Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 21:

  Which two methods can be used to access the Cisco AIP-SSM CLI? (Choose two.)

  A. initiating an SSH connection to the Cisco AIP-SSM external management Ethernet port
  B. connecting to the console port on the Cisco AIP-SSM
  C. using the setup command on the Cisco ASA CLI
  D. using the session 1 command on the Cisco ASA CLI
  E. using the hw-module command on the Cisco ASA CLI
  A. initiating an SSH connection to the Cisco AIP-SSM external management Ethernet port
  D. using the session 1 command on the Cisco ASA CLI

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/ssm.html#wp1058664 http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/intrface.html#wpxref9

• Question 22:

  When configuring security contexts on the Cisco ASA, which three resource class limits can be set using a rate limit? (Choose three.)

  A. address translation rate
  B. Cisco ASDM session rate
  C. connections rate
  D. MAC-address learning rate (when in transparent mode)
  E. syslog messages rate
  F. stateful packet inspections rate
  C. connections rate
  E. syslog messages rate
  F. stateful packet inspections rate

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/mngcntxt.html#wp111 Table 6-1 lists the resource types and the limits. See also the show resource types command.

• Question 23:

  Which option is not supported when the Cisco ASA is operating in transparent mode and also is using multiple security contexts?

  A. NAT
  B. shared interface
  C. security context resource management
  D. Layer 7 inspections
  E. failover
  B. shared interface

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html

  Unique Interfaces

  If only one context is associated with the ingress interface, the ASA classifies the packet into that context. In transparent firewall mode, unique interfaces for contexts are required, so this method is used to classify packets at all times.

• Question 24:

  With Cisco ASA active/standby failover, what is needed to enable subsecond failover?

  A. Use redundant interfaces.
  B. Enable the stateful failover interface between the primary and secondary Cisco ASA.
  C. Decrease the default unit failover polltime to 300 msec and the unit failover holdtime to 900 msec.
  D. Decrease the default number of monitored interfaces to 1.
  C. Decrease the default unit failover polltime to 300 msec and the unit failover holdtime to 900 msec.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa83/asdm63/configuration_guide/ha_active_sta ndby.html

  Configuring the Unit and Interface Health Poll Times The adaptive security appliance sends hello packets out of each data interface to monitor interface health. The appliance sends hello messages across the failover link to monitor unit health. If the adaptive security appliance does not receive a hello packet from the corresponding interface on the peer unit for over half of the hold time, then the additional interface testing begins. If a hello packet or a successful test result is not received within the specified hold time, the interface is marked as failed. Failover occurs if the number of failed interfaces meets the failover criteria.

  Decreasing the poll and hold times enables the adaptive security appliance to detect and respond to interface failures more quickly, but may consume more system resources. Increasing the poll and hold times prevents the adaptive security appliance from failing over on networks with higher latency.

• Question 25:

  Which four unicast or multicast routing protocols are supported by the Cisco ASA appliance? (Choose four.)

  A. RIP (v1 and v2)
  B. OSPF
  C. ISIS
  D. BGP
  E. EIGRP
  F. Bidirectional PIM
  G. MOSPF
  H. PIM dense mode
  A. RIP (v1 and v2)
  B. OSPF
  E. EIGRP
  F. Bidirectional PIM

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/asdm64/configuration_guide/route_overvie w.html#wp1125708

  -Enhanced Interior Gateway Routing Protocol (EIGRP)

  Enhanced IGRP provides compatibility and seamless interoperation with IGRP routers. An automaticredistribution mechanism allows IGRP routes to be imported into Enhanced IGRP, and vice versa, so it is possible to add Enhanced IGRP

  gradually into an existing IGRP network. For more infomation on configuring EIGRP, see the chapter `Configuring EIGRP'.

  -Open Shortest Path First (OSPF)

  Open Shortest Path First (OSPF) is a routing protocol developed for Internet Protocol (IP) networks by the interior gateway protocol (IGP) working group of the Internet Engineering Task Force (IETF). OSPF uses a linkstate algorithm in order

  to build and calculate the shortest path to all known destinations. Each router in an OSPF area contains an identical link-state database, which is a list of each of the router usable interfaces and reachable neighbors

  For more infomation on configuring OSPF, see the chapter `Configuring OSPF'. -Routing Information Protocol The Routing Information Protocol (RIP) is a distance-vector protocol that uses hop count as its metric. RIP is widely used for

  routing traffic in the global Internet and is an interior gateway protocol (IGP), which means that it performs routing within a single autonomous system.

  For more infomation on configuring RIP, see the chapter `Configuring RIP'. http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/multicst.html#wp1060775

  Multicast Routing Overview The adaptive security appliance supports both stub multicast routing and PIM multicast routing. However, you cannot configure both concurrently on a single adaptive security appliance.

  Stub multicast routing provides dynamic host registration and facilitates multicast routing. When configured for stub multicast routing, the adaptive security appliance acts as an IGMP proxy agent. Instead of fully participating in multicast

  routing, the adaptive security appliance forwards IGMP messages to an upstream multicast router, which sets up delivery of the multicast data. When configured for stub multicast routing, the adaptive security appliance cannot be configured

  for PIM.

