Cisco 640-554 Online Practice Questions and Exam Preparation

Cisco 640-554 Online Questions & Answers

• Question 81:

  Refer to the exhibit.

  

  Based on the show policy-map type inspect zone-pair session command output shown, what can be determined about this Cisco IOS zone based firewall policy?

  A. All packets will be dropped since the class-default traffic class is matching all traffic.
  B. This is an inbound policy (applied to traffic sourced from the less secured zone destined to the more secured zone).
  C. This is an outbound policy (applied to traffic sourced from the more secured zone destined to the less secured zone).
  D. Stateful packet inspection will be applied only to HTTP packets that also match ACL 110.
  E. All non-HTTP traffic will be permitted to pass as long as it matches ACL 110.
  F. All non-HTTP traffic will be inspected.
  D. Stateful packet inspection will be applied only to HTTP packets that also match ACL 110.

  ---

  http://www.cisco.com/en/US/docs/ios/qos/command/reference/qos_m1.html

  Match access-group To configure the match criteria for a class map on the basis of the specified access control list (ACL), use the match access-group command in class-map configuration mode. To remove ACL match criteria from a class map, use the no form of this command. match access-group {access-group | name access-group-name} no match access-group access-group match protocol To configure the match criterion for a class map on the basis of a specified protocol, use the match protocol command in class-map configuration mode. To remove the protocol-based match criterion from the class map, use the no form of this command. Match protocol protocol-name no match protocol protocol-name

• Question 82:

  Refer to the exhibit.

  

  Which statement about this partial CLI configuration of an access control list is true?

  A. The access list accepts all traffic on the 10.0.0.0 subnets.
  B. All traffic from the 10.10.0.0 subnets is denied.
  C. Only traffic from 10.10.0.10 is allowed.
  D. This configuration is invalid. It should be configured as an extended ACL to permit the associated wildcard mask.
  E. From the 10.10.0.0 subnet, only traffic sourced from 10.10.0.10 is allowed; traffic sourced from the other 10.0.0.0 subnets also is allowed.
  F. The access list permits traffic destined to the 10.10.0.10 host on FastEthernet0/0 from any source.
  E. From the 10.10.0.0 subnet, only traffic sourced from 10.10.0.10 is allowed; traffic sourced from the other 10.0.0.0 subnets also is allowed.

  ---

  http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/15-2mt/sec-acl-ov-gdl.html

  The Order in Which You Enter Criteria Statements

  Note that each additional criteria statement that you enter is appended to the end of the access list statements.

  Also note that you cannot delete individual statements after they have been created. You can only delete an entire access list.

  The order of access list statements is important! When the router is deciding whether to forward or block a packet, the Cisco IOS software tests the packet against each criteria statement in the order in which the statements were created.

  After a match is found, no more criteria statements are checked.

  If you create a criteria statement that explicitly permits all traffic, no statements added later will ever be checked. If you need additional statements, you must delete the access list and retype it with the new entries.

  Apply an Access Control List to an Interface

  With some protocols, you can apply up to two access lists to an interfacE. one inbound access list and one outbound access list. With other protocols, you apply only one access list that checks both inbound and outbound packets.

  If the access list is inbound, when a device receives a packet, Cisco software checks the access list's criteria statements for a match. If the packet is permitted, the software continues to process the packet. If the packet is denied, the software

  discards the packet.

  If the access list is outbound, after receiving and routing a packet to the outbound interface, Cisco software checks the access list's criteria statements for a match. If the packet is permitted, the software transmits the packet. If the packet is

  denied, the software discards the packet.

  Note

  Access lists that are applied to interfaces on a device do not filter traffic that originates from that device. The access list check is bypassed for locally generated packets, which are always outbound. By default, an access list that is applied to

  an outbound interface for matching locally generated traffic will bypass the outbound access list check; but transit traffic is subjected to the outbound access list check.

• Question 83:

  Which Cisco product can help mitigate web-based attacks within a network?

  A. Adaptive Security Appliance
  B. Web Security Appliance
  C. Email Security Appliance
  D. Identity Services Engine
  B. Web Security Appliance

• Question 84:

  DRAG DROP

  Select and Place:

  

  

• Question 85:

  What are two primary attack methods of VLAN hopping? (Choose two.)

  A. VoIP hopping
  B. switch spoofing
  C. CAM-table overflow
  D. double tagging
  B. switch spoofing
  D. double tagging

  ---

  There are a number of different types of VLAN attacks in modern switched networks. The VLAN architecture simplifies network maintenance and improves performance, but it also opens the door to abuse. It is important to understand the general methodology behind these attacks and the primary approaches to mitigate them. VLAN hopping enables traffic from one VLAN to be seen by another VLAN. Switch spoofing is a type of VLAN hopping attack that works by taking advantage of an incorrectly configured trunk port. By default, trunk ports have access to all VLANs and pass traffic for multiple VLANs across the same physical link, generally between switches. Another type of VLAN attack is a double-tagging (or double-encapsulated) VLAN hopping attack. This type of attack takes advantage of the way that hardware on most switches operates. Most switches perform only one level of 802.1Q deencapsulation, which allows an attacker to embed a hidden 802.1Q tag inside the frame. This tag allows the frame to be forwarded to a VLAN that the original 802.1Q tag did not specify as shown below. An important characteristic of the double- encapsulated VLAN hopping attack is that it works even if trunk ports are disabled, because a host typically sends a frame on a segment that is not a trunk link.

  

  Double-Tagging Attack Reference: http://www.ciscopress.com/articles/article.asp?p=2181837andseqNum=10

• Question 86:

  Which statement about the role-based CLI access views on a Cisco router is true?

