Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 21:

  Refer to the exhibit.

  

  Which three statements are true? (Choose three.)

  A. Triggered inline blocks will last for 1 hour while triggered requests for external systems to block will last for 30 minutes.
  B. Triggered inline blocks will last for 30 minutes while triggered requests for external systems to block will last for 1 hour.
  C. TCP Resets will only be sent to the victim IP address.
  D. TCP Resets will only be sent to the attacker IP address.
  E. The IPS appliance can be configured to ignore scanning events sourced from the organization network management system.
  F. An alert risk rating will be calculated from the base value of the threat rating reduced by a value corresponding to the preventative actions taken by the IPS appliance.
  A. Triggered inline blocks will last for 1 hour while triggered requests for external systems to block will last for 30 minutes.
  C. TCP Resets will only be sent to the victim IP address.
  E. The IPS appliance can be configured to ignore scanning events sourced from the organization network management system.

• Question 22:

  

  

  

  What is the status of OS Identification?

  A. It is only enabled to identify Cisco IOS" OS using statically mapped OS fingerprinting
  B. OS mapping information will not be used for Risk Rating calculations.
  C. It is configured to enable OS mapping and ARR only for the 10.0.0.0/24 network.
  D. It is enabled for passive OS fingerprinting for all networks.
  C. It is configured to enable OS mapping and ARR only for the 10.0.0.0/24 network.

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_event_action_rules.

  html#wp2119120

  Understanding Passive OS Fingerprinting

  Passive OS fingerprinting lets the sensor determine the OS that hosts are running. The sensor analyzes network traffic between hosts and stores the OS of these hosts with their IP addresses. The sensor inspects TCP SYN and SYNACK

  packets exchanged on the network to determine the OS type.

  The sensor then uses the OS of the target host OS to determine the relevance of the attack to the victim by computing the attack relevance rating component of the risk rating. Based on the relevance of the attack, the sensor may alter the risk

  rating of the alert for the attack and/or the sensor may filter the alert for the attack.

  You can then use the risk rating to reduce the number of false positive alerts (a benefit in IDS mode) or definitively drop suspicious packets (a benefit in IPS mode). Passive OS fingerprinting also enhances the alert output by reporting the

  victim OS, the source of the OS identification, and the relevance to the victim OS in the alert.

  Passive OS fingerprinting consists of three components:

  稰assive OS learning

  Passive OS learning occurs as the sensor observes traffic on the network. Based on the characteristics of TCP

  SYN and SYNACK packets, the sensor makes a determination of the OS running on the host of the source IP address.

  稶ser-configurable OS identification

  You can configure OS host mappings, which take precedence over learned OS mappings. 稢omputation of attack relevance rating and risk rating

  

• Question 23:

  Numerous attacks using duplicate packets, changed packets, or out-of-order packets are able to successfully evade and pass through the Cisco IPS appliance when it is operating in inline mode. What could be causing this problem?

  A. The IPS Application Inspection and Control is disabled.
  B. All the DoS signatures are disabled.
  C. All the reconnaissance signatures are disabled.
  D. TCP state bypass is enabled.
  E. The normalizer is set to asymmetric mode.
  E. The normalizer is set to asymmetric mode.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/white_paper_c11- 459025.html

• Question 24:

  DRAG DROP

  Select and Place:

  

  

• Question 25:

  

  Reports generated by Cisco IME can be saved in which two formats? (Choose two.)

  A. XML
  B. RTF
  C. HTML
  D. PDF
  E. XLS
  F. DOC
  B. RTF
  D. PDF

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5715/ps9610/data_sheet_c78- 459033_ps6120_Products_Data_Sheet.html

• Question 26:

  Which Cisco IPS appliance feature has the following three potential settings: off, partial, and full?

  A. anomaly detection
  B. POSFP
  C. reputation filtering
  D. global correlation network participation
  E. event action overrides
  D. global correlation network participation

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html

• Question 27:

  

  

  

  What action will the sensortake regarding IP addresses listed as known bad hosts in the Cisco SensorBase network?

  A. Global correlation is configured in Audit mode for testing the feature without actually denying any hosts.
  B. Global correlation is configured in Aggressive mode, which has a very aggressive effect on deny actions.
  C. It will not adjust risk rating values based on the known bad hosts list.
  D. Reputation filtering is disabled.
  D. Reputation filtering is disabled.

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html# wp1054333

• Question 28:

  Which four parameters are used to configure how often the Cisco IPS appliance generates alerts when a signature is firing? (Choose four.)

  A. summary mode
  B. summary interval
  C. event count key
  D. global summary threshold
  E. summary key
  F. event count
  G. summary count
  H. event alert mode
  A. summary mode
  B. summary interval
  D. global summary threshold
  F. event count

  ---

  

  NB: Watch for Summary Threshold instead of Event Count

• Question 29:

  

  

  

  To what extent will the Cisco IPS sensor contribute data to the Cisco SensorBase network?

  A. It will not contribute to the SensorBase network.
  B. It will contribute to the SensorBase network, but will withhold some sensitive information
  C. It will contribute the victim IP address and port to the SensorBase network.
  D. It will not contribute to Risk Rating adjustments that use information from the SensorBase network.
  B. It will contribute to the SensorBase network, but will withhold some sensitive information

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html# wp1053292

  Configuring Network Participation

  To configure network participation, follow these steps:

  Step 1 Log in to IDM using an account with administrator privileges. Step 2 Choose Configuration > Policies > Global Correlation > Network Participation. Step 3 To turn on network participation, click the Partial or Full radio button:

  稰artial--Data is contributed to the SensorBase Network, but data considered potentially sensitive is filtered out and never sent.

  稦ull--All data is contributed to the SensorBase Network.

• Question 30:

  Which two interface modes can be implemented with a single physical sensing interface on the Cisco IPS 4200 Series appliance? (Choose two.)

  A. inline interface pair
  B. inline VLAN groups
  C. inline VLAN pair
  D. promiscuous
  E. hardware bypass
  C. inline VLAN pair
  D. promiscuous

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_interfaces.html