Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 41:

  In an IPsec VPN, what determination does the access list make about VPN traffic?

  A. whether the traffic should be blocked
  B. whether the traffic should be permitted
  C. whether the traffic should be encrypted
  D. the peer to which traffic should be sent
  C. whether the traffic should be encrypted

  ---

  Crypto access lists are used to define which IP traffic will be protected by crypto and which traffic will not be protected by crypto (encrypted). These access lists are not the same as regular access lists, which determine what traffic to forward or block at an interface. For example, access lists can be created to protect all IP traffic between Subnet A and Subnet Y or Telnet traffic between Host A and Host B. Reference: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfipsec.html#wp1001139

• Question 42:

  Scenario:

  You are the security admin for a small company. This morning your manager has supplied you with a list of Cisco ISR and CCP configuration questions. Using CCP, your job is to navigate the pre-configured CCP in order to find answers to

  your business question.

  

  What NAT address will be assigned by ACL 1?

  A. 192.168.1.0/25
  B. GlobalEthernet0/0 interface address.
  C. 172.25.223.0/24
  D. 10.0.10.0/24
  C. 172.25.223.0/24

  ---

  

• Question 43:

  Which command enables Cisco IOS image resilience?

  A. secure boot-
  B. secure boot-running-config
  C. secure boot-start
  D. secure boot-image
  D. secure boot-image

  ---

  http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html

  secure boot-config To take a snapshot of the router running configuration and securely archive it in persistent storage, use the secure boot-config command in global configuration mode. To remove the secure configuration archive and disable configuration resilience, use the no form of this command.

  secure boot-config [restore filename] no secure boot-config Usage Guidelines

  Without any parameters, this command takes a snapshot of the router running configuration and securely archives it in persistent storage. Like the image, the configuration archive is hidden and cannot be viewed or removed directly from the command-line interface (CLI) prompt . It is recommended that you run this command after the router has been fully configured to reach a steady state of operation and the running configuration is considered complete for a restoration, if required. A syslog message is printed on the console notifying the user of configuration resilience activation. The secure archive uses the time of creation as its filename. For example, .runcfg-20020616-081702.ar was created July 16 2002 at

  8:17:02.

  The restore option reproduces a copy of the secure configuration archive as the supplied filename

  (disk0:running-config, slot1:runcfg, and so on). The restore operation will work only if configuration resilience is enabled. The number of restored copies that can be created is unlimited.

  The no form of this command removes the secure configuration archive and disables configuration resilience.

  An enable, disable, enable sequence has the effect of upgrading the configuration archive if any changes were made to the running configuration since the last time the feature was disabled.

  The configuration upgrade scenario is similar to an image upgrade. The feature detects a different version of Cisco IOS and notifies the user of a version mismatch. The same command can be run to upgrade the configuration archive to a

  newer version after new configuration commands corresponding to features in the new image have been issued.

  The correct sequence of steps to upgrade the configuration archive after an image upgrade is as follows:

  •

  Configure new commands

  •

  Issue the secure boot-config command secure boot-image To enable Cisco IOS image resilience, use the secure boot-image command in global configuration mode. To disable Cisco IOS image resilience and release the secured image so that it can be safely removed, use the no form of this command.

  secure boot-image no secure boot-image Usage Guidelines This command enables or disables the securing of the running Cisco IOS image. The following two possible scenarios exist with this command.

  •

  When turned on for the first time, the running image (as displayed in the show version command output) is secured, and a syslog entry is generated. This command will function properly only when the system is configured to run an image

  from a disk with an Advanced Technology Attachment (ATA) interface. Images booted from a TFTP server cannot be secured. Because this command has the effect of "hiding" the running image, the image file will not be included in any

  directory listing of the disk. The no form of this command releases the image so that it can be safely removed.

  •

  If the router is configured to boot up with Cisco IOS resilience and an image with a different version of Cisco IOS is detected, a message similar to the following is displayed at bootup:

  ios resilience :Archived image and configuration version 12.2 differs from running

  version 12.3.

  Run secure boot-config and image commands to upgrade archives to running version.

  To upgrade the image archive to the new running image, reenter this command from the console. A message will be displayed about the upgraded image. The old image is released and will be visible in the dir command output.

