Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 121:

  Scenario: To access Cisco ASDM, click the PC icon in the Topology window, ASDM and answer the following question as:

  

  

  

  Which two statements about the running configuration of the Cisco ASA are true? (Choose Two)

  A. The auto NAT configuration causes all traffic arriving on the inside interface destined to any outside destinations to be translated with dynamic port address transmission using the outside interface IP address.
  B. The Cisco ASA is using the Cisco ASDM image from disk1:/asdm-642.bin
  C. The Cisco ASA is setup as the DHCP server for hosts that are on the inside and outside interfaces.
  D. SSH and Cisco ASDM access to the Cisco ASA requires AAA authentication using the LOCAL user database.
  E. The Cisco ASA is using a persistent self-signed certified so users can authenticate the Cisco ASA when accessing it via ASDM
  A. The auto NAT configuration causes all traffic arriving on the inside interface destined to any outside destinations to be translated with dynamic port address transmission using the outside interface IP address.
  E. The Cisco ASA is using a persistent self-signed certified so users can authenticate the Cisco ASA when accessing it via ASDM

  ---

  Have to check each and every setting -- expect different results for different exams

  

  

• Question 122:

  Which other match command is used with the match flow ip destination-address command within the class map configurations of the Cisco ASA MPF?

  A. match tunnel-group
  B. match access-list
  C. match default-inspection-traffic
  D. match port
  E. match dscp
  A. match tunnel-group

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/vpngrp.html or http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_qos.html

• Question 123:

  Scenario: To access Cisco ASDM, click the PC icon in the Topology window, ASDM and answer the following question as:

  

  

  Which statement about the Cisco ASA configuration is true?

  A. All input traffic on the inside interface is denied by the global ACL.
  B. All input and output traffic on the outside interface is denied by the global ACL.
  C. ICMP echo-request traffic is permitted from the inside to the outside, and ICMP echo-reply will be permitted from the outside back to inside.
  D. HTTP inspection is enabled in the global policy.
  E. Traffic between two hosts connected to the same interface is permitted.
  B. All input and output traffic on the outside interface is denied by the global ACL.

  ---

  

• Question 124:

  Which option can cause the interactive setup script not to work on a Cisco ASA 5520 appliance running software version 8.4.1?

  A. The clock has not been set on the Cisco ASA appliance using the clock set command.
  B. The HTTP server has not been enabled using the http server enable command.
  C. The domain name has not been configured using the domain-name command.
  D. The inside interface IP address has not been configured using the ip address command.
  E. The management 0/0 interface has not been configured as management-only and assigned a name using the nameif command.
  E. The management 0/0 interface has not been configured as management-only and assigned a name using the nameif command.

  ---

  http://www.checkthenetwork.com/networksecurityCiscoASA1.asp shows need for nameif and http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/intparam.html shows manaagement only The ASA 5510 and higher adaptive security appliance also includes the following type: -management The management interface is a Fast Ethernet interface designed for management traffic only, and is specified as management0/0. You can, however, use it for through traffic if desired (see the management-only command). In

  transparent firewall mode, you can use the management interface in addition to the two interfaces allowed for through traffic. You can also add subinterfaces to the management interface to provide management in each security context for

  multiple context mode.

  Append the subinterface ID to the physical interface ID separated by a period (.). In multiple context mode, enter the mapped name if one was assigned using the allocate- interface command.

  For example, enter the following command:

  hostname(config)# interface gigabitethernet0/1.1

  Step 2 To name the interface, enter the following command: hostname(config-if)# nameif name

  The name is a text string up to 48 characters, and is not case-sensitive. You can change the name by reentering this command with a new value. Do not enter the no form, because that command causes all commands that refer to that name

  to be deleted.

  Step 3 To set the security level, enter the following command:

  hostname(config-if)# security-level number Where number is an integer between 0 (lowest) and 100 (highest).

