Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 61:

  Refer to the exhibit of a Cisco IPS CLI configuration, which statement is true?

  

  A. The IPS administrator should be able to use Telnet to connect to the IP appliance 172.26.26.1 IP address.
  B. The IPS administrator should be able to use Telnet to connect to the IP appliance 172.26.26.2 IP address.
  C. The IP appliance default gateway IP address is 172.26.26.1.
  D. The IPS administrator will not be able to use Telnet to connect to the IP appliance.
  E. The IP appliance primary IP address is 172.26.26.1 with a secondary IP address of 172.26.26.2.
  D. The IPS administrator will not be able to use Telnet to connect to the IP appliance.

• Question 62:

  When upgrading a Cisco IPS AIM or IPS NME using manual upgrade, what must be performed before installing the upgrade?

  A. Disable the heartbeat reset on the router.
  B. Enable fail-open IPS mode.
  C. Enable the Router Blade Configuration Protocol.
  D. Gracefully halt the operating system on the Cisco IPS AIM or IPS NME.
  A. Disable the heartbeat reset on the router.

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/release/notes/18483_01.html Using manual upgrade:

  if you want to manually update your sensor, copy the 7.0(1)E3 update files to the directory on the server that your sensor polls for updates.

  when you upgrade the AIM IPS or the NME IPS using manual upgrade, you must disable heartbeat reset on the router before installing the upgrade. You can reenable heartbeat reset after you complete the upgrade. If you do not disable

  heartbeat reset, the upgrade can fail and leave the AIM IPS or the NME IPS in an unknown state, which can require a system reimage to recover.

• Question 63:

  Which three statements about the Cisco IPS appliance normalizer feature are true? (Choose three.)

  A. only operates in inline modes
  B. ensures that Layer 4 to Layer 7 traffic conforms to the protocol specifications
  C. tracks session states and stops packets that do not fully match session state
  D. modifies ambiguously fragmented IP traffic
  E. cannot analyze asymmetric traffic flows
  A. only operates in inline modes
  C. tracks session states and stops packets that do not fully match session state
  D. modifies ambiguously fragmented IP traffic

  ---

  http://globalknowledgeblog.com/technology/cisco/asa-and-ips-parallel-features-part-ii/ = A

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/white_paper_c11- 459025_ps6120_Products_White_Paper.html

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_signature_engines.ht ml#wpxref98199

  = C and D

  The Cisco ASA AIP-SSM is a fully functional firewall and IPS solution that can be deployed in symmetric or asymmetric mode and supports stateful failover deployments. In either deployment mode, session state and evasion protection will be

  maintained because of advanced state features in the Cisco ASA operating system.

  E is not an option -- even though it reduces performance -it is still able to analyze a single traffic flow.

  http://globalknowledgeblog.com/technology/cisco/asa-and-ips-parallel-features-%E2%80%93-part- iii/

• Question 64:

  Referring to the monitor session 1 destination GigabitEthernet0/47 ingress Cisco Catalyst switch command, what does the "ingress" command option enable?

  A. Allow the capture of bidirectional traffic on the GigabitEthernet0/47 switch port.
  B. Add .1Q headers on the SPAN port (GigabitEthernet0/47) to indicate the source VLAN to the Cisco IPS appliance in promiscuous mode.
  C. Allow the SPAN port (GigabitEthernet0/47) to be a source of traffic (for TCP resets).
  D. Enable flow-based SPAN session.
  E. Limit (filter) SPAN source traffic.
  C. Allow the SPAN port (GigabitEthernet0/47) to be a source of traffic (for TCP resets).

  ---

  http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612. shtml

• Question 65:

  DRAG DROP

  Select and Place:

  

  

• Question 66:

  In which three ways can you achieve better Cisco IPS appliance performance? (Choose three.)

  A. Place the Cisco IPS appliance behind a firewall.
  B. Disable unneeded signatures.
  C. Enable unidirectional capture.
  D. Have multiple Cisco IPS appliances in the path and configure them to detect different types of events
  E. Enable selective packet capture using VLAN ACL on the Cisco IPS 4200 Series appliance.
  F. Enable all anti-evasive measures to reduce noise.
  A. Place the Cisco IPS appliance behind a firewall.
  B. Disable unneeded signatures.
  D. Have multiple Cisco IPS appliances in the path and configure them to detect different types of events

  ---

  A. Placing the IPS behind a firewall will reduce traffic which will help improve performance - Confirmed Correct

  B. Disable unneeded signatures will reduce processing over head which will help improve performance - Unconfirmed Correct

  C. Enabling unidirectional capture would improve device performance but it would also result in poor IPS performance - Unconfirmed Incorrect

  D. Having multiple Cisco IPS devices in the path each detecting a different type of traffic would balance the load resulting in increased performance on each device - Confirmed correct E. VACL selective packet capture is enabled on the switch, not the device. - Confirmed incorrect F. Enabling all anti-evasive measures would force all traffic through the device likely causing an increase in noice (not a reduction) and the increased traffic would cause increased load on the device resulting in decrease performance. - Confirmed Incorrect http://my.safaribooksonline.com/book/certification/ccnp/9780132372107/deploying-cisco-ips-for- highavailability-and-high-performance/499#

• Question 67:

  Which four networking tools does Cisco IME include that can be invoked for specific events, to learn more about attackers and victims using basic network reconnaissance? (Choose four.)

  A. ping
  B. traceroute
  C. packet tracer
  D. nslookup
  E. whois
  F. nmap
  A. ping
  B. traceroute
  D. nslookup
  E. whois

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_getting_started.htm l IME also supports tools such, as ping, trace route, DNS lookup, and whois lookup for selected events

• Question 68:

  The Cisco IDM Custom Signature Wizard asks you to select between the protocol types IP, ICMP, UDP, and TCP under which circumstance?

  A. when you specify the String engine
  B. when you specify the Service engine
  C. when you specify the Atomic engine
  D. when you specify the String or Service engine
  E. when you do not select a specific engine
  E. when you do not select a specific engine

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_signature_wizard.ht ml#wp1655660

• Question 69:

  Which two operations would put an inline Cisco IPS sensor in detection mode? (Choose two.)

  A. subtract all aggressive actions using event action filters
  B. decrease the event count using event action filters
  C. increase the maximum inter-event interval using event action overrides
  D. remove the default event action override, which drops traffic with a risk rating of 90 to 100
  E. enable anomaly detection in detection mode only
  A. subtract all aggressive actions using event action filters
  D. remove the default event action override, which drops traffic with a risk rating of 90 to 100

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_anomaly_detection.ht ml#wp1041433

  Not sure of this answer yet - 9/25/12 - DD but seems to be another Cisco classif question, meaning that once a signature is tuned it is ready for prime time i.e. detection mode After the signatures are tuned, remove the event action filters that removed the aggressive actions, and remove the event action overrides that produced the verbose alerts.

• Question 70:

  Which four configuration elements can the virtual sensor of an Cisco IPS appliance have? (Choose four.)

  A. interfaces or VLAN pairs
  B. IPS reputation filters
  C. signature set definition
  D. global correlation rules
  E. event action rules (filters and overrides)
  F. anomaly detection policy
  A. interfaces or VLAN pairs
  C. signature set definition
  E. event action rules (filters and overrides)
  F. anomaly detection policy