Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 111:

  Which configuration step (if any) is necessary to enable FTP inspection on TCP port 2121?

  A. None. FTP inspection is enabled by default using the global policy.
  B. Create a new class map to match TCP port 2121, then edit the global policy to inspect FTP for traffic matched by the new class map.
  C. Edit default-inspection-traffic to match FTP on port 2121.
  D. Add a new traffic class using the match protocol FTP option within the inspect_default class map.
  B. Create a new class map to match TCP port 2121, then edit the global policy to inspect FTP for traffic matched by the new class map.

• Question 112:

  Which configuration step is the first to enable PIM-SM on the Cisco ASA appliance?

  A. Configure the static RP IP address.
  B. Enable IGMP forwarding on the required interface(s).
  C. Add the required static mroute(s).
  D. Enable multicast routing globally on the Cisco ASA appliance.
  E. Configure the Cisco ASA appliance to join the required multicast groups.
  D. Enable multicast routing globally on the Cisco ASA appliance.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_multicast.html# wp1060775

  Enabling Multicast Routing Enabling multicast routing lets the ASA forward multicast packets. Enabling multicast routing automatically enables PIM and IGMP on all interfaces.

  To enable multicast routing, perform the following step:

  

• Question 113:

  In which two directions are the Cisco ASA modular policy framework inspection policies applied? (Choose two.)

  A. in the ingress direction only when applied globally
  B. in the ingress direction only when applied on an interface
  C. in the egress direction only when applied globally
  D. in the egress direction only when applied on an interface
  E. bi-directionally when applied globally
  F. bi-directionally when applied on an interface
  A. in the ingress direction only when applied globally
  F. bi-directionally when applied on an interface

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/mpf_service_policy.ht ml#wp1162717

  Feature Directionality

  Actions are applied to traffic bidirectionally or unidirectionally depending on the feature. For features that are applied bidirectionally, all traffic that enters or exits the interface to which you apply the policy map is affected if the traffic matches

  the class map for both directions. When you use a global policy, all features are unidirectional; features that are normally bidirectional when applied to a single interface only apply to the ingress of each interface when applied globally.

  Because the policy is applied to all interfaces, the policy will be applied in both directions so bidirectionality in this case is redundant.

• Question 114:

  Which statement about the default ACL logging behavior of the Cisco ASA is true?

  A. The Cisco ASA generates system message 106023 for each denied packet when a deny ACE is configured.
  B. The Cisco ASA generates system message 106023 for each packet that matched an ACE.
  C. The Cisco ASA generates system message 106100 only for the first packet that matched an ACE.
  D. The Cisco ASA generates system message 106100 for each packet that matched an ACE.
  E. No ACL logging is enabled by default.
  A. The Cisco ASA generates system message 106023 for each denied packet when a deny ACE is configured.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/acl_logging.html#wp1 076483

  

• Question 115:

  Which three Cisco ASA configuration commands are used to enable the Cisco ASA to log only the debug output to syslog? (Choose three.)

  A. logging list test message 711001
  B. logging debug-trace
  C. logging trap debugging
  D. logging message 711001 level 7
  E. logging trap test
  A. logging list test message 711001
  B. logging debug-trace
  E. logging trap test

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/l2.html#wp1754683

  

  http://www.cisco.com/en/US/docs/security/asa/asa84/asdm64/configuration_guide/monitor_sysl og.html#wp1131130

  Step 4 of sending syslog to external syslog server

  Check the Send debug messages as syslogs check box to redirect all debugging trace output to system logs.

  The syslog message does not appear on the console if this option is enabled. Therefore, to view debugging messages, you must have logging enabled at the console and have it configured as the destination for the debugging syslog

  message number and severity level. The syslog message number to use is 711001.

  The default severity level for this syslog message is debugging.

  Logging list

  Creates a logging list to use in other commands to specify messages by various criteria (logging level, event class, and message IDs).

• Question 116:

  Refer to the exhibit and to the four HTTP inspection requirements and the Cisco ASA configuration.

  

  Which two statements about why the Cisco ASA configuration is not meeting the specified HTTP inspection requirements are true? (Choose two.)

  1.

  All outside clients can use only the HTTP GET method on the protected 10.10.10.10 web server.

  2.

  All outside clients can access only HTTP URIs starting with the "/myapp" string on the protected 10.10.10.10 web server.

  3.

