Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 71:

  How can the administrator enable permanent client installation in a Cisco AnyConnect VPN firewall configuration?

  A. Issue the command anyconnect keep-installer under the group policy or username webvpn mode
  B. Issue the command anyconnect keep-installer installed in the global configuration
  C. Issue the command anyconnect keep-installer installed under the group policy or username webvpn mode
  D. Issue the command anyconnect keep-installer installer under the group policy or username webvpn mode
  D. Issue the command anyconnect keep-installer installer under the group policy or username webvpn mode

  ---

  To enable permanent client installation for a specific group or user, use the anyconnect keep-installer command from group-policy or username webvpn modes: anyconnect keep-installer installer The default is that permanent installation of the client is enabled. The client remains on the remote computer at the end of the session. The following example configures the existing group-policy sales to remove the client on the remote computer at the end of the session: hostname(config)# group-policy sales attributes hostname(config-group-policy)# webvpn hostname(config-group-policy)# anyconnect keep-installer installed none

  Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/ asa_84_cli_config/vpn_anyconnect.html

• Question 72:

  What is the key difference between host-based and network-based intrusion prevention?

  A. Network-based IPS is better suited for inspection of SSL and TLS encrypted data flows.
  B. Network-based IPS provides better protection against OS kernel-level attacks against hosts and servers.
  C. Network-based IPS can provide protection to desktops and servers without the need of installing specialized software on the end hosts and servers.
  D. Host-based IPS can work in promiscuous mode or inline mode.
  E. Host-based IPS is more scalable then network-based IPS.
  F. Host-based IPS deployment requires less planning than network-based IPS.
  C. Network-based IPS can provide protection to desktops and servers without the need of installing specialized software on the end hosts and servers.

  ---

  http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/ServerFarmSec_2.1/8_NIDS.html

  Cisco Network-Based Intrusion Detection -- Functionalities and Configuration

  This chapter highlights the need for and the benefits of deploying network-based intrusion detection in the data center. It addresses mitigation techniques, deployment models, and the management of the infrastructure.

  Intrusion detection systems help data centers and other computer installations prepare for and deal with electronic attacks. Usually deployed as a component of a security infrastructure with a set of security policies for a larger, comprehensive

  information system, the detection systems themselves are of two main types. Network-based systems inspect traffic "on the wire" and host-based systems monitor only individual computer server traffic. Network intrusion detection systems

  deployed at several points within a single network topology, together with host-based intrusion detection systems and firewalls, can provide a solid, multi-pronged defense against both outside, Internet-based attacks, and internal threats,

  including network misconfiguration, misuse, or negligent practices. The Cisco Intrusion Detection System (IDS) product line provides flexible solutions for data center security.

• Question 73:

  On Cisco ISR routers, for what purpose is the realm-cisco.pub public encryption key used?

  A. used for SSH server/client authentication and encryption
  B. used to verify the digital signature of the IPS signature file
  C. used to generate a persistent self-signed identity certificate for the ISR so administrators can authenticate the ISR when accessing it using Cisco Configuration Professional
  D. used to enable asymmetric encryption on IPsec and SSL VPNs
  E. used during the DH exchanges on IPsec VPNs
  B. used to verify the digital signature of the IPS signature file

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/prod_white_paper0900aecd805c4ea8.html

  Step 1: Downloading IOS IPS files

  The first step is to download IOS IPS signature package files and public crypto key from Cisco.com.

  Step 1.1: Download the required signature files from Cisco.com to your PC

  ?Location: http://tools.cisco.com/support/downloads/go/Model.x?mdfid=28144296and;mdfLevel=Software%20Familand;treeName=Securitand;modelName=Cisco% 20IOS%20Intrusion%20Prevention%20System%20Feature%

  20SoftwareandtreeMdfId=268438162

  ?Files to download:

  IOS-Sxxx-CLI.pkg: Signature package - download the latest signature package.

  realm-cisco.pub.key.txt: Public Crypto key - this is the crypto key used by IOS IPS

• Question 74:

  Which step is important to take when implementing secure network management?

  A. Implement in-band management whenever possible.
  B. Implement telnet for encrypted device management access.
  C. Implement SNMP with read/write access for troubleshooting purposes.
  D. Synchronize clocks on hosts and devices.
  E. Implement management plane protection using routing protocol authentication.
  D. Synchronize clocks on hosts and devices.

  ---

  http://www.cisco.com/en/US/tech/tk869/tk769/technologies_white_paper09186a0080117070.shtml

  Background Information

  Network time synchronization, to the degree required for modern performance analysis, is an essential exercise. Depending on the business models, and the services being provided, the characterization of network performance can be

  considered an important competitive service differentiator. In these cases, great expense may be incurred deploying network management systems and directing engineering resources towards analyzing the collected performance data.

