Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 91:

  Refer to the partial Cisco ASA configuration and the network topology shown in the exhibit.

  

  Which two Cisco ASA configuration commands are required so that any hosts on the Internet can HTTP to the WEBSERVER using the 192.168.1.100 IP address? (Choose two.)

  A. nat (inside,outside) static 192.168.1.100
  B. nat (inside,outside) static 172.31.0.100
  C. nat (inside,outside) static interface
  D. access-list outside_access_in extended permit tcp any object 172.31.0.100 eq http
  E. access-list outside_access_in extended permit tcp any object 192.168.1.100 eq http
  F. access-list outside_access_in extended permit tcp any object 192.168.1.1 eq http
  A. nat (inside,outside) static 192.168.1.100
  D. access-list outside_access_in extended permit tcp any object 172.31.0.100 eq http

• Question 92:

  Refer to the exhibit.

  

  Which Cisco ASA feature can be configured using this Cisco ASDM screen?

  A. Cisco ASA command authorization using TACACS+
  B. AAA accounting to track serial, ssh, and telnet connections to the Cisco ASA
  C. Exec Shell access authorization using AAA
  D. cut-thru proxy
  E. AAA authentication policy for Cisco ASDM access
  D. cut-thru proxy

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/asdm52/user/guide/aaarules.html

  And from http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/access_idfw.html#wp1 324095 Configuring Cut-through Proxy Authentication

  In an enterprise, some users log onto the network by using other authentication mechanisms, such as authenticating with a web portal (cut-through proxy) or by using a VPN. For example, users with a Machintosh and Linux client might log in a web portal (cut-through proxy) or by using a VPN. Therefore, you must configure the Identity Firewall to allow these types of authentication in connection with identity-based access policies. The ASA designates users logging in through a web portal (cut-through proxy) as belonging to the Active Directory domain with which they authenticated. The ASA designates users logging in through a VPN as belonging to the LOCAL domain unless the VPN is authenticated by LDAP with Active Directory, then the Identity Firewall can associate the users with their Active Directory domain. The ASA reports users logging in through VPN authentication or a web portal (cut-through proxy) to the AD Agent, which distributes the user information to all registered ASA devices.

  Users can log in by using HTTP/HTTPS, FTP, Telnet, or SSH. When users log in with these authentication methods, the following guidelines apply:

  -For HTTP/HTTPS traffic, an authentication window appears for unauthenticated users. -For Telnet and FTP traffic, users must log in through the cut-through proxy and again to Telnet and FTP server.

  -A user can specify an Active Directory domain while providing login credentials (in the format domain \username). The ASA automatically selects the associated AAA server group for the specified domain.

  -If a user specifies an Active Directory domain while providing login credentials (in the format domain \username), the ASA parses the domain and uses it to select an authentication server from the AAA servers configured for the Identity

  Firewall. Only the username is passed to the AAA server.

  -If the backslash (\) delimiter is not found in the log in credentials, the ASA does not parse a domain and authentication is conducted with the AAA server that corresponds to default domain configured for the Identity Firewall.

  -If a default domain or a server group is not configured for that default domain, the ASA rejects the authentication.

  -If the domain is not specified, the ASA selects the AAA server group for the default domain that is configured for the Identity Firewall.

• Question 93:

  Which two Cisco ASA licensing features are correct with Cisco ASA Software Version 8.3 and later? (Choose two.)

  A. Identical licenses are not required on the primary and secondary Cisco ASA appliance.
  B. Cisco ASA appliances configured as failover pairs disregard the time-based activation keys.
  C. Time-based licenses are stackable in duration but not in capacity.
  D. A time-based license completely overrides the permanent license, ignoring all permanently licensed features until the time-based license is uninstalled.
  A. Identical licenses are not required on the primary and secondary Cisco ASA appliance.
  C. Time-based licenses are stackable in duration but not in capacity.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c 25-593781.html

  Time-based license stacking: Customers can extend time-based licenses such as Botnet Traffic Filter and SSL VPN Burst by applying multiple licenses. Licensing of high-availability pairs: For several features, the requirement to deploy identical licenses on the standby unit in a high-availability pair has been removed.

  Security Plus licenses must still be purchased for both the Active and Standby units.

• Question 94:

  On the Cisco ASA, where are the Layer 5-7 policy maps applied?

