Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 101:

  In the default global policy, which traffic is matched for inspections by default?

  A. match any
  B. match default-inspection-traffic
  C. match access-list
  D. match port
  E. match class-default
  B. match default-inspection-traffic

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/inspect.html#wp13836 Default Inspection Policy

  By default, the configuration includes a policy that matches all default application inspection traffic and applies inspection to the traffic on all interfaces (a global policy). Default application inspection traffic includes traffic to the default ports for each protocol. You can only apply one global policy, so if you want to alter the global policy, for example, to apply inspection to non- standard ports, or to add inspections that are not enabled by default, you need to either edit the default policy or disable it and apply a new one.

• Question 102:

  Which statement about access list operations on Cisco ASA Software Version 8.3 and later is true?

  A. If the global and interface access lists are both configured, the global access list is matched first before the interface access lists.
  B. Interface and global access lists can be applied in the input or output direction.
  C. In the inbound access list on the outside interface that permits traffic to the inside interface, the destination IP address referenced is always the "mapped-ip" (translated) IP address of the inside host.
  D. When adding an access list entry in the global access list using the Cisco ASDM Add Access Rule window, choosing "any" for Interface applies the access list entry globally.
  D. When adding an access list entry in the global access list using the Cisco ASDM Add Access Rule window, choosing "any" for Interface applies the access list entry globally.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/access_rules.html#wp 1083595

  Using Global Access Rules

  Global access rules allow you to apply a global rule to ingress traffic without the need to specify an interface to which the rule must be applied. Using global access rules provides the following benefits:

  -When migrating to the ASA from a competitor appliance, you can maintain a global access rule policy instead of needing to apply an interface-specific policy on each interface.

  -Global access control policies are not replicated on each interface, so they save memory space.

  -Global access rules provides flexibility in defining a security policy. You do not need to specify which interface a packet comes in on, as long as it matches the source and destination IP addresses.

  -Global access rules use the same mtrie and stride tree as interface-specific access rules, so scalability and performance for global rules are the same as for interface-specific rules. You can configure global access rules in conjunction with

  interface access rules, in which case, the specific interface access rules are always processed before the general global access rules.

• Question 103:

  How many interfaces can a Cisco ASA bridge group support and how many bridge groups can a Cisco ASA appliance support?

  A. up to 2 interfaces per bridge group and up to 4 bridge groups per Cisco ASA appliance
  B. up to 2 interfaces per bridge group and up to 8 bridge groups per Cisco ASA appliance
  C. up to 4 interfaces per bridge group and up to 4 bridge groups per Cisco ASA appliance
  D. up to 4 interfaces per bridge group and up to 8 bridge groups per Cisco ASA appliance
  E. up to 8 interfaces per bridge group and up to 4 bridge groups per Cisco ASA appliance
  F. up to 8 interfaces per bridge group and up to 8 bridge groups per Cisco ASA appliance
  D. up to 4 interfaces per bridge group and up to 8 bridge groups per Cisco ASA appliance

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/asdm64/configuration_guide/interface_co mplete_transparent.html#wp1321327

  Firewall Mode Guidelines

  -You can configure up to 8 bridge groups in single mode or per context in multiple mode. Note that you must use at least 1 bridge group; data interfaces must belong to a bridge group.

  -Each bridge group can include up to 4 interfaces.

• Question 104:

  When will a Cisco ASA that is operating in transparent firewall mode perform a routing table lookup instead of a MAC address table lookup to determine the outgoing interface of a packet?

  A. if multiple context mode is configured
  B. if the destination MAC address is unknown
  C. if the destination is more than a hop away from the Cisco ASA
  D. if NAT is configured
  E. if dynamic ARP inspection is configured
  D. if NAT is configured

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/fwmode.html#wp1214 MAC Address vs. Route Lookups

  When the ASA runs in transparent mode, the outgoing interface of a packet is determined by performing a MAC address lookup instead of a route lookup. Route lookups, however, are necessary for the following traffic types:

  -Traffic originating on the ASA--For example, if your syslog server is located on a remote network, you must use a static route so the ASA can reach that subnet.

