Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 31:

  Drag the correct three access list entries (from the left) and drop them (on the right) in the order that is used when the interface ACL and global ACL are configured. Not all access list entries are required.

  Select and Place:

  

  

• Question 32:

  Refer to the exhibit.

  

  Which two statements about the class maps are true? (Choose two.)

  A. These class maps are referenced within the global policy by default for HTTP inspection.
  B. These class maps are all type inspect http class maps.
  C. These class maps classify traffic using regular expressions.
  D. These class maps are Layer 3/4 class maps.
  E. These class maps are used within the inspection_default class map for matching the default inspection traffic.
  B. These class maps are all type inspect http class maps.
  C. These class maps classify traffic using regular expressions.

• Question 33:

  Refer to the exhibit.

  

  Which option completes the CLI NAT configuration command to match the Cisco ASDM NAT configuration?

  object network insidenatted range 10.1.2.10 10.1.2.20 ! object network insidenet range 172.16.1.10 172.16.1.100 ! object network outnatted range 192.168.3.100 192.168.3.150 ! nat (inside,outside) after-auto 1 _______________?________________

  A. source dynamic insidenet insidenatted destination static Partner-internal-subnets outnatted
  B. source dynamic insidenet insidenatted interface destination static Partner-internal-subnets outnatted
  C. source dynamic insidenet insidenatted destination static Partner-internal-subnets outnatted interface
  D. source dynamic insidenet interface destination static Partner-internal-subnets outnatted
  E. source dynamic insidenatted insidenet destination static Partner-internal-subnets outnatted
  F. source dynamic insidenatted interface destination static Partner-internal-subnets outnatted
  B. source dynamic insidenet insidenatted interface destination static Partner-internal-subnets outnatted

• Question 34:

  Which Cisco ASA (8.4.1 and later) CLI command is the best command to use for troubleshooting SSH connectivity from the Cisco ASA appliance to the outside 192.168.1.1 server?

  A. telnet 192.168.1.1 22
  B. ssh -l username 192.168.1.1
  C. traceroute 192.168.1.1 22
  D. ping tcp 192.168.1.1 22
  E. packet-tracer input inside tcp 10.0.1.1 2043 192.168.4.1 ssh
  D. ping tcp 192.168.1.1 22

• Question 35:

  A Cisco ASA is operating in transparent firewall mode, but the MAC address table of the Cisco ASA is always empty, which causes connectivity issues.

  What should you verify to troubleshoot this issue?

  A. if ARP inspection has been disabled
  B. if MAC learning has been disabled
  C. if NAT has been disabled
  D. if ARP traffic is explicitly allowed using EtherType ACL
  E. if BPDU traffic is explicitly allowed using EtherType ACL
  B. if MAC learning has been disabled

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/fwmode.html#wp1224

• Question 36:

  Which addresses are considered "ambiguous addresses" and are put on the greylist by the Cisco ASA botnet traffic filter feature?

  A. addresses that are unknown
  B. addresses that are on the greylist identified by the dynamic database
  C. addresses that are blacklisted by the dynamic database but also are identified by the static whitelist
  D. addresses that are associated with multiple domain names, but not all of these domain names are on the blacklist
  D. addresses that are associated with multiple domain names, but not all of these domain names are on the blacklist

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa83/asdm63/configuration_guide/protect_botne t.html

  Botnet Traffic Filter Address Categories

  Addresses monitored by the Botnet Traffic Filter include:

  -Known malware addresses--These addresses are on the blacklist identified by the dynamic database and the static blacklist.

  -Known allowed addresses--These addresses are on the whitelist. The whitelist is useful when an address is blacklisted by the dynamic database and also identified by the static whitelist.

  -Ambiguous addresses--These addresses are associated with multiple domain names, but not all of these domain names are on the blacklist. These addresses are on the greylist.

  -Unlisted addresses--These addresses are unknown, and not included on any list.

• Question 37:

  In one custom dynamic application, the inside client connects to an outside server using TCP port 4444 and negotiates return client traffic in the port range of 5000 to 5500. The server then starts streaming UDP data to the client on the negotiated port in the specified range.

  Which Cisco ASA feature or command supports this custom dynamic application?

  A. TCP normalizer
  B. TCP intercept
  C. ip verify command
  D. established command
  E. tcp-map and tcp-options commands
  F. set connection advanced-options command
  D. established command

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/int5505.html

  Established command--This command allows return connections from a lower security host to a higher security host if there is already an established connection from the higher level host to the lower level host.

  For same security interfaces, you can configure established commands for both directions.

• Question 38:

  Using the default modular policy framework global configuration on the Cisco ASA, how does the Cisco ASA process outbound HTTP traffic?

  A. HTTP flows are not permitted through the Cisco ASA, because HTTP is not inspected by default.
  B. HTTP flows match the inspection_default traffic class and are inspected using HTTP inspection.
  C. HTTP outbound traffic is permitted, but all return HTTP traffic is denied.
  D. HTTP flows are statefully inspected using TCP stateful inspection.
  D. HTTP flows are statefully inspected using TCP stateful inspection.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/intro_intro.html#wp11 28055

• Question 39:

  Which feature is not supported on the Cisco ASA 5505 with the Security Plus license?

  A. security contexts
  B. stateless active/standby failover
  C. transparent firewall
  D. threat detection
  E. traffic shaping
  A. security contexts

• Question 40:

  Which statement about static or default route on the Cisco ASA appliance is true?

  A. The admin distance is 1 by default.
  B. From the show route output, the [120/3] indicates an admin distance of 3.
  C. A default route is specified using the 0.0.0.0 255.255.255.255 address/mask combination.
  D. The tunneled command option is used to enable route tracking.
  E. The interface-name parameter in the route command is an optional parameter if the static route points to the next-hop router IP address.
  A. The admin distance is 1 by default.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1 121521