Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 161:

  Which of these depicts the correct process order of the Cisco IPS reputation filters and global correlation operations?

  A. IPS reputation filters > signature inspection > global correlation
  B. IPS reputation filters > global correlation > signature inspection
  C. global correlation > IPS reputation filters > signature inspection
  D. signature inspection > IPS reputation filters > global correlation
  A. IPS reputation filters > signature inspection > global correlation

  ---

  http://www.cisco.com/en/US/prod/collateral/modules/ps2641/solution_overview_cisco_ips_aim.ht ml

• Question 162:

  You are working with Cisco TAC to troubleshoot a software problem on the Cisco IPS appliance. TAC suspects a fault with the ARC software module in the Cisco IPS appliance. In this case, which Cisco IPS appliance operations may be most affected by the ARC software module fault?

  A. SDEE
  B. global correlation
  C. anomaly detection
  D. remote blocking
  E. virtual sensor
  F. OS fingerprinting
  D. remote blocking

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/installation/guide/hw_troubleshooting.html#wpm kr1185768

• Question 163:

  Simlet - which area will you need to work in to get the answers for the simlet?

  

  A. Home > Dashboard
  B. Configuration > Policies > Rule 0
  C. Configuration > Sensor Setup
  D. Configuration > Polices > virtual sensor
  B. Configuration > Policies > Rule 0

• Question 164:

  Which two statements accurately describe virtual sensor operations on the Cisco IPS appliance? (Choose two.)

  A. You must create a new instance of a signature set for each new virtual sensor.
  B. The packet processing policy is virtualized.
  C. Creating a new virtual sensor creates a "virtual" machine on the Cisco IPS appliance.
  D. vs0 can be cloned then deleted.
  E. Each virtual sensor can have its own unique event action rules.
  B. The packet processing policy is virtualized.
  E. Each virtual sensor can have its own unique event action rules.

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_virtual_sensors.html# wp1029979

• Question 165:

  Which four statements about Cisco IPS appliance anomaly detection histograms are true? (Choose four.)

  A. Histograms are learned or configured manually.
  B. Destination IP address row is the same for all histograms.
  C. Source IP address row can be learned or configured.
  D. Anomaly detection only builds a single histogram for all services in a zone.
  E. You can enable a separate histogram and scanner threshold for specific services, or use the default one for all other services
  F. Anomaly detection histograms only track source (attacker) IP addresses.
  A. Histograms are learned or configured manually.
  B. Destination IP address row is the same for all histograms.
  C. Source IP address row can be learned or configured.
  E. You can enable a separate histogram and scanner threshold for specific services, or use the default one for all other services