  The security appliance should drop all requests that contain basic SQL injection attempts (the string "SELECT" followed by the string "FROM") inside HTTP arguments.

  4.

  The security appliance should drop all requests that do not conform to the HTTP protocol.

  A. Both instances of match not request should be changed to match request.
  B. The policy-map type inspect http MY-HTTP-POLICY configuration is missing the references to the class maps.
  C. The BASIC-SQL-INJECTION regular expression is not configured correctly.
  D. The MY-URI regular expression is not configured correctly.
  E. The WEB-SERVER-ACL ACL is not configured correctly.
  D. The MY-URI regular expression is not configured correctly.
  E. The WEB-SERVER-ACL ACL is not configured correctly.

• Question 117:

  Refer to the exhibit.

  

  Which command options represent the inside local address, inside global address, outside local address, and outside global address?

  A. 1 = outside local, 2 = outside global, 3 = inside global, 4 = inside local
  B. 1 = outside local, 2 = outside global, 3 = inside local, 4 = inside global
  C. 1 = outside global, 2 = outside local, 3 = inside global, 4 = inside local
  D. 1 = inside local, 2 = inside global, 3 = outside global, 4 = outside local
  E. 1 = inside local, 2 = inside global, 3 = outside local, 4 = outside global
  D. 1 = inside local, 2 = inside global, 3 = outside global, 4 = outside local

  ---

  Cisco twice NAT

  nat [(real_ifc,mapped_ifc)] [line | {after-object [line]}] source static {nw_obj nw_obj | any any} [destination static {mapped_obj | interface} real_obj] [service real_src_mapped_dest_svc_obj mapped_src_real_dest_svc_obj] [no-proxy-arp] [routelookup] [inactive] [description desc]

  Example:

  hostname(config)# nat (inside,outside) source static MyInsNet MyInsNet destination static Server1 Server1

• Question 118:

  Which three statements are the default security policy on a Cisco ASA appliance? (Choose three.)

  A. Traffic that goes from a high security level interface to a lower security level interface is allowed.
  B. Outbound TCP and UDP traffic is statefully inspected and returning traffic is allowed to traverse the Cisco ASA appliance.
  C. Traffic that goes from a low security level interface to a higher security level interface is allowed.
  D. Traffic between interfaces with the same security level is allowed by default.
  E. Traffic can enter and exit the same interface by default.
  F. When the Cisco ASA appliance is accessed for management purposes, the access must be made to the nearest Cisco ASA interface.
  G. Inbound TCP and UDP traffic is statefully inspected and returning traffic is allowed to traverse the Cisco ASA appliance.
  A. Traffic that goes from a high security level interface to a lower security level interface is allowed.
  B. Outbound TCP and UDP traffic is statefully inspected and returning traffic is allowed to traverse the Cisco ASA appliance.
  F. When the Cisco ASA appliance is accessed for management purposes, the access must be made to the nearest Cisco ASA interface.

  ---

  The security algorithm is responsible for implementing and enforcing your security policies. The algorithm uses a tiered hierarchy that allows you to implement multiple levels of security. To accomplish this, each interface on the appliance is

  assigned a security level number from 0 to 100, where 0 is the least secure and 100 is the most secure. The algorithm uses these security levels to enforce its default policies.

  Here are the four default security policy rules for traffic as it flows through the appliance:

  Traffic flowing from a higher-level security interface to a lower one is permitted by default. Traffic flowing from a lower-level security interface to a higher one is denied by default. Traffic flowing from one interface to another with the same

  security level is denied by default. Traffic flowing into and then out of the same interface is denied by default

  http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/access_rules.html#wp 1120072 Implicit Permits

  For routed mode, the following types of traffic are allowed through by default:

  -IPv4 traffic from a higher security interface to a lower security interface.

  -IPv6 traffic from a higher security interface to a lower security interface. For transparent mode, the following types of traffic are allowed through by default:

  -IPv4 traffic from a higher security interface to a lower security interface. -IPv6 traffic from a higher security interface to a lower security interface.

  -ARPs in both directions.

  Implicit Deny

  Interface-specific access rules do not have an implicit deny at the end, but global rules on inbound traffic do have an implicit deny at the end of the list, so unless you explicitly permit it, traffic cannot pass. For example, if you want to allow all

  users to access a network through the adaptive security appliance except for particular addresses, then you need to deny the particular addresses and then permit all others.

