Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 141:

  In Cisco IDM, the Configuration > Sensor Setup > SSH > Known Host Keys screen is used for what purpose?

  A. to enable the Cisco IPS appliance as a master blocking sensor
  B. to enable management hosts to access the Cisco IPS appliance
  C. to regenerate the Cisco IPS appliance SSH host key
  D. to regenerate the Cisco IPS appliance SSL RSA key pair
  E. to enable communications with a blocking device
  E. to enable communications with a blocking device

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliTasks.html#wp1067312

  You must add hosts to the SSH known hosts list so that the sensor can recognize the hosts that it can communicate with through SSH. These hosts are SSH servers that the sensor needs to connect to for upgrades and file copying, and other hosts, such as Cisco routers, PIX Firewalls, and Catalyst switches that the sensor will connect to for blocking.

• Question 142:

  What is a best practice to follow before tuning a Cisco IPS signature?

  A. Disable all the alert actions on the signature to be tuned.
  B. Disable the signature to be tuned.
  C. Create a clone of the signature to be tuned.
  D. Increase the number of events required to trigger the signature to be tuned.
  E. Decrease the attention span (maximum inter-event interval) of the signature to be tuned
  C. Create a clone of the signature to be tuned.

  ---

  http://www.cisco.com/web/about/security/intelligence/ips_custom_sigs_pdf.pdf, specifically:

  Cloning a Signature

  Administrators often find the need to modify a signature to meet the needs of a specific network, such as to reduce false positives or false negatives.

  In such cases, the first approach should be to fine tune signature parameters such as event action filters and override policies. If these tunings are not sufficient, the last action that is available is to modify a signature. By default, signature

  parameters such as the regular expression cannot be modified.

  The signature must first be cloned in order to modify such signature parameters. The original signature can be retired or disabled if it is determined that it is no longer required.

  ORIGINAL FROM CHIP:

  Still Doubt here. 100% certain C is wrong.

  A is best answer with B also possible.

  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/ prod_white_paper0900aecd8066d265.html

  Official Guide - Chapter 13 Quiz - When tuning signatures it is recommended Answer: By removing harmful actions during the tuning phase we can have visibility......without interfering with normal traffic "Do no harm" approach.

• Question 143:

  From which three sources does the Cisco IPS appliance obtain OS mapping information? (Choose three.)

  A. from manually configured OS mappings
  B. imported OS mappings from Management Center for Cisco Security Agent
  C. imported OS mappings from Cisco Security Manager
  D. learned OS mappings from passive OS fingerprinting
  E. learned OS mappings from Cisco SensorBase input
  F. from Cisco IPS signature updates
  A. from manually configured OS mappings
  B. imported OS mappings from Management Center for Cisco Security Agent
  D. learned OS mappings from passive OS fingerprinting

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.1/user/guide/ipsevact.html#wp707692

  There are three sources of OS information. The sensor ranks the sources of OS information in the following order:

  1.

  Configured OS mappings--OS mappings that you enter on the OS Identification tab of the Event Actions

  Network Information policy. You can configure different mappings for each virtual sensor. For more information, see Configuring OS Identification (Cisco IPS 6.x and Later Sensors Only). We recommend configuring OS mappings to define the

  identity of the OS running on critical systems. It is best to configure OS mappings when the OS and IP address of the critical systems are unlikely to change.

  2.

  Imported OS mappings--OS mappings imported from Management Center for Cisco Security Agents (CSA MC).

  Imported OS mappings are global and apply to all virtual sensors. For information on configuring the sensor to use CSA MC, see Configuring the External Product Interface, page 32-23.

  3.

  Learned OS mappings--OS mappings observed by the sensor through the fingerprinting of TCP packets with the SYN control bit set.

  Learned OS mappings are local to the virtual sensor that sees the traffic. When the sensor needs to determine the OS for a target IP address, it consults the configured OS mappings. If the target IP address is not in the configured OS mappings, the sensor looks in the imported OS mappings. If the target IP address is not in the imported OS mappings, the sensor looks in the learned OS mappings. If it cannot find it there, the sensor treats the OS of the target IP address as unknown.

