Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 131:

  Refer to the exhibit.

  

  Which command enables the stateful failover option?

  A. failover link MYFAILOVER GigabitEthernet0/2
  B. failover lan interface MYFAILOVER GigabitEthernet0/2
  C. failover interface ip MYFAILOVER 172.16.5.1 255.255.255.0 standby 172.16.5.10
  D. preempt
  E. failover group 1 primary
  F. failover lan unit primary
  A. failover link MYFAILOVER GigabitEthernet0/2

  ---

  http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example091 86a00807dac5f.shtml

• Question 132:

  What mechanism is used on the Cisco ASA to map IP addresses to domain names that are contained in the botnet traffic filter dynamic database or local blacklist?

  A. HTTP inspection
  B. DNS inspection and snooping
  C. WebACL
  D. dynamic botnet database fetches (updates)
  E. static blacklist
  F. static whitelist
  B. DNS inspection and snooping

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_botnet.html

• Question 133:

  Refer to the exhibit.

  

  Which three CLI commands are generated by these Cisco ASDM configurations? (Choose three.)

  A. object-group network testobj
  B. object network testobj
  C. ip address 10.1.1.0 255.255.255.0
  D. subnet 10.1.1.0 255.255.255.0
  E. nat (any,any) static 192.168.1.0 dns
  F. nat (outside,inside) static 192.168.1.0 dns
  G. nat (inside,outside) static 192.168.1.0 dns
  H. nat (inside,any) static 192.168.1.0 dns
  I. nat (any,inside) static 192.168.1.0 dns
  B. object network testobj
  D. subnet 10.1.1.0 255.255.255.0
  E. nat (any,any) static 192.168.1.0 dns

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/inspect_basic.html#wp 1350877

  When DNS inspection is enabled, DNS rewrite provides full support for NAT of DNS messages originating from any interface.

  If a client on an inside network requests DNS resolution of an inside address from a DNS server on an outside interface, the DNS A-record is translated correctly.

  If the DNS inspection engine is disabled, the A-record is not translated.

  As long as DNS inspection remains enabled, you can configure DNS rewrite using the alias, static, or nat commands.

  DNS Rewrite performs two functions:

  -Translating a public address (the routable or "mapped" address) in a DNS reply to a private address (the "real" address) when the DNS client is on a private interface. -Translating a private address to a public address when the DNS client is

  on the public interface.

• Question 134:

  When a Cisco ASA is configured in multiple context mode, within which configuration are the interfaces allocated to the security contexts?

  A. each security context
  B. system configuration
  C. admin context (context with the "admin" role)
  D. context startup configuration file (.cfg file)
  B. system configuration

  ---

  http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/

  products_configuration_example09186a00808d2b63.shtml

  In order to specify the interfaces that you can use in the context, enter the command appropriate for a physical interface or for one or more subinterfaces.

  In order to allocate a physical interface, enter this command:

  hostname(config-ctx)# allocate-interface [mapped_name] [visible | invisible]

  Context Configurations

  The security appliance includes a configuration for each context that identifies the security policy, interfaces, and almost all the options you can configure on a standalone device. You can store context configurations on the internal Flash

  memory or the external Flash memory card, or you can download them from a TFTP, FTP, or HTTP(S) server.

  System Configuration

  The system administrator adds and manages contexts by configuring each context configuration location, allocated interfaces, and other context operating parameters in the system configuration, which, like a single mode configuration, is the

  startup configuration. The system configuration identifies basic settings for the security appliance. The system configuration does not include any network interfaces or network settings for itself; rather, when the system needs to access

  network resources (such as downloading the contexts from the server), it uses one of the contexts that is designated as the admin context. The system configuration does include a specialized failover interface for failover traffic only.

  Admin Context Configuration

  The admin context is just like any other context, except that when a user logs in to the admin context, then that user has system administrator rights and can access the system and all other contexts. The admin context is not restricted in any

  way, and can be used as a regular context. However, because logging into the admin context grants you administrator privileges over all contexts, you might need to restrict access to the admin context to appropriate users. The admin context

  must reside on Flash memory, and not remotely.

  If your system is already in multiple context mode, or if you convert from single mode, the admin context is created automatically as a file on the internal Flash memory called admin.cfg. This context is named "admin." If you do not want to use

  admin.cfg as the admin context, you can change the admin context.

• Question 135:

  Refer to the exhibit.

  

  Which two statements are true? (Choose two.)

  A. The connection is awaiting outside ACK to SYN.
  B. The connection is initiated from the inside.
  C. The connection is active and has received inbound and outbound data.
  D. The connection is an incomplete TCP connection.
  E. The connection is a DNS connection.
  B. The connection is initiated from the inside.
  C. The connection is active and has received inbound and outbound data.

  ---

  

  

• Question 136:

  Refer to the exhibit.

  

  Which Cisco ASA configuration has the minimum number of the required configuration commands to enable the Cisco ASA appliance to establish EIGRP neighborship with its two neighboring routers?

  A. router eigrp 1 network 10.0.0.0 255.0.0.0
  B. router eigrp 1 network 10.0.0.0 255.0.0.0 network 192.168.1.0 255.255.255.0 network 192.168.2.0 255.255.255.0
  C. router eigrp 1 network 10.1.1.0 255.255.255.0 network 10.2.2.0 255.255.255.0
  D. router eigrp 1 network 10.1.1.0 255.255.255.0 network 10.2.2.0 255.255.255.0 network 192.168.1.0 255.255.255.0 network 192.168.2.0 255.255.255.0
  E. router eigrp 1 network 0.0.0.0 255.255.255.255
  A. router eigrp 1 network 10.0.0.0 255.0.0.0

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008086eb d2.shtml EIGRP Configuration - the CLI configuration is very similar to the !Cisco IOS router EIGRP configuration.

• Question 137:

  By default, how does the Cisco ASA authenticate itself to the Cisco ASDM users?

  A. The administrator validates the Cisco ASA by examining the factory built-in identity certificate thumbprint of the Cisco ASA.
  B. The Cisco ASA automatically creates and uses a persistent self-signed X.509 certificate to authenticate itself to the administrator.
  C. The Cisco ASA automatically creates a self-signed X.509 certificate on each reboot to authenticate itself to the administrator.
  D. The Cisco ASA and the administrator use a mutual password to authenticate each other.
  E. The Cisco ASA authenticates itself to the administrator using a one-time password.
  C. The Cisco ASA automatically creates a self-signed X.509 certificate on each reboot to authenticate itself to the administrator.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808efb d2.shtml