Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 51:

  Which two considerations about secure network monitoring are important? (Choose two.)

  A. log tampering
  B. encryption algorithm strength
  C. accurate time stamping
  D. off-site storage
  E. Use RADIUS for router commands authorization.
  F. Do not use a loopback interface for device management access.
  A. log tampering
  C. accurate time stamping

  ---

  A coordinated clock is important primarily to provide chronological, sequential, and coordinated logs. If clock sources are hijacked, events posted to logs can be out of sequence and not coordinated. The risks include:

  •

  The date of clock events could be modified so that they would not appear on daily/weekly reports

  •

  The date could be modified back far enough so that events would be instantly purged at the logging server

  •

  The dates on multiple devices could be modified so that causal events would not appear correlated in time The net result of such tampering would corrupt the logs, therefore crippling the forensic analysis of events. Reference: http://www.cisco.com/web/about/security/intelligence/05_11_nsa-scty-compliance.html

• Question 52:

  Which two options are asymmetric-key algorithms that are recommended by Cisco? (Choose two.)

  A. Rivest-Shamir-Adleman Algorithm
  B. ElGamal encryption system
  C. Digital Signature Algorithm
  D. Paillier cryptosystem
  A. Rivest-Shamir-Adleman Algorithm
  C. Digital Signature Algorithm

• Question 53:

  Which statement about extended access lists is true?

  A. Extended access lists perform filtering that is based on source and destination and are most effective when applied to the destination
  B. Extended access lists perform filtering that is based on source and destination and are most effective when applied to the source
  C. Extended access lists perform filtering that is based on destination and are most effective when applied to the source
  D. Extended access lists perform filtering that is based on source and are most effective when applied to the destination
  B. Extended access lists perform filtering that is based on source and destination and are most effective when applied to the source

• Question 54:

  Which two IPsec protocols are used to protect data in motion? (Choose two.)

  A. Encapsulating Security Payload Protocol
  B. Transport Layer Security Protocol
  C. Secure Shell Protocol
  D. Authentication Header Protocol
  A. Encapsulating Security Payload Protocol
  D. Authentication Header Protocol

  ---

  IPsec provides three main facilities:

  An authentication-only function, referred to as Authentication Header (AH)

  A combined authentication/ encryption function called Encapsulating Security Payload (ESP)

  A key exchange function. For virtual private networks, both authentication and encryption are generally desired, because it is important both to a) assure that unauthorized users do not penetrate the virtual private network, and b) assure that

  eavesdroppers on the Internet cannot read messages sent over the virtual private network.

  Because both features are generally desirable, most implementations are likely to use ESP rather than AH. The key exchange function allows for manual exchange of keys as well as an automated scheme.

  Reference: http://www.cisco.com/c/en/us/td/docs/net_mgmt/vpn_solutions_center/2-0/ip_security/provisioning/guide/IPsecPG1.html

• Question 55:

  Which statement describes how the sender of the message is verified when asymmetric encryption is used?

  A. The sender encrypts the message using the sender's public key, and the receiver decrypts the message using the sender's private key.
  B. The sender encrypts the message using the sender's private key, and the receiver decrypts the message using the sender's public key.
  C. The sender encrypts the message using the receiver's public key, and the receiver decrypts the message using the receiver's private key.
  D. The sender encrypts the message using the receiver's private key, and the receiver decrypts the message using the receiver's public key.
  E. The sender encrypts the message using the receiver's public key, and the receiver decrypts the message using the sender's public key.
  C. The sender encrypts the message using the receiver's public key, and the receiver decrypts the message using the receiver's private key.

  ---

  http://www.cisco.com/en/US/tech/tk1132/technologies_white_paper09186a00800e79cb.shtml

  Public-Key Cryptography and Asymmetric Encryption

  In asymmetric encryption, two different keys are used to render data illegible to anyone who may be eavesdropping on a conversation. The certificates contain the two components of asymmetric encryption: public key and private key.

  Data that is encrypted with the public key can be decrypted with the private key, and vice versa. However, data encrypted with the public key cannot be decrypted with the public key. The parties who need to encrypt their communications will

  exchange their public keys (contained in the certificate), but will not disclose their private keys. The sending party will use the public key of the receiving party to encrypt message data and forward the cipher text (encrypted data) to the other

  party. The receiving party will then decrypt the cipher text with their private key.

  Data encrypted with the public key cannot be decrypted with the public key. This prevents someone from compromising the cipher text after acquiring both public keys by eavesdropping on the certificate exchange.

• Question 56:

  What is the purpose of a trunk port?

  A. A trunk port carries traffic for multiple VLANs.
  B. A trunk port connects multiple hubs together to increase bandwidth.
  C. A trunk port separates VLAN broadcast domains.
  D. A trunk port provides a physical link specifically for a VPN.
  A. A trunk port carries traffic for multiple VLANs.

  ---

  Ethernet interfaces can be configured either as access ports or trunk ports. Trunks carry the traffic of multiple VLANs over a single link and allow you to extend VLANs across the network. Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/AccessTrunk.html

• Question 57:

  Which two options are advantages of a network-based Cisco IPS? (Choose two.)

  A. It can examine encrypted traffic.
  B. It can protect the host after decryption.
  C. It is an independent operating platform.
  D. It can observe bottom-level network events.
  E. It can block traffic
  C. It is an independent operating platform.
  D. It can observe bottom-level network events.

• Question 58:

  What Cisco Security Agent Interceptor is in charge of intercepting all read/write requests to the rc files in UNIX?

  A. Configuration interceptor
  B. Network interceptor
  C. File system interceptor
  D. Execution space interceptor
  A. Configuration interceptor

  ---

  Configuration interceptor: Read/write requests to the Registry in Windows or to rc configuration files on UNIX are intercepted. This interception occurs because modification of the operating system configuration can have serious consequences. Therefore, Cisco Security Agent tightly controls read/write requests to the Registry.

• Question 59:

  Which type of management reporting is defined by separating management traffic from production traffic?

  A. IPsec encrypted
  B. in-band
  C. out-of-band
  D. SSH
  C. out-of-band

  ---

  http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/SAFE_RG/chap9.html#wp1054536

  OOB Management Best Practices The OOB network segment hosts console servers, network management stations, AAA servers, analysis and correlation tools, NTP, FTP, syslog servers, network compliance management, and any other management and control services. A single OOB management network may serve all the enterprise network modules located at the headquarters. An OOB management network should be deployed using the following best practices:

  •

  Provide network isolation

  •

  Enforce access control

  •

  Prevent data traffic from transiting the management network

• Question 60:

  Which option describes a function of a virtual VLAN?

  A. A virtual VLAN creates a logically partitioned LAN to place switch ports in a separate broadcast domain.
  B. A virtual VLAN creates trunks and links two switches together.
  C. A virtual VLAN adds every port on a switch to its own collision domain.
  D. A virtual VLAN connects many hubs together.
  A. A virtual VLAN creates a logically partitioned LAN to place switch ports in a separate broadcast domain.