Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 71:

  On the Cisco IPS appliance, the anomaly detection knowledge base is used to store which two types of information for each service? (Choose two.)

  A. scanner threshold
  B. packet per second rate limit
  C. anomaly detection mode
  D. histogram
  E. total bytes transferred
  A. scanner threshold
  D. histogram

• Question 72:

  Which type of signature engine is best suited for creating custom signatures that inspect data at OSI Layer 5 and above?

  A. Atomic
  B. String
  C. Sweep
  D. Service
  E. Meta
  F. Flood
  D. Service

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_engines.ht ml#wp1014328 Service Engines The Service engines analyze Layer 5+ traffic between two hosts. These are one-to-one signatures that track persistent data. The engines analyze the Layer 5+ payload in a manner similar to the live service.

• Question 73:

  The default virtual sensor on all IPS appliances is vs0. Which three components are assigned to vs0 by default? (Choose three.)

  A. sig0
  B. engine0
  C. rules0
  D. ad0
  E. filters0
  F. gc0
  A. sig0
  C. rules0
  D. ad0

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/idm/idm_policies.html

  The sensor can receive data inputs from one or many monitored data streams. These monitored data streams can either be physical interface ports or virtual interface ports. For example, a single sensor can monitor traffic from in front of the firewall, from behind the firewall, or from in front of and behind the firewall concurrently. And a single sensor can monitor one or more data streams. In this situation a single sensor policy or configuration is applied to all monitored data streams.

  A virtual sensor is a collection of data that is defined by a set of configuration policies. The virtual sensor is applied to a set of packets as defined by interface component. A virtual sensor can monitor multiple segments, and you can apply a different policy or configuration for each virtual sensor within a single physical sensor. You can set up a different policy per monitored segment under analysis. You can also apply the same policy instance, for example, sig0, rules0, or ad0, to different virtual sensors. You can assign interfaces, inline interface pairs, inline VLAN pairs, and VLAN groups to a virtual sensor.

• Question 74:

  Which protocol is used by Encapsulated Remote SPAN?

  A. ESP
  B. GRE
  C. TLS
  D. STP
  E. VTI
  F. 802.1Q
  B. GRE

  ---

  http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guid e/span.html#wp1059482

  ERSPAN Overview

  ERSPAN supports source ports, source VLANs, and destination ports on different switches, which provides remote monitoring of multiple switches across your network (see Figure 52-3). ERSPAN consists of an ERSPAN source session,

  routable ERSPAN GRE-encapsulated traffic, and an ERSPAN destination session. You separately configure ERSPAN source sessions and destination sessions on different switches.

  To configure an ERSPAN source session on one switch, you associate a set of source ports or VLANs with a destination IP address, ERSPAN ID number, and optionally with a VRF name. To configure an ERSPAN destination session on

  another switch, you associate the destination ports with the source IP address, ERSPAN ID number, and optionally with a VRF name.

  ERSPAN source sessions do not copy locally sourced RSPAN VLAN traffic from source trunk ports that carry RSPAN VLANs. ERSPAN source sessions do not copy locally sourced ERSPAN GRE-encapsulated traffic from source ports.

  Each ERSPAN source session can have either ports or VLANs as sources, but not both. The ERSPAN source session copies traffic from the source ports or source VLANs and forwards the traffic using routable GRE-encapsulated packets to

  the ERSPAN destination session. The ERSPAN destination session switches the traffic to the destination ports.

• Question 75:

  During Cisco IPS appliance troubleshooting, you notice that all the signatures are set to Fire All. What can cause this situation to occur?

  A. A new signature engine update package has been loaded to the Cisco IPS appliance.
  B. A new signature/virus update package has been loaded to the Cisco IPS appliance.
  C. Summarizer has been disabled globally.
  D. All the signatures have been set to the default state.
  E. All the signatures have been retired, and then unretired.
  C. Summarizer has been disabled globally.

  ---

  http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_tech_note09186a0080838bcf. shtml

• Question 76:

  Which four statements about the blocking capabilities of the Cisco IPS appliance are true? (Choose four.)

  A. The three types of blocks are: host, connection, and network.
  B. Host and connection blocks can be initiated manually or automatically when a signature is triggered.
  C. Network blocks can only be initiated manually.
  D. The Device Login Profiles pane is used to configure the profiles that the network devices use when logging into the Cisco IPS appliance
  E. Multiple Cisco IPS appliances can forward their blocking requests to the master blocking sensor.
  F. Pre-Block and Post-Block ACLs are applicable for blocking or rate limiting.
  A. The three types of blocks are: host, connection, and network.
  B. Host and connection blocks can be initiated manually or automatically when a signature is triggered.
  C. Network blocks can only be initiated manually.
  E. Multiple Cisco IPS appliances can forward their blocking requests to the master blocking sensor.

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/command/reference/crCmds.html#wp765330 http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_blocking.html#wp2 216370

  It appears that block network is not available from the ARC module.

  D is definitely incorrect

  Use the Device Login Profiles pane to configure the profiles that the sensor uses when logging in to blocking devices.

  F is also incorrect

  Pre-Block and Post-Block ACLS do not apply to rate limiting.

• Question 77:

  DRAG DROP

  Select and Place:

  

  

• Question 78:

  Which two switching-based mechanisms are used to deploy high availability IPS using multiple Cisco IPS appliances? (Choose two.)

  A. Spanning Tree-based HA
  B. HSRP-basedHA
  C. EtherChannel-based HA
  D. VRRP-basedHA
  A. Spanning Tree-based HA
  C. EtherChannel-based HA

  ---

  When network switches are used to provide High Availability you have two options