Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 1:

  Refer to the exhibit.

  

  A Cisco ASA in transparent firewall mode generates the log messages seen in the exhibit. What should be configured on the Cisco ASA to allow the denied traffic?

  A. extended ACL on the outside and inside interface to permit the multicast traffic
  B. EtherType ACL on the outside and inside interface to permit the multicast traffic
  C. stateful packet inspection
  D. static ARP mapping
  E. static MAC address mapping
  A. extended ACL on the outside and inside interface to permit the multicast traffic

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/mpf.html#wp1101685

  Allowing Broadcast and Multicast Traffic through the Transparent Firewall In routed firewall mode, broadcast and multicast traffic is blocked even if you allow it in an access list, including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay). Transparent firewall mode can allow any IP traffic through. This feature is especially useful in multiple context mode, which does not allow dynamic routing, for example.

• Question 2:

  Refer to the exhibit.

  

  Which option describes the problem with this botnet traffic filter configuration on the Cisco ASA appliance?

  A. The traffic classification ACL is not defined.
  B. The use of the dynamic database is not enabled.
  C. DNS snooping is not enabled.
  D. The threat level range for the traffic to be dropped is not defined.
  E. The static black and white list entries should use domain name instead of IP address.
  C. DNS snooping is not enabled.

  ---

  https://supportforums.cisco.com/docs/DOC-8782

  Prerequisite The ASA must be running minimum 8.2 code to be able to configure botnet feature. Botnet license must be installed on the ASA Limitations Step by Step Configuration

  1.

  Enable DNS client on ASA

  2.

  Enable dynamic traffic filtering (Botnet Traffic Filter).

  3.

  Enable the Botnet Traffic Filter database update.

  4.

  Classify the traffic that will be exempted and subjected.

  5.

  Enable dynamic-filter classification on outside interface

  6.

  Configure a class map and only match dns traffic

  7.

  Enable DNS snooping on the external interface

  8.

  Define local whitelists and/or blacklists if needed.

  Never block addresses:

  Manual Black List:

• Question 3:

  Which option is one requirement before a Cisco ASA appliance can be upgraded from Cisco ASA Software Version 8.2 to 8.3?

  A. Remove all the pre 8.3 NAT configurations in the startup configuration.
  B. Upgrade the memory on the Cisco ASA appliance to meet the memory requirement of Cisco ASA Software Version 8.3.
  C. Request new Cisco ASA licenses to meet the 8.3 licensing requirement.
  D. Upgrade Cisco ASDM to version 6.2.
  E. Migrate interface ACL configurations to include interface and global ACLs.
  B. Upgrade the memory on the Cisco ASA appliance to meet the memory requirement of Cisco ASA Software Version 8.3.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c 25-586414.html

• Question 4:

  By default, how does a Cisco ASA appliance process IP fragments?

  A. Each fragment passes through the Cisco ASA appliance without any inspections.
  B. Each fragment is blocked by the Cisco ASA appliance.
  C. The Cisco ASA appliance verifies each fragment and performs virtual IP re-assembly before the full IP packet is forwarded out.
  D. The Cisco ASA appliance forwards the packet out as soon as all of the fragments of the packet have been received.
  C. The Cisco ASA appliance verifies each fragment and performs virtual IP re-assembly before the full IP packet is forwarded out.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/intro.html

  Protecting from IP Fragments The adaptive security appliance provides IP fragment protection. This feature performs full reassembly of all ICMP error messages and virtual reassembly of the remaining IP fragments that are routed through the adaptive security appliance. Fragments that fail the security check are dropped and logged. Virtual reassembly cannot be disabled.

• Question 5:

  

  

  Which Cisco ASA show command groups the xlates and connections information together in its output?

  A. show conn
  B. show conn detail
  C. show xlate
  D. show asp
  E. show local-host
  E. show local-host

  ---

  

• Question 6:

  Which two Cisco ASA configuration tasks are necessary to allow authenticated BGP sessions to pass through the Cisco ASA appliance? (Choose two.)

