Cisco 640-722 Online Practice Questions and Exam Preparation

Cisco 640-722 Online Questions & Answers

• Question 41:

  To mitigate DoS attacks on a network, what security method should be implemented?

  A. WEP
  B. 802.1x
  C. Non-broadcast SSID
  D. Client MFP
  D. Client MFP

• Question 42:

  Which statement describes a security weakness of a WPA2 with a PSK?

  A. The compromised key can be used for another connection.
  B. The key can be eavesdropped from the wireless medium.
  C. The key can be recreated from a few eavesdropped frames.
  D. The key is not case-sensitive and is vulnerable to compromise by brute-force methods.
  A. The compromised key can be used for another connection.

  ---

  WPA2-Enterprise is (in my opinion) considerably more secure than PSK. Reasons

  WPA2-PSK has a single shared key amongst all devices. That means that if one of the devices is compromised the key is lost, so the more devices you have the risk of loss or compromise increases. As against this WPA2-Enterprise has per

  user secrets, so not the same problem. Using WPA2-Enterprise each user can change their credentials as required, whereas with WPA2-PSK changing the secret could be a major undertaking, depending on the size and make-up of the user/

  device population. This increases the potential severity of a compromise as key rotation will be much slower (in most cases) than password rotation so if a credential is compromised, it's likely to remain so for longer with PSK. With WPA2Enterprise you can make use of stronger authentication mechanisms (e.g. 2- factor if needed)

  With WPA2-Enterprise you can add certificate authentication to stop random attackers brute-forcing the users creds to get access.

• Question 43:

  Refer to the exhibit.

  

  At which point in the network topology must the trunk be configured to support multiple SSIDs for voice and data separation?

  A. A
  B. B
  C. C
  D. D
  D. D

  ---

  Controllers typically map WLANs to VLANs. When configuring a switch port to a controller, you would set the port to support 802.1Q (switchport trunk encapsulation dot1q), then set the port to trunk (switchport mode trunk) and only allow the VLANs needed by the controller (for example, switchport trunk allowed VLANs 10,20,30 if your controller needs only VLANs 10, 20, and 30).

  Reference: CCNA Wireless (640-722 IUWNE) Quick Reference Guide page 111

• Question 44:

  DRAG DROP

  Drag the Cisco WCS report from the left and drop it on the category it reports on to the right.

  Select and Place:

  

  

• Question 45:

  Refer to the exhibit.

  

  Which antenna would produce the given radiation pattern?

  A. patch
  B. Yagi
  C. parabolic dish
  D. dipole
  E. omni-directional
  A. patch

• Question 46:

  Which two statements about beacon frames used by access points are true? (Choose two.)

  A. They contain SSIDs if this feature is enabled.
  B. They provide vendor proprietary information.
  C. They are another name for an associated request.
  D. They are sent in response to a probe frame.
  E. They include ATIM window information for power save operations.
  A. They contain SSIDs if this feature is enabled.
  B. They provide vendor proprietary information.

  ---

  Probably the most common 802.11 management frame is the beacon frame. This frame is broadcasted from the AP listing the capabilities of the WLAN, but what exactly is listed? Let's take a quick look.

  

  Beacon frame from a Cisco WLAN Here we can easily make out some of the capabilities of the WLAN, for example the SSID is probably going to be the first thing you notice TestSSID in this case, this is what provides the name of the WLAN. As you know SSID broadcasting can be disabled (Also called Closed System) at which point the SSID field will be blank. Now, at the end of the beacon frame you will notice all this Unknown information, as you have probably guessed (or read) this information is vendor specific, which is common for every vendor to have put their own proprietary information within the Beacon frames.

  Reference: http://ccie-or-null.net/2011/06/22/802-11-beacon-frames/

• Question 47:

  You are setting up a laptop to connect to the wireless network of your organization. The protocols that are used for the corporate network are WPA2 Enterprise, PEAP, and AES. Which three parameters do you need to configure in the Windows 7 wireless network properties for this connection? (Choose three.)

  A. VLAN
  B. encryption type
  C. authentication method
  D. VRF
  E. security type
  F. IP address
  B. encryption type
  C. authentication method
  E. security type

  ---

  On the Security tab, you can specify the following security types:

  

  No authentication (Open)

  

  Shared or Shared key authentication (The Security tab is the only location where you can configure shared key authentication because its use is highly discouraged.)

