Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  Which traffic is permitted by this ACL?

  A. TCP traffic sourced from any host in the 172.26.26.8/29 subnet on any port to host 192.168.1.2 port 80 or 443
  B. TCP traffic sourced from host 172.26.26.21 on port 80 or 443 to host 192.168.1.2 on any port
  C. any TCP traffic sourced from host 172.26.26.30 destined to host 192.168.1.1
  D. any TCP traffic sourced from host 172.26.26.20 to host 192.168.1.2
  C. any TCP traffic sourced from host 172.26.26.30 destined to host 192.168.1.1

  ---

  www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

  Extended ACLs

  Extended ACLs were introduced in Cisco IOS Software Release 8.3. Extended ACLs control traffic by the comparison of the source and destination addresses of the IP packets to the addresses configured in the ACL.

  IP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} protocol source source-wildcard

  destination destination-wildcard [precedence precedence]

  [tos tos] [log|log-input] [time-range time-range-name]

  ICMP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} icmp source source-wildcard

  destination destination-wildcard

  [icmp-type [icmp-code] |icmp-message]

  [precedence precedence] [tos tos] [log|log-input]

  [time-range time-range-name]

  TCP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} tcp source source-wildcard [operator [port]]

  destination destination-wildcard [operator [port]]

  [established] [precedence precedence] [tos tos]

  [log|log-input] [time-range time-range-name]

  UDP

  access-list access-list-number

  [dynamic dynamic-name [timeout minutes]]

  {deny|permit} udp source source-wildcard [operator [port]]

  destination destination-wildcard [operator [port]]

  [precedence precedence] [tos tos] [log|log-input]

  [time-range time-range-name]

• Question 32:

  SIMULATION

  

  Correct Answer. Here is the solution below
  Here is the solution below

  ---

  For the NTP portion:

  Click on Router – Time – NTP and SNTP on left hand pane.

  Then click the Add button. Enter the Server IP address and source interface and key information as specified. Also be sure to click the Prefer button.

  For the access rule portion:

  Click on Router – ACL – ACL Editor. Click Add button. Then enter Inbound for the name and make sure rule is extended. Then click Add at the rule entry. Then ensure that permit is selected and that source and destination boxes both say

  Any IP Address (They should already).

  Under Protocol and Service select EIGRP. Hit OK.

  Then click add button again. Leave the source as any and click the destination box as “A network” and type in 10.0.2.0 and select the wildcard mask as 0.0.0.255.

  Click on the TCP protocol button and select “www” Hit OK.

  Finally, click on edit for this rule and click on the Associate button. Select the outside interface and select the inbound direction.

• Question 33:

  Which three options are components of Transport Layer Security? (Choose three.)

  A. stateless handshake
  B. stateful handshake
  C. application layer
  D. session layer
  E. pre-shared keys
  F. digital certificates
  B. stateful handshake
  C. application layer
  F. digital certificates

• Question 34:

  The host A Layer 2 port is configured in VLAN 5 on switch 1, and the host B Layer 2 port is configured in VLAN 10 on switch 1. Which two actions you can take to enable the two hosts to communicate with each other? (Choose two.)

  A. Configure inter-VLAN routing.
  B. Connect the hosts directly through a hub.
  C. Configure switched virtual interfaces.
  D. Connect the hosts directly through a router.
  A. Configure inter-VLAN routing.
  C. Configure switched virtual interfaces.

  ---

  VLANs divide broadcast domains in a LAN environment. Whenever hosts in one VLAN need to communicate with hosts in another VLAN, the traffic must be routed between them. This is known as inter-VLAN routing. On Catalyst switches it is accomplished by creating Layer 3 interfaces (Switch virtual interfaces (SVI) ). Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html

• Question 35:

  Which three statements about the Cisco ASA appliance are true? (Choose three.)

  A. The DMZ interface(s) on the Cisco ASA appliance most typically use a security level between 1 and 99.
  B. The Cisco ASA appliance supports Active/Active or Active/Standby failover.
  C. The Cisco ASA appliance has no default MPF configurations.
  D. The Cisco ASA appliance uses security contexts to virtually partition the ASA into multiple virtual firewalls.
  E. The Cisco ASA appliance supports user-based access control using 802.1x.
  F. An SSM is required on the Cisco ASA appliance to support Botnet Traffic Filtering.
  A. The DMZ interface(s) on the Cisco ASA appliance most typically use a security level between 1 and 99.
  B. The Cisco ASA appliance supports Active/Active or Active/Standby failover.
  D. The Cisco ASA appliance uses security contexts to virtually partition the ASA into multiple virtual firewalls.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/int5505.html

  Security Level Overview

  Each VLAN interface must have a security level in the range 0 to 100 (from lowest to highest). For example, you should assign your most secure network, such as the inside business network, to level 100. The outside network connected to

  the Internet can be level 0. Other networks, such as a home network can be in between. You can assign interfaces to the same security level. See the "Allowing Communication Between VLAN Interfaces on the Same Security Level" section

  for more information.