  -Voice over IP (VoIP) traffic with inspection enabled, and the endpoint is at least one hop away from the ASA-For example, if you use the transparent firewall between a CCM and an H.323 gateway, and there is a router between the transparent firewall and the H.323 gateway, then you need to add a static route on the ASA for the H.323 gateway for

  successful call completion.

  -VoIP or DNS traffic with NAT and inspection enabled--To successfully translate the IP address inside VoIP and DNS packets, the ASA needs to perform a route lookup. Unless the host is on a directly-connected network, then you need to

  add a static route on the ASA for the real host address that is embedded in the packet.

• Question 105:

  Refer to the exhibit.

  

  Which Cisco ASA CLI nat command is generated based on this Cisco ASDM NAT configuration?

  A. nat (dmz, outside) 1 source static any any
  B. nat (dmz, outside) 1 source static any outside
  C. nat (dmz,outside) 1 source dynamic any interface
  D. nat (dmz, outside) 1 source dynamic any interface destination dynamic outside outside
  E. nat (dmz, outside) 1 source static any interface destination static any any
  F. nat (dmz, outside) 1 source dynamic any outside destination static any any
  C. nat (dmz,outside) 1 source dynamic any interface

  ---

  Pretty straight forward - like this example http://tunnelsup.com/2011/06/24/nat-for-cisco-asas-version-8-3/ Regular Dynamic PAT To create a many-to-one NAT where the entire inside network is getting PAT'd to a single outside IP do the following.

  Old 8.2 command: nat (inside) 1 10.0.0.0 255.255.255.0 global (outside) 1 interface New 8.3 equivalent command: object network inside-net subnet 10.0.0.0 255.255.255.0 nat (inside, outside) dynamic interface

  Note: the "interface" command is the 2nd interface in the nat statement, in this case the outside.

• Question 106:

  Which Cisco ASA platform should be selected if the requirements are to support 35,000 connections per second, 600,000 maximum connections, and traffic shaping?

  A. 5540
  B. 5550
  C. 5580-20
  D. 5580-40
  B. 5550

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_data_sheet 0900aecd802930c5.pdf

  

• Question 107:

  A customer is ordering a number of Cisco ASAs for their network. For the remote or home office, they are purchasing the Cisco ASA 5505.

  When ordering the licenses for their Cisco ASAs, which two licenses must they order that are "platform specific" to the Cisco ASA 5505? (Choose two.)

  A. AnyConnect Essentials license
  B. per-user Premium SSL VPN license
  C. VPN shared license
  D. internal user licenses
  E. Security Plus license
  D. internal user licenses
  E. Security Plus license

  ---

  

• Question 108:

  Which two statements about Cisco ASA redundant interface configuration are true? (Choose two.)

  A. Each redundant interface can have up to four physical interfaces as its member.
  B. When the standby interface becomes active, the Cisco ASA sends gratuitous ARP out on the standby interface.
  C. Interface duplex and speed configurations are configured under the redundant interface.
  D. Redundant interfaces use MAC address-based load balancing to load share traffic across multiple physical interfaces.
  E. Each Cisco ASA supports up to eight redundant interfaces.
  B. When the standby interface becomes active, the Cisco ASA sends gratuitous ARP out on the standby interface.
  E. Each Cisco ASA supports up to eight redundant interfaces.

  ---

  Configuring a Redundant Interface A logical redundant interface pairs an active and a standby physical interface. When the active interface fails, the standby interface becomes active and starts passing traffic. You can configure a redundant interface to increase the security appliance reliability. This feature is separate from device-level failover, but you can configure redundant interfaces as well as failover if desired.

  You can configure up to 8 redundant interface pairs.

  In Active/Standby failover, the active device uses the primary unit's MAC addresses. In the event of a failover, the secondary Cisco ASA becomes active and takes over the primary unit's MAC addresses, while the active device (now standby) takes over the standby unit's MAC addresses. Once the standby Cisco ASA becomes active, it sends out a gratuitous ARP on the network.