  A. inside the Layer 3-4 policy map
  B. inside the Layer 3-4 class map
  C. inside the Layer 5-7 class map
  D. inside the Layer 3-4 service policy
  E. inside the Layer 5-7 service policy
  A. inside the Layer 3-4 policy map

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/inspect_overview.html #wp1313159

• Question 95:

  When troubleshooting redundant interface operations on the Cisco ASA, which configuration should be verified?

  A. The name if configuration on the member physical interfaces are identical.
  B. The MAC address configuration on the member physical interfaces are identical.
  C. The active interface is sending periodic hellos to the standby interface.
  D. The IP address configuration on the logical redundant interface is correct.
  E. The duplex and speed configuration on the logical redundant interface are correct.
  D. The IP address configuration on the logical redundant interface is correct.

  ---

  Concept A logical redundant interface is a pair of an active and a standby physical interface. When the active interface fails, the standby interface becomes active. From firewall perspective this event is completely transparent and can be viewed as a single logical interface. We can use redundant interfaces to increase the security appliance reliability. This feature is separate from device-level failover, but you can configure redundant interfaces as well as failover if desired. We can configure upto 8 redundant interfaces.

  Redundant interface are number from 1 to 8 and have the name redundant X. When adding physical interfaces to the redundant pair, please make sure there is no configuration on it and interface is also in no shutdown state. This is just a precaution, the firewall will remove these settings when adding the physical interface to a new group. The logical redundant interface will take the MAC address of the first interface added to the group.

  This MAC address is not changed with the member interface failures, but changes when you swap the order of the physical interfaces to the pair.

  Once we have configured a redundant interface, we can assign it a name and a security level, followed by an IP address. The procedure is the same as with any interface in the system.

  Configuration --> interface GigabitEthernet0/0 no nameif no security-level no ip address ! interface GigabitEthernet0/1 no nameif no security-level no ip address interface Redundant1 member-interface GigabitEthernet0/0 member-interface GigabitEthernet0/1 nameif outside security-level 0 ip address 1.1.1.1 255.255.255.0

  Verify You can use the following command to verify---> ciscoasa(config)# show interface redundant 1 Interface Redundant1 "outside", is up, line protocol is up Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 5475.d0d4.9594, MTU 1500 IP address 1.1.1.1, subnet mask 255.255.255.0 27 packets input, 12330 bytes, 0 no buffer Received 27 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 27 overrun, 0 ignored, 0 abort 10 L2 decode drops 1 packets output, 64 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops input queue (curr/max packets): hardware (5/25) software (0/0) output queue (curr/max packets): hardware (0/1) software (0/0)

  Traffic Statistics for "outside": 17 packets input, 7478 bytes 1 packets output, 28 bytes 17 packets dropped 1 minute input rate 0 pkts/sec, 92 bytes/sec 1 minute output rate 0 pkts/sec, 0 bytes/sec 1 minute drop rate, 0 pkts/sec

  5 minute input rate 0 pkts/sec, 0 bytes/sec

  5 minute output rate 0 pkts/sec, 0 bytes/sec

  5 minute drop rate, 0 pkts/sec

  Redundancy Information:

  Member GigabitEthernet0/0(Active), GigabitEthernet0/1 Last switchover at 23:13:03 UTC Dec 15 2011

• Question 96:

  Where in the Cisco ASA appliance CLI are Active/Active Failover configuration parameters configured?

  A. admin context
  B. customer context
  C. system execution space
  D. within the system execution space and admin context
  E. within each customer context and admin context
  C. system execution space

  ---

  System Execution Space

  Unlike other contexts, the system execution space does not have any Layer 2 or Layer 3 interfaces or any network settings. Rather, it is mainly used to define the attributes of other security context attributes. Here are the three important

  attributes configured for each context in the system execution space:

  Context name.

  Location of context's startup configuration.

  The configuration of each context is also known as a configlet. Interface allocation.

  Additionally, many optional features, such as interface and boot parameters, can be configured within the system execution space. The important features that can be set up through the system execution space

  

  The system execution space configuration resides in the nonvolatile random-access memory (NVRAM) area of the security appliance, while the configurations for security contexts are stored either in local Flash memory or on a network storage server using one of the following protocols:

  TFTP FTP HTTPS HTTP

  The system execution space designates one of the security contexts as the admin context, which is responsible for providing network access when the system needs to contact resources.

• Question 97:

  Which two options show the required Cisco ASA command(s) to allow this scenario? (Choose two.)

  An inside client on the 10.0.0.0/8 network connects to an outside server on the 172.16.0.0/16 network using TCP and the server port of 2001. The inside client negotiates a client port in the range between UDP ports 5000 to 5500. The outside server then can start sending UDP data to the inside client on the negotiated port within the specified UDP port range.

  A. access-list INSIDE line 1 permit tcp 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0 eq 2001 access-group INSIDE in interface inside
  B. access-list INSIDE line 1 permit tcp 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0 eq 2001 access-list INSIDE line 2 permit udp 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0 eq established access-group INSIDE in interface inside
  C. access-list OUTSIDE line 1 permit tcp 172.16.0.0 255.255.0.0 eq 2001 10.0.0.0 255.0.0.0 access-list OUTSIDE line 2 permit udp 172.16.0.0 255.255.0.0 10.0.0.0 255.0.0.0 eq 5000-5500 access-group OUTSIDE in interface outside
  D. access-list OUTSIDE line 1 permit tcp 172.16.0.0 255.255.0.0 eq 2001 10.0.0.0 255.0.0.0 access-list OUTSIDE line 2 permit udp 172.16.0.0 255.255.0.0 10.0.0.0 255.0.0.0 eq established access-group OUTSIDE in interface outside
  E. established tcp 2001 permit udp 5000-5500
  F. established tcp 2001 permit from udp 5000-5500
  G. established tcp 2001 permit to udp 5000-5500
  A. access-list INSIDE line 1 permit tcp 10.0.0.0 255.0.0.0 172.16.0.0 255.255.0.0 eq 2001 access-group INSIDE in interface inside
  G. established tcp 2001 permit to udp 5000-5500

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/ef_72.html#wp176466 Established command--This command allows return connections from a lower security host to a higher security host if there is already an established connection from the higher level host to the lower level host.

  For same security interfaces, you can configure established commands for both directions.

• Question 98:

  Which two statements about Cisco ASA failover troubleshooting are true? (Choose two.)

  A. With active/active failover, failover link troubleshooting should be done in the system execution space.
  B. With active/active failover, ASR groups must be enabled.
  C. With active/active failover, user data passing interfaces troubleshooting should be done within the context execution space.
  D. The failed interface threshold is set to 1. Using the show monitor-interface command, if one of the monitored interfaces on both the primary and secondary Cisco ASA appliances is in the unknown state, a failover should occur.
  E. Syslog level 1 messages will be generated on the standby unit only if the logging standby command is used.
  A. With active/active failover, failover link troubleshooting should be done in the system execution space.
  C. With active/active failover, user data passing interfaces troubleshooting should be done within the context execution space.

  ---

  System Configuration The system administrator adds and manages contexts by configuring each context configuration location, allocated interfaces, and other context operating parameters in the system configuration, which, like a single mode configuration, is the startup configuration. The system configuration identifies basic settings for the security appliance. The system configuration does not include any network interfaces or network settings for itself; rather, when the system needs to access network resources (such as downloading the contexts from the server), it uses one of the contexts that is designated as the admin context. The system configuration does include a specialized failover interface for failover traffic only.

  Context Configurations The security appliance includes a configuration for each context that identifies the security policy, interfaces, and almost all the options you can configure on a standalone device. You can store context configurations on the internal Flash memory or the external Flash memory card, or you can download them from a TFTP, FTP, or HTTP(S) server.

• Question 99:

  Which logging mechanism is configured using MPF and allows high-volume traffic-related events to be exported from the Cisco ASA appliance in a more efficient and scalable manner compared to classic syslog logging?

  A. SDEE
  B. Secure SYSLOG
  C. XML
  D. NSEL
  E. SNMPv3
  D. NSEL

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/monitor_nsel.html#wp 1111174

• Question 100:

  Refer to the exhibit.

  

  What is a reasonable conclusion?

  A. The maximum number of TCP connections that the 10.1.1.99 host can establish will be 146608.
  B. All the connections from the 10.1.1.99 have completed the TCP three-way handshake.
  C. The 10.1.1.99 hosts are generating a vast number of outgoing connections, probably due to a virus.
  D. The 10.1.1.99 host on the inside is under a SYN flood attack.
  E. The 10.1.1.99 host operations on the inside look normal.
  C. The 10.1.1.99 hosts are generating a vast number of outgoing connections, probably due to a virus.

  ---