Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 11:

  Which two statements about traffic shaping capability on the Cisco ASA appliance are true? (Choose two.)

  A. Traffic shaping can be applied to all outgoing traffic on a physical interface or, in the case of the Cisco ASA 5505 appliance, on a VLAN.
  B. Traffic shaping can be applied in the input or output direction.
  C. Traffic shaping can cause jitter and delay.
  D. You can configure traffic shaping and priority queuing on the same interface.
  E. With traffic shaping, when traffic exceeds the maximum rate, the security appliance drops the excess traffic.
  A. Traffic shaping can be applied to all outgoing traffic on a physical interface or, in the case of the Cisco ASA 5505 appliance, on a VLAN.
  C. Traffic shaping can cause jitter and delay.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/qos.html#wp1083655

  Information About Traffic Shaping Traffic shaping is used to match device and link speeds, thereby controlling packet loss, variable delay, and link saturation, which can cause jitter and delay.

  -Traffic shaping must be applied to all outgoing traffic on a physical interface or in the case of the ASA 5505, on a VLAN. You cannot configure traffic shaping for specific types of traffic. -Traffic shaping is implemented when packets are ready to be transmitted on an interface, so the rate calculation is performed based on the actual size of a packet to be transmitted, including all the possible overhead such as the IPsec header and L2 header. -The shaped traffic includes both through-the-box and from-the-box traffic. -The shape rate calculation is based on the standard token bucket algorithm. The token bucket size is twice the Burst Size value. See the "What is a Token Bucket?" section. -When burst traffic exceeds the specified shape rate, packets are queued and transmitted later. Following are some characteristics regarding the shape queue (for information about hierarchical priority queuing, see the "Information About Priority Queuing" section):

  The queue size is calculated based on the shape rate. The queue can hold the equivalent of 200- milliseconds worth of shape rate traffic, assuming a 1500-byte packet. The minimum queue size is 64.

  When the queue limit is reached, packets are tail-dropped. Certain critical keep-alive packets such as OSPF Hello packets are never dropped. The time interval is derived by time_interval = burst_size / average_rate. The larger the time interval is, the bustier the shaped traffic might be, and the longer the link might be idle. The effect can be best understood using the following exaggerated example:

  Average Rate = 1000000 Burst Size = 1000000 In the above example, the time interval is 1 second, which means, 1 Mbps of traffic can be bursted out within the first 10 milliseconds of the 1-second interval on a 100 Mbps FE link and leave the remaining 990 milliseconds idle without being able to send any packets until the next time interval. So if there is delay sensitive traffic such as voice traffic, the Burst Size should be reduced compared to the average rate so the time interval is reduced.

• Question 12:

  Which five options are valid logging destinations for the Cisco ASA? (Choose five.)

  A. AAA server
  B. Cisco ASDM
  C. buffer
  D. SNMP traps
  E. LDAP server
  F. email
  G. TCP-based secure syslog server
  B. Cisco ASDM
  C. buffer
  D. SNMP traps
  F. email
  G. TCP-based secure syslog server

  ---

  Choose the name of the logging destination to which you want to apply a filter. Available logging destinations are as follows:

  

  ASDM

  

  E-Mail

  

  Internal buffer

  

  SNMP server

  

  Syslog server also

  

  Telnet or SSH session

  

  Console port

• Question 13:

  By default, which traffic can pass through a Cisco ASA that is operating in transparent mode without explicitly allowing it using an ACL?

  A. ARP
  B. BPDU
  C. CDP
  D. OSPF multicasts
  E. DHCP
  A. ARP

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/fwmode.html

• Question 14:

  Where in the ACS are the individual downloadable ACL statements configured to achieve the most scalable deployment?

  A. Group Setup
  B. User Setup
  C. Shared Profile Components
  D. Network Access Profiles
  E. Network Configuration
  F. Interface Configuration
  C. Shared Profile Components

  ---

  The Shared Profile Components section enables you to develop and name reusable, shared sets of authorization components which may be applied to one or more users or groups of users and referenced by name within their profiles. These include network access restrictions (NARs), command authorization sets, and downloadable PIX ACLs.

  The Shared Profile Components section of Cisco Secure ACS addresses the scalability of selective authorization. Shared profile components can be configured once and then applied to many users or groups.