  A gratuitous ARP is an ARP request that the Cisco ASA sends out on the Ethernet networks with the source and destination IP addresses of the active IP addresses. The destination MAC address is the Ethernet broadcast address, i.e., ffff.ffff.ffff. All devices on the

  Ethernet segment process this broadcast frame and update their ARP table with this information. Using gratuitous ARP, the Layer 2 devices, including bridges and switches, also update the Content Addressable Memory (CAM) table with the MAC address and the updated switch port information.

  Using a virtual MAC address is recommended to avoid network disruptions. When a secondary Cisco ASA boots up before the primary Cisco ASA, it uses its physical MAC addresses as active Layer 2 addresses.

  However, when the primary Cisco ASA boots up, the secondary swaps the MAC addresses and uses the primary Cisco ASA's physical MAC addresses as active.

  With the virtual MAC address, Cisco ASA do not need to swap the MAC address.

  When stateful failover is enabled, the active unit continually passes per-connection state information to the standby unit. After a failover occurs, the same connection information is available at the new active unit.

  Supported end-user applications are not required to reconnect to keep the same communication session.

  The state information passed to the standby unit includes these: The NAT translation table The TCP connection states The UDP connection states The ARP table The Layer 2 bridge table (when it runs in the transparent firewall mode) The HTTP connection states (if HTTP replication is enabled) The ISAKMP and IPSec SA table The GTP PDP connection database The information that is not passed to the standby unit when stateful failover is enabled includes these:

  The HTTP connection table (unless HTTP replication is enabled) The user authentication (uauth) table

  The routing tables State information for security service modules Note: If failover occurs within an active Cisco IP SoftPhone session, the call remains active because the call session state information is replicated to the standby unit. When the call is terminated, the IP SoftPhone client loses connection with the Call Manager. This occurs because there is no session information for the CTIQBE hang-up message on the standby unit. When the IP SoftPhone client does not receive a response back from the Call Manager within a certain time period, it considers the Call Manager unreachable and unregisters itself.

• Question 109:

  Which two statements about Cisco ASA 8.2 NAT configurations are true? (Choose two.)

  A. NAT operations can be implemented using the NAT, global, and static commands.
  B. If nat-control is enabled and a connection does not need a translation, then an identity NAT configuration is required.
  C. NAT configurations can use the any keyword as the input or output interface definition.
  D. The NAT table is read and processed from the top down until a translation rule is matched.
  E. Auto NAT links the translation to a network object.
  A. NAT operations can be implemented using the NAT, global, and static commands.
  B. If nat-control is enabled and a connection does not need a translation, then an identity NAT configuration is required.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008046f3 1a.shtml#IN1

• Question 110:

  What is the first configuration step when using Cisco ASDM to configure a new Layer 3/4 inspection policy on the Cisco ASA?

  A. Create a new class map.
  B. Create a new policy map and apply actions to the traffic classes.
  C. Create a new service policy rule.
  D. Create the ACLs to be referenced by any of the new class maps.
  E. Disable the default global inspection policy.
  F. Create a new firewall access rule.
  C. Create a new service policy rule.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/user/guide/svcrules.html#wp11619 Default Global Policy

  By default, the configuration includes a policy that matches all default application inspection traffic and applies certain inspections to the traffic on all interfaces (a global policy). Not all inspections are enabled by default.

  You can only apply one global policy, so if you want to alter the global policy, you need to either edit the default policy or disable it and apply a new one. (An interface policy overrides the global policy.)

  Service policies provide a consistent and flexible way to configure security appliance features. For example, you can use a service policy to create a timeout configuration that is specific to a particular TCP application, as opposed to one that

  applies to all TCP applications. Configuring a service policy consists of adding one or more service policy rules per interface or for the global policy. For each rule, you identify the following elements:

  1.

  Identify the interface to which you want to apply the rule, or identify the global policy.

  2.

  Identify the traffic to which you want to apply actions. You can identify Layer 3 and 4 through traffic.

  3.

  Apply actions to the traffic class. You can apply multiple actions for each traffic class.