Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 121:

  Which three Cisco IPS cross-launch capabilities do Cisco Security Manager and Cisco Security MARS support? (Choose three.)

  A. Edit IPS signatures in Cisco Security Manager from a Cisco Security MARS query.
  B. Create custom signatures in Cisco Security Manager from a Cisco Security MARS query.
  C. Create event action filters in Cisco Security Manager from a Cisco Security MARS query.
  D. Create a Cisco Security MARS drop rule from Cisco Security Manager policy.
  E. Create a Cisco Security MARS user inspection rule from Cisco Security Manager policy.
  F. Query Cisco Security MARS from Cisco Security Manager policy.
  A. Edit IPS signatures in Cisco Security Manager from a Cisco Security MARS query.
  C. Create event action filters in Cisco Security Manager from a Cisco Security MARS query.
  F. Query Cisco Security MARS from Cisco Security Manager policy.

  ---

  "...MARS creates queries that include a launch point for CSM. When CSM is launched, you can carry out the following (cross-connected actions):

  Edit an IPS Signature

  Add an event action filter to an IPS configuration in Cisco Security Manager and when you use CSM to cross-launch MARS, you can query events that were originated by the signatures in CSM."

  http://my.safaribooksonline.com/book/certification/ccnp/9780132372107/integrating-cisco-ips-with- csm-andcisco-security-mars/435#

• Question 122:

  Which parameter is used to configure a signature to fire if the activity it detects happens a certain number of times for the same address set within a specified period of time?

  A. event action
  B. event counter
  C. summary count
  D. summary key
  B. event counter

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/4.1/user/guide/ipsvchap.pdf

  

• Question 123:

  What are the five possible values for the event count key parameter of an IPS signature? (Choose five.)

  A. attacker address
  B. victim address
  C. attacker and victim address
  D. victim address and port
  E. attacker and victim addresses and ports
  F. attacker address and victim port
  G. attacker and victim port
  A. attacker address
  B. victim address
  C. attacker and victim address
  E. attacker and victim addresses and ports
  F. attacker address and victim port

• Question 124:

  Which option is best to use to capture only a subset of traffic (capturing traffic per-IP-address, per- protocol, or per-application) off the switch backplane and copy it to the Cisco IPS appliance?

  A. SPAN
  B. PBR
  C. VACL
  D. MPF
  E. STP
  C. VACL

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guid e/vacl.html#wp1037197

• Question 125:

  Refer to the exhibit. Which General settings under the Event Action Rule affect the risk rating calculations?

  

  A. Use Summarizer
  B. Use Meta Event Generator
  C. Use Threat Rating Adjustment
  D. Use Event Action Filters
  E. Enable One Way TCP Reset
  C. Use Threat Rating Adjustment

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/product_data_sheet0 900aecd805baef2.html

  Threat Rating

  New with Cisco IPS Sensor Software Version 6.0, the Threat Rating feature provides a single view of the threat environment of the network. Threat Rating can minimize alarms and events through the ability to customize the viewer to only

  show events with a high Threat Rating value. The Threat Rating value is derived as follows:

  ?Dynamic adjustment of event Risk Rating based on success of response action ?If response action was applied, Risk Rating is deprecated (TR<; RR) ?If response action was not applied, Risk Rating remains unchanged (TR = RR)

  The result is a single value by which the threat risk is determined. This eases the management of alarms and determination of risk on the network.

• Question 126:

  What are the three anomaly detection modes? (Choose three.)

  A. detect
  B. active
  C. inactive
  D. learn
  E. full
  F. partial
  A. detect
  C. inactive
  D. learn

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.0/user/guide/ipsanom.html

  Anomaly detection has the following modes:

  稬earning accept mode (initial setup)

  Although anomaly detection is in detect mode by default, it conducts an initial learning accept mode for the default period of 24 hours. We assume that during this phase no attack is being carried out. Anomaly detection creates an initial

  baseline, known as a knowledge base, of the network traffic. The default interval value for periodic schedules is 24 hours and the default action is rotate, meaning that a new knowledge base is saved and loaded, and then replaces the initial

  knowledge base after 24 hours.

  Keep the following in mind:

  瑼nomaly detection does not detect attacks when working with the initial knowledge base, which is empty.

  After the default of 24 hours, a knowledge base is saved and loaded and now anomaly detection also detects attacks.