• Question 44:

  In which two modes can Cisco Configuration Professional Security Audit operate? (Choose two.)

  A. Security Audit wizard
  B. Lockdown
  C. One-Step Lockdown
  D. AutoSecure
  A. Security Audit wizard
  C. One-Step Lockdown

  ---

  

  Reference: http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/configuration-professional/data_sheet_c78_462210.html

• Question 45:

  Which type of intrusion prevention technology is the primary type used by the Cisco IPS security appliances?

  A. profile-based
  B. rule-based
  C. protocol analysis-based
  D. signature-based
  E. NetFlow anomaly-based
  D. signature-based

  ---

  http://www.cisco.com/en/US/docs/ios/12_3t/12_3t8/feature/guide/gt_fwids.html

  The Signature Definition File A Signature Definition file (SDF) has definitions for each signature it contains. After signatures are loaded and complied onto a router running Cisco IOS IPS, IPS can begin detecting the new signatures immediately. If customers do not use the default, built-in signatures that are shipped with the routers, users can choose to download one of two different types of SDFs: the attack-drop.sdf file (which is a static file) or a dynamic SDF (which is dynamically updated and accessed from Cisco.com). The attack-drop.sdf file is available in flash on all Cisco access routers that are shipped with Cisco IOS Release 12.3(8)T or later. The attack-drop.sdf file can then be loaded directly from flash into the Cisco IOS IPS system. If flash is erased, the attack-drop.sdf file may also be erased. Thus, if you are copying a Cisco IOS image to flash and are prompted to erase the contents of flash before copying the new image, you might risk erasing the attack-drop.sdf file. If this occurs, the router will refer to the built-in signatures within the Cisco IOS image. The attack-drop.sdf file can also be downloaded onto your router from Cisco.com. To help detect the latest vulnerabilities, Cisco provides signature updates on Cisco.com on a regular basis. Users can use SDM or VMS to download these signature updates, tune the signature parameters as necessary, and deploy the new SDF to a Cisco IOS IPS router.

• Question 46:

  Which Cisco AnyConnect VPN feature enables DTLS to fall back to a TLS connection?

  A. perfect forward secrecy
  B. dead peer detection
  C. keepalives
  D. IKEv2
  B. dead peer detection

• Question 47:

  Which of the following statements about access lists are true? (Choose three.)

  A. Extended access lists should be placed as near as possible to the destination
  B. Extended access lists should be placed as near as possible to the source
  C. Standard access lists should be placed as near as possible to the destination
  D. Standard access lists should be placed as near as possible to the source
  E. Standard access lists filter on the source address
  F. Standard access lists filter on the destination address
  B. Extended access lists should be placed as near as possible to the source
  C. Standard access lists should be placed as near as possible to the destination
  E. Standard access lists filter on the source address

• Question 48:

  Which TACACS+ server-authentication protocols are supported on Cisco ASA firewalls? (Choose three.)

  A. EAP
  B. ASCII
  C. PAP
  D. PEAP
  E. MS-CHAPv1
  F. MS-CHAPv2
  B. ASCII
  C. PAP
  E. MS-CHAPv1

  ---

  Information about TACACS+ Servers

  The ASA supports TACACS+ server authentication with the following protocols: ASCII, PAP, CHAP, and MS-CHAPv1.

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/ asa_91_general_config/aaa_tacacs.html

• Question 49:

  Which VTP mode allows you to change the VLAN configuration and will then propagate the change throughout the entire switched network?

  A. VTP server
  B. VTP client
  C. VTP transparent
  D. VTP off
  A. VTP server

• Question 50:

  Which statement about identity NAT is true?

  A. It is a static NAT configuration that translates the real IP address on the ingress interface to the same IP address on the egress interface.
  B. It is a dynamic NAT configuration that translates a real IP address to a mapped IP address.
  C. It is a static NAT configuration that translates a real IP address to a mapped IP address.
  D. It is a dynamic NAT configuration that translates the real IP address on the ingress interface to the same IP address on the egress interface.
  A. It is a static NAT configuration that translates the real IP address on the ingress interface to the same IP address on the egress interface.