  Step 4 (Optional) To set an interface to management-only mode, enter the following command:

  hostname(config-if)# management-only The ASA 5510 and higher adaptive security appliance includes a dedicated management interface called Management 0/0, which is meant to support traffic to the security appliance. However, you can

  configure any interface to be a management- only interface using the management-only command. Also, for Management 0/0, you can disable management-only mode so the interface can pass through traffic just like any other interface.

• Question 125:

  On Cisco ASA Software Version 8.4.1, which four inspections are enabled by default in the global policy? (Choose four.)

  A. HTTP
  B. ESMTP
  C. SKINNY
  D. ICMP
  E. TFTP
  F. SIP
  B. ESMTP
  C. SKINNY
  E. TFTP
  F. SIP

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/inspect_overview.html

• Question 126:

  Which three types of class maps can be configured on the Cisco ASA appliance? (Choose three.)

  A. control-plane
  B. regex
  C. inspect
  D. access-control
  E. management
  F. stack
  B. regex
  C. inspect
  E. management

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/mpc.html

  Maximum Class Maps The maximum number of class maps of all types is 255 in single mode or per context in multiple mode. Class maps include the following types:

  -Layer 3/4 class maps (for through traffic and management traffic -Inspection class maps -Regular expression class maps

• Question 127:

  With Cisco ASA active/active or active/standby stateful failover, which state information or table is not passed between the active and standby Cisco ASA by default?

  A. NAT translation table
  B. TCP connection states
  C. UDP connection states
  D. ARP table
  E. HTTP connection table
  E. HTTP connection table

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_overview.html#wp 1078922

  

• Question 128:

  When the Cisco ASA appliance is processing packets, which action is performed first?

  A. Check if the packet is permitted or denied by the inbound interface ACL.
  B. Check if the packet is permitted or denied by the outbound interface ACL.
  C. Check if the packet is permitted or denied by the global ACL.
  D. Check if the packet matches an existing connection in the connection table.
  E. Check if the packet matches an inspection policy.
  F. Check if the packet matches a NAT rule.
  D. Check if the packet matches an existing connection in the connection table.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080ba9d00.shtml

• Question 129:

  Which access rule is disabled automatically after the global access list has been defined and applied?

  A. the implicit global deny ip any any access rule
  B. the implicit interface access rule that permits all IP traffic from high security level to low security level interfaces
  C. the implicit global access rule that permits all IP traffic from high security level to low security level interfaces
  D. the implicit deny ip any any rule on the global and interface access lists
  E. the implicit permit all IP traffic from high security level to low security level access rule on the global and interface access lists
  B. the implicit interface access rule that permits all IP traffic from high security level to low security level interfaces

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.3/user/guide/fwaccess.html

  Understanding Device Specific Access Rule Behavior

  If you do not create an access rule policy, the following is the default behavior based on the type of device, and what happens when you create an access rule:

  -IOS devices--Permit all traffic through an interface.

  When you create an access rule permitting source A to destination B without configuring TCP/UDP inspection on the inspection rule table, or configuring the established advanced option on the rule, the device permits any packet from A to B.

  However, for any returning packet from B to A, the packet is not allowed, unless there is a corresponding access rule permitting that packet. If you configure TCP/UDP inspection on the traffic the inspection rule table, a rule permitting B to A is

  not needed in the access rule, as any returning packet from B to A automatically passes the device.

  -ASA and PIX devices--Permit traffic from a higher-security interface to a lower-security interface. Otherwise, all traffic is denied.

  If an access rule allows TCP/UDP traffic in one direction, the appliance automatically allows return traffic (you do not need to configure a corresponding rule for the return traffic), except for ICMP traffic, which does require a return rule (where

  you permit the reverse source and destination), or you must create an inspection rule for ICMP.

  -FWSM devices--Deny all traffic entering an interface, permit all traffic leaving an interface. You must configure access rules to allow any traffic to enter the device.

• Question 130:

  Drag the Cisco ASR modes from the left to the correct description on the right.

  Select and Place: