Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 281:

  DRAG DROP

  Select and Place:

  

  

• Question 282:

  What are purposes of the Internet Key Exchange in an IPsec VPN? (Choose two.)

  A. The Internet Key Exchange protocol establishes security associations
  B. The Internet Key Exchange protocol provides data confidentiality
  C. The Internet Key Exchange protocol provides replay detection
  D. The Internet Key Exchange protocol is responsible for mutual authentication
  A. The Internet Key Exchange protocol establishes security associations
  D. The Internet Key Exchange protocol is responsible for mutual authentication

  ---

  Reference: https://tools.ietf.org/html/rfc4306

• Question 283:

  DRAG DROP

  Select and Place:

  

  

• Question 284:

  Which priority is most important when you plan out access control lists?

  A. Build ACLs based upon your security policy.
  B. Always put the ACL closest to the source of origination.
  C. Place deny statements near the top of the ACL to prevent unwanted traffic from passing through the router.
  D. Always test ACLs in a small, controlled production environment before you roll it out into the larger production network.
  A. Build ACLs based upon your security policy.

  ---

  Packet filtering can help limit network traffic and restrict network use by certain users or devices. ACLs filter traffic as it passes through a router or switch and permit or deny packets crossing specified interfaces or VLANs. An ACL is a sequential collection of permit and deny conditions that apply to packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied ACLs to verify that the packet has the required permissions to be forwarded, based on the criteria specified in the access lists. One by one, it tests packets against the conditions in an access list. The first match decides whether the switch accepts or rejects the packets. Because the switch stops testing after the first match, the order of conditions in the list is critical. If no conditions match, the switch rejects the packet. If there are no restrictions, the switch forwards the packet; otherwise, the switch drops the packet. The switch can use ACLs on all packets it forwards, including packets bridged within a VLAN. You configure access lists on a router or Layer 3 switch to provide basic security for your network. If you do not configure ACLs, all packets passing through the switch could be allowed onto all parts of the network. You can use ACLs to control which hosts can access different parts of a network or to decide which types of traffic are forwarded or blocked at router interfaces. For example, you can allow e-mail traffic to be forwarded but not Telnet traffic. ACLs can be configured to block inbound traffic, outbound traffic, or both. Depending on your security policy, the Layer 3 ACLs can be as simple as not allowing IP traffic from the non-voice VLANS to access the voice gateway in the network, or the ACLs can be detailed enough to control the individual ports and the time of the day that are used by other devices to communicate to IP Telephony devices. As the ACLs become more granular and detailed, any changes in port usage in a network could break not only voice but also other applications in the network. Reference: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/security.html#pgfId-1045388

• Question 285:

  Which description of the Diffie-Hellman protocol is true?

  A. It uses symmetrical encryption to provide data confidentiality over an unsecured communications channel.
  B. It uses asymmetrical encryption to provide authentication over an unsecured communications channel.
  C. It is used within the IKE Phase 1 exchange to provide peer authentication.
  D. It provides a way for two peers to establish a shared-secret key, which only they will know, even though they are communicating over an unsecured channel.
  E. It is a data integrity algorithm that is used within the IKE exchanges to guarantee the integrity of the message of the IKE exchanges.
  D. It provides a way for two peers to establish a shared-secret key, which only they will know, even though they are communicating over an unsecured channel.

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/user/guide/vpipsec.html

  Modulus Group

  The Diffie-Hellman group to use for deriving a shared secret between the two IPsec peers without transmitting it to each other. A larger modulus provides higher security but requires more processing time. The two peers must have a

  matching modulus group. Options are:

  ?1 -- Diffie-Hellman Group 1 (768-bit modulus).

  ?2 -- Diffie-Hellman Group 2 (1024-bit modulus).

  ?5 -- Diffie-Hellman Group 5 (1536-bit modulus, considered good protection for 128-bit keys, but group 14 is better). If you are using AES encryption, use this group (or higher). The ASA supports this group as the highest group.

  ?7 -- Diffie-Hellman Group 7 (163-bit elliptical curve field size).

  ?14 -- Diffie-Hellman Group 14 (2048-bit modulus, considered good protection for 128-bit keys). ?15 -- Diffie-Hellman Group 15 (3072-bit modulus, considered good protection for 192-bit keys). ?16 -- Diffie-Hellman Group 16 (4096-bit

  modulus, considered good protection for 256-bit keys).

• Question 286:

  Which kind of table do most firewalls use today to keep track of the connections through the firewall?

  A. dynamic ACL
  B. reflexive ACL
  C. netflow
  D. queuing
  E. state
  F. express forwarding
  E. state

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/intro.html

  Stateful Inspection Overview

  All traffic that goes through the ASA is inspected using the Adaptive Security Algorithm and either allowed through or dropped. A simple packet filter can check for the correct source address, destination address, and ports, but it does not

  check that the packet sequence or flags are correct. A filter also checks every packet against the filter, which can be a slow process.

  A stateful firewall like the ASA, however, takes into consideration the state of a packet:

  ?Is this a new connection?

  If it is a new connection, the ASA has to check the packet against access lists and perform other tasks to determine if the packet is allowed or denied. To perform this check, the first packet of the session goes through the "session

  management path," and depending on the type of traffic, it might also pass through the "control plane path."

  The session management path is responsible for the following tasks:

  ?Performing the access list checks

  ?Performing route lookups

  ?Allocating NAT translations (xlates)

  ?Establishing sessions in the";fast pat";

  The ASA creates forward and reverse flows in the fast path for TCP traffic; the ASA also creates connection state information for connectionless protocols like UDP, ICMP (when you enable ICMP inspection), so that they can also use the fast

  path.

  Some packets that require Layer 7 inspection (the packet payload must be inspected or altered) are passed on to the control plane path. Layer 7 inspection engines are required for protocols that have two or more channels:

  A data channel, which uses well-known port numbers, and a control channel, which uses different port numbers for each session. These protocols include FTP, H.323, and SNMP.

  ?Is this an established connection?

  If the connection is already established, the ASA does not need to re-check packets; most matching packets can go through the "fast" path in both directions. The fast path is responsible for the following tasks:

  ?IP checksum verification

  ?Session lookup

  ?TCP sequence number check

  ?NAT translations based on existing sessions

  ?Layer 3 and Layer 4 header adjustments

  Data packets for protocols that require Layer 7 inspection can also go through the fast path. Some established session packets must continue to go through the session management path or the control plane path. Packets that go through the

  session management path include HTTP packets that require inspection or content filtering. Packets that go through the control plane path include the control packets for protocols that require Layer 7 inspection.

• Question 287:

  Which type of network masking is used when Cisco IOS access control lists are configured?

  A. extended subnet masking
  B. standard subnet masking
  C. priority masking
  D. wildcard masking
  D. wildcard masking

  ---

  Masks are used with IP addresses in IP ACLs to specify what should be permitted and denied. Masks in order to configure IP addresses on interfaces start with 255 and have the large values on the left side, for example, IP address

  209.165.202.129 with a 255.255.255.224 mask. Masks for IP ACLs are the reverse, for example, mask 0.0.0.255. This is sometimes called an inverse mask or a wildcard mask. When the value of the mask is broken down into binary (0s and 1s), the results determine which address bits are to be considered in processing the traffic. A 0 indicates that the address bits must be considered (exact match); a 1 in the mask is a "don't care". Reference: http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html