Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 51:

  Refer to the Exhibit.

  

  Which statement about the NAT/PAT configuration is true?

  A. Dynamic PAT is used for any traffic that is sourced from the dmz_emailserver to the outside
  B. Dynamic PAT is used for any traffic that is sourced from any host on the inside network to the outside
  C. Static NAT is used for any traffic that is sourced from the dmz_emailserver to the outside
  D. Static PAT is used for any traffic that is sourced from the dmz_emailserver to the outside
  E. Dynamic NAT is used for any traffic that is sourced from the dmz_emailserver to the outside
  F. Dynamic NAT is used for any traffic that is sourced from and host on the guest-network to the outside
  B. Dynamic PAT is used for any traffic that is sourced from any host on the inside network to the outside

• Question 52:

  Which statement about the Cisco ASA 5585-X appliance is true?

  A. The IPS SSP must be installed in slot 0 (bottom slot) and the firewall/VPN SSP must be installed in slot 1 (top slot).
  B. The IPS SSP operates independently. The firewall/VPN SSP is not necessary to support the IPS SSP.
  C. The ASA 5585-X appliance supports three types of SSP (the firewall/VPN SSP, the IPS SSP, and the CSC SSP).
  D. The ASA 5585-X appliance with the firewall/VPN SSP-60 has a maximum firewall throughput of 10 Gb/s.
  E. All IPS traffic (except the IPS management interface traffic) must flow through the firewall/VPN SSP first before it can be redirected to the IPS SSP.
  E. All IPS traffic (except the IPS management interface traffic) must flow through the firewall/VPN SSP first before it can be redirected to the IPS SSP.

  ---

  http://www.cisco.com/en/US/docs/security/asa/quick_start/ips/ips_qsg.pdf

  The IPS module runs a separate application from the ASA. The IPS module might include an external management interface so you can connect to the IPS module directly; if it does not have a management interface, you can connect to the IPS module through the ASA interface. Any other interfaces on the IPS module, if available for your model, are used for ASA traffic only. Traffic goes through the firewall checks before being forwarded to the IPS module.

• Question 53:

  On Cisco ASA Software Version 8.3 and later, which two statements correctly describe the NAT table or NAT operations? (Choose two.)

  A. The NAT table has four sections.
  B. Manual NAT configurations are found in the first (top) and/or the last (bottom) section(s) of the NAT table.
  C. Auto NAT also is referred to as Object NAT.
  D. Auto NAT configurations are found only in the first (top) section of the NAT table.
  E. The order of the NAT entries in the NAT table is not relevant to how the packets are matched against the NAT table.
  F. Twice NAT is required for hosts on the inside to be accessible from the outside.
  B. Manual NAT configurations are found in the first (top) and/or the last (bottom) section(s) of the NAT table.
  C. Auto NAT also is referred to as Object NAT.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html

  

• Question 54:

  Which Cisco ASDM 6.4.1 pane is used to enable the Cisco ASA appliance to perform TCP checksum verifications?

  A. Configuration > Firewall > Service Policy Rules
  B. Configuration > Firewall > Advanced > IP Audit > IP Audit Policy
  C. Configuration > Firewall > Advanced > IP Audit > IP Audit Signatures
  D. Configuration > Firewall > Advanced > TCP options
  E. Configuration > Firewall > Objects > TCP Maps
  F. Configuration > Firewall > Objects > Inspect Maps
  E. Configuration > Firewall > Objects > TCP Maps

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/asdm52/release/notes/rn524.html shows:

  

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/user/guide/protect.html

  shows

  a.

  In the TCP Map Name field, enter a name.

  b.

  In the Queue Limit field, enter the maximum number of out-of-order packets, between 0 and 250.

  c.

  In the Reserved Bits area, click Clear and allow, Allow only, or Drop. Allow only allows packets with the reserved bits in the TCP header. Clear and allow clears the reserved bits in the TCP header and allows the packet. Drop drops the packet with the reserved bits in the TCP header.

  d.

  Check any of the following options:

  -Clear Urgent Flag--Allows or clears the URG pointer through the security appliance. -Drop Connection on Window Variation--Drops a connection that has changed its window size unexpectedly.

  -Drop Packets that Exceed Maximum Segment Size--Allows or drops packets that exceed MSS set by peer.

  -Check if transmitted data is the same as original--Enables and disables the retransmit data checks.

  -Drop SYN Packets With Data--Allows or drops SYN packets with data. -Enable TTL Evasion Protection--Enables or disables the TTL evasion protection offered by the security appliance.

  -Verify TCP Checksum--Enables and disables checksum verification. e. To set TCP options, check any of the following options:

  -Clear Selective Ack--Lists whether the selective-ack TCP option is allowed or cleared.

  -Clear TCP Timestamp--Lists whether the TCP timestamp option is allowed or cleared. -Clear Window Scale--Lists whether the window scale timestamp option is allowed or cleared.

  -Range--Lists the valid TCP options ranges, which should fall within 6-7 and 9-255. The lower bound should be less than or equal to the upper bound.

  f. Click OK.

• Question 55:

  A Cisco ASA requires an additional feature license to enable which feature?

  A. transparent firewall
  B. cut-thru proxy
  C. threat detection
  D. botnet traffic filtering
  E. TCP normalizer
  D. botnet traffic filtering

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa83/license_standalone/license_management/li cense.html#wp1450282

• Question 56:

  With active/standby failover, what happens if the standby Cisco ASA does not receive three consecutive hello messages from the active Cisco ASA on the LAN failover interface?

  A. The standby ASA immediately becomes the active ASA.
  B. The standby ASA eventually becomes the active ASA after three times the hold-down timer interval expires.
  C. The standby ASA runs network activity tests, including ARP and ping, to determine if the active ASA has failed.
  D. The standby ASA sends additional hellos packets on all monitored interfaces, including the LAN failover interface, to determine if the active ASA has failed.
  E. Both ASAs go to the "unknown" state until the LAN interface becomes operational again.
  D. The standby ASA sends additional hellos packets on all monitored interfaces, including the LAN failover interface, to determine if the active ASA has failed.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_overview.html

  Unit Health Monitoring The ASA determines the health of the other unit by monitoring the failover link. When a unit does not receive three consecutive hello messages on the failover link, the unit sends interface hello messages on each

  interface, including the failover interface, to validate whether or not the peer interface is responsive. The action that the ASA takes depends upon the response from the other unit. See the following possible actions:

  -If the ASA receives a response on the failover interface, then it does not fail over.

  -If the ASA does not receive a response on the failover link, but it does receive a response on another interface, then the unit does not failover. The failover link is marked as failed. You should restore the failover link as soon as possible

  because the unit cannot fail over to the standby while the failover link is down.

  -If the ASA does not receive a response on any interface, then the standby unit switches to active mode and classifies the other unit as failed.

• Question 57:

  A Cisco ASA appliance running software version 8.4.1 has an active botnet traffic filter license with 1 month left on the time-based license. Which option describes the result if a new botnet traffic filter with a 1 year time-based license is activated also?

  A. The time-based license for the botnet traffic filter is valid only for another month.
  B. The time-based license for the botnet traffic filter is valid for another 12 months.
  C. The time-based license for the botnet traffic filter is valid for another 13 months.
  D. The new 1 year time-based license for the botnet traffic filter cannot be activated until the current botnet traffic filter license expires in a month.
  C. The time-based license for the botnet traffic filter is valid for another 13 months.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c 25-593781.html

  Time-based license stacking: Customers can extend time-based licenses such as Botnet Traffic Filter and SSL VPN Burst by applying multiple licenses.

• Question 58:

  Which three actions can be applied to a traffic class within a type inspect policy map? (Choose three.)

  A. drop
  B. priority
  C. log
  D. pass
  E. inspect
  F. reset
  A. drop
  C. log
  F. reset

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/mpc.html hostname(config-pmap-c)# {[drop [send-protocol-error] | drop-connection [send-protocol-error]| mask | reset] [log] | rate-limit message_rate}

  The drop keyword drops all packets that match.

  The send-protocol-error keyword sends a protocol error message. The drop-connection keyword drops the packet and closes the connection. The mask keyword masks out the matching portion of the packet. The reset keyword drops the

  packet, closes the connection, and sends a TCP reset to the server and/or client.

  The log keyword, which you can use alone or with one of the other keywords, sends a system log message.

  The rate-limit message_rate argument limits the rate of messages.

• Question 59:

  Refer to the exhibit.

  

  Which two options will result from the Cisco ASA configuration? (Choose two.)

  A. The outside hosts can use the 192.168.100.1 IP address to reach the web server on the inside network.
  B. The global IP address of the web server is 209.165.200.230.
  C. The inside web client will use the 209.165.200.230 IP address to reach the web server and the Cisco ASA will translate the 209.165.200.230 IP address to the 192.168.100.1 IP address.
  D. The Cisco ASA will translate the DNS A-Record reply from the DNS server to any inside client for the web server (web server IP = 192.168.100.1).
  E. The web server will be reachable only from the inside.
  F. The web server will be reachable only from the outside.
  B. The global IP address of the web server is 209.165.200.230.
  D. The Cisco ASA will translate the DNS A-Record reply from the DNS server to any inside client for the web server (web server IP = 192.168.100.1).

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/inspect_basic.html#wp 1350877

  When DNS inspection is enabled, DNS rewrite provides full support for NAT of DNS messages originating from any interface.

  If a client on an inside network requests DNS resolution of an inside address from a DNS server on an outside interface, the DNS A-record is translated correctly.

  If the DNS inspection engine is disabled, the A-record is not translated.

  As long as DNS inspection remains enabled, you can configure DNS rewrite using the alias, static, or nat commands.

  DNS Rewrite performs two functions:

  -Translating a public address (the routable or "mapped" address) in a DNS reply to a private address (the "real" address) when the DNS client is on a private interface.

  -Translating a private address to a public address when the DNS client is on the public interface.

• Question 60:

  When active/active failover is implemented on the Cisco ASA, how many failover groups are supported on the Cisco ASA?

  A. 1
  B. 2
  C. 1 failover group per configured security context
  D. 2 failover groups per configured security context
  B. 2

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808340 58.shtml#act1

  Active/Active Failover Overview Active/Active failover is only available to security appliances in multiple context mode. In an Active/Active failover configuration, both security appliances can pass network traffic. In Active/Active failover, you divide the security contexts on the security appliance into failover groups. A failover group is simply a logical group of one or more security contexts. You can create a maximum of two failover groups on the security appliance. The admin context is always a member of failover group 1. Any unassigned security contexts are also members of failover group 1 by default. The failover group forms the base unit for failover in Active/Active failover. Interface failure monitoring, failover, and active/standby status are all attributes of a failover group rather than the unit. When an active failover group fails, it changes to the standby state while the standby failover group becomes active. The interfaces in the failover group that becomes active assume the MAC and IP addresses of the interfaces in the failover group that failed. The interfaces in the failover group that is now in the standby state take over the standby MAC and IP addresses.

  Note: A failover group failing on a unit does not mean that the unit has failed. The unit may still have another failover group passing traffic on it.