  Without this ability, flexible and comprehensive authorization could only be accomplished by explicitly configuring the authorization of each user group for each possible command on each possible device. Creating and applying these named shared profile components (access restrictions, command sets, and ACLs) makes it unnecessary to repeatedly enter long lists of devices or commands when defining network access parameters.

  Shared profile components also enable Cisco Secure ACS to authorize a command on behalf of another device or devices. Their scalability extends to the following capabilities: A way to determine the list of commands a user could issue against one or more devices in the network.

  A way to determine the list of devices on which a particular user may execute a particular command and http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a0 080205a4a.html

• Question 15:

  On Cisco ASA Software Version 8.4.1 and later, which three EtherChannel modes are supported? (Choose three.)

  A. active mode, which initiates LACP negotiation
  B. passive mode, which responds to LACP negotiation from the peer
  C. auto mode, which automatically responds to either PAgP or LACP negotiation from the peer
  D. on mode, which enables static port-channel mode
  E. off mode, which disables dynamic negotiation
  A. active mode, which initiates LACP negotiation
  B. passive mode, which responds to LACP negotiation from the peer
  D. on mode, which enables static port-channel mode

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start.html#w p1329030

  Link Aggregation Control Protocol

  The Link Aggregation Control Protocol (LACP) aggregates interfaces by exchanging the Link Aggregation Control Protocol Data Units (LACPDUs) between two network devices. You can configure each physical interface in an EtherChannel

  to be:

  -Active--Sends and receives LACP updates. An active EtherChannel can establish connectivity with either an active or a passive EtherChannel. You should use the active mode unless you need to minimize the amount of LACP traffic.

  -Passive--Receives LACP updates. A passive EtherChannel can only establish connectivity with an active

  EtherChannel.

  -On--The EtherChannel is always on, and LACP is not used. An "on" EtherChannel can only establish a connection with another "on" EtherChannel. LACP coordinates the automatic addition and deletion of links to the EtherChannel without

  user intervention. It also handles misconfigurations and checks that both ends of member interfaces are connected to the correct channel group. "On" mode cannot use standby interfaces in the channel group when an interface goes down,

  and the connectivity and configurations are not checked.

• Question 16:

  Which statement about SNMP support on the Cisco ASA appliance is true?

  A. The Cisco ASA appliance supports only SNMPv1 or SNMPv2c.
  B. The Cisco ASA appliance supports read-only and read-write access.
  C. The Cisco ASA appliance supports three built-in SNMPv3 groups in Cisco ASDM: Authentication and Encryption, Authentication Only, and No Authentication, No Encryption.
  D. The Cisco ASA appliance can send SNMP traps to the network management station only using SNMPv2.
  C. The Cisco ASA appliance supports three built-in SNMPv3 groups in Cisco ASDM: Authentication and Encryption, Authentication Only, and No Authentication, No Encryption.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/monitor_snmp.html#w p1042029

  SNMP Version 3 Overview

  SNMP Version 3 provides security enhancements that are not available in SNMP Version 1 or SNMP Version 2c. SNMP Versions 1 and 2c transmit data between the SNMP server and SNMP agent in clear text. SNMP Version 3 adds

  authentication and privacy options to secure protocol operations. In addition, this version controls access to the SNMP agent and MIB objects through the User-based Security Model (USM) and Viewbased Access Control Model (VACM). The

  ASA 5500 series ASAs also support the creation of SNMP groups and users, as well as hosts, which is required to enable transport authentication and encryption for secure SNMP communications.

  Security Models

  For configuration purposes, the authentication and privacy options are grouped together into security models.

  Security models apply to users and groups, and are divided into the following three types:

  -NoAuthPriv--No Authentication and No Privacy, which means that no security is applied to messages.

  -AuthNoPriv--Authentication but No Privacy, which means that messages are authenticated.

  -AuthPriv--Authentication and Privacy, which means that messages are authenticated and encrypted.

• Question 17:

  SIMULATION

  Instructions This item contains a simulation task. Refer to the scenario and topology before you start. When you are ready, open the Topology window and click the required device to open the GUI window on a virtual terminal. Scroll to view all parts of the Cisco ASDM screens.

