Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 71:

  On which type of encrypted traffic can a Cisco ASA appliance running software version 8.4.1 perform application inspection and control?

  A. IPsec
  B. SSL
  C. IPsec or SSL
  D. Cisco Unified Communications
  E. Secure FTP
  D. Cisco Unified Communications

  ---

  http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns165/ns391/guide__c07- 494658.html

• Question 72:

  Refer to the exhibit.

  

  Which statement about the MPF configuration is true?

  A. Any non-RFC complaint FTP traffic will go through additional deep FTP packet inspections.
  B. FTP traffic must conform to the FTP RFC, and the FTP connection will be dropped if the PUT command is used.
  C. Deep FTP packet inspections will be performed on all TCP inbound and outbound traffic on the outside interface.
  D. The ftp-pm policy-map type should be type inspect.
  E. Due to a configuration error, all FTP connections through the outside interface will not be permitted.
  B. FTP traffic must conform to the FTP RFC, and the FTP connection will be dropped if the PUT command is used.

• Question 73:

  Refer to the exhibit.

  

  What is the resulting CLI command?

  A. match request uri regex _default_GoToMyPC-tunnel drop-connection log
  B. match regex _default_GoToMyPC-tunnel drop-connection log
  C. class _default_GoToMyPC-tunnel drop-connection log
  D. match class-map _default_GoToMyPC-tunnel drop-connection log
  C. class _default_GoToMyPC-tunnel drop-connection log

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/inspect_basic.html Step 6 To apply actions to matching traffic, perform the following steps. a. Specify the traffic on which you want to perform actions using one of the following methods:

  Specify the DNS class map that you created in Step 3 by entering the following command:

  hostname(config-pmap)# class class_map_name

  hostname(config-pmap-c)#

  Specify traffic directly in the policy map using one of the match commands described in Step 3. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

  b. Specify the action you want to perform on the matching traffic by entering the following command:

  hostname(config-pmap-c)# {[drop [send-protocol-error] | drop-connection [send-protocol-error]| mask | reset] [log] | rate-limit message_rate}

  Not all options are available for each match or class command. See the CLI help or the Cisco ASA 5500 Series Command Reference for the exact options available.

  The drop keyword drops all packets that match.

  The send-protocol-error keyword sends a protocol error message. The drop-connection keyword drops the packet and closes the connection. The mask keyword masks out the matching portion of the packet. The reset keyword drops the

  packet, closes the connection, and sends a TCP reset to the server and/or client.

  The log keyword, which you can use alone or with one of the other keywords, sends a system log message

  The rate-limit message_rate argument limits the rate of messages.

• Question 74:

  Click and drag the supported ASA QoS option on the left to the correct description on the right. (Some of the options on the left are not used)

  Select and Place:

  

  

• Question 75:

  Which three configurations are needed to enable SNMPv3 support on the Cisco ASA? (Choose three.)

  A. SNMPv3 Local EngineID
  B. SNMPv3 Remote EngineID
  C. SNMP Users
  D. SNMP Groups
  E. SNMP Community Strings
  F. SNMP Hosts
  C. SNMP Users
  D. SNMP Groups
  F. SNMP Hosts

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/snmp/snmpv3_1.html The adaptive security appliance requires that you configure the SNMP server group, the SNMP server user associated with the group, and the SNMP server host, which specifies the user for receiving SNMP traps.

  To configure SNMP Version 3 operations, the required sequence of commands is as follows:

  

  Snmp-server

  group

  

  Snmp-server

  user

  

  Snmp-server

  host

  The following shows an example adaptive security appliance configuration:

  hostname# snmp-server group authPriv v3 priv hostname# snmp-server group authNoPriv v3 auth hostname# snmp-server group noAuthNoPriv v3 noauth

• Question 76:

  Refer to the exhibit.

  

  What does the * next to the CTX security context indicate?

  A. The CTX context is the active context on the Cisco ASA.
  B. The CTX context is the standby context on the Cisco ASA.
  C. The CTX context contains the system configurations.
  D. The CTX context has the admin role.
  D. The CTX context has the admin role.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa70/configuration/guide/mngcntxt.html#wp110 Context Configurations The security appliance includes a configuration for each context that identifies the security policy, interfaces, and almost all the options you can configure on a standalone device. You can store context configurations on the internal Flash memory or the external Flash memory card, or you can download them from a TFTP, FTP, or HTTP(S) server.

  System Configuration The system administrator adds and manages contexts by configuring each context configuration location, allocated interfaces, and other context operating parameters in the system configuration, which, like a single mode configuration, is the startup configuration. The system configuration identifies basic settings for the security appliance. The system configuration does not include any network interfaces or network settings for itself; rather, when the system needs to access network resources (such as downloading the contexts from the server), it uses one of the contexts that is designated as the admin context. The system configuration does include a specialized failover interface for failover traffic only.