  A. Configure the Cisco ASA TCP normalizer to permit TCP option 19.
  B. Configure the Cisco ASA TCP Intercept to inspect the BGP packets (TCP port 179).
  C. Configure the Cisco ASA default global inspection policy to also statefully inspect the BGP flows.
  D. Configure the Cisco ASA TCP normalizer to disable TCP ISN randomization for the BGP flows.
  E. Configure TCP state bypass to allow the BGP flows.
  A. Configure the Cisco ASA TCP normalizer to permit TCP option 19.
  D. Configure the Cisco ASA TCP normalizer to disable TCP ISN randomization for the BGP flows.

  ---

  1.

  The ASA strips TCP Option 19. This is used by Border Gateway Protocol (BGP) for authentication.

  2.

  The ASA randomizes the TCP sequence numbers.

  With Option 19 being stripped, BGP routers configured for authentication will not see credentials coming from their peer and thus will not establish the BGP neighbor.

  First match the BGP Traffic.

  access-list BGP extended permit tcp any eq bgp any access-list BGP extended permit tcp any any eq bgp Next create a TCP Map that allows Option 19. tcp-map BGP tcp-options range 19 19 allow Now create a class-map to match the BGP ACL you created earlier. class-map BGP match access-list BGP Finally, apply the class-map to the global policy: policy-map global_policy class BGP set connection advanced-options BGP Now for the second issue, while you are still in the policy-map configuration mode, you need to disable the random-sequence numbering.

  set connection random-sequence-number disable

• Question 7:

  Which two configurations are the minimum needed to enable EIGRP on the Cisco ASA appliance? (Choose two.)

  A. Enable the EIGRP routing process and specify the AS number.
  B. Define the EIGRP default-metric.
  C. Configure the EIGRP router ID.
  D. Use the neighbor command(s) to specify the EIGRP neighbors.
  E. Use the network command(s) to enable EIGRP on the Cisco ASA interface(s).
  A. Enable the EIGRP routing process and specify the AS number.
  E. Use the network command(s) to enable EIGRP on the Cisco ASA interface(s).

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008086eb d2.shtml

  !EIGRP Configuration - the CLI configuration is very similar to the !Cisco IOS router EIGRP configuration.

• Question 8:

  Refer to the exhibit.

  

  On Cisco ASA Software Version 8.3 and later, which two sets of CLI configuration commands result from this Cisco ASDM configuration? (Choose two.)

  A. nat (inside) 1 10.1.1.10 global (outside) 1 192.168.1.1
  B. nat (outside) 1 192.168.1.1 global (inside 1 10.1.1.10
  C. static(inside,outside) 192.168.1.1 10.1.1.10 netmask 255.255.255.255 tcp 0 0 udp 0
  D. static(inside,outside) tcp 192.168.1.1 80 10.1.1.10 80
  E. object network 192.168.1.1 nat (inside,outside) static 10.1.1.10
  F. object network 10.1.1.10 nat (inside,outside) static 192.168.1.1
  G. access-list outside_access_in line 1 extended permit tcp any object 10.1.1.10 eq http access-group outside_access_in in interface outside
  H. access-list outside_access_in line 1 extended permit tcp any object 192.168.1.1 eq http access-group outside_access_in in interface outside
  F. object network 10.1.1.10 nat (inside,outside) static 192.168.1.1
  G. access-list outside_access_in line 1 extended permit tcp any object 10.1.1.10 eq http access-group outside_access_in in interface outside

• Question 9:

  Refer to the exhibit.

  

  What can be determined about the connection status?

  A. The output is showing normal activity to the inside 10.1.1.50 web server.
  B. Many HTTP connections to the 10.1.1.50 web server have successfully completed the three- way TCP handshake.
  C. Many embryonic connections are made from random sources to the 10.1.1.50 web server.
  D. The 10.1.1.50 host is triggering SYN flood attacks against random hosts on the outside.
  E. The 10.1.1.50 web server is terminating all the incoming HTTP connections.
  C. Many embryonic connections are made from random sources to the 10.1.1.50 web server.

• Question 10:

  With Cisco ASA active/standby failover, by default, how many monitored interface failures will cause failover to occur?

  A. 1
  B. 2
  C. 3
  D. 4
  E. 5
  A. 1

  ---