Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 131:

  When setting up a Cisco IPS appliance in promiscuous mode, which Cisco Catalyst switch command is used to display information about all SPAN and remote SPAN sessions on the switch?

  A. show span
  B. show sessions
  C. show interface
  D. show monitor
  D. show monitor

  ---

  show monitor session

  To display information about the ERSPAN, SPAN and RSPAN sessions, use the show monitor session command in user EXEC mode.

  show monitor session [range session-range | local | remote | all | session] show monitor session [erspan-destination | erspan-source | egress replication-mode capability| detail]

• Question 132:

  Refer to the exhibit.

  

  Which option is affected by the IP Log parameters?

  A. the syslog operations of the Cisco IPS appliance
  B. the signature logging action
  C. SNMP trap operations
  D. the signature produce verbose alert action
  E. the SDEE operations of the Cisco IPS appliance
  B. the signature logging action

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/4.1/user/guide/ipsvchap.pdf

• Question 133:

  Refer to the exhibit. Which statement is true?

  A. A summary alert is sent once during each interval for each unique Summary Key entry.
  B. An alert is generated each time the signature triggers.
  C. This signature does not fire until three events are seen during 60 seconds with the same attacker and victim IP addresses and ports
  D. This signature is disabled by default.
  E. When this signature triggers, the Cisco IPS appliance sends an SNMP trap for this event.
  C. This signature does not fire until three events are seen during 60 seconds with the same attacker and victim IP addresses and ports

  ---

  NB: even if the box is not checked it is still in use - it is the default action/configuration - ticking it is allowing edit of that value

• Question 134:

  DRAG DROP

  Select and Place:

  

  

• Question 135:

  DRAG DROP

  Match the Password recovery techniques or command on left with the platform that they are used on right

  Select and Place:

  

  

• Question 136:

  Refer to the exhibit.

  

  The scanner threshold is set to 120. Which two statements about this histogram are true? (Choose two.)

  A. From a single source you do not expect to see nonestablished connections to more than 120 different destination IP addresses.
  B. From a single source you do not expect to see nonestablished connections to more than 100 different destination IP addresses.
  C. You do not expect to see more than 5 sources generate nonestablished connections to 10 or more different destinations.
  D. You do not expect to see more than 10 sources generate nonestablished connections to 5 or more different destinations.
  E. A scanner threshold of 120 is not a valid value for this histogram.
  F. Scanning attacks will not be triggered, because the scanner threshold is higher than the maximum number of destination IP addresses in the histogram.
  G. Scanning attacks will not be triggered, because the scanner threshold is higher than the maximum number of source IP addresses in the histogram.
  B. From a single source you do not expect to see nonestablished connections to more than 100 different destination IP addresses.
  D. You do not expect to see more than 10 sources generate nonestablished connections to 5 or more different destinations.

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.0/user/guide/ipsanom.pdf

  Read this topic carefully and you will see the answers better. Two test takers have done B and D and have 100% in troubleshooting so beilieve this is good.

• Question 137:

  Which rating is determined by adjusting the risk rating with respect to preventative actions taken by the sensor?

  A. attack severity rating
  B. attack relevancy rating
  C. damage assessment rating
  D. hazard rating
  E. threat rating
  F. event action delta
  E. threat rating

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd806e7299.html

• Question 138:

  Anomaly detection may send an alert under which two circumstances? (Choose two.)

  A. The attacker obfuscates a malicious HTTP request.
  B. Inbound traffic arrives from a source with a low reputation score.
  C. Outbound traffic is destined towards a known botnet system.
  D. A single worm-infected source enters the network and starts scanning for other vulnerable hosts.
  E. Benign traffic is misinterpreted as an attack.
  F. The network starts becoming congested by worm traffic.
  D. A single worm-infected source enters the network and starts scanning for other vulnerable hosts.
  F. The network starts becoming congested by worm traffic.

  ---

  http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/anomaly_detector/v5.0/c onfiguration/guide/Intro.html#wp1046115

  The Detector module analyzes the zone traffic, and sends out an alert when a DoS attack is detected. The Detector module can detect attacks and activate protection mechanisms. It is best suited to work alongside with the Cisco Anomaly Guard Module but it can also operate as a separate DDoS detection and alarm component.

• Question 139:

  In a centralized Cisco IPS appliance deployment, it may not be possible to connect an IPS appliance to every switch or segment in the network. So, an IPS appliance can be deployed to inspect traffic on ports that are located on multiple remote network switches. In this case, which two configurations required? (Choose two.)

  A. IPS promiscuous mode operations
  B. in-line IPS operations
  C. RSPAN
  D. SPAN
  E. HSRP
  F. SLB
  A. IPS promiscuous mode operations
  C. RSPAN

  ---

  RSPAN aznd promiscuous From Chip: No specific reference --- is in Videos from CBT

• Question 140:

  Refer to the exhibit.

  

  What does an action of Rotate indicate?

  A. A new knowledge base is created, but is not loaded. You can view it to decide if you want to load it.
  B. A new knowledge base is created and loaded.
  C. The knowledge base is rolled back to the previous version.
  D. The knowledge base is rotated on a periodic schedule using the different existing knowledge bases.
  B. A new knowledge base is created and loaded.