  Admin Context Configuration The admin context is just like any other context, except that when a user logs in to the admin context, then that user has system administrator rights and can access the system and all other contexts. The admin context is not restricted in any way, and can be used as a regular context.

  However, because logging into the admin context grants you administrator privileges over all contexts, you might need to restrict access to the admin context to appropriate users. The admin context must reside on Flash memory, and not remotely.

  If your system is already in multiple context mode, or if you convert from single mode, the admin context is created automatically as a file on the internal Flash memory called admin.cfg. This context is named "admin." If you do not want to use admin.cfg as the admin context, you can change the admin context.

• Question 77:

  Scenario: To access Cisco ASDM, click the PC icon in the Topology window, ASDM and answer the following question as:

  

  

  The Cisco ASA administration must enable the Cisco ASA to automatically drop suspicious botnet traffic. After the Cisco ASA administrator entered the initial configuration, the Cisco ASA is not automatically dropping the suspicious botnet traffic.

  What else must be enabled in order to make it work?

  A. DNS snooping
  B. Botnet traffic filtering on atleast one of the Cisco ASA interface.
  C. Periodic download of the dynamic botnet database from Cisco.
  D. DNS inspection in the global policy.
  E. Manual botnet black and white lists.
  A. DNS snooping

  ---

  Just check all the following settings - certain they will change from time to time

  

  

• Question 78:

  Which option lists the main tasks in the correct order to configure a new Layer 3 and 4 inspection policy on the Cisco ASA appliance using the Cisco ASDM Configuration > Firewall > Service Policy Rules pane?

  A. 1. Create a class map to identify which traffic to match. 2. Create a policy map and apply action(s) to the traffic class(es). 3. Apply the policy map to an interface or globally using a service policy.
  B. 1. Create a service policy rule. 2. Identify which traffic to match. 3. Apply action(s) to the traffic.
  C. 1. Create a Layer 3 and 4 type inspect policy map. 2. Create class map(s) within the policy map to identify which traffic to match. 3. Apply the policy map to an interface or globally using a service policy.
  D. 1. Identify which traffic to match. 2. Apply action(s) to the traffic. 3. Create a policy map. 4. Apply the policy map to an interface or globally using a service policy.
  B. 1. Create a service policy rule. 2. Identify which traffic to match. 3. Apply action(s) to the traffic.

  ---

  http://www.cisco.com/en/US/docs/security/asdm/6_2/user/guide/inspctrl.html#wpxref87867

  Choose Configuration > Firewall > Service Policy Rules. Add or edit a service policy rule click the Protocol Inspection tab In the Edit Service Policy Rule > Rule Actions dialog box, Select each inspection type that you want to apply. You can predefine inspect maps in the Configuration > Firewall > Objects > Inspect Maps pane

• Question 79:

  When troubleshooting a Cisco ASA that is operating in multiple context mode, which two verification steps should be performed if a user context does not pass user traffic? (Choose two.)

  A. Verify the interface status in the system execution space.
  B. Verify the mac-address-table on the Cisco ASA.
  C. Verify that unique MAC addresses are configured if the contexts are using nonshared interfaces.
  D. Verify the interface status in the user context.
  E. Verify the resource classes configuration by accessing the admin context.
  A. Verify the interface status in the system execution space.
  D. Verify the interface status in the user context.

  ---

  http://www.ciscopress.com/articles/article.asp?p=426641

  Packet Flow in Multiple Mode When the packets traverse through the security appliance in multiple mode, they are classified and forwarded to the right context.

  The packets are then processed based on the configured security policies on a context.

  T Packet Classification In multiple mode, the security appliance must classify the packets to find out which context should operate on them. The packet classification is done at the ingress interface point that tags the packets using the source IP address, source port, destination IP address, destination port, and the interface or VLAN. The packet is processed based on the security policies configured in that context.

  That said we need to note also that:

  System Configuration The system administrator adds and manages contexts by configuring each context configuration location, allocated interfaces, and other context operating parameters in the system configuration, which, like a single mode configuration, is the startup configuration. The system configuration identifies basic settings for the security appliance. The system configuration does not include any network interfaces or network settings for itself; rather, when the system needs to access network resources (such as downloading the contexts from the server), it uses one of the contexts that is designated as the admin context. The system configuration does include a specialized failover interface for failover traffic only.

  Context Configurations The security appliance includes a configuration for each context that identifies the security policy, interfaces, and almost all the options you can configure on a standalone device. You can store context configurations on the internal Flash memory or the external Flash memory card, or you can download them from a TFTP, FTP, or HTTP(S) server.

• Question 80:

  Which Cisco ASA configuration is used to configure the TCP intercept feature?

  A. a TCP map
  B. an access list
  C. the established command
  D. the set connection command with the embryonic-conn-max option
  E. a type inspect policy map
  D. the set connection command with the embryonic-conn-max option

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_connlimits.html #wp1080734