  

  WPA2-Personal

  

  WPA-Personal

  

  WPA2-Enterprise

  

  WPA-Enterprise

  

  802.1x

  Based on the selected security type, you can configure either a network security key or specify and configure a network authentication method. If you specify WPA-Enterprise, WPA2- Enterprise, or 802.1x as your security type, you must configure the following (as shown in the previous figure):

  

  Choose a network authentication methodSelect an Extensible Authentication Protocol (EAP) method and click Settings to configure the EAP type as needed.

  

  Remember my credentials for this connection each time I'm logged on: Specifies that when the user logs off, the user credential data is not removed from the registry. If you clear the checkbox, the next time the user logs on, he will be prompted for credentials (such as user name and password). If you specify the use of WPA-Personal or WPA2-Personal as your security type or No authentication (Open) or Shared as your security type with WEP as your encryption type,

  you must configure a network security key, as shown in Figure 10.

  

  Reference: https://technet.microsoft.com/en-us/magazine/ff847520.aspx

• Question 48:

  A network engineer is troubleshooting a LAP that is unable to join the controller and receives the message below:

  LWAPP_CLIENT_ERROR_DEBUG. No more AP manager IP addresses remain. What does the log indicate?

  A. Two or more LAPs have the same IP address.
  B. An AP manager has the same IP address as another AP manager.
  C. A LAP has the same IP address as the AP manager.
  D. Two or more controllers have the same IP address.
  C. A LAP has the same IP address as the AP manager.

  ---

  Problem 13: Duplicate IP address in the network

  This is another common issue that is seen when the AP tries to join the WLC. You might see this error message when the AP tries to join the controller.

  No more AP manager IP addresses remain

  One of the reasons for this error message is when there is a duplicate IP address on the network that matches the AP manager IP address. In such a case, the LAP keeps power cycling and cannot join the controller.

  The debugs will show that the WLC receives LWAPP discovery requests from the APs and transmits a LWAPP discovery response to the APs. However, WLCs do not receive LWAPP join requests from the APs.

  In order to troubleshoot this issue, ping the AP manager from a wired host on the same IP subnet as the AP manager. Then, check the ARP cache. If a duplicate IP address is found, remove the device with the duplicate IP address or change

  the IP address on the device so that it has a unique IP address on the network.

  The AP can then join the WLC.

  Reference: http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99948-lap-notjoin-wlc-tshoot.html

• Question 49:

  Access points must discover a wireless LAN controller before they can become an active part of the network. In which order does an access point try to discover a controller?

  A. Layer 3 CAPWAP or LWAPP broadcast discovery DHCP option 43 Locally stored controller IP address discovery DNS controller name resolution
  B. Layer 3 CAPWAP or LWAPP broadcast discovery Locally stored controller IP address discovery DNS controller name resolution DHCP option 43
  C. Layer 3 CAPWAP or LWAPP broadcast discovery Locally stored controller IP address discovery DHCP option 43 DNS controller name resolution
  D. DNS controller name resolution DHCP option 43 Layer 3 CAPWAP or LWAPP broadcast discovery Locally stored controller IP address discovery
  C. Layer 3 CAPWAP or LWAPP broadcast discovery Locally stored controller IP address discovery DHCP option 43 DNS controller name resolution

  ---

  The different methods by which the access point (AP) discovers the controller are:

  1.

  The AP issues a DHCP DISCOVER in order to obtain an address.

  2.

  Layer 2 attempts LWAPP WLAN controller discovery and Ethernet broadcast.

  3.

  Layer 3 attempts LWAPP WLAN controller discovery:

  

  LWAPP discovery broadcast on local subnet

  

  Over-the-air provisioning

  

  Locally stored controller IP address(IP addresses of the controller learned from previously joined mobility group )

  

  DHCP option 43

  

  DNS resolution of CISCO-LWAPP-CONTROLLER.localdomain

  Reference: https://supportforums.cisco.com/document/8446/how-configure-lightweight-ap-order-join-respective-wlan-controller

• Question 50:

  What is the maximum number of access points supported on Cisco WCS with an enterprise license?

  A. 5,000
  B. 10,000
  C. 50,000
  D. 100,000
  C. 50,000

  ---

  Enterprise Server License (Multiple Servers) Overview (release 4.1 or later)

  

  License: WCS-ENT-PLUS-K9

  

  License increments: 1000, 2500, 10000, 50000

  

  Single or multiple server deployment (Cisco WCS Navigator included in 10000, and 50000 licenses)

  

  Suitable for customers deploying 500 or more Cisco Aironet lightweight access points

  

  Multiple license files linked to a single PAK certificate

  

  Server decrements available number of access points as licenses are allocated within the network

  Reference: http://www.cisco.com/c/en/us/products/collateral/wireless/wireless-control-system/product_data_sheet0900aecd804b4646.html