Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 61:

  When enabling a Cisco ASA to send syslog messages to a syslog server, which syslog level will produce the most messages?

  A. notifications
  B. informational
  C. alerts
  D. emergencies
  E. errors
  F. debugging
  F. debugging

• Question 62:

  By default, which access rule is applied inbound to the inside interface?

  A. All IP traffic is denied.
  B. All IP traffic is permitted.
  C. All IP traffic sourced from any source to any less secure network destinations is permitted.
  D. All IP traffic sourced from any source to any more secure network destinations is permitted
  C. All IP traffic sourced from any source to any less secure network destinations is permitted.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/access_rules.html#wp 1083496

  Implicit Permits

  For routed mode, the following types of traffic are allowed through by default:

  -IPv4 traffic from a higher security interface to a lower security interface.

  -IPv6 traffic from a higher security interface to a lower security interface. Note These defaults might not be true if you have configured a global access rule. For transparent mode, the following types of traffic are allowed through by default:

  -IPv4 traffic from a higher security interface to a lower security interface. -IPv6 traffic from a higher security interface to a lower security interface.

  -ARPs in both directions

• Question 63:

  The Cisco ASA is configured in multiple mode and the security contexts share the same outside physical interface.

  Which two packet classification methods can be used by the Cisco ASA to determine which security context to forward the incoming traffic from the outside interface? (Choose two.)

  A. unique interface IP address
  B. unique interface MAC address
  C. routing table lookup
  D. MAC address table lookup
  E. unique global mapped IP addresses
  B. unique interface MAC address
  E. unique global mapped IP addresses

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html

  Unique Interfaces

  If only one context is associated with the ingress interface, the ASA classifies the packet into that context. In transparent firewall mode, unique interfaces for contexts are required, so this method is used to classify packets at all times.

  Unique MAC Addresses

  If multiple contexts share an interface, then the classifier uses the interface MAC address. The ASA lets you assign a different MAC address in each context to the same shared interface, whether it is a shared physical interface or a shared

  subinterface. By default, shared interfaces do not have unique MAC addresses; the interface uses the physical interface burned-in MAC address in every context. An upstream router cannot route directly to a context without unique MAC

  addresses. You can set the MAC addresses manually when you configure each interface (see the "Configuring the MAC Address" section), or you can automatically generate MAC addresses (see the "Automatically Assigning MAC

  Addresses to Context Interfaces" section).

  NAT Configuration

  If you do not have unique MAC addresses, then the classifier intercepts the packet and performs a destination IP address lookup. All other fields are ignored; only the destination IP address is used. To use the destination address for

  classification, the classifier must have knowledge about the subnets located behind each security context. The classifier relies on the NAT configuration to determine the subnets in each context. The classifier matches the destination IP

  address to either a static command or a global command. In the case of the global command, the classifier does not need a matching nat command or an active NAT session to classify the packet. Whether the packet can communicate with

  the destination IP address after classification depends on how you configure NAT and NAT control.

  For example, the classifier gains knowledge about subnets 10.10.10.0, 10.20.10.0 and 10.30.10.0 when the context administrators configure static commands in

  each context:

  -Context A:

  static (inside,shared) 10.10.10.0 10.10.10.0 netmask 255.255.255.0

  -Context B:

  static (inside,shared) 10.20.10.0 10.20.10.0 netmask 255.255.255.0

• Question 64:

  Refer to the exhibit.

  

  Which statement about the policy map named test is true?

  A. Only HTTP inspection will be applied to the TCP port 21 traffic.
  B. Only FTP inspection will be applied to the TCP port 21 traffic.
  C. both HTTP and FTP inspections will be applied to the TCP port 21 traffic.
  D. No inspection will be applied to the TCP port 21 traffic, because the http class map configuration conflicts with the ftp class map.
  E. All FTP traffic will be denied, because the FTP traffic will fail the HTTP inspection.
  B. Only FTP inspection will be applied to the TCP port 21 traffic.

• Question 65:

  Which Cisco ASA CLI command is used to enable HTTPS (Cisco ASDM) access from any inside host on the 10.1.16.0/20 subnet?

  A. http 10.1.16.0 0.0.0.0 inside
  B. http 10.1.16.0 0.0.15.255 inside
  C. http 10.1.16.0 255.255.240.0 inside
  D. http 10.1.16.0 255.255.255.255
  C. http 10.1.16.0 255.255.240.0 inside

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/mgaccess.html#wp104 Allowing HTTPS Access for ASDM

  To use ASDM, you need to enable the HTTPS server, and allow HTTPS connections to the security appliance.

  All of these tasks are completed if you use the setup command. This section describes how to manually configure ASDM access.

  The security appliance allows a maximum of 5 concurrent ASDM instances per context, if available, with a maximum of 32 ASDM instances between all contexts.

  Note WebVPN and ASDM administration cannot be enabled on the same interface. If you enable WebVPN on an interface, then that interface cannot be used for ASDM.

  To configure ASDM access, follow these steps:

  Step 1 To identify the IP addresses from which the security appliance accepts HTTPS connections, enter the following command for each address or subnet:

  hostname(config)# http source_IP_address mask source_interface

  Step 2 To enable the HTTPS server, enter the following command:

  hostname(config)# http server enable

• Question 66:

  Which Cisco ASA feature enables the ASA to do these two things?

  1) Act as a proxy for the server and generate a SYN-ACK response to the client SYN request.

  2) When the Cisco ASA receives an ACK back from the client, the Cisco ASA authenticates the client and allows the connection to the server.

  A. TCP normalizer
  B. TCP state bypass
  C. TCP intercept
  D. basic threat detection
  E. advanced threat detection
  F. botnet traffic filter
  C. TCP intercept

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_connlimits.html #wp1080734

  TCP Intercept and Limiting Embryonic Connections Limiting the number of embryonic connections protects you from a DoS attack. The ASA uses the per-client limits and the embryonic connection limit to trigger TCP Intercept, which protects inside systems from a DoS attack perpetrated by flooding an interface with TCP SYN packets. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. TCP Intercept uses the SYN cookies algorithm to prevent TCP SYN-flooding attacks. A SYN-flooding attack consists of a series of SYN packets usually originating from spoofed IP addresses. The constant flood of SYN packets keeps the server SYN queue full, which prevents it from servicing connection requests.

  When the embryonic connection threshold of a connection is crossed, the ASA acts as a proxy for the server and generates a SYN-ACK response to the client SYN request. When the ASA receives an ACK back from the client, it can then authenticate the client and allow the connection to the server.

• Question 67:

  On Cisco ASA Software Version 8.4.1 and later, when you configure the Cisco ASA appliance in transparent firewall mode, how is the Cisco ASA management IP address configured?

  A. using the IP address global configuration command
  B. using the IP address GigabitEthernet 0/x interface configuration command
  C. using the IP address BVI x interface configuration command
  D. using the bridge-group global configuration command
  E. using the bridge-group GigabitEthernet 0/x interface configuration command
  F. using the bridge-group BVI x interface configuration command
  C. using the IP address BVI x interface configuration command

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/i3.html#wp1898863

  

• Question 68:

  Refer to the exhibit.

  

  Which two configurations are required on the Cisco ASAs so that the return traffic from the 10.10.10.100 outside server back to the 10.20.10.100 inside client can be rerouted from the Active Ctx B context in ASA Two to the Active Ctx A context in ASA One? (Choose two.)

  A. stateful active/active failover
  B. dynamic routing (EIGRP or OSPF or RIP)
  C. ASR-group
  D. no NAT-control
  E. policy-based routing
  F. TCP/UDP connections replication
  A. stateful active/active failover
  C. ASR-group

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_active.html

  Configuring Support for Asymmetrically Routed Packets When running in Active/Active failover, a unit may receive a return packet for a connection that originated through its peer unit. Because the ASA that receives the packet does not have any connection information for the packet, the packet is dropped. This most commonly occurs when the two ASAs in an Active/Active failover pair are connected to different service providers and the outbound connection does not use a NAT address.

  You can prevent the return packets from being dropped using the asr-group command on interfaces where this is likely to occur. When an interface configured with the asr-group command receives a packet for which it has no session information, it checks the session information for the other interfaces that are in the same group. If it does not find a match, the packet is dropped. If it finds a match, then one of the following actions occurs:

  -If the incoming traffic originated on a peer unit, some or all of the layer 2 header is rewritten and the packet is redirected to the other unit. This redirection continues as long as the session is active. -If the incoming traffic originated on a different interface on the same unit, some or all of the layer 2 header is rewritten and the packet is reinjected into the stream.

• Question 69:

  Which command option/keyword in Cisco ASA 8.3 NAT configurations makes the NAT policy interface independent?

  A. interface
  B. all
  C. auto
  D. global
  E. any
  E. any

  ---

  http://tunnelsup.com/2011/06/24/nat-for-cisco-asas-version-8-3/ Using the "any" interface in the NAT statement

  ASA 8.3 introduces the "any" interface when configuring NAT. For instance if you have a system on the DMZ that you wish to NAT not only to the outside interface, but to any interface you can use this command: object network dmzwebserver host 192.168.1.23 nat (dmz,any) static 209.165.201.28 This makes it so users on the inside can web to 209.165.201.28 and if traffic is routed to the firewall it will NAT it to the real IP in the DMZ.

• Question 70:

  Refer to the exhibit.

  

  Which additional Cisco ASA Software Version 8.3 NAT configuration is needed to meet the following requirements?

  When any host in the 192.168.1.0/24 subnet behind the inside interface accesses any destinations in the 10.10.1.0/24 subnet behind the outside interface, PAT them to the outside interface. Do not change the destination IP in the packet.

  A. nat (inside,outside) source static inside-net interface destination static outhosts outhosts
  B. nat (inside,outside) source dynamic inside-net interface destination static outhosts outhosts
  C. nat (outside,inside) source dynamic inside-net interface destination static outhosts outhosts
  D. nat (outside,inside) source static inside-net interface destination static outhosts outhosts
  E. nat (any, any) source dynamic inside-net interface destination static outhosts outhosts
  F. nat (any, any) source static inside-net interface destination static outhosts outhosts
  B. nat (inside,outside) source dynamic inside-net interface destination static outhosts outhosts