  When you have no global access rules in your configuration, the implicit deny rule is applied at the end of interface access rules. When you configure both an interface access rule and a global access rule, the implicit deny (any any) is no

  longer located at the end of the interface-based access rule. The implicit deny (any any) is enforced at the end of the global access rule. Logically, the entries on the interface-based access rule are processed first, followed by the entries on

  the global access rule, and then finally the implicit deny (any any) at the end of the global access rule.

  For example, when you have an interface-based access rule and a global access rule in your configuration, the following processing logic applies:

  1.

  interface access control rules

  2.

  global access control rules

  3.

  default global access control rule (deny any any)

  When only interface-based access rules are configured, the following processing logic applies:

  1.

  interface access control rules

  2.

  default interface access control rule (deny any any) For EtherType rules, the implicit deny does not affect IPv4 or IPv6 traffic or ARPs; for example, if you allow EtherType 8037 (the EtherType for IPX), the implicit deny at the end of the list does not block any IP traffic that you previously allowed with an access rule (or implicitly allowed from a high security interface to a low security interface). However, if you explicitly deny all traffic with an EtherType rule, then IP and ARP traffic is denied.

  Management access to an interface other than the one from which you entered the adaptive security appliance is not supported. For example, if your management host is located on the outside interface, you can only initiate a management connection directly to the outside interface. The only exception to this rule is through a VPN connection, and entering the management- access command. For more information about the management-access command, see the Cisco ASA 5500 Series Command Reference.

• Question 119:

  Which flag not shown in the output of the show conn command is used to indicate that an initial SYN packet is from the outside (lower security-level interface)?

  

  A. B
  B. D
  C. b
  D. A
  E. a
  F. i
  G. I
  H. O
  A. B

  ---

  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080bcad00.shtml

  Originally answer from dump was A meaning B or initial SYN from outside but B is not shown in the output.

  The question used to read ".. Which flag shown in the output of the show conn command is used to indicate that an initial SYN packet is from the outside (lower security-level interface)?

  TCP Connection Flag Values

  

• Question 120:

  On the Cisco ASA Software Version 8.3 and later, which type of NAT configuration can be used to translate the source and destination IP addresses of the packet?

  A. auto NAT
  B. object NAT
  C. one-to-one NAT
  D. many-to-one NAT
  E. manual NAT
  F. identity NAT
  E. manual NAT

  ---

  http://tunnelsup.com/2011/06/24/nat-for-cisco-asas-version-8-3/

  Manual NAT or Twice NAT or Policy NAT or Reverse NAT

  The limitation that Auto NAT has is that it cannot take the destination into consideration when conducting it's NAT. This also of course results in it not being able to alter the destination address either. To accomplish either of these tasks you

  must use "manual NAT". All of these terms are identical: Manual NAT, Twice NAT, Policy NAT, Reverse NAT. Don't be confused by fancy mumbo jumbo.

  http://www.cisco.com/en/US/docs/security/asa/asa83/asdm63/configuration_guide/nat_overview html#wpxref64594

  Main Differences Between Network Object NAT and Twice NAT The main differences between these two NAT types are:

  -How you define the real address.

  Network object NAT--You define NAT as a parameter for a network object; the network object definition itself provides the real address. This method lets you easily add NAT to network objects. The objects can also be used in other parts of

  your configuration, for example, for access rules or even in twice NAT rules. -Twice NAT--You identify a network object or network object group for both the real and mapped addresses. In this case, NAT is not a parameter of the network

  object; the network object or group is a parameter of the NAT configuration. The ability to use a network object group for the real address means that twice NAT is more scalable.

  -How source and destination NAT is implemented.

  Network object NAT-- Each rule can apply to either the source or destination of a packet. So two rules might be used, one for the source IP address, and one for the destination IP address. These two rules cannot be tied together to enforce a

  specific translation for a source/destination combination.

  Twice NAT--A single rule translates both the source and destination. A matching packet only matches the one rule, and further rules are not checked. Even if you do not configure the optional destination address for twice NAT, a matching

  packet still only matches one twice NAT rule. The source and destination are tied together, so you can enforce different translations depending on the source/destination combination. For example, sourceA/destinationA can have a different

  translation than sourceA/destinationB.

  -Order of NAT Rules.

  Network object NAT--Automatically ordered in the NAT table. Twice NAT--Manually ordered in the NAT table (before or after network object NAT rules).