  A. The maximum number of configurable CLI access views is 10, including one lawful intercept view and excluding the root view.
  B. The maximum number of configurable CLI access views is 10, including one superview.
  C. The maximum number of configurable CLI access views is 15, including one lawful intercept view and excluding the root view.
  D. The maximum number of configurable CLI access views is 15, including one lawful intercept view.
  C. The maximum number of configurable CLI access views is 15, including one lawful intercept view and excluding the root view.

• Question 87:

  You suspect that an attacker in your network has configured a rogue Layer 2 device to intercept traffic from multiple VLANs, which allows the attacker to capture potentially sensitive data. Which two methods will help to mitigate this type of activity? (Choose two.)

  A. Turn off all trunk ports and manually configure each VLAN as required on each port.
  B. Place unused active ports in an unused VLAN.
  C. Secure the native VLAN, VLAN 1, with encryption.
  D. Set the native VLAN on the trunk ports to an unused VLAN.
  E. Disable DTP on ports that require trunking.
  D. Set the native VLAN on the trunk ports to an unused VLAN.
  E. Disable DTP on ports that require trunking.

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/layer2.html

  Layer 2 LAN Port Modes

  Table 17-2 lists the Layer 2 LAN port modes and describes how they function on LAN ports.

  switchport mode access

  Puts the LAN port into permanent nontrunking mode and negotiates to convert the link into a nontrunk link. The LAN port becomes a nontrunk port even if the neighboring LAN port does not agree to the change.

  switchport mode dynamic desirable

  Makes the LAN port actively attempt to convert the link to a trunk link. The LAN port becomes a trunk port if the neighboring LAN port is set to trunk, desirable, or auto mode. This is the default mode for all LAN ports.

  switchport mode dynamic auto

  Makes the LAN port willing to convert the link to a trunk link. The LAN port becomes a trunk port if the neighboring LAN port is set to trunk or desirable mode.

  switchport mode trunk

  Puts the LAN port into permanent trunking mode and negotiates to convert the link into a trunk link. The LAN port becomes a trunk port even if the neighboring port does not agree to the change.

  switchport nonegotiate

  Puts the LAN port into permanent trunking mode but prevents the port from generating DTP frames. You must configure the neighboring port manually as a trunk port to establish a trunk link.

  http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a008013159f.shtml

  Double Encapsulation Attack

  When double-encapsulated 802.1Q packets are injected into the network from a device whose VLAN happens to be the native VLAN of a trunk, the VLAN identification of those packets cannot be preserved from end to end since the 802.1Q

  trunk would always modify the packets by stripping their outer tag. After the external tag is removed, the internal tag permanently becomes the packet's only VLAN identifier. Therefore, by doubleencapsulating packets with two different tags,

  traffic can be made to hop across VLANs.

  This scenario is to be considered a misconfiguration, since the 802.1Q standard does not necessarily force the users to use the native VLAN in these cases. As a matter of fact, the proper configuration that should always be used is to clear

  the native VLAN from all 802.1Q trunks (alternatively, setting them to 802.1q-all- tagged mode achieves the exact same result). In cases where the native VLAN cannot be cleared, then always pick an unused VLAN as native VLAN of all the

  trunks; don't use this VLAN for any other purpose.

  Protocols like STP, DTP, and UDLD (check out [3]) should be the only rightful users of the native VLAN and their traffic should be completely isolated from any data packets.

• Question 88:

  Which two accounting notices are used to send a failed authentication attempt record to a AAA server? (Choose two.)

  A. start-stop
  B. stop-record
  C. stop-only
  D. stop
  A. start-stop
  C. stop-only

• Question 89:

  Which address block is reserved for locally assigned unique local addresses?

  A. 2002::/16
  B. FD00::/8
  C. 2001::/32
  D. FB00::/8
  B. FD00::/8

• Question 90:

  When Cisco IOS zone-based policy firewall is configured, which three actions can be applied to a traffic class? (Choose three.)

  A. pass
  B. police
  C. inspect
  D. drop
  E. queue
  F. shape
  A. pass
  C. inspect
  D. drop

  ---

  http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00808bc994.shtml

  Zone-Based Policy Firewall Actions

  ZFW provides three actions for traffic that traverses from one zone to another:

  Drop -- This is the default action for all traffic, as applied by the "class class-default" that terminates every inspect-type policy-map. Other class-maps within a policy-map can also be configured to drop unwanted traffic.

  Traffic that is handled by the drop action is "silently" dropped (i.e., no notification of the drop is sent to the relevant end-host) by the ZFW, as opposed to an ACL's behavior of sending an ICMP "host unreachable" message to the host that sent

  the denied traffic. Currently, there is not an option to change the "silent drop" behavior. The log option can be added with drop for syslog notification that traffic was dropped by the firewall.

  Pass -- This action allows the router to forward traffic from one zone to another. The pass action does not track the state of connections or sessions within the traffic. Pass only allows the traffic in one direction. A corresponding policy must be

  applied to allow return traffic to pass in the opposite direction. The pass action is useful for protocols such as IPSec ESP, IPSec AH, ISAKMP, and other inherently secure protocols with predictable behavior. However, most application traffic is

  better handled in the ZFW with the inspect action.

  Inspect -- The inspect action offers state-based traffic control. For example, if traffic from the private zone to the Internet zone in the earlier example network is inspected, the router maintains connection or session information for TCP and

  User Datagram Protocol (UDP) traffic. Therefore, the router permits return traffic sent from Internet-zone hosts in reply to private zone connection requests. Also, inspect can provide application inspection and control for certain service

  protocols that might carry vulnerable or sensitive application traffic.

  Audit-trail can be applied with a parameter-map to record connection/session start, stop, duration, the data volume transferred, and source and destination addresses.