Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 101:

  Which Cisco IPS appliance feature uses profile-based intrusion detection?

  A. profiler
  B. anomaly detection
  C. threat detection
  D. netflow
  E. reputation filter
  F. senderbase
  B. anomaly detection

• Question 102:

  What must be configured to enable Cisco IPS appliance reputation filtering and global correlation?

  A. DNS server(s) IP address
  B. full sensor based network participation
  C. trusted hosts settings D. external product interfaces settings
  A. DNS server(s) IP address

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/ime/ime_collaboration.html

  Global Correlation Requirements

  Global correlation has the following requirements:

  稸alid license

  You must have a valid sensor license for global correlation features to function. You can still configure and display statistics for the global correlation features, but the global correlation databases are cleared and no updates are attempted.

  Once you install a valid license, the global correlation features are reactivated.

  稟gree to network participation disclaimer

  稥xternal connectivity for sensor and a DNS server

  The global correlation features of IPS 7.0 require the sensor to connect to the Cisco SensorBase Network.

  Domain name resolution is also required for these features to function. You can either configure the sensor to connect through an HTTP proxy server that has a DNS client running on it, or you can assign an Internet routable address to the

  management interface of the sensor and configure the sensor to use a DNS server. In IPS 7.0 the HTTP proxy and DNS servers are used only by the global correlation features.

• Question 103:

  What will happen if you try to recover the password on the Cisco IPS 4200 Series appliance on which password recovery is disabled?

  A. The GRUB menu will be disabled.
  B. The ROM monitor command to reset the password will be disabled.
  C. The password recovery process will proceed with no errors or warnings; however, the password is not reset.
  D. The Cisco IPS appliance will reboot immediately.
  C. The password recovery process will proceed with no errors or warnings; however, the password is not reset.

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_troubleshooting.html# wp1139544

  If you try to recover the password on a sensor on which password recovery is disabled, the process proceeds with no errors or warnings; however, the password is not reset. If you cannot log in to the sensor because you have forgotten the

  password, and password recovery is set to disabled, you must reimage your sensor.

  You have the ability to disable password recovery if required (it is enabled by default). Follow these steps to disable password recovery from the CLI:

  Step 1. Log in to the CLI using administrative privileges. Step 2. Enter global configuration mode followed by host mode:

  sensor# configure terminal

  sensor(config)# service host

  Step 3. Disable password recovery:

  sensor(config-host)# password-recovery disallowed

  Note: If an admin/user tries to recover the password on a sensor that is disabled, the process proceeds with no errors or warnings; however, the password is not reset. Follow these steps to disable password recovery from the Cisco IDM:

  Step 1. Log in to the Cisco IDM using administrative privileges. Step 2. Navigate to Configuration > Sensor Setup > Network. Step 3. Disable password recovery by deselecting the Allow Password Recovery check box.

• Question 104:

  Refer to the exhibit. What happens when you click the Cisco Security MARS icon on the Cisco Security MARS query result screen?

  

  A. Cross-launch Cisco Security Manager to link the Cisco Security MARS event back to the IPS signature and policy within the Cisco Security Manager that triggered it.
  B. Cross-launch Cisco IDM so the signature that triggered it can be examined.
  C. Cross-launch Cisco IDM to show the corresponding IPS alerts.
  D. Cross-launch Cisco Security Manager to show the corresponding IPS alerts.
  E. Cross-launch Cisco IME so the signature that triggered it can be examined.
  A. Cross-launch Cisco Security Manager to link the Cisco Security MARS event back to the IPS signature and policy within the Cisco Security Manager that triggered it.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5739/ps6241/product_data_sheet0900aec d80272e64.html

  Cisco Security MARS integrates tightly with Cisco's premier security management suite, Cisco Security Manager. This integration maps traffic-related syslog messages to the firewall policies defined in Cisco Security Manager that triggered the event. Policy lookup enables rapid, round-trip analysis for troubleshooting firewall-configuration-related network issues, policy configuration errors, and fine-tuning defined policies.

  http://www.cisco.com/en/US/docs/security/security_management/cs- mars/4.3/user/guide/local_controller/cfgcsm.html

• Question 105:

  Regarding the Cisco IPS appliance anomaly detection feature, which two of these would be considered scan events? (Choose two.)

  A. an unacknowledged TCP SYN
  B. an online dictionary password attack
  C. exhaustive directory tree traversal on an FTP server
  D. a scan of all TCP ports on a single destination IP address
  E. a unidirectional UDP session
  A. an unacknowledged TCP SYN
  E. a unidirectional UDP session

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_anomaly_detection.ht ml#wp1046814

• Question 106:

  Regarding the Cisco IPS NME, when should the heartbeat reset be disabled on the ISR?

