Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 41:

  On the Cisco IPS appliance, each virtual sensor can have its own instance of which three parameters? (Choose three.)

  A. signature-definition
  B. event-action-rules
  C. global-correlation-rules
  D. anomaly-detection
  E. reputation-filters
  F. external-product-interfaces
  A. signature-definition
  B. event-action-rules
  D. anomaly-detection

• Question 42:

  Which signature engine is recommended for creating a custom signature for packet header matching?

  A. MULTI-STRING
  B. FLOOD.HOST
  C. ATOMIC.IP
  D. SERVICE
  E. SWEEP
  F. META
  C. ATOMIC.IP

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_engines.ht ml#wp1141808

  Atomic IP Engine

  The Atomic IP engine defines signatures that inspect IP protocol headers and associated Layer 4 transport protocols (TCP, UDP, and ICMP) and payloads.

• Question 43:

  What about this configuration command is true: ips inline fail-open sensor sensor_name?

  A. will enable fail-open hardware bypass on the Cisco IPS 4200 Series appliance
  B. will enable inline operation on the Cisco IPS 4200 Series appliance
  C. will enable inline operation on the Cisco IDSM-2, IPS AIM, or IPS NME
  D. will enable the desired traffic to be diverted from the Cisco ASA to one of the Cisco ASA AIP- SSM virtual sensors
  D. will enable the desired traffic to be diverted from the Cisco ASA to one of the Cisco ASA AIP- SSM virtual sensors

  ---

  http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clissm.html

• Question 44:

  The AIP-SSM CLI can be accessed from the ASA CLI by using which command?

  A. connect
  B. telnet
  C. hw-module
  D. session
  E. module
  D. session

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/ssm.html#wp1096676

• Question 45:

  Refer to the exhibit.

  

  Configuring traffic flow notifications on the Cisco IPS appliance is most useful in what situation?

  A. to determine the IPS throughput rate when using inline mode
  B. to detect IPS performance issues
  C. to enable bypass mode when the Cisco IPS appliance fails
  D. to prevent DoS attacks
  B. to detect IPS performance issues

  ---

  http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/idm/dminter.html#wp103214

• Question 46:

  Which statement about inline VLAN pair deployment with the Cisco IPS 4200 Series appliance is true?

  A. The sensing interface acts as an 802.1q trunk port, and the Cisco IPS appliance performs VLAN translation between pairs of VLANs.
  B. The Cisco IPS appliance connects to two physically distinct switches using two paired physical interfaces.
  C. Two sensing interfaces connect to the same switch that forwards traffic between two VLANs.
  D. The pair of sensing interfaces can be selectively divided (virtualized) into multiple logical "wires" by VLANs that can be analyzed separately
  A. The sensing interface acts as an 802.1q trunk port, and the Cisco IPS appliance performs VLAN translation between pairs of VLANs.

• Question 47:

  Which mode consolidates alarms where the Cisco IPS appliance will generate an alert the first time that a signature fires on an address set and then only send a summary alert for all address sets over a given time interval?

  A. Fire Once
  B. Fire All
  C. Fire Summarize
  D. Summarize
  E. Global Summarize
  E. Global Summarize

  ---

  http://www.cisco.com/en/US/docs/security/ips/5.1/configuration/guide/idm/dmSgEng.html

  

• Question 48:

  What is the correct regular expression to match a URI request equal to /test.exe?

  A. /test.exe
  B. Vtest\.exe
  C. /test\.exe
  D. */test\.exe
  E. \*/test\.exe
  F. */test.exe
  C. /test\.exe

  ---

  https://supportforums.cisco.com/community/netpro/security/intrusion- prevention/blog/2010/12/23/introductionto-regular-expressions-for-ips http://regexlib.com/DisplayPatterns.aspx?cattabindex=1andcategoryid=2andp=4 http://wdvl.com/Style/

  Languages/Perl/PerlfortheWeb/perlintro2_table1.html the . has a special meaning = match any character which would have the result testaexe, test$exe etc- would me matched as well as test.exe

  The \ removes the special meaning from the . so it is now just matching the .exe -- so = test.exe exactly has to be matched.

  See the above links as to why the other answers are not valid.

• Question 49:

  The Cisco IPS appliance global correlation and reputation filtering features depend on which two of these? (Choose two.)

  A. anomaly detection
  B. OS fingerprinting
  C. Cisco SensorBase
  D. watch list ratings
  E. event action overrides
  F. DNS
  C. Cisco SensorBase
  F. DNS

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.1/user/guide/ipsglobe.html

• Question 50:

  Which four features are supported on the Cisco ASA AIP-SSM but are not supported on the Cisco ASA AIP-SSC? (Choose four.)

  A. multiple virtual sensors
  B. anomaly detection
  C. promiscuous mode
  D. custom signatures
  E. fail open
  F. global correlation
  A. multiple virtual sensors
  B. anomaly detection
  D. custom signatures
  F. global correlation

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/product_data _sheet0900aecd80404916_ps6120_Products_Data_Sheet.html