. A host on an isolated VLAN can only communicate with the associated promiscuous port in its primary VLAN. Hosts on community VLANs can communicate among themselves and with their associated promiscuous port but not with ports in other community VLANs. Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus4000/nexus4000_i/sw/configuration/guide/rel_4_1_2_E1_1/n400xi_config/ PrivateVLANs.html

• Question 280:

  You have been tasked by your manager to implement syslog in your network. Which option is an important factor to consider in your implementation?

  A. Use SSH to access your syslog information.
  B. Enable the highest level of syslog function available to ensure that all possible event messages are logged.
  C. Log all messages to the system buffer so that they can be displayed when accessing the router.
  D. Synchronize clocks on the network with a protocol such as Network Time Protocol.
  D. Synchronize clocks on the network with a protocol such as Network Time Protocol.

  ---

  http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/Baseline_Security/sec_chap5.html

  Time Synchronization When implementing network telemetry, it is important that dates and times are both accurate and synchronized across all network infrastructure devices. Without time synchronization, it is very difficult to correlate different sources of telemetry.

  Enabling Network Time Protocol (NTP) is the most common method of time synchronization. General best common practices for NTP include:

  •

  A common, single time zone is recommended across an entire network infrastructure in order to enable the consistency and synchronization of time across all network devices.

  •

  The time source should be from an authenticated, limited set of authorized NTP servers.

  Detailed information on NTP and NTP deployment architectures is available in the Network Time Protocol: Best

  Practices White Paper at the following URL:

  http://www.cisco.com/warp/public/126/ntpm.pdf

  Timestamps and NTP Configuration

  In Cisco IOS, the steps to enable timestamps and NTP include:

  Step 1 Enable timestamp information for debug messages.

  Step 2 Enable timestamp information for log messages.

  Step 3 Define the network-wide time zone.

  Step 4 Enable summertime adjustments.

  Step 5 Restrict which devices can communicate with this device as an NTP server.

  Step 6 Restrict which devices can communicate with this device as an NTP peer.

  Step 7 Define the source IP address to be used for NTP packets.

  Step 8 Enable NTP authentication.

  Step 9 Define the NTP servers.

  Step 10 Define the NTP peers.

  Step 11 Enable NTP to update the device hardware clock