  璂epending on your network complexity, you may want to have anomaly detection in learning accept mode for longer than the default 24 hours. You configure the mode in the Virtual Sensors policy; see Defining A Virtual Sensor, page 28-5.

  After your learning period has finished, edit the virtual sensor and change the mode to Detect.

  稤etect mode

  For ongoing operation, the sensor should remain in detect mode. This is for 24 hours a day, 7 days a week.

  Once a knowledge base is created and replaces the initial knowledge base, anomaly detection detects attacks based on it. It looks at the network traffic flows that violate thresholds in the knowledge base and sends alerts.

  As anomaly detection looks for anomalies, it also records gradual changes to the knowledge base that do not violate the thresholds and thus creates a new knowledge base. The new knowledge base is periodically saved and takes the place

  of the old one thus maintaining an up-to-date knowledge base.

  稩nactive mode

  You can turn anomaly detection off by putting it in inactive mode. Under certain circumstances, anomaly detection should be in inactive mode, for example, if the sensor is running in an asymmetric environment.

  Because anomaly detection assumes it gets traffic from both directions, if the sensor is configured to see only one direction of traffic, anomaly detection identifies all traffic as having incomplete connections, that is, as scanners, and sends

  alerts for all traffic flows.

• Question 127:

  The Cisco IPS appliance risk category is used with which other feature?

  A. anomaly detection
  B. event action overrides
  C. global correlation
  D. reputation filter
  B. event action overrides

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_event_action_rules. html#wp2068398

• Question 128:

  All signatures in the Cisco IPS signature set include which three parameters that can be tuned according to the environment? (Choose three.)

  A. vulnerable OS list
  B. alert severity rating
  C. inline mode delta
  D. signature fidelity rating
  E. threat rating
  A. vulnerable OS list
  B. alert severity rating
  D. signature fidelity rating

  ---

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/white_paper_c11_54 9300.html

  After configuring Cisco IOS IPS on your router, you should adjust the staging router's signature configuration. The IOS IPS `basic' and `advanced' signature categories include a set of signatures that detect and mitigate a broad range of traffic that could potentially exploit various types of software vulnerabilities in server and workstation hosts, as well as network devices; other signature categories may hold some appeal for your environment, but will likely require tuning to fit into the router's available memory. You will need to be sure that IOS IPS is configured to enable signatures that specifically address the requirements of your environment. Additionally, while some signatures may offer some benefit for vulnerabilities that your network presents, IPS may recognize traffic that is not an exploit as unwanted traffic, thus affecting a "false positive". False positives must be dealt with in a manner that suits the nature of the vulnerability. If a very high-risk vulnerability must be mitigated by IPS, operational tools and staff must be able to distinguish between traffic that comprises a false positive and that which comprises a live exploit. Otherwise, signatures addressing low-risk vulnerabilities might be tuned to generate less response, or disabled entirely, to avoid the additional operational burden of dealing with the false positives. Other reasons for tuning the signature database are to reduce memory or CPU footprint, or to add custom IPS signatures that you have developed to address the security requirements of your environment.

• Question 129:

  Which three Cisco IPS sensor features are configured within an event action rule? (Choose three.)

  A. event action overrides
  B. target value rating
  C. use global correlation
  D. use reputation filter
  E. event action filters
  F. enable TCP state bypass
  G. blocking properties
  A. event action overrides
  B. target value rating
  E. event action filters

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/4.1/user/guide/ipsevact.html

  

• Question 130:

  Which Cisco IPS signature parameter can be tuned to reduce the volume of the alerts that are written to the event store?

  A. alert action
  B. alert frequency
  C. alert fidelity rating
  D. alert severity
  E. alert firing mode
  F. alert logging
  B. alert frequency

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_definitions.h tml#wp1094231

  Configuring Alert Frequency

  Use the alert-frequency command in signature definition submode to configure the alert frequency for a signature. The alert-frequency command specifies how often the sensor alerts you when this signature is firing.

  The following options apply:

  穝ig_id--Identifies the unique numerical value assigned to this signature. This value lets the sensor identify a particular signature. The value is 1000 to 65000. 穝ubsig_id--Identifies the unique numerical value assigned to this subsignature. A

  subsignature ID is used to identify a more granular version of a broad signature. The value is 0 to 255.