  Scenario Click the PC icon to launch Cisco ASDM. You have access to a Cisco ASA 5505 via Cisco ASDM. Use Cisco ASDM to edit the Cisco ASA 5505 configurations to enable Advanced HTTP Application inspection by completing the following tasks:

  1.

  Enable HTTP inspection globally on the Cisco ASA

  2.

  Create a new HTTP inspect Map named: http-inspect-map to:

  A. Enable the dropping of any HTTP connections that encounter HTTP protocol violations

  B. Enable the dropping and logging of any HTTP connections when the content type in the HTTP response does not match one of the MIME types in the accept filed of the HTTP request Note: In the simulation, you will not be able to test the HTTP inspection policy after you complete your configuration. Not all Cisco ASDM screens are fully functional.

  After you complete the configuration, you do not need to save the running configuration to the start-up config, you will not be able to test the HTTP inspection policy that is created after you complete your configuration. Also not all the ASDM screens are filly functional.

  

  

  Check the answer below

  1.>Go to Configuration>>Firewall>>Objects>>Inspect Maps>>HTTP>>Add>>Add name "http- inspect-map">>click on detail>>

  a.

  select "check for protocol violations"

  b.

  Action: Drop connection

  c.

  Log: Enable

  d.

  Click on Inspection: Click Add

  e.

  Select Single Match>>Match type: No Match

  f.

  Criterion: response header field

  g.

  Field: Predefined: Content type

  h.

  value: Content type

  i.

  Action: Drop connection

  j.

  Log: Enable

  h.

  ok>>>ok>>>Apply HTTP inspection is disabled in global policy by default - we need to enable and use this Inspect Map Achieve this through command line: policy-map type inspect http http-inspect-map parameters protocol-violation action drop-connection match req-resp content-type mismatch drop-connection log policy-map global_policy class inspaection_default inspect http http-inspect-map also you have to edit the global policy to apply this inspection into it. Add/Edit HTTP Map The Add/Edit HTTP Map dialog box is accessible as follows: Configuration > Global Objects > Inspect Maps > HTTP > HTTP Inspect Map > Advanced View > Add/Edit HTTP Inspect The Add/Edit HTTP Inspect dialog box lets you define the match criterion and value for the HTTP inspect map.

  Fields

  ꞏSingle Match--Specifies that the HTTP inspect has only one match statement. ꞏMatch Type--Specifies whether traffic should match or not match the values. For example, if No Match is selected on the string "example.com," then any traffic

  that contains "example.com" is excluded from the class map.

  ꞏCriterion--Specifies which criterion of HTTP traffic to match. Request/Response Content Type Mismatch--Specifies that the content type in the response must match one of the MIME types in the accept field of the request. Request

  Arguments--Applies the regular expression match to the arguments of the request.

  Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular Expressions dialog box, which lets you configure regular expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets you configure regular expression class maps.

  Request Body Length--Applies the regular expression match to the body of the request with field length greater than the bytes specified.

  Greater Than Length--Enter a field length value in bytes that request field lengths will be matched against.

  Request Body--Applies the regular expression match to the body of the request. Regular Expression--Lists the defined regular expressions to match. Manage-Opens the Manage Regular Expressions dialog box, which lets you configure regular expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets configure regular expression class maps.

  Request Header Field Count--Applies the regular expression match to the header of the request with a maximum number of header fields.

  Predefined--Specifies the request header fields: accept, accept-charset, accept-encoding, accept-language, allow, authorization, cache-control, connection, content-encoding, content- language, content-length, contentlocation, content-md5,

  content-range, content-type, cookie, date, expect, expires, from, host, if-match, ifmodified- since, if-none-match, if-range, if- unmodified-since, last-modified, max-forwards, pragma, proxyauthorization, range, referer, te, trailer,

  transferencoding, upgrade, user-agent, via, warning. Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular

  Expressions dialog box, which lets you configure regular expressions.

  Greater Than Count--Enter the maximum number of header fields. Request Header Field Length--Applies the regular expression match to the header of the request with field length greater than the bytes specified. Predefined--Specifies the

  request header fields: accept, accept-charset, accept-encoding, accept language, allow, authorization, cache-control, connection, content-encoding, content- language, content-length, contentlocation,

  content-md5, content-range, content-type, cookie, date, expect, expires, from, host, if-match, ifmodified- since, if-none-match, if-range, if-unmodified-since, lastmodified, max-forwards, pragma, proxyauthorization,

  range, referer, te, trailer, transfer-encoding, upgrade, user-agent, via, warning. Regular Expression--Lists the defined regular expressions to match. Manage-Opens the Manage Regular Expressions dialog box, which lets you configure regular expressions.