  However, if proper attention is not given to the often-overlooked principle of time synchronization, those efforts may be rendered useless.

• Question 75:

  Refer to Cisco IOS Zone-Based Policy Firewall, where will the inspection policy be applied?

  A. to the zone-pair
  B. to the zone
  C. to the interface
  D. to the global service policy
  A. to the zone-pair

  ---

  Zone-based policy firewall (also known as "Zone-Policy Firewall" or "ZPF") changes the firewall from the older interface-based model to a more flexible, more easily understood zone-based configuration model. Interfaces are assigned to

  zones, and an inspection policy is applied to traffic moving between the zones. Inter-zone policies offer considerable flexibility and granularity, so different inspection policies can be applied to multiple host groups connected to the same router

  interface.

  The following task order can be followed to configure a Zone-Based Policy Firewall:

  1.

  Define zones.

  2.

  Define zone-pairs.

  3.

  Define class-maps that describe traffic that must have policy applied as it crosses a zone-pair.

  4.

  Define policy-maps to apply action to your class-map's traffic.

  5.

  Apply policy-maps to zone-pairs.

  6.

  Assign interfaces to zones.

  Reference: http://www.cisco.com/c/en/us/td/docs/routers/access/cisco_router_and_security_device_manager/24/software/user/guide/ZPF.html

• Question 76:

  Which three statements about applying access control lists to a Cisco router are true? (Choose three.)

  A. Place more specific ACL entries at the top of the ACL.
  B. Place generic ACL entries at the top of the ACL to filter general traffic and thereby reduce "noise" on the network.
  C. ACLs always search for the most specific entry before taking any filtering action.
  D. Router-generated packets cannot be filtered by ACLs on the router.
  E. If an access list is applied but it is not configured, all traffic passes.
  A. Place more specific ACL entries at the top of the ACL.
  D. Router-generated packets cannot be filtered by ACLs on the router.
  E. If an access list is applied but it is not configured, all traffic passes.

  ---

  http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/15-2mt/sec-acl-ov-gdl.html

  The Order in Which You Enter Criteria Statements

  Note that each additional criteria statement that you enter is appended to the end of the access list statements.

  Also note that you cannot delete individual statements after they have been created. You can only delete an entire access list. The order of access list statements is important! When the router is deciding whether to forward or block a packet,

  the Cisco IOS software tests the packet against each criteria statement in the order in which the statements were created. After a match is found, no more criteria statements are checked.

  If you create a criteria statement that explicitly permits all traffic, no statements added later will ever be checked. If you need additional statements, you must delete the access list and retype it with the new entries.

  Apply an Access Control List to an Interface

  With some protocols, you can apply up to two access lists to an interfacE. one inbound access list and one outbound access list. With other protocols, you apply only one access list that checks both inbound and outbound packets.

  If the access list is inbound, when a device receives a packet, Cisco software checks the access list's criteria statements for a match. If the packet is permitted, the software continues to process the packet. If the packet is denied, the software

  discards the packet. If the access list is outbound, after receiving and routing a packet to the outbound interface, Cisco software checks the access list's criteria statements for a match. If the packet is permitted, the software transmits the

  packet. If the packet is denied, the software discards the packet.

  Note

  Access lists that are applied to interfaces on a device do not filter traffic that originates from that device. The access list check is bypassed for locally generated packets, which are always outbound. By default, an access list that is applied to

  an outbound interface for matching locally generated traffic will bypass the outbound access list check; but transit traffic is subjected to the outbound access list check.

• Question 77:

  Which option describes information that must be considered when you apply an access list to a physical interface?

  A. Protocol used for filtering
  B. Direction of the access class
  C. Direction of the access group
  D. Direction of the access list
  C. Direction of the access group

• Question 78:

  Which command configures stateful packet inspection to inspect a packet after it passes the inbound ACL of the input interface?

  A. ip inspect out
  B. ip inspect in
  C. ip inspect name audit-trail on
  D. ip inspect name audit-trail off
  B. ip inspect in

• Question 79:

  What must be configured before Secure Copy can be enabled?

  A. SSH
  B. AAA
  C. TFTP
  D. FTP
  B. AAA

• Question 80:

  Information about a managed device's resources and activity is defined by a series of objects. What defines the structure of these management objects?

  A. MIB
  B. FIB
  C. LDAP
  D. CEF
  A. MIB

  ---

  Management Information Base (MIB) is the database of configuration variables that resides on the networking device.