  A. when performing an upgrade on the ISR
  B. when the NME is used in inline mode
  C. when the NME is used in promiscuous mode
  D. when the NME is used in fail-open mode
  E. when the NME is used in fail-closed open mode
  F. when performing an upgrade on the NME
  F. when performing an upgrade on the NME

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_images.html

• Question 107:

  A Cisco Catalyst switch is experiencing packet drops on a SPAN destination port that is connected to an Cisco IPS appliance. Which three configurations should be considered to resolve the packet drops issue? (Choose three.)

  A. Configure an additional SPAN session to a different Cisco IPS appliance interface connected to the same virtual sensor
  B. Configure an EtherChannel bundle as the SPAN destination port.
  C. Configure RSPAN.
  D. Configure VACL capture.
  E. Configure the Cisco IPS appliance to inline mode.
  A. Configure an additional SPAN session to a different Cisco IPS appliance interface connected to the same virtual sensor
  D. Configure VACL capture.
  E. Configure the Cisco IPS appliance to inline mode.

  ---

  From Neil: A, D, E

  A. Adding an additional span session to a different Cisco IPS will remove some of the traffic and load from the existing span - Confirmed Correct

  B. Cisco documentation clearly defines that Ether-channels cannot be configured as SPAN destination ports.

  This rules out option B. - Confirmed Incorrect

  http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/config uration/guide/swspan.html#wp1044603

  C. RSPAN is remote span which is used to send traffic to a device not connected to the local switch.

  While this would have a similar effect to answer A since you are in fact creating another span, the implication here is that there is only one IPS device. - Unconfirmed Incorrect D. Configuring VACL capture will allow a reduced amount of traffic

  and load on the span by selecting and sending only select traffic over the SPAN to the IPS. - Confirmed Correct E. Configuring the Cisco IPS appliance in inline mode would eliminate the need for a span altogether. -Unconfirmed Correct.

  Cisco ASA IPS Modules--Inline Operation

  You can configure the ASA to only forward specific traffic to the AIP SSM or AIP SSC for inspection. This is achieved by using the Cisco Modular Policy Framework (MPF), where you can configure a Cisco ASA to selectively send traffic to the

  AIP module operating in inline or promiscuous mode. You can also specify that all traffic be inspected by the AIP module, and if the total traffic exceeds the IPS module inspection capacity, you can modify the MPF configuration in such a way

  that only critical traffic is inspected.

  This approach reduces the traffic the IPS module will have to analyze, and it is guaranteed to perform optimally.

  Cisco ASA IPS Modules--Promiscuous Operation

  A selective capture can also be used to ensure that only part of the traffic flowing through a Cisco ASA is sent to the AIP module in promiscuous mode. This way, the AIP module is not overwhelmed and critical data is analyzed.

  The same concept applies when using the Cisco IPS Advanced Integration Module (AIM):

  When inline or in promiscuous mode, select traffic can be directed to it.

  Cisco Catalyst Switches--VACL Capture

  When an IPS is connected to a Cisco Catalyst switch, you can perform selective capture by setting the appropriate VLAN access control lists (VACL). The VACLs capture only a subset of traffic off the switch backplane and copy it to the

  sensor that is connected on a capture port, instead of a SPAN port. The sensor in this case only receives a copy of the packets that are suitable for analysis and completely ignores the rest of the traffic.

  Performance issues and bottlenecks should be avoided by sizing the IPS sensors adequately and ensuring that the network topology design is a good fit.

• Question 108:

  Which three statements about the Cisco IPS appliance anomaly detection feature are true? (Choose three.)

  A. The scanner threshold is used to detect a single scanner.
  B. Once the multiple scanners alert is triggered, the learning period will begin.
  C. The histogram is used to detect multiple scanners.
  D. Once a scanner threshold is violated, an alert is triggered for the multiple scanner signature.
  E. The illegal zone should contain non-allocated internal IP addresses.
  F. The traffic anomaly signature engine contains only two anomaly detection signatures (signature ID 13000 and 13001).
  A. The scanner threshold is used to detect a single scanner.
  C. The histogram is used to detect multiple scanners.
  E. The illegal zone should contain non-allocated internal IP addresses.

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/3.1/user/guide/ipsvchap.html

  And

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/ product_data_sheet0900aecd805baef2.html

  

• Question 109:

  Which two Cisco IPS modules support sensor virtualization? (Choose two.)

  A. AIP-SSM
  B. AIP-SSC
  C. IPS AIM
  D. IPS NME
  E. IDSM-2
  A. AIP-SSM
  E. IDSM-2

  ---

  http://my.safaribooksonline.com/book/certification/ccnp/9780132372107/using-cisco-ips-virtual- sensors/ch20lev1sec5

• Question 110:

  Which Cisco IPS appliance signature engine uses signature events as input to correlate different signatures into a higher level event?

  A. Atomic signature engine
  B. Service signature engine
  C. Meta signature engine
  D. Sweep signature engine
  E. Multistring signature engine
  F. Normalizer signature engine
  C. Meta signature engine

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_engines.ht ml#wp1014660