• Question 144:

  You are tasked to create a custom IPS signature using the IDM Custom Signature Wizard to detect a network reconnaissance attack in which one system makes connections to multiple hosts on multiple TCP ports. Which Cisco IPS signature engine should be selected to configure this custom IPS signature?

  A. Atomic IP
  B. Atomic IP Advanced
  C. String TCP
  D. Sweep
  E. Meta
  D. Sweep

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_signature_wizard.ht ml

• Question 145:

  Which global correlation data is sent to the Cisco SensorBase Network with full network participation that is not sent with partial network participation?

  A. attack type
  B. connecting IP address and port
  C. victim IP address and port
  D. protocol attributes
  E. IPS appliance CPU and memory usage information
  C. victim IP address and port

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html# wp1053292

  In the Network Participation pane, you can configure the sensor to send data to the SensorBase Network. You can configure the sensor to fully participate and send all data to the SensorBase Network. Or you can configure the sensor to collect the data but to omit potentially sensitive data, such as the destination IP address of trigger packets.

• Question 146:

  Which Cisco IPS appliance feature is best used to detect these two conditions? 1) The network starts becoming congested by worm traffic. 2) A single worm-infected source enters the network and starts scanning for other vulnerable hosts.

  A. global correlation
  B. anomaly detection
  C. reputation filtering
  D. custom signature
  E. meta signature
  F. threat detection
  B. anomaly detection

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/4.0/user/guide/ipsanom.html

  Anomaly detection identifies worm-infected hosts by their behavior as a scanner. To spread, a worm virus must find new hosts. It finds them by scanning the Internet using TCP, UDP, and other protocols to generate unsuccessful attempts to access different destination IP addresses. A scanner is defined as a source IP address that generates events on the same destination port (in TCP and UDP) for too many destination IP addresses.

• Question 147:

  Refer to the exhibit.

  

  When viewing the All Signatures pane, clicking on the Advanced option can be used to enable which two IPS configurations? (Choose two.)

  A. normalizer mode
  B. signature variables
  C. HTTP and FTP AIC
  D. network participation mode
  E. event action overrides
  F. event action filters
  B. signature variables
  C. HTTP and FTP AIC

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/idm/idm_signature_definition s.html#wp1224787

• Question 148:

  Which three actions does the Cisco IDM custom signature wizard provide? (Choose three.)

  A. selecting the signature engine to use or not to use any signature engine
  B. selecting the Layer 3 or Layer 4 protocol that the sensor will use to match malicious traffic
  C. selecting the attack relevancy rating
  D. selecting the signature threat rating
  E. selecting the scope of matching (for example, single packet)
  A. selecting the signature engine to use or not to use any signature engine
  B. selecting the Layer 3 or Layer 4 protocol that the sensor will use to match malicious traffic
  E. selecting the scope of matching (for example, single packet)

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/idm/idm_signature_wizard.ht ml#wp1655660 Shows A B E and nothing for C or D

• Question 149:

  Refer to the exhibit. What does the Deny Percentage setting affect?

  

  A. the percentage of the signatures to be tuned by the event action filter
  B. the percentage of the Risk Rating value to be tuned by the event action filter
  C. the percentage of packets to be denied for the deny attacker actions
  D. the percentage of the signatures to be tuned by the event action overrides
  C. the percentage of packets to be denied for the deny attacker actions

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_event_action_rules.

  html#wp2032330

  稤eny Percentage--Determines the percentage of packets to deny for deny attacker features. The valid range is 0 to 100. The default is 100 percent.

• Question 150:

  OS mappings associate IP addresses with an OS type, which in turn helps the Cisco IPS appliance to calculate what other value?

  A. TVR
  B. SFR
  C. ARR
  D. PD
  E. ASR
  C. ARR

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/idm/dmEvtRul.html#wp1159