Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 11:

  DRAG DROP

  Select and Place:

  

  

• Question 12:

  

  

  

  Which three statements about the Cisco IPS appliance configurations are true? (Choose three.)

  A. The maximum number of denied attackers is set to 10000.
  B. The block action duraton is set to 3600 seconds.
  C. The Meta Event Generator is globally enabled.
  D. Events Summarization is globally disabled.
  E. Threat Rating Adjustment is globally disabled.
  A. The maximum number of denied attackers is set to 10000.
  B. The block action duraton is set to 3600 seconds.
  C. The Meta Event Generator is globally enabled.

  ---

  Feedback from test takers.

  A and C is clear.

  Major issues with this answer --- the third choice is impossible I believe B should be Block action duration is set for 30minutes -- only choice really.

  

• Question 13:

  Which two IPS appliance configuration options are used in conjunction with the attack relevance rating feature? (Choose two.)

  A. OS mappings
  B. OS risk category levels
  C. passive OS fingerprinting
  D. OS target value rating
  E. OS event action filter
  F. OS event action override
  A. OS mappings
  C. passive OS fingerprinting

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd80191021.html

• Question 14:

  Which four data strings will match the regular expression c[a-z]*sc[0-4]+? (Choose four.)

  A. Cisc0
  B. Francisc0123456789 C. Ciscocisc0
  D. SanFrancisco44
  E. SanFranciscosc00L
  F. csc0123456780
  B. Francisc0123456789 C. Ciscocisc0
  E. SanFranciscosc00L
  F. csc0123456780

  ---

  https://supportforums.cisco.com/community/netpro/security/intrusion- prevention/blog/2010/12/23/introductionto-regular-expressions-for-ips

  And also http://www.cisco.com/web/about/security/intelligence/ips_custom_sigs.html

  Note especially that there are two special wildcard operators: the plus (+) and the asterisk (*). The plus operator signifies that one or more of the previous expressions will follow, whereas the asterisk means that zero or more of those expressions will follow. Keep in mind that these operators will not stop matching, so be sure to terminate them by adding a terminal expression

• Question 15:

  In tuning a Cisco IPS signature, you need to edit the regexp string of the Cisco IPS signature, but when editing the signature, the regexp string of the signature cannot be edited. What should you do?

  A. Create a new custom signature, then disable the original signature.
  B. Log in to the IPS appliance using a service account, which allows you to edit the regexp string of the signature.
  C. Clone the signature, then edit the cloned signature, then disable the original signature.
  D. Disable the signature first; then you can edit the regexp string of the signature and then re- enable the signature.
  C. Clone the signature, then edit the cloned signature, then disable the original signature.

  ---

  http://www.cisco.com/web/about/security/intelligence/ips_custom_sigs.html

  Cloning a Signature Administrators often find the need to modify a signature to meet the needs of a specific network, such as to reduce false positives or false negatives. In such cases, the first approach should be to fine tune signature parameters such as event action filters and override policies. If these tunings are not sufficient, the last action that is available is to modify a signature. By default, signature parameters such as the regular expression cannot be modified. The signature must first be cloned in order to modify such signature parameters. The original signature can be retired or disabled if it is determined that it is no longer required.

• Question 16:

  Which signature action should be selected to cause the attacker's traffic flow to terminate when the Cisco IPS appliance is operating in promiscuous mode?

  A. deny connection
  B. deny attacker
  C. reset TCP connection
  D. deny packet, reset TCP connection
  E. deny connection, reset TCP connection
  C. reset TCP connection

  ---

  Deny attacker is only available in inline mode! http://www.cisco.com/web/about/security/intelligence/ipsmit.html#7

  Promiscuous Mode Event Actions The following event actions can be deployed in Promiscuous mode. These actions are in affect for a userconfigurable default time of 30 minutes. Because the IPS sensor must send the request to another device or craft a packet, latency is associated with these actions and could allow some attacks to be successful. Blocking through usage of the Attack Response Controller (ARC) has the potential benefit of being able to perform to the network edge or at multiple places within the network.

  Request block host: This event action will send an ARC request to block the host for a specified time frame, preventing any further communication. This is a severe action that is most appropriate when there is minimal chance of a false alarm or spoofing. Request block connection: This action will send an ARC response to block the specific connection. This action is appropriate when there is potential for false alarms or spoofing. Reset TCP connection: This action is TCP specific, and in instances where the attack requires several TCP packets, this can be a successful action. However, in some cases where the attack only needs one packet it may not work as well. Additionally, TCP resets are not very effective with protocols such as SMTP that consistently try to establish new connections, nor are they effective if the reset cannot reach the destination host in time.

  Event actions can be specified on a per signature basis, or as an event action override (based on risk rating values ?event action override only). In the case of event action override, specific event actions are performed when specific risk rating value conditions are met. Event action overrides offer consistent and simplified management. IPS version 6.0 contains a default event action override with a deny-packet-inline action for events with a risk rating between 90 and 100. For this action to occur, the device must be deployed in Inline mode.

• Question 17:

  Which application within the Cisco IPS appliance can modify the configurations of other devices on the network?

  A. SDEE
  B. POSFP
  C. ARC
  D. global correlation
  E. reputation filter
  F. anomaly detection
  C. ARC

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/4.1/user/guide/ipsblock.pdf

• Question 18:

  Which two statements are true with respect to the AIP-SSC? (Choose two.)

  A. The AIP-SSC is a module for the ASA 5510.
  B. The AIP-SSC supports a maximum of two virtual sensors.
  C. The AIP-SSC supports custom signatures.
  D. The AIP-SSC supports fail open.
  E. The AIP-SSC supports both promiscuous and inline analysis.
  D. The AIP-SSC supports fail open.
  E. The AIP-SSC supports both promiscuous and inline analysis.

  ---

  https://docs.google.com/viewer?a=vandq=cache:xcV24pCOF4MJ:www.cisco.com/en/US/docs/securi ty/ips/6.2/configuration/guide/cli/cli_ssc.pdf+cisco+asa+aip+ssc+failopenand hl=enandgl=usandpid=blandsrcid=ADGEESi0RHlzQEpHH8Uu4c_jbwGBNqpMmZsVkjsfy6phll2Z0C5uZe QXUErbeYB-mLNlzyPb2FkNp9CrNqTJ70P-rjxrka68y6lzM9wGKpB76k- A38s8q70NsLgU_D3QAei23fVql53andsig=AHIEtbQ5ENt7hynvXatqPIccq8paHRyuJQ

• Question 19:

  Which three IPS alert actions are available in promiscuous mode? (Choose three.)

  A. reset tcp connection
  B. request block host
  C. deny packet
  D. deny connection
  E. send snmp inform
  F. log pair packets
  A. reset tcp connection
  B. request block host
  F. log pair packets

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_event_action_rules.ht ml

• Question 20:

  Which three configurations are the defaults on the Cisco IPS 4200 Series appliance? (Choose three.)

  A. IPS appliance default IP address = 192.168.1.2 and default gateway = 192.168.1.1
  B. password recovery enabled
  C. TLS and SSL access disabled
  D. Telnet access disabled
  E. Web Server Port = 80
  A. IPS appliance default IP address = 192.168.1.2 and default gateway = 192.168.1.1
  B. password recovery enabled
  D. Telnet access disabled

  ---

  http://www.cisco.com/en/US/docs/security/asa/quick_start/ips/ips_qsg.html