Cisco 642-618 Online Practice Questions and Exam Preparation

Cisco 642-618 Online Questions & Answers

• Question 81:

  Refer to the exhibit.

  

  Which traffic is permitted on the inside interface without any interface ACLs configured?

  A. any IP traffic input to the inside interface
  B. any IP traffic input to the inside interface destined to any lower security level interfaces
  C. only HTTP traffic input to the inside interface
  D. only HTTP traffic output from the inside interface
  E. No input traffic is permitted on the inside interface.
  F. No output traffic is permitted on the inside interface.
  C. only HTTP traffic input to the inside interface

• Question 82:

  Refer to the exhibit.

  

  Which two functions will the Set ASDM Defined User Roles perform? (Choose two.)

  A. enables role based privilege levels to most Cisco ASA commands
  B. enables the Cisco ASDM user to assign privilege levels manually to individual commands or groups of commands
  C. enables command authorization with a remote TACACS+ server
  D. enables three predefined user account privileges (Admin=Priv 15, Read Only=Priv 5, Monitor Only=Priv 3)
  A. enables role based privilege levels to most Cisco ASA commands
  D. enables three predefined user account privileges (Admin=Priv 15, Read Only=Priv 5, Monitor Only=Priv 3)

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/user/guide/devaccss.html -To use predefined user account privileges, click Set ASDM Defined User Roles. The ASDM Defined User Roles Setup dialog box shows the commands and their levels. Click Yes to use the predefined user account privileges: Admin (privilege level 15, with full access to all CLI commands; Read Only (privilege level 5, with read-only access); and Monitor Only (privilege level 3, with access to the Monitoring section only). -To manually configure command levels, click the Configure Command Privileges button. The Command Privileges Setup dialog box appears. You can view all commands by choosing --All Modes-- from the Command Mode drop-down list, or you can choose a configuration mode to view the commands available in that mode. For example, if you choose context, you can view all commands available in context configuration mode. If a command can be entered in user EXEC/privileged EXEC mode as well as configuration mode, and the command performs different actions in each mode, you can set the privilege level for these modes separately. The Variant column displays show, clear, or cmd. You can set the privilege only for the show, clear, or configure form of the command. The configure form of the command is typically the form that causes a configuration change, either as the unmodified command (without the show or clear prefix) or as the no form.

  To change the level of a command, double-click it or click Edit. You can set the level between 0 and 15. You can only configure the privilege level of the main command. For example, you can configure the level of all aaa commands, but not the level of the aaa authentication command and the aaa authorization command separately.

  To change the level of all shown commands, click Select All and then Edit. Click OK to accept your changes.

• Question 83:

  Which statement about the Cisco ASA 5505 configuration is true?

  A. The IP address is configured under the physical interface (ethernet 0/0 to ethernet 0/7).
  B. With the default factory configuration, the management interface (management 0/0) is configured with the 192.168.1.1/24 IP address.
  C. With the default factory configuration, Cisco ASDM access is not enabled.
  D. The switchport access vlan command can be used to assign the VLAN to each physical interface (ethernet 0/0 to ethernet 0/7).
  E. With the default factory configuration, both the inside and outside interface will use DHCP to acquire its IP address.
  D. The switchport access vlan command can be used to assign the VLAN to each physical interface (ethernet 0/0 to ethernet 0/7).

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/interface_start_5505.ht ml

  

• Question 84:

  Refer to the exhibit.

  

  -Context C:

  static (inside,shared) 10.30.10.0 10.30.10.0 netmask 255.255.255.0

  Which two CLI commands result from this configuration? (Choose two.)

  A. aaa authorization network LOCAL
  B. aaa authorization network default authentication-server LOCAL
  C. aaa authorization command LOCAL
  D. aaa authorization exec LOCAL
  E. aaa authorization exec authentication-server LOCAL
  F. aaa authorization exec authentication-server
  C. aaa authorization command LOCAL
  D. aaa authorization exec LOCAL

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/access_management.ht ml#wp1145888

• Question 85:

  Which statement about the Cisco ASA botnet traffic filter is true?

  A. The four threat levels are low, moderate, high, and very high.
  B. By default, the dynamic-filter drop blacklist interface outside command drops traffic with a threat level of high or very high.
  C. Static blacklist entries always have a very high threat level.
  D. A static or dynamic blacklist entry always takes precedence over the static whitelist entry.
  C. Static blacklist entries always have a very high threat level.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_botnet.html

  Information About the Static Database You can manually enter domain names or IP addresses (host or subnet) that you want to tag as bad names in a blacklist. Static blacklist entries are always designated with a Very High threat level. You can also enter names or IP addresses in a whitelist, so that names or addresses that appear on both the dynamic blacklist and the whitelist are identified only as whitelist addresses in syslog messages and reports. Note that you see syslog messages for whitelisted addresses even if the address is not also in the dynamic blacklist.

• Question 86:

  Which statement about Cisco ASA multicast routing support is true?

  A. The Cisco ASA appliance supports PIM dense mode, sparse mode, and BIDIR-PIM.
  B. The Cisco ASA appliance supports only stub multicast routing by forwarding IGMP messages from multicast receivers to the upstream multicast router.
  C. The Cisco ASA appliance supports DVMRP and PIM.
  D. The Cisco ASA appliance supports either stub multicast routing or PIM, but both cannot be enabled at the same time.
  E. The Cisco ASA appliance supports only IGMP v1.
  D. The Cisco ASA appliance supports either stub multicast routing or PIM, but both cannot be enabled at the same time.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_multicast.html# wp1060775

  Multicast routing is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of corporate recipients and homes. Applications that take advantage of multicast routing include videoconferencing, corporate communications, distance learning, and distribution of software, stock quotes, and news. Multicast routing protocols delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers while using the least network bandwidth of any competing technology. Multicast packets are replicated in the network by Cisco routers enabled with Protocol Independent Multicast (PIM) and other supporting multicast protocols resulting in the most efficient delivery of data to multiple receivers possible. The ASA supports both stub multicast routing and PIM multicast routing. However, you cannot configure both concurrently on a single ASA.

• Question 87:

  When the Cisco ASA detects scanning attacks, how long is the attacker who is performing the scan shunned?

  

  A. 120 seconds
  B. 600 seconds
  C. 1200 seconds
  D. 3600 seconds
  E. 6000 seconds
  B. 600 seconds

  ---

  

• Question 88:

  In which type of environment is the Cisco ASA MPF set connection advanced-options tcp- statebypass option the most useful?

  A. SIP proxy
  B. WCCP
  C. BGP peering through the Cisco ASA
  D. asymmetric traffic flow
  E. transparent firewall
  D. asymmetric traffic flow

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.html

• Question 89:

  Based on this NAT command, drag the IP address network on the left to the correct NAT address type on the right.

  Nat(inside, outside) source dynamic 10.0.1.0_obj 192.168.1.7_obj destination static 209.165.200.226_Server 209.265.201.21_Server

  Select and Place:

  

  

• Question 90:

  Refer to the exhibit.

  

  Which reason explains why the Cisco ASA appliance cannot establish an authenticated NTP session to the inside 192.168.1.1 NTP server?

  A. The ntp server 192.168.1.1 command is incomplete.
  B. The ntp source inside command is missing.
  C. The ntp access-group peer command and the ACL to permit 192.168.1.1 are missing.
  D. The trusted-key number should be 1 not 2.
  A. The ntp server 192.168.1.1 command is incomplete.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/basic.html#wp106776 hostname(config)# ntp server ip_address [key key_id] [source interface_name][prefer] ntp server 192.168.1.1 2