Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 21:

  You are the security administrator for a large enterprise network with many remote locations. You have been given the assignment to deploy a Cisco IPS solution.

  Where in the network would be the best place to deploy Cisco IOS IPS?

  A. Inside the firewall of the corporate headquarters Internet connection
  B. At the entry point into the data center
  C. Outside the firewall of the corporate headquarters Internet connection
  D. At remote branch offices
  D. At remote branch offices

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/product_data_sheet0900aecd803137cf.html

  Product Overview

  In today's business environment, network intruders and attackers can come from outside or inside the network. They can launch distributed denial-of-service attacks, they can attack Internet connections, and they can exploit network and host

  vulnerabilities. At the same time, Internet worms and viruses can spread across the world in a matter of minutes. There is often no time to wait for human intervention-the network itself must possess the intelligence to recognize and mitigate

  these attacks, threats, exploits, worms and viruses.

  Cisco IOS Intrusion Prevention System (IPS) is an inline, deep-packet inspection-based solution that enables Cisco IOS Software to effectively mitigate a wide range of network attacks. While it is common practice to defend against attacks by

  inspecting traffic at data centers and corporate headquarters, distributing the network level defense to stop malicious traffic close to its entry point at branch or telecommuter offices is also critical.

  Cisco IOS IPS: Major Use Cases and Key Benefits

  IOS IPS helps to protect your network in 5 ways:

  

  Key Benefits ?Provides network-wide, distributed protection from many attacks, exploits, worms and viruses exploiting vulnerabilities in operating systems and applications ?Eliminates the need for a standalone IPS device at branch and telecommuter offices as well as small and medium-sized business networks ?Unique, risk rating based signature event action processor dramatically improves the ease of management of IPS policies ?Offers field-customizable worm and attack signature set and event actions ?Offers inline inspection of traffic passing through any combination of router LAN and WAN interfaces in both directions ?Works with Cisco IOS?Firewall, control-plane policing, and other Cisco IOS Software security features to protect the router and networks behind the router ?Supports more than 3700 signatures from the same signature database available for Cisco Intrusion Prevention System (IPS) appliances

• Question 22:

  Which protocol provides security to Secure Copy?

  A. IPsec
  B. SSH
  C. HTTPS
  D. ESP
  B. SSH

• Question 23:

  Which statement describes a best practice when configuring trunking on a switch port?

  A. Disable double tagging by enabling DTP on the trunk port.
  B. Enable encryption on the trunk port.
  C. Enable authentication and encryption on the trunk port.
  D. Limit the allowed VLAN(s) on the trunk to the native VLAN only.
  E. Configure an unused VLAN as the native VLAN.
  E. Configure an unused VLAN as the native VLAN.

  ---

  http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a008013159f.shtml

  Double Encapsulation Attack When double-encapsulated 802.1Q packets are injected into the network from a device whose VLAN happens to be the native VLAN of a trunk, the VLAN identification of those packets cannot be preserved from end to end since the 802.1Q trunk would always modify the packets by stripping their outer tag. After the external tag is removed, the internal tag permanently becomes the packet's only VLAN identifier. Therefore, by double encapsulating packets with two different tags, traffic can be made to hop across VLANs. This scenario is to be considered a misconfiguration, since the 802.1Q standard does not necessarily force the users to use the native VLAN in these cases. As a matter of fact, the proper configuration that should always be used is to clear the native VLAN from all 802.1Q trunks (alternatively, setting them to 802.1q-all- tagged mode achieves the exact same result). In cases where the native VLAN cannot be cleared, then always pick an unused VLAN as native VLAN of all the trunks; don't use this VLAN for any other purpose. Protocols like STP, DTP, and UDLD (check out [3]) should be the only rightful users of the native VLAN and their traffic should be completely isolated from any data packets.

• Question 24:

  When port security is enabled on a Cisco Catalyst switch, what is the default action when the configured maximum number of allowed MAC addresses value is exceeded?

  A. The port remains enabled, but bandwidth is throttled until old MAC addresses are aged out.
  B. The port is shut down.
  C. The MAC address table is cleared and the new MAC address is entered into the table.
  D. The violation mode of the port is set to restrict.
  B. The port is shut down.

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/20ewa/configuration/guide/port_sec.html

  Default Port Security Configuration Port security Disabled on a port Maximum number of secure MAC addresses Violation mode Shutdown. The port shuts down when the maximum number of secure MAC addresses is exceeded, and an SNMP trap notification is sent.

  Aging Disabled

  Aging type Absolute Static Aging Disabled

  Sticky Disabled

• Question 25:

  Which four tasks are required when you configure Cisco IOS IPS using the Cisco Configuration Professional IPS wizard? (Choose four.)

  A. Select the interface(s) to apply the IPS rule.
  B. Select the traffic flow direction that should be applied by the IPS rule.
  C. Add or remove IPS alerts actions based on the risk rating.
  D. Specify the signature file and the Cisco public key.
  E. Select the IPS bypass mode (fail-open or fail-close).
  F. Specify the configuration location and select the category of signatures to be applied to the selected interface(s).
  A. Select the interface(s) to apply the IPS rule.
  B. Select the traffic flow direction that should be applied by the IPS rule.
  D. Specify the signature file and the Cisco public key.
  F. Specify the configuration location and select the category of signatures to be applied to the selected interface(s).

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/prod_white_paper0900aecd8066d265.html

  Step 11. At the `Select Interfaces' screen, select the interface and the direction that IOS IPS will be applied to, then click `Next' to continue.

  

  Step 12. At the `IPS Policies Wizard' screen, in the `Signature File' section, select the first radio button "Specify the signature file you want to use with IOS IPS", then click the "..." button to bring up a dialog box to specify the location of the signature package file, which will be the directory specified in Step 6. In this example, we use tftp to download the signature package to the router.

