Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 91:

  DRAG DROP

  Select and Place:

  

  

• Question 92:

  DRAG DROP

  Select and Place:

  

  

• Question 93:

  DRAG DROP

  Select and Place:

  

  

• Question 94:

  Which Cisco IPS feature is most likely to respond to a zero-day attack?

  A. reputation filtering
  B. botnet filtering
  C. anomaly detection
  D. meta-engine
  E. de-obfuscation
  F. threat detection
  C. anomaly detection

  ---

  http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/anomaly_detector/v5.0/c onfiguration/guide/Intro.html#wp1046115

• Question 95:

  The AIP-SSC differs from the AIP-SSM in which three ways? (Choose three.)

  A. It uses the ASA backplane as its monitoring interface.
  B. It does not support fail open operation.
  C. It does not support global correlation.
  D. It does not support custom signatures.
  E. It supports only one virtual sensor.
  F. It does not support inline operation.
  C. It does not support global correlation.
  D. It does not support custom signatures.
  E. It supports only one virtual sensor.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/ product_data_sheet0900aecd80404916_ps6120_Products_Data_Sheet.html

• Question 96:

  DRAG DROP

  Select and Place:

  

  

• Question 97:

  Which protocol or protocols does the Cisco Security Manager use to communicate with the Cisco IPS appliance?

  A. HTTPS only
  B. SSH only
  C. SNMPv3 only
  D. HTTPS and SNMPv3
  E. HTTPS and SSH
  F. HTTPS, SSH, and SNMPv3
  A. HTTPS only

• Question 98:

  Refer to the exhibit. What does the Risk Threshold setting of 95 specify?

  

  A. the low risk rating threshold
  B. the low threat rating threshold
  C. the low target value rating threshold
  D. the high risk rating threshold
  E. the high threat rating threshold
  F. the high target value rating threshold
  D. the high risk rating threshold

  ---

  HIGHRISK = 90 - 100 - = Red Threat

• Question 99:

  Which four statements are true about the Cisco IPS global correlation and reputation filtering features? (Choose four.)

  A. Reputation filtering can adjust the risk rating of an alert.
  B. Reputation filtering can be set to permissive, standard, or aggressive.
  C. Global correlation can be trialed in with a test mode.
  D. Reputation filtering can drop packets from untrusted source IP addresses.
  E. Both global correlation and reputation filtering leverage Cisco SenderBase.
  F. Global correlation can adjust the risk rating of an alert.
  C. Global correlation can be trialed in with a test mode.
  D. Reputation filtering can drop packets from untrusted source IP addresses.
  E. Both global correlation and reputation filtering leverage Cisco SenderBase.
  F. Global correlation can adjust the risk rating of an alert.

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html# wp1056492

  Global Correlation Requirements Global correlation has the following requirements:稸alid license--You must have a valid sensor license for global correlation features to function. You can still configure and display statistics for the global correlation features, but the global correlation databases are cleared and no updates are attempted. Once you install a valid license, the global correlation features are reactivated.稟gree to Network Participation disclaimer稥xternal connectivity for sensor and a DNS server--The global correlation features of IPS 7.0 require the sensor to connect to the Cisco SensorBase Network. Domain name resolution is also required for these features to function. You can either configure the sensor to connect through an HTTP proxy server that has a DNS client running on it, or you can assign an Internet routeable address to the management interface of the sensor and configure the sensor to use a DNS server. In IPS 7.0 the HTTP proxy and DNS servers are used only by the global correlation features

• Question 100:

  Which two statements are true regarding the Cisco IPS appliance traffic normalizer? (Choose two.)

  A. It only operates in inline mode.
  B. It operates in one of three modes: symmetric, loose, or asymmetric.
  C. It can help prevent false negatives that are caused by evasions.
  D. It can help ensure that Layer 7 traffic conforms to its protocol specifications.
  E. It will not modify fragmented IP traffic.
  A. It only operates in inline mode.
  C. It can help prevent false negatives that are caused by evasions.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/white_paper_c11- 459025.html