Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 41:

  For which purpose is the Cisco ASA CLI command aaa authentication match used?

  A. Enable authentication for SSH and Telnet connections to the Cisco ASA appliance.
  B. Enable authentication for console connections to the Cisco ASA appliance.
  C. Enable authentication for connections through the Cisco ASA appliance.
  D. Enable authentication for IPsec VPN connections to the Cisco ASA appliance.
  E. Enable authentication for SSL VPN connections to the Cisco ASA appliance.
  F. Enable authentication for Cisco ASDM connections to the Cisco ASA appliance.
  C. Enable authentication for connections through the Cisco ASA appliance.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/access_fwaaa.html

  Or

  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080ba6110.shtml

  To enable network access authentication, perform the following steps:

  Step 1 Using the aaa-server command, identify your AAA servers. If you have already identified your AAA servers, continue to the next step.

  Step 2 Using the access-list command, create an access list that identifies the source addresses and destination addresses of traffic you want to authenticate. The permit ACEs mark matching traffic for authentication, while deny entries

  exclude matching traffic from authentication. Be sure to include the destination ports for either HTTP, HTTPS, Telnet, or FTP in the access list because the user must authenticate with one of these services before other services are allowed

  through the ASA.

  Step 3 To configure authentication, enter the following command:

  hostname(config)# aaa authentication match acl_name interface_name server_group

  Where acl_name is the name of the access list you created; interface_name is the name of the interface as specified with the nameif command, and server_group is the AAA server group you created.

  The following commands authenticate Telnet traffic from the outside interface to a particular server (209.165.201.5):

  hostname(config)# aaa-server AuthInbound protocol tacacs+ hostname(config-aaa-server-group)# exit

  hostname(config)# aaa-server AuthInbound (inside) host 10.1.1.1 hostname(config-aaa-server-host)# key TACPlusUauthKey hostname(config-aaa-server-host)#exit

  hostname(config)# access-list TELNET_AUTH extended permit tcp any host 209.165.201.5 eq telnet

• Question 42:

  Refer to the exhibit.

  

  The Cisco ASA is operating in transparent mode. What is required on the Cisco ASA so that R1 and R2 can form OSPF neighbor adjacency?

  A. Map the R1 and R2 MAC address in the Cisco ASA MAC address table using the mac- address-table static if_name MAC_address command.
  B. Configure OSPF stateful packet inspection using MPF.
  C. Apply an EtherType ACL to the inside and outside interfaces to permit OSPF multicast traffic.
  D. Apply an extended ACL to the inside and outside interfaces to permit OSPF multicast traffic.
  E. Enable Advanced Application Inspection using MPF.
  D. Apply an extended ACL to the inside and outside interfaces to permit OSPF multicast traffic.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/mpf.html#wp1101685 Allowing Broadcast and Multicast Traffic through the Transparent Firewall In routed firewall mode, broadcast and multicast traffic is blocked even if you allow it in an access list, including unsupported dynamic routing protocols and DHCP (unless you configure DHCP relay). Transparent firewall mode can allow any

  IP traffic through. This feature is especially useful in multiple context mode, which does not allow dynamic routing, for example.

• Question 43:

  Refer to the exhibit.

  

  The Cisco ASA is dropping all the traffic that is sourced from the internet and is destined to any security context inside interface.

  Which configuration should be verified on the Cisco ASA to solve this problem?

  A. The Cisco ASA has NAT control disabled on each security context.
  B. The Cisco ASA is using inside dynamic NAT on each security context.
  C. The Cisco ASA is using a unique MAC address on each security context outside interface.
  D. The Cisco ASA is using a unique dynamic routing protocol process on each security context.
  E. The Cisco ASA packet classifier is configured to use the outside physical interface to assign the packets to each security context.
  C. The Cisco ASA is using a unique MAC address on each security context outside interface.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/mode_contexts.html# wp1134937

• Question 44:

  On the Cisco ASA, tcp-map can be applied to a traffic class using which MPF CLI configuration command?

  A. inspect
  B. sysopt connection
  C. tcp-options
  D. parameters
  E. set connection advanced-options
  E. set connection advanced-options

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpnorm.html

• Question 45:

  Which flags should the show conn command normally show after a TCP connection has successfully been established from an inside host to an outside host?

  A. aB
  B. saA
  C. sIO
  D. AIO
  E. UIO
  F. F
  E. UIO

• Question 46:

  Which Cisco ASA object group type offers the most flexibility for grouping different services together based on arbitrary protocols?

  A. network
  B. ICMP
  C. protocol
  D. TCP-UDP
  E. service
  E. service

• Question 47:

  The Cisco ASA software image has been erased from flash memory. Which two statements about the process to recover the Cisco ASA software image are true? (Choose two.)