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html

  Active/Standby Failover Overview

  Active/Standby failover lets you use a standby security appliance to take over the functionality of a failed unit. When the active unit fails, it changes to the standby state while the standby unit changes to the active state. The unit that becomes

  active assumes the IP addresses (or, for transparent firewall, the management IP address) and MAC addresses of the failed unit and begins passing traffic. The unit that is now in standby state takes over the standby IP addresses and MAC

  addresses. Because network devices see no change in the MAC to IP address pairing, no ARP entries change or time out anywhere on the network.

  Active/Active Failover Overview

  Active/Active failover is only available to security appliances in multiple context mode. In an Active/Active failover configuration, both security appliances can pass network traffic.

  In Active/Active failover, you divide the security contexts on the security appliance into failover groups. A failover group is simply a logical group of one or more security contexts. You can create a maximum of two failover groups on the

  security appliance. The admin context is always a member of failover group 1. Any unassigned security contexts are also members of failover group 1 by default.

  The failover group forms the base unit for failover in Active/Active failover. Interface failure monitoring, failover, and active/standby status are all attributes of a failover group rather than the unit. When an active failover group fails, it changes

  to the standby state while the standby failover group becomes active. The interfaces in the failover group that becomes active assume the MAC and IP addresses of the interfaces in the failover group that failed. The interfaces in the failover

  group that is now in the standby state take over the standby MAC and IP addresses.

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/contexts.html

  Security Context Overview

  You can partition a single security appliance into multiple virtual devices, known as security contexts. Each context is an independent device, with its own security policy, interfaces, and administrators. Multiple contexts are similar to having

  multiple standalone devices. Many features are supported in multiple context mode, including routing tables, firewall features, IPS, and management. Some features are not supported, including VPN and dynamic routing protocols.

• Question 36:

  In a brute-force attack, what percentage of the keyspace must an attacker generally search through until he or she finds the key that decrypts the data?

  A. Roughly 50 percent
  B. Roughly 66 percent C. Roughly 75 percent
  D. Roughly 10 percent
  A. Roughly 50 percent

  ---

  In a brute force attack, an attacker tries every possible key with the decryption algorithm, knowing that eventually one of them will work. On average, a brute force attack will succedd about 50 percent of the way through the keyspace. Reference: Implementing Cisco IOS Network Security (IINS 640-554) Foundation Learning Guide, By Catherine Paquet

• Question 37:

  Which statement about the Atomic signature engine is true?

  A. It can perform signature matching on a single packet only.
  B. It can perform signature matching on multiple packets.
  C. It can examine applications independent of the platform.
  D. It can flexibly match patterns in a session.
  A. It can perform signature matching on a single packet only.

• Question 38:

  HOTSPOT

  

  Hot Area:

  

  

• Question 39:

  Which three options are common examples of AAA implementation on Cisco routers? (Choose three.)

  A. authenticating remote users who are accessing the corporate LAN through IPsec VPN connections
  B. authenticating administrator access to the router console port, auxiliary port, and vty ports
  C. implementing PKI to authenticate and authorize IPsec VPN peers using digital certificates
  D. tracking Cisco NetFlow accounting statistics
  E. securing the router by locking down all unused services
  F. performing router commands authorization using TACACS+
  A. authenticating remote users who are accessing the corporate LAN through IPsec VPN connections
  B. authenticating administrator access to the router console port, auxiliary port, and vty ports
  F. performing router commands authorization using TACACS+

  ---

  http://www.cisco.com/en/US/products/ps6638/products_data_sheet09186a00804fe332.html

  Need for AAA Services Security for user access to the network and the ability to dynamically define a user's profile to gain access to network resources has a legacy dating back to asynchronous dial access. AAA network security services provide the primary framework through which a network administrator can set up access control on network points of entry or network access servers, which is usually the function of a router or access server.

  Authentication identifies a user; authorization determines what that user can do; and accounting monitors the network usage time for billing purposes. AAA information is typically stored in an external database or remote server such as RADIUS or TACACS+. The information can also be stored locally on the access server or router. Remote security servers, such as RADIUS and TACACS+, assign users specific privileges by associating attribute-value (AV) pairs, which define the access rights with the appropriate user. All authorization methods must be defined through AAA.

• Question 40:

  Which option can be used to authenticate the IPsec peers during IKE Phase 1?

  A. Diffie-Hellman Nonce
  B. pre-shared key
  C. XAUTH
  D. integrity check value
  E. ACS
  F. AH
  B. pre-shared key

  ---

  http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfike.html

  Encryption algorithm 56-bit DES-CBC, des, Default 56-bit DES-CBC 168-bit DES, 3des, Default 168-bit DES

  Hash algorithm SHA-1 (HMAC variant), sha, Default SHA-1 MD5 (HMAC variant), md5

  Authentication method RSA signatures, rsa-sig, Default RSA signatures RSA encrypted nonces, rsa-encr preshared keys, pre-share Diffie-Hellman group identifier 768-bit Diffie-Hellman, 1, Default 768-bit Diffie-Hellman 1024-bit Diffie-Hellman, 2 Lifetime of the security association Any number of seconds, Default 86400 seconds (one day)