Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 51:

  DRAG DROP

  Select and Place:

  

  

• Question 52:

  Which Cisco IPS signature parameter cannot be edited using IDM?

  A. signature name
  B. signature engine type
  C. signature type
  D. vulnerable OS list
  E. event count key
  B. signature engine type

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security _manager/4.0.1/user/guide/ipsvchap.html

• Question 53:

  You are working with Cisco TAC to troubleshoot a software problem on the Cisco IPS appliance. TAC suspects a fault with the NotificationApp software module in the Cisco IPS appliance. In this case, which Cisco IPS appliance operations may be most affected by the NotificationApp software module fault?

  A. SNMP
  B. IDM or IME
  C. global correlation
  D. remote blocking
  E. anomaly detection
  F. SDEE
  A. SNMP

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.ht ml#wp1009053

  NotificationApp allows the sensor to send alerts and system error messages as SNMP traps. It subscribes to events in the Event Store and translates them into SNMP MIBs and sends them to destinations through a public-domain SNMP agent. NotificationApp supports sending sets and gets. The SNMP GETs provide information about basic sensor health.

• Question 54:

  

  

  

  Which two statements about Signature 1104 are true? (Choose two.)

  A. This is a custom signature.
  B. The severity level is High.
  C. This signature has triggered as indicated by the red severity icon.
  D. Produce Alert is the only action defined.
  E. This signature is enabled, but inactive, as indicated by the/0 to that follows the signature number.
  B. The severity level is High.
  D. Produce Alert is the only action defined.

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/ime/ime_signature_wizard.p df

  

• Question 55:

  Refer to the exhibit of a partial Cisco IPS appliance CLI configurations, what is the purpose of the access-list CLI command?

  

  A. to define network objects that are used for IPS policy application
  B. to specify which traffic will be analyzed on the sensing interfaces of the IPS sensor
  C. to configure manually blocked IP addresses
  D. to specify trusted management IP addresses for SSH and HTTPS access to the IPS appliance
  D. to specify trusted management IP addresses for SSH and HTTPS access to the IPS appliance

• Question 56:

  Which four types of interface modes are available on the Cisco IPS 4200 Series appliance? (Choose four.)

  A. promiscuous
  B. inline TAP
  C. inline interface
  D. inline VLAN pair
  E. VLAN groups
  F. bypass
  A. promiscuous
  C. inline interface
  D. inline VLAN pair
  E. VLAN groups

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_interfaces.html#wp104 https://supportforums.cisco.com/thread/246376 4000 series does not support bypass mode

• Question 57:

  The threat rating is calculated using which two factors? (Choose two.)

  A. event action overrides
  B. attack severity rating
  C. risk rating
  D. preventative actions taken by the Cisco IPS sensor
  E. target value rating
  F. attack relevancy rating
  C. risk rating
  D. preventative actions taken by the Cisco IPS sensor

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd806e7299.html

• Question 58:

  Refer to the exhibit.

  A Cisco IPS appliance is connected to the FastEthernet 1/0/1 switch port. Referring to the switch show outputs shown below, what can be determined about the Cisco IPS appliance operations?

  A. The Cisco IPS appliance is operating in inline interface mode.
  B. A lot of traffic is bypassing the IPS appliance.
  C. The IPS appliance is dropping a lot of traffic inline.
  D. The IPS appliance is experiencing many false positive alerts.
  E. The IPS appliance sensing interface that is connected to the FastEthernet 1/0/1 switch port is shut down.
  B. A lot of traffic is bypassing the IPS appliance.

• Question 59:

  Which statement about the 4-port GigabitEthernet card with hardware bypass is true?

  A. Hardware bypass only works with inline interface pairs.
  B. Hardware bypass is only supported on the Cisco IPS 4270 appliance.
  C. Hardware bypass is independent from software bypass.
  D. Hardware bypass is enabled if software bypass is configured to "OFF".
  E. Hardware bypass is supported between any of the four GigabitEthernet ports
  A. Hardware bypass only works with inline interface pairs.

• Question 60:

  A Cisco IPS appliance running in a network environment with asymmetrical traffic flow is experiencing many false positive alerts that are triggered by the 13000 signature ID. What can the IPS administrator tune on the IPS to reduce the false positives?

  A. set the normalizer mode to strict mode
  B. set the AD operational mode to inactive
  C. enable TCP state bypass
  D. increase the default scanner threshold
  E. disable the uRPF check
  B. set the AD operational mode to inactive

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.1/user/guide/ipsanom.html

  Anomaly Detection Modes

  Anomaly detection initially conducts a "peacetime" learning process when the most normal state of the network is reflected. Anomaly detection then derives a set of policy thresholds that best fit the normal network. This is done in two phases:

  an initial learning mode phase, followed by the ongoing operational detect mode phase.

  Anomaly detection has the following modes:

  稬earning accept mode (initial setup)

  Although anomaly detection is in detect mode by default, it conducts an initial learning accept mode for the default period of 24 hours. We assume that during this phase no attack is being carried out. Anomaly detection creates an initial

  baseline, known as a knowledge base, of the network traffic. The default interval value for periodic schedules is 24 hours and the default action is rotate, meaning that a new knowledge base is saved and loaded, and then replaces the initial

  knowledge base after 24 hours.

  Keep the following in mind:

  瑼nomaly detection does not detect attacks when working with the initial knowledge base, which is empty.

  After the default of 24 hours, a knowledge base is saved and loaded and now anomaly detection also detects attacks.

  璂epending on your network complexity, you may want to have anomaly detection in learning accept mode for longer than the default 24 hours. You configure the mode in the Virtual Sensors policy; see Defining A Virtual Sensor, . After your

  learning period has finished, edit the virtual sensor and change the mode to Detect.

  稤etect mode

  For ongoing operation, the sensor should remain in detect mode. This is for 24 hours a day, 7 days a week.

  Once a knowledge base is created and replaces the initial knowledge base, anomaly detection detects attacks based on it. It looks at the network traffic flows that violate thresholds in the knowledge base and sends alerts.

  As anomaly detection looks for anomalies, it also records gradual changes to the knowledge base that do not violate the thresholds and thus creates a new knowledge base. The new knowledge base is periodically saved and takes the place

  of the old one thus maintaining an up-to-date knowledge base.

  稩nactive mode

  You can turn anomaly detection off by putting it in inactive mode. Under certain circumstances, anomaly detection should be in inactive mode, for example, if the sensor is running in an asymmetric environment.

  Because anomaly detection assumes it gets traffic from both directions, if the sensor is configured to see only one direction of traffic, anomaly detection identifies all traffic as having incomplete connections, that is, as scanners, and sends

  alerts for all traffic flows. The following example summarizes the default anomaly detection configuration. If you add a virtual sensor at 11:00 pm and do not change the default anomaly detection configuration, anomaly detection begins

  working with the initial knowledge base and only performs learning. Although it is in detect mode, it cannot detect attacks until it has gathered information for 24 hours and replaced the initial knowledge base. At the first start time (10:00 am by

  default), and the first interval (24 hours by default), the learning results are saved to a new knowledge base and this knowledge base is loaded and replaces the initial knowledge base. Because the anomaly detection is in detect mode by

  default, now that anomaly detection has a new knowledge base, the anomaly detection begins to detect attacks.