  A. Access to the ROM monitor mode is required.
  B. The Cisco ASA appliance must have connectivity to the TFTP server where the Cisco ASA image is stored through the Management 0/0 interface.
  C. The copy tftp flash command is necessary to start the TFTP file transfer.
  D. The server command is necessary to set the TFTP server IP address.
  E. Cisco ASA password recovery must be enabled.
  A. Access to the ROM monitor mode is required.
  D. The server command is necessary to set the TFTP server IP address.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/admin_trouble.html

  Using the ROM Monitor to Load a Software Image

  To load a software image to an ASA from the ROM monitor mode using TFTP, perform the following steps:

  Step 1 Connect to the ASA console port according to the instructions in the "Accessing the Appliance Command-Line Interface" section.

  Step 2 Power off the ASA, then power it on.

  Step 3 During startup, press the Escape key when you are prompted to enter ROMMON mode.

  Step 4 In ROMMOM mode, define the interface settings to the ASA, including the IP address, TFTP server

  address, gateway address, software image file, and port, as follows:

  rommon #1> ADDRESS=10.132.44.177

  rommon #2> SERVER=10.129.0.30

  rommon #3> GATEWAY=10.132.44.1

  rommon #4> IMAGE=f1/asa840-232-k8.bin

  rommon #5> PORT=Ethernet0/0

  Ethernet0/0

  Link is UP

  MAC Address: 0012.d949.15b8

  Note Be sure that the connection to the network already exists.

  Step 5 To validate your settings, enter the set command.

  rommon #6> set

  ROMMON Variable Settings:

  ADDRESS=10.132.44.177

  SERVER=10.129.0.30

  GATEWAY=10.132.44.1

  PORT=Ethernet0/0

  VLAN=untagged

  IMAGE=f1/asa840-232-k8.bin

  CONFIG=

  LINKTIMEOUT=20

  PKTTIMEOUT=4

  RETRY=20

  Step 6 Ping the TFTP server by entering the ping server command.

  rommon #7> ping server

  Sending 20, 100-byte ICMP Echoes to server 10.129.0.30, timeout is 4 seconds:

  Success rate is 100 percent (20/20)

  Step 7 Load the software image by entering the tftp command.

  rommon #8> tftp

  ROMMON Variable Settings:

  ADDRESS=10.132.44.177

  SERVER=10.129.0.30

  GATEWAY=10.132.44.1

  PORT=Ethernet0/0

  VLAN=untagged

  IMAGE=f1/asa840-232-k8.bin

  CONFIG=

  LINKTIMEOUT=20

  PKTTIMEOUT=4

  RETRY=20

  tftp f1/[email protected] via 10.132.44.1 Received 14450688 bytes

  Launching TFTP Image...

  Cisco ASA Security Appliance admin loader (3.0) #0: Mon Mar 5 16:00:07 MST 2011 Loading...

  After the software image is successfully loaded, the ASA automatically exits ROMMON mode.

  Step 8 To verify that the correct software image has been loaded into the ASA, check the version by entering the following command:

  hostname# show version

• Question 48:

  On the Cisco ASA Software Version 8.4.1, which three parameters can be configured using the set connection command within a policy map? (Choose three.)

  A. per-client TCP and/or UDP idle timeout
  B. per-client TCP and/or UDP maximum session time
  C. TCP sequence number randomization
  D. maximum number of simultaneous embryonic connections
  E. maximum number of simultaneous TCP and/or UDP connections
  F. fragments reassembly options
  C. TCP sequence number randomization
  D. maximum number of simultaneous embryonic connections
  E. maximum number of simultaneous TCP and/or UDP connections

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s1.html#wp1424045

  

• Question 49:

  Refer to the exhibit.

  

  Which statement about the Telnet session from 10.0.0.1 to 172.26.1.200 is true?

  A. The Telnet session should be successful.
  B. The Telnet session should fail because the route lookup to the destination fails.
  C. The Telnet session should fail because the inside interface inbound access list will block it.
  D. The Telnet session should fail because no matching flow was found.
  E. The Telnet session should fail because inside NAT has not been configured.
  C. The Telnet session should fail because the inside interface inbound access list will block it.

• Question 50:

  Which Cisco ASA feature is implemented by the ip verify reverse-path interface interface_name command?

  A. uRPF
  B. TCP intercept
  C. botnet traffic filter
  D. scanning threat detection
  E. IPS (IP audit)
  A. uRPF

  ---

  https://supportforums.cisco.com/thread/2070206

  Unicast RPF is disabled by default on the ASA unless you explicitly enable it on an interface. Since it is disabled by default on all interfaces, you will not see them in the configuration. Once you enable RPF for a specific interface, you will see

  that enabled in the configuration.

  For example:

  If you have 3 interfaces: inside, dmz and outside, and you enable it for inside only, then when you perform "sh run ip verify reverse-path", you will see the following:

  ip verify reverse-path interface inside

  OR/ you will see that in the running configuration as well. The other 2 interfaces that you haven't explicitly enabled will still be disabled by default, and will not show under the configuration.