  Greater Than Length--Enter a field length value in bytes that request field lengths will be matched against.

  Request Header Field--Applies the regular expression match to the header of the request. Predefined--Specifies the request header fields: accept, accept-charset, accept-encoding, accept-language, allow, authorization, cache-control,

  connection, content-encoding, content- language, content-length, contentlocation, contentmd5, content-range, content-type, cookie, date, expect, expires, from, host, if-match, ifmodified-since, if-none-match, if-range, if- unmodified-since, last-

  modified, max-forwards, pragma, proxyauthorization, range, referer, te, trailer, transfer-encoding, upgrade, user-agent, via, warning. Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular

  Expressions dialog box, which lets you configure regular expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets you configure regular expression class maps.

  Request Header Count--Applies the regular expression match to the header of the request with a maximum number of headers.

  Greater Than Count--Enter the maximum number of headers. Request Header Length--Applies the regular expression match to the header of the request with length greater than the bytes specified.

  Greater Than Length--Enter a header length value in bytes. Request Header non-ASCII--Matches non-ASCII characters in the header of the request. Request Method--Applies the regular expression match to the method of the request.

  Method--Specifies to match on a request method: bcopy, bdelete, bmove, bpropfind, bproppatch, connect, copy, delete, edit, get, getattribute, getattributenames, getproperties, head, index, lock, mkcol, mkdir, move, notify, options, poll, post,

  propfind, proppatch, put, revadd, revlabel, revlog, revnum, save, search, setattribute, startrev, stoprev, subscribe, trace, unedit, unlock, unsubscribe.

  Regular Expression--Specifies to match on a regular expression. Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular Expressions dialog box, which lets you configure regular

  expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets you configure regular expression class maps.

  Request URI Length--Applies the regular expression match to the URI of the request with length greater than the bytes specified.

  Greater Than Length--Enter a URI length value in bytes. Request URI--Applies the regular expression match to the URI of the request. Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular

  Expressions dialog box, which lets you configure regular expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets you configure regular expression class maps.

  Response Body--Applies the regex match to the body of the response.

  ActiveX--Specifies to match on ActiveX.

  Java Applet--Specifies to match on a Java Applet.

  Regular Expression--Specifies to match on a regular expression. Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular Expressions dialog box, which lets you configure regular

  expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets you configure regular expression class maps.

  Response Body Length--Applies the regular expression match to the body of the response with field length greater than the bytes specified.

  Greater Than Length--Enter a field length value in bytes that response field lengths will be matched against.

  Response Header Field Count--Applies the regular expression match to the header of the response with a maximum number of header fields.

  Predefined--Specifies the response header fields: accept-ranges, age, allow, cache-control, connection, content-encoding, content-language, content-length, content-location, content- md5, content-range, contenttype, date, etag, expires, last-

  modified, location, pragma, proxy- authenticate, retry-after, server, set-cookie, trailer, transfer-encoding, upgrade, vary, via, warning, www-authenticate.

  Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular Expressions dialog box, which lets you configure regular expressions.

  Greater Than Count--Enter the maximum number of header fields. Response Header Field Length--Applies the regular expression match to the header of the response with field length greater than the bytes specified. Predefined--Specifies

  the response header fields: accept-ranges, age, allow, cache-control, connection, content-encoding, content-language, content-length, content-location, content- md5, content-range, contenttype, date, etag, expires, last-modified, location,

  pragma, proxy- authenticate, retry-after, server, set-cookie, trailer, transfer-encoding, upgrade, vary, via, warning, www-authenticate.

  Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular Expressions dialog box, which lets you configure regular expressions.

  Greater Than Length--Enter a field length value in bytes that response field lengths will be matched against.

  Response Header Field--Applies the regular expression match to the header of the response. Predefined--Specifies the response header fields: accept-ranges, age, allow, cache-control, connection, content-encoding, content-language,

  content-length, content-location, content- md5, content-range, contenttype, date, etag, expires, last-modified, location, pragma, proxy- authenticate, retry-after, server, set-cookie, trailer, transfer-encoding, upgrade, vary, via, warning,

  wwwauthenticate.