  The adaptive security appliance supports both PIM-SM and bi-directional PIM. PIM-SM is a multicast routing protocol that uses the underlying unicast routing information base or a separate multicast-capable routing information base. It builds

  unidirectional shared trees rooted at a single Rendezvous Point per multicast group and optionally creates shortest-path trees per multicast source.

  Bi-directional PIM is a variant of PIM-SM that builds bi-directional shared trees connecting multicast sources and receivers. Bi-directional trees are built using a DF election process operating on each link of the multicast topology. With the

  assistance of the DF, multicast data is forwarded from sources to the Rendezvous Point, and therefore along the shared tree to receivers, without requiring source-specific state. The DF election takes place during Rendezvous Point

  discovery and provides a default route to the Rendezvous Point.

• Question 26:

  Refer to the exhibit.

  

  Which corresponding Cisco ASA Software Version 8.3 command accomplishes the same Cisco ASA Software Version 8.2 NAT configuration?

  A. nat (any,any) dynamic interface
  B. nat (any,any) static interface
  C. nat (inside,outside) dynamic interface
  D. nat (inside,outside) static interface
  E. nat (outside,inside) dynamic interface
  F. nat (outside,inside) static interface
  C. nat (inside,outside) dynamic interface

  ---

  http://tunnelsup.com/2011/06/24/nat-for-cisco-asas-version-8-3/ Regular Dynamic PAT

  To create a many-to-one NAT where the entire inside network is getting PAT'd to a single outside IP do the following.

  Old 8.2 command:

  nat (inside) 1 10.0.0.0 255.255.255.0 global (outside) 1 interface New 8.3 equivalent command: object network inside-net subnet 10.0.0.0 255.255.255.0 nat (inside,outside) dynamic interface Note: the "interface" command is the 2nd interface in the nat statement, in this case the outside.

• Question 27:

  On Cisco ASA Software Version 8.4.1 and later, when you configure the Cisco ASA appliance in transparent firewall mode, which configuration is mandatory?

  A. NAT
  B. static routes
  C. ARP inspections
  D. EtherType access-list
  E. bridge group(s)
  F. dynamic MAC address learning
  E. bridge group(s)

  ---

  

• Question 28:

  By default, not all services in the default inspection class are inspected. Which Cisco ASA CLI command do you use to determine which inspect actions are applied to the default inspection class?

  A. show policy-map global_policy
  B. show policy-map inspection_default
  C. show class-map inspection_default
  D. show class-map default-inspection-traffic
  E. show service-policy global
  E. show service-policy global

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa81/command/ref/s7.html#wp1254424

  

• Question 29:

  On Cisco ASA Software Version 8.4 and later, which two options show the maximum number of active and standby ports that an EtherChannel can have? (Choose two.)

  A. 2 active ports
  B. 4 active ports
  C. 6 active ports
  D. 8 active ports
  E. 2 standby ports
  F. 4 standby ports
  G. 6 standby ports
  H. 8 standby ports
  D. 8 active ports
  H. 8 standby ports

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/asdm64/configuration_guide/interface_star t.pdf

  Channel Group Interfaces

  Each channel group can have eight active interfaces. Note that you can assign up to 16 interfaces to a channel group. While only eight interfaces can be active, the remaining interfaces can act as standby links in case of interface failure.

  All interfaces in the channel group must be the same type and speed. The first interface added to the channel group determines the correct type and speed.

  The EtherChannel aggregates the traffic across all the available active interfaces in the channel. The port is selected using a proprietary hash algorithm, based on source or destination MAC addresses, IP addresses, TCP and UDP port

  numbers and vlan numbers

• Question 30:

  Refer to the exhibit.

  

  Which Cisco ASA CLI commands configure these static routes in the Cisco ASA routing table?

  A. route dmz 10.2.2.0 0.0.0.255 172.16.1.10 route dmz 10.3.3.0 0.0.0.255 172.16.1.11
  B. route dmz 10.2.2.0 0.0.0.255 172.16.1.10 1 route dmz 10.3.3.0 0.0.0.255 172.16.1.11 1
  C. route dmz 10.2.2.0 0.0.0.255 172.16.1.10 route dmz 10.3.3.0 0.0.0.255 172.16.1.11 2
  D. route dmz 10.2.2.0 255.255.255.0 172.16.1.10 route dmz 10.3.3.0 255.255.255.0 172.16.1.11
  E. route dmz 10.2.2.0 255.255.255.0 172.16.1.10 1 route dmz 10.3.3.0 255.255.255.0 172.16.1.11 1
  F. route dmz 10.2.2.0 255.255.255.0 172.16.1.10 route dmz 10.3.3.0 255.255.255.0 172.16.1.11 2
  F. route dmz 10.2.2.0 255.255.255.0 172.16.1.10 route dmz 10.3.3.0 255.255.255.0 172.16.1.11 2

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1 121521