  

  Step 13. In the `Configure Public Key' section, enter `realm-cisco.pub' in the `Name' text field, then copy and paste the following public key's key-string in the `Key' text field. This public key can be download from

  Cisco.com at: http://www.cisco.com/pcgi-bin/tablebuild.pl/ios-v5sigup. Click `Next' to continue. 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101 00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16 17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128 B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E 5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35 FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85 50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36 006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE 2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3 F3020301 0001

  

• Question 26:

  Which command will block external spoofed addresses?

  A. access-list 128 deny ip 10.0.0.0 0.0.255.255 any
  B. access-list 128 deny ip 192.168.0.0 0.0.0.255 any
  C. access-list 128 deny ip 10.0.0.0 0.255.255.255 any
  D. access-list 128 deny ip 192.168.0.0 0.0.31.255 any
  C. access-list 128 deny ip 10.0.0.0 0.255.255.255 any

• Question 27:

  Which three modes of access can be delivered by SSL VPN? (Choose three.)

  A. full tunnel client
  B. IPsec SSL
  C. TLS transport mode
  D. thin client
  E. clientless
  F. TLS tunnel mode
  A. full tunnel client
  D. thin client
  E. clientless

  ---

  http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htwebvpn.html

  SSL VPN

  The SSL VPN feature (also known as WebVPN) provides support, in Cisco IOS software, for remote user access to enterprise networks from anywhere on the Internet. Remote access is provided through a Secure Socket Layer- (SSL-)

  enabled SSL VPN gateway. The SSL VPN gateway allows remote users to establish a secure Virtual Private Network (VPN) tunnel using a web browser. This feature provides a comprehensive solution that allows easy access to a broad

  range of web resources and web-enabled applications using native HTTP over SSL (HTTPS) browser support. SSL VPN delivers three modes of SSL VPN access:

  clientless, thin-client, and full-tunnel client support.

• Question 28:

  Which statement about an access control list that is applied to a router interface is true?

  A. It only filters traffic that passes through the router.
  B. It filters pass-through and router-generated traffic.
  C. An empty ACL blocks all traffic.
  D. It filters traffic in the inbound and outbound directions.
  A. It only filters traffic that passes through the router.

  ---

  http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/15-2mt/sec-acl-ov-gdl.html

  The Order in Which You Enter Criteria Statements

  Note that each additional criteria statement that you enter is appended to the end of the access list statements. Also note that you cannot delete individual statements after they have been created. You can only delete an entire access list.

  The order of access list statements is important! When the router is deciding whether to forward or block a packet, the Cisco IOS software tests the packet against each criteria statement in the order in which the statements were created.

  After a match is found, no more criteria statements are checked.

  If you create a criteria statement that explicitly permits all traffic, no statements added later will ever be checked. If you need additional statements, you must delete the access list and retype it with the new entries.

  Apply an Access Control List to an Interface

  With some protocols, you can apply up to two access lists to an interfacE. one inbound access list and one outbound access list. With other protocols, you apply only one access list that checks both inbound and outbound packets.

  If the access list is inbound, when a device receives a packet, Cisco software checks the access list's criteria statements for a match. If the packet is permitted, the software continues to process the packet. If the packet is denied, the software

  discards the packet.

  If the access list is outbound, after receiving and routing a packet to the outbound interface, Cisco software checks the access list's criteria statements for a match. If the packet is permitted, the software transmits the packet. If the packet is

  denied, the software discards the packet.

  Note

  Access lists that are applied to interfaces on a device do not filter traffic that originates from that device. The access list check is bypassed for locally generated packets, which are always outbound. By default, an access list that is applied to

  an outbound interface for matching locally generated traffic will bypass the outbound access list check; but transit traffic is subjected to the outbound access list check.

• Question 29:

  You want to use the Cisco Configuration Professional site-to-site VPN wizard to implement a site-to-site IPsec VPN using pre-shared key.

  Which four configurations are required (with no defaults)? (Choose four.)

  A. the interface for the VPN connection
  B. the VPN peer IP address
  C. the IPsec transform-set
  D. the IKE policy
  E. the interesting traffic (the traffic to be protected)
  F. the pre-shared key
  A. the interface for the VPN connection
  B. the VPN peer IP address
  E. the interesting traffic (the traffic to be protected)
  F. the pre-shared key

  ---

  http://www.cisco.com/en/US/products/ps9422/products_configuration_example09186a0080ba1d0a.shtml

  3. In the next window, provide the VPN Connection Information in the respective spaces. Choose the interface of the VPN Tunnel from the drop-down menu. Here, FastEthernet0 is chosen. In the Peer Identity section, choose Peer with static IP address and provide the remote peer IP address. Then, provide the Pre-shared Keys (cisco123 in this example) in the Authentication section. Lastly, click Next.

  

  10. In the following window, provide the details about the Traffic to be protected through the VPN Tunnel. Provide the Source and Destination Networks of the traffic to be protected so that the traffic between the specified source and destination networks are protected. In this example, the Source network is 10.10.10.0 and the Destination network is 10.20.10.0. Click Next.

  

• Question 30:

  Which two considerations about secure network management are important? (Choose two.)

  A. log tampering
  B. encryption algorithm strength
  C. accurate time stamping
  D. off-site storage
  E. Use RADIUS for router commands authorization.
  F. Do not use a loopback interface for device management access.
  A. log tampering
  C. accurate time stamping

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/best/practices/recommendations.html

  Enable Timestamped Messages Enable timestamps on log messages: Router(config)# service timestamps log datetime localtime show-timezone msec Enable timestamps on system debug messages: Router(config)# service timestamps debug datetime localtime show-timezone msec