  Regular Expression--Lists the defined regular expressions to match. Manage--Opens the Manage Regular Expressions dialog box, which lets you configure regular expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets you configure regular expression class maps.

  Response Header Count--Applies the regular expression match to the header of the response with a maximum number of headers.

  Greater Than Count--Enter the maximum number of headers. Response Header Length--Applies the regular expression match to the header of the response with length greater than the bytes specified.

  Greater Than Length--Enter a header length value in bytes. Response Header non-ASCII--Matches non-ASCII characters in the header of the response. - Response Status Line--Applies the regular expression match to the status line. Regular

  Expression--Lists the defined regular expressions to match. Manage-Opens the Manage Regular Expressions dialog box, which lets you configure regular expressions.

  Regular Expression Class--Lists the defined regular expression classes to match. Manage--Opens the Manage Regular Expression Class dialog box, which lets you configure regular

  expression class maps.

  ꞏMultiple Matches--Specifies multiple matches for the HTTP inspection. H323 Traffic Class--Specifies the HTTP traffic class match. Manage--Opens the Manage HTTP Class Maps dialog box to add, edit, or delete HTTP Class Maps.

  ꞏAction--Drop connection, reset, or log.

  ꞏLog--Enable or disable.

  NOTE:

  http://www.cisco.com/en/US/docs/security/asa/asa83/asdm63/configuration_guide/inspect_b asic.html#wp1144259and/or

  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080b84568.shtml

  Through achieve this command line: policy-map type inspect http http-inspect-map parameters protocol-violation action drop-connection log policy-map type inspect http http-inspect-map match not response header content-type application/msword drop-connection log

• Question 18:

  Which additional active/standby failover feature was introduced in Cisco ASA Software Version 8.4?

  A. HTTP stateful failover
  B. OSPF and EIGRP routing protocol stateful failover
  C. SSL VPN stateful failover
  D. IPsec VPN stateful failover
  E. NAT stateful failover
  B. OSPF and EIGRP routing protocol stateful failover

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_overview.html#wp 1077551

  Stateful Failover When Stateful Failover is enabled, the active unit continually passes per-connection state information to the standby unit. After a failover occurs, the same connection information is available at the new active unit. Supported end-user applications are not required to reconnect to keep the same communication session.

  In Version 8.4 and later, Stateful Failover participates in dynamic routing protocols, like OSPF and EIGRP, so routes that are learned through dynamic routing protocols on the active unit are maintained in a Routing Information Base (RIB) table on the standby unit. Upon a failover event, packets travel normally with minimal disruption to traffic because the Active secondary ASA initially has rules that mirror the primary ASA. Immediately after failover, the re-convergence timer starts on the newly Active unit. Then the epoch number for the RIB table increments. During re-convergence, OSPF and EIGRP routes become updated with a new epoch number. Once the timer is expired, stale route entries (determined by the epoch number) are removed from the table. The RIB then contains the newest routing protocol forwarding information on the newly Active unit.

• Question 19:

  The Cisco ASA must support dynamic routing and terminating VPN traffic. Which three Cisco ASA options will not support these requirements? (Choose three.)

  A. transparent mode
  B. multiple context mode
  C. active/standby failover mode
  D. active/active failover mode
  E. routed mode
  F. no NAT-control
  A. transparent mode
  B. multiple context mode
  D. active/active failover mode

  ---

  Dynamic routing (OSPF and RIP (in passive mode)) is supported by routed firewall. Dynamic routing is NOT supported in Transparent UNLESS you can allow dynamic routing protocols through the ASA using an extended access list Dynamic routing is NOT supported in Multiple context mode

• Question 20:

  What is the correct regular expression to match HTTP requests whose URI is /welcome.jpg?

  A. ^/welcome.jpg
  B. ^/welcome\.jpg
  C. ^*/welcome\.jpg
  D. ^\/welcome\.jpg
  E. ^\*/welcome\.jpg
  D. ^\/welcome\.jpg

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/mpf.html#wp1101685 ^ Caret Specifies the beginning of a line. \ Escape When used with a metacharacter, matches a literal character. For example, \[ matches the left square bracket. character