Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 61:

  Which tasks is the session management path responsible for? (Choose three.)

  A. Verifying IP checksums
  B. Performing route lookup
  C. Performing session lookup
  D. Allocating NAT translations
  E. Checking TCP sequence numbers
  F. Checking packets against the access list
  B. Performing route lookup
  D. Allocating NAT translations
  F. Checking packets against the access list

  ---

  The session management path is responsible for the following tasks:

  Performing the access list checks

  Performing route lookups

  Allocating NAT translations (xlates)

  Establishing sessions in the";fast pat";

  Reference: http://www.cisco.com/c/en/us/td/docs/security/fwsm/fwsm31/configuration/guide/fwsm_cfg/ intro_f.html

• Question 62:

  Which actions can a promiscuous IPS take to mitigate an attack? (Choose three.)

  A. modifying packets
  B. requesting connection blocking
  C. denying packets
  D. resetting the TCP connection
  E. requesting host blocking
  F. denying frames
  B. requesting connection blocking
  D. resetting the TCP connection
  E. requesting host blocking

  ---

  Promiscuous Mode Event Actions The following event actions can be deployed in Promiscuous mode. These actions are in affect for a user- configurable default time of 30 minutes. Because the IPS sensor must send the request to another device or craft a packet, latency is associated with these actions and could allow some attacks to be successful. Blocking through usage of the Attack Response Controller (ARC) has the potential benefit of being able to perform to the network edge or at multiple places within the network. Request block host: This event action will send an ARC request to block the host for a specified time frame, preventing any further communication. This is a severe action that is most appropriate when there is minimal chance of a false alarm or spoofing. Request block connection: This action will send an ARC response to block the specific connection. This action is appropriate when there is potential for false alarms or spoofing. Reset TCP connection: This action is TCP specific, and in instances where the attack requires several TCP packets, this can be a successful action. However, in some cases where the attack only needs one packet it may not work as well. Additionally, TCP resets are not very effective with protocols such as SMTP that consistently try to establish new connections, nor are they effective if the reset cannot reach the destination host in time. Reference: http://www.cisco.com/web/about/security/intelligence/ipsmit.html

• Question 63:

  Which statements about smart tunnels on a Cisco firewall are true? (Choose two.)

  A. Smart tunnels can be used by clients that do not have administrator privileges
  B. Smart tunnels support all operating systems
  C. Smart tunnels offer better performance than port forwarding
  D. Smart tunnels require the client to have the application installed locally
  A. Smart tunnels can be used by clients that do not have administrator privileges
  C. Smart tunnels offer better performance than port forwarding

  ---

  Smart tunnel is supported on Windows and Mac OS X platforms only.

  OS X 10.9 does not support Smart Tunnel.

  Smart tunnel does not support Linux.

  Smart Tunnel Advantages over Port-Forwarding, Plug-ins

  Smart Tunnel offers better performance than browser plug-ins. Port forwarding is the legacy technology for supporting TCP-based applications over a Clientless SSL VPN connection. Unlike port forwarding, Smart Tunnel simplifies the user

  experience by not requiring the user connection of the local application to the local port.

  Smart Tunnel does not require users to have administrator privileges. Smart Tunnel does not require the administrator to know application port numbers in advance.

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asa-vpn-compatibility.html http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/tunnel.pdf

• Question 64:

  Which type of NAT would you configure if a host on the external network required access to an internal host?

  A. Outside global NAT
  B. NAT overload
  C. Dynamic outside NAT
  D. Static NAT
  D. Static NAT

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_static.html Information About Static NAT Static NAT creates a fixed translation of real address(es) to mapped address(es).With dynamic NAT and PAT, each host uses a different address or port for each subsequent translation. Because the mapped address is the same for each consecutive connection with static NAT, and a persistent translation rule exists, static NAT allows hosts on the destination network to initiate traffic to a translated host (if an access list exists that allows it).

  The main difference between dynamic NAT and a range of addresses for static NAT is that static NAT allows a remote host to initiate a connection to a translated host (if an access list exists that allows it), while dynamic NAT does not. You also need an equal number of mapped addresses as real addresses with static NAT.

  Figure 28-1 shows a typical static NAT scenario. The translation is always active so both translated and remote hosts can originate connections, and the mapped address is statically assigned by the static command. Figure 28-1 Static NAT

  

• Question 65:

  Which two ports does Cisco Configuration Professional use? (Choose two.)

  A. 80
  B. 8080
  C. 443
  D. 21
  E. 23
  A. 80
  C. 443

• Question 66:

  On which Cisco Configuration Professional screen do you enable AAA?

  A. AAA Summary
  B. AAA Servers and Groups
  C. Authentication Policies
  D. Authorization Policies
  A. AAA Summary

  ---

  Authentication/Authorization: These fields are visible when AAA is enabled on the router. AAA can be enabled by clicking Configure > Router > AAA > AAA Summary > Enable AAA.

  Reference: Cisco Configuration Professional User Guide 2.5 PDF

• Question 67:

  Scenario:

  You are the security admin for a small company. This morning your manager has supplied you with a list of Cisco ISR and CCP configuration questions. Using CCP, your job is to navigate the pre-configured CCP in order to find answers to

  your business question.

  

  Which policy is assigned to Zone Pair sdm-zip-OUT-IN?

  A. Sdm-cls-http
  B. OUT_SERVICE
  C. Ccp-policy-ccp-cls-1
  D. Ccp-policy-ccp-cls-2
  D. Ccp-policy-ccp-cls-2

• Question 68:

  What features can protect the data plane? (Choose three.)

  A. policing
  B. ACLs
  C. IPS
  D. antispoofing
  E. QoS
  F. DHCP-snooping
  B. ACLs
  D. antispoofing
  F. DHCP-snooping

  ---

  Reference: http://www.ciscopress.com/articles/article.asp?p=1924983andseqNum=5

• Question 69:

  When a switch has multiple links connected to a downstream switch, what is the first step that STP takes to prevent loops?

  A. STP elects the root bridge.
  B. STP selects the root port.
  C. STP selects the designated port.
  D. STP blocks one of the ports.
  A. STP elects the root bridge.

• Question 70:

  Which IOS feature can limit SSH access to a specific subnet under a VTY line?

  A. access class
  B. access list
  C. route map
  D. route tag
  A. access class