Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 1:

  DRAG DROP

  Select and Place:

  

  

• Question 2:

  What is the maximum number of virtual sensors that a Cisco IPS 4200 Series appliance can support?

  A. depends on the Cisco IPS 4200 Series appliance model
  B. 2
  C. 3
  D. 4
  E. 5
  F. 6
  D. 4

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_virtual_sensors.html# wp1035356 It states you can create four virtual sensors.

• Question 3:

  Which two are the functions of the learning feature of anomaly detection within a Cisco IPS appliance? (Choose two.)

  A. observes actual traffic patterns to the zones
  B. retrieves zero-day attack information from the Cisco SIO
  C. dynamically populates the host operating system database
  D. allows false-positive training by an IPS administrator
  E. builds the host reputation histogram
  F. learns which legitimate services have a scanning behavior
  A. observes actual traffic patterns to the zones
  F. learns which legitimate services have a scanning behavior

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_anomaly_detection.ht ml#wp1046814

• Question 4:

  What are the three valid options for configuring Cisco SensorBase participation? (Choose three.)

  A. off
  B. test
  C. manual
  D. automatic
  E. partial
  F. full
  A. off
  E. partial
  F. full

• Question 5:

  Which IPS alert action is available only in inline mode?

  A. produce verbose alert
  B. request rate limit
  C. reset TCP connection
  D. log attacker/victim pair packets
  E. deny-packet-inline
  F. request block connection
  E. deny-packet-inline

  ---

  http://www.cisco.com/web/about/security/intelligence/ipsmit.html

  Inline Mode Event Actions

  The following actions require the device to be deployed in Inline mode and are in affect for a user- configurable default time of 3600 seconds (60 minutes). Deny attacker inline: This action is the most severe and effectively blocks all

  communication from the attacking host that passes through the IPS for a specified period of time. Because this event action is severe, administrators are advised to use this only when the probability of false alarms or spoofing is minimal.

  Deny attacker service pair inline: This action prevents communication between the attacker IP address and the protected network on the port in which the event was detected. However, the attacker would be able to communicate on another

  port that has hosts on the protected network. This event action works well for worms that attack many hosts on the same service port. If an attack occurred on the same host but on another port, this communication would be allowed. This

  event action is appropriate when the likelihood of a false alarm or spoofing is minimal. Deny attacker victim pair inline: This action prevents the attacker from communicating with the victim on any port. However, the attacker could

  communicate with other hosts, making this action better suited for exploits that target a specific host. This event action is appropriate when the likelihood of a false alarm or spoofing is minimal.

  Deny connection inline: This action prevents further communication for the specific TCP flow. This action is appropriate when there is the potential for a false alarm or spoofing and when an administrator wants to prevent the action but not

  deny further communication. Deny packet inline: This action prevents the specific offending packet from reaching its intended destination.

  Other communication between the attacker and victim or victim network may still exist. This action is appropriate when there is the potential for a false alarm or spoofing. Note that for this action, the default time has no effect.

  Modify packet inline: This action enables the IPS device to modify the offending part of the packet. However, it forwards the modified packet to the destination. This action is appropriate for packet normalization and other anomalies, such as

  TCP segmentation and IP fragmentation re-ordering.

• Question 6:

  Which two statements are true with respect to the AIP-SSM? (Choose two.)

  A. The hosting ASA will always bypass the AIP-SSM if the AIP-SSM fails.
  B. The AIP-SSM supports up to four virtual sensors.
  C. Initial setup of the AIP-SSM is configured through its external console port.
  D. The AIP-SSM supports both promiscuous and inline analysis.
  E. The AIP-SSM must be managed by the IPS Device Manager.
  B. The AIP-SSM supports up to four virtual sensors.
  D. The AIP-SSM supports both promiscuous and inline analysis.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/ssm.html

• Question 7:

  When setting up a Cisco IPS appliance in promiscuous mode, which Cisco Catalyst switch CLI command is used to configure SPAN on the switch?

  A. span source in interface configuration mode
  B. span session in global configuration mode
  C. monitor destination in interface configuration mode
  D. monitor session in global configuration mode
  E. mirror session in global configuration mode
  D. monitor session in global configuration mode

  ---

  http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612. shtml

• Question 8:

  What is the maximum number of virtual sensors that can be configured on a Cisco IPS 4260 Sensor appliance?

  A. 2
  B. 4
  C. 6
  D. 8
  E. 16
  F. There is no fixed limit.
  B. 4

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_virtual_sensors.html# wp1035356 It states you can create four virtual sensors.

• Question 9:

  Which two are valid examples of String engines? (Choose two.)

  A. String HTTP
  B. String FTP
  C. String TCP
  D. String UDP
  E. String Trojan
  F. String IP
  C. String TCP
  D. String UDP

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/idm/dmSigEng.html#wp1048

  

• Question 10:

  Which configuration is required when setting up the initial configuration on the Cisco ASA 5505 to support the Cisco ASA AIP-SSC?

  A. Configure a VLAN interface as a management interface to access the Cisco ASA AIP-SSC.
  B. Using MPF, configure which virtual sensor to use.
  C. Configure a management access rule to allow Cisco ASDM access from the Cisco ASA AIP- SSC management interface IP address.
  D. Configure a management access rule to allow SSH access from the Cisco ASA AIP-SSC management interface IP address.
  A. Configure a VLAN interface as a management interface to access the Cisco ASA AIP-SSC.

  ---

  http://www.cisco.com/en/US/docs/security/asa/quick_start/ips/ips_qsg.html

  2 Connecting Management Interface Cables

  稟SA 5505--The ASA 5505 does not have a dedicated management interface. You must use an ASA VLAN to access an internal management IP address over the backplane. Connect the management PC to one of the following ports:

  Ethernet 0/1 through 0/7. These ports are assigned to VLAN 1 using the 192.168.1.1/24 address. The internal IPS management address is 192.168.1.2/24.