Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 111:

  Which three are global correlation network participation modes? (Choose three.)

  A. off
  B. partial participation
  C. reputation filtering
  D. detect
  E. full participation
  F. learning
  A. off
  B. partial participation
  E. full participation

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html

• Question 112:

  Which three statements about the Cisco IPS appliance Event Store are true? (Choose three.)

  A. The Event Store is accessible through the CLI, Cisco IDM, Cisco ASDM, or SDEE.
  B. The Event Store is a circular, first-in first-out buffer.
  C. The Event Store can be configured to be located on a remote server.
  D. The size of the Event Store depends on the Cisco IPS appliance platform.
  E. Each virtual sensor has its own Event Store.
  F. If the Event Store is full, the Cisco IPS appliance performs an automatic graceful shutdown.
  A. The Event Store is accessible through the CLI, Cisco IDM, Cisco ASDM, or SDEE.
  B. The Event Store is a circular, first-in first-out buffer.
  D. The size of the Event Store depends on the Cisco IPS appliance platform.

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.ht ml

• Question 113:

  Which two configurations are required on the Cisco IPS appliance to allow Cisco Security Manager to log into the Cisco IPS appliance? (Choose two.)

  A. Enable SNMPv2.
  B. Enable SSH access.
  C. Enable TLS/SSL to allow HTTPS access.
  D. Enable NTP.
  E. Enable Telnet access.
  F. Enable the IP address of the Cisco Security Manager server as an allowed host.
  C. Enable TLS/SSL to allow HTTPS access.
  F. Enable the IP address of the Cisco Security Manager server as an allowed host.

  ---

  Explanation: : Obvious standard config but needs confirmation http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliTasks.html#wp1056053

• Question 114:

  The Cisco IPS sensor can obtain operating system identification data from which two sources? (Choose two.)

  A. passive operating system fingerprinting
  B. imported from Cisco SensorBase
  C. imported from Cisco Security MARS
  D. manual operating system mappings configured on the Cisco IPS appliance
  E. imported from Cisco Secure Desktop OS scan
  A. passive operating system fingerprinting
  D. manual operating system mappings configured on the Cisco IPS appliance

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_event_action_rules. html

• Question 115:

  Passive operating system fingerprinting can be used to determine which aspect of the event risk rating?

  A. target value rating
  B. watch list rating
  C. signature fidelity rating
  D. attack severity rating
  E. promiscuous delta
  F. attack relevancy rating
  F. attack relevancy rating

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd806e7299.html

• Question 116:

  From the Cisco IPS appliance CLI setup command, one of the options is "Modify default threat prevention settings? [no]". What is this option related to?

  A. anomaly detection
  B. threat rating adjustment
  C. event action override that denies high-risk network traffic with a risk rating of 90 to 100
  D. risk rating adjustment with global correlation
  E. reputation filters
  C. event action override that denies high-risk network traffic with a risk rating of 90 to 100

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.2/configuration/guide/cli/cli_initializing.html Modify default threat prevention settings?[no]: Step 11 Enter yes if you want to modify the default threat prevention settings.

  Note: The sensor comes with a built-in override to add the deny packet event action to high risk rating alerts. If you do not want this protection, disable automatic threat prevention.

• Question 117:

  What are four properties of an IPS signature? (Choose four.)

  A. reputation rating
  B. fidelity rating
  C. summarization strategy
  D. signature engine
  E. global correlation mode
  F. signature ID and signature status
  B. fidelity rating
  C. summarization strategy
  D. signature engine
  F. signature ID and signature status

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/3.1/user/guide/ipsvchap.html#wp1912551 Reputation and correaltion are NOT

• Question 118:

  DRAG DROP

  Select and Place:

  

  

• Question 119:

  DRAG DROP

  Select and Place:

  

  

• Question 120:

  Refer to the exhibit.

  

  Which statement is true?

  A. The Service HTTP engine is disabled.
  B. The Cisco IPS sensor will send an alert if an attacker makes more than 10 HTTP requests to a single target server.
  C. The IP logging feature has been disabled by setting the Max IP Log Packets and Max IP Log Bytes to 0.
  D. Application inspection and control for HTTP is disabled.
  E. Automatic IP Log actions will capture the specified traffic for 30 minutes.
  D. Application inspection and control for HTTP is disabled.