Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 31:

  Which Cisco IPS appliance TCP session tracking mode should be used if packets of the same session are coming to the sensor over different interfaces, but should be treated as a single session?

  A. interface and VLAN
  B. virtual sensor
  C. VLAN only
  D. promiscuous
  E. normalizer
  B. virtual sensor

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/ime/ime_policies.html#wp20 05229

  Inline TCP Session Tracking Mode

  When you choose to modify packets inline, if the packets from a stream are seen twice by the Normalizer engine, it cannot properly track the stream state and often the stream is dropped. This situation occurs most often when a stream is

  routed through multiple VLANs or interfaces that are being monitored by the IPS. A further complication in this situation is the necessity of allowing asymmetric traffic to merge for proper tracking of streams when the traffic for either direction is

  received from different VLANs or interfaces.

  To deal with this situation, you can set the mode so that streams are perceived as unique if they are received on separate interfaces and/or VLANs (or the subinterface for VLAN pairs).

  The following inline TCP session tracking modes apply:

  稩nterface and VLAN--All packets with the same session key (AaBb) in the same VLAN (or inline VLAN pair) and on the same interface belong to the same session. Packets with the same key but on different VLANs are tracked separately.

  稸LAN Only--All packets with the same session key (AaBb) in the same VLAN (or inline VLAN pair) regardless

  of the interface belong to the same session. Packets with the same key but on different VLANs are tracked separately.

  稸irtual Sensor--All packets with the same session key (AaBb) within a virtual sensor belong to the same session. This is the default and almost always the best option to choose.

• Question 32:

  Which Cisco IDM pane is used to add the public keys of all the SSH clients that are allowed to connect to the IPS appliance SSH server using RSA authentication?

  A. Configuration > Sensor Management > SSH > Authorized Keys
  B. Configuration > Sensor Management > SSH > Known Host Keys C. Configuration > Sensor Management > SSH > Sensor key
  D. Configuration > Sensor Management > Certificates > Trusted Hosts
  E. Configuration > Sensor Management > Certificates > Server Certificate
  F. Configuration > Sensor Management > Certificates > Known Host Keys
  A. Configuration > Sensor Management > SSH > Authorized Keys

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_ssh_tls.html

• Question 33:

  Refer to the exhibit.

  Which statement is true about the IPS signature shown?

  A. To match a string, the regular expression requires zero or more period characters (.) to immediately precede the newline character.
  B. A summary alert is sent once during each interval for each unique Summary Key entry.
  C. An alert is generated each time the signature triggers.
  D. This signature does not fire until three events are seen during 60 minutes with the same attacker and victim IP addresses and ports.
  E. This signature does not analyze traffic that is sent from the SMTP server to the client.
  D. This signature does not fire until three events are seen during 60 minutes with the same attacker and victim IP addresses and ports.

• Question 34:

  Which Cisco IPS appliance CLI command is used to display information in the IPS Event Store?

  A. show config
  B. show events
  C. show database
  D. show sdee
  E. show log
  F. show event-store
  G. show alerts
  B. show events

  ---

  show events To display the local event log contents, use the show events command in EXEC mode. show events [{alert [informational] [low] [medium] [high] [include-traits traits] [exclude-traits traits] [min-threatrating min-rr] [max-threat-rating max-rr | error [warning] [error] [fatal] | NAC | status}] [hh:mm:ss [month day [year]] | past hh:mm:ss] Syntax Description

  

• Question 35:

  Which two statements are true with respect to IPS false negatives? (Choose two.)

  A. A false negative is the failure of the IPS to create an alert on malicious activity.
  B. Increasing event count thresholds can lead to false negatives.
  C. A false negative results in an IPS alert that is associated with an unsuccessful denial of service attack.
  D. Disabling anti-evasion features of the IPS can reduce false negatives.
  E. False negatives can only occur when an IPS sensor is in promiscuous mode.
  A. A false negative is the failure of the IPS to create an alert on malicious activity.
  B. Increasing event count thresholds can lead to false negatives.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd805c389a.html

• Question 36:

  DRAG DROP

  Matching users with their capabilities

  Select and Place:

  

  

• Question 37:

  Which Cisco IPS NME interface is visible to the NME module but not visible in the router configuration and acts as the sensing interface of the NME module?

  A. ids-sensor 0/1 interface
  B. ids-sensor 1/0 interface
  C. gigabitEthernet 0/1
  D. gigabitEthernet 1/0
  E. management 0/1
  F. management 1/0
  C. gigabitEthernet 0/1

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_nme.html#wp1057817

• Question 38:

  When the Cisco IPS appliance is operating in inline mode, what is the default event actions rule?

  A. All alert events with a risk rating of 75 or higher will have a default action of deny packet inline.
  B. All alert events with a risk rating of 75 or higher will have a default action of deny attacker inline.
  C. High risk category attacks will have a default action of deny packet inline.
  D. High risk category attacks will have a default action of deny attacker inline.
  E. Attacks to any of the mission critical resources will have a default action of deny packet inline.
  F. Attacks to any of the mission critical resources will have a default action of deny attacker inline.
  C. High risk category attacks will have a default action of deny packet inline.

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/4.1/user/guide/ipsevact.html

• Question 39:

  DRAG DROP

  Select and Place:

  

  

• Question 40:

  DRAG DROP

  Select and Place: