Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 151:

  You want your inline Cisco IPS appliance to drop packets that pose the most severe risk to your network, especially to the servers on your DMZ. Which two parameters should you set to protect your DMZ servers in the most-time-efficient manner? (Choose two.)

  A. event action filter
  B. reputation filter
  C. target value rating
  D. signature fidelity rating
  E. global correlation
  F. event action override
  C. target value rating
  F. event action override

• Question 152:

  Which two methods can be used together to configure a Cisco IPS signature set into detection mode when tuning the Cisco IPS appliance to reduce false positives? (Choose two.)

  A. Subtract all aggressive actions using event action filters.
  B. Enable anomaly detection learning mode.
  C. Enable verbose alerts using event action overrides.
  D. Decrease the number of events required to trigger the signature.
  E. Increase the maximum inter-event interval of the signature.
  A. Subtract all aggressive actions using event action filters.
  C. Enable verbose alerts using event action overrides.

  ---

  1 > Remove all agressive actions from all signatures using event action filters 2 > Add verbose alerts using event action overrides 3 > Add logging packets between the attacker and the victim using event action overrides

• Question 153:

  DRAG DROP

  Select and Place:

  

  

• Question 154:

  

  Check the answer below

  Tasks = 4

  1: Event Action Overrides Verify and enable this feature for rules0 instance

  2: Risk Category name MYCUSTOMRISK create a custom risk category named MYCUSTOMRISK assign this category a risk threshold of 80 (hard to see could be 90) Modify the the new MYCUSTOMRISK to take the following actions > Deny Attacker Inline > Produce Alert > Reset TCP Connection

  3: Modify the Red Threat Threshold Modify the value to 80 to enable the new risk category to be included in the Red Threshold level for network security health statistics alert threat categorization

  4 : REMEMBER TO SAVE AND APPLY ALL CHANGES AS NEEDED (MEANS AS YOU GO - DO NOT WAIT TILL END TO SAVE CHANGES) #3 http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_dashboards.html

  

  Sensor Health Gadget The Sensor Health gadget visually displays sensor health and network security information in two colored meters. The meters are labeled Normal, Needs Attention, or Critical according to an analysis of the specific metrics. The overall health status is set to the highest severity of all the metrics you configured. For example, if you configure eight metrics to determine the sensor health and seven of the eight are green while one is red, the overall sensor health is displayed as red.

  The dashboard is not available you have to use Configuration >Policies > Event Action rules > rules0 pane. From http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/idm/idmguide71.html

  The Event Action Rules part of the pane contains the following tabs:

• Question 155:

  DRAG DROP

  Select and Place:

  

  

• Question 156:

  The Cisco IPS appliance anomaly detection signatures cover which three protocols? (Choose three.)

  A. TCP
  B. ICMP
  C. UDP
  D. NETBIOS
  E. IP
  F. other
  A. TCP
  C. UDP
  F. other

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_anomaly_detection s.html#wp2040302

  Anomaly Detection Signatures

  The Traffic Anomaly engine contains nine anomaly detection signatures covering three protocols (TCP, UDP, and other).

• Question 157:

  Threat rating calculation is performed based on which factors?

  A. risk rating and adjustment based on the prevention actions taken
  B. threat rating and event action overrides
  C. event action overrides and event action filters
  D. risk rating and target value rating
  E. alert severity and alert actions
  A. risk rating and adjustment based on the prevention actions taken

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd806e7299.html

  Threat rating is a quantitative measure of your network's threat level after IPS mitigation. The formula for threat rating is:

  Threat Rating = Risk Rating - Alert Rating The values of the alert ratings are listed below. ?45: deny-attacker-inline ?40: deny-attacker-victim-pair-inline ?40: deny-attacker-service-pair-inline ?35: deny-connection-inline ?35: deny-packet-inline ?35: modify-packet-inline ?20: request-block-host ?20: request-block-connection ?20: reset-tcp-connection ?20: request-rate-limit

  For example, if an alert had a risk rating of 100 and the IPS mitigates the event with a deny- attacker-inlineaction, the threat rating would be calculated as: Threat Rating = Risk Rating - Alert Rating, or 100 - 45 = 55.

  Threat rating brings the value of risk rating to a new level. By taking the IPS mitigation action into account, threat rating helps you further focus on the most important threats that have not been mitigated.

• Question 158:

  Which two Cisco IPS appliance features are implemented using input data from the Cisco SensorBase? (Choose two.)

  A. global correlation
  B. anomaly detection
  C. reputation filters
  D. botnet traffic filters
  E. OS fingerprinting
  F. threat detection
  A. global correlation
  C. reputation filters

• Question 159:

  In which CLI configuration mode is the Cisco IPS appliance management IP address configured?

  A. global configuration ips(config)#
  B. service network-access ips(config-net)#
  C. service host network-settings ips(config-hos-net)#
  D. service interface ips(config-int)#
  C. service host network-settings ips(config-hos-net)#

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/cli/cli_setup.html#wp103132

• Question 160:

  Which value is not used by the Cisco IPS appliance in the risk rating calculation?

  A. attack severity rating
  B. target value rating
  C. signature fidelity rating
  D. promiscuous delta
  E. threat rating adjustment
  F. watch list rating
  E. threat rating adjustment

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd806e7299.html

  Risk Rating Calculation

  Risk rating is a quantitative measure of your network's threat level before IPS mitigation. For each event fired by IPS signatures, Cisco IPS Sensor Software calculates a risk rating number. The factors used to calculate risk rating are:

  ?Signature fidelity rating: This IPS-generated variable indicates the degree of attack certainty. ?Attack severity rating: This IPS-generated variable indicates the amount of damage an attack can cause.

  ?Target value rating: This user-defined variable indicates the criticality of the attack target. This is the only factor in risk rating that is routinely maintained by the user. You can assign a target value rating per IP address in Cisco IPS Device

  Manager or Cisco Security Manager. The target value rating can raise or lower the overall risk rating for a network device. You can assign the following target values:

  ?75: Low asset value

  ?100: Medium asset value

  ?200: Mission-critical asset value

  ?Attack relevancy rating: This IPS-generated value indicates the vulnerability of the attack target. ?Promiscuous delta: The risk rating of an IPS deployed in promiscuous mode is reduced by the promiscuous delta. This is because

  promiscuous sensing is less accurate than inline sensing. The promiscuous delta can be configured on a per-signature basis, with a value range of 0 to 30. (The promiscuous delta was introduced in Cisco IPS Sensor Software Version 6.0.) ?

  Watch list rating: This IPS-generated value is based on data found in the Cisco Security Agent watch list. The Cisco Security Agent watch list contains IP addresses of devices involved in network scans or possibly contaminated by viruses or

  worms. If an attacker is found on the watch list, the watch list rating for that attacker is added to the risk rating. The value for this factor is between 0 and 35. (The watch list rating was introduced in Cisco IPS Sensor Software Version 6.0.)

  The formula to calculate risk rating in Cisco IPS Sensor Software Version 6.0 is:

  Risk rating can help enhance your productivity as it intelligently assesses the level of risk of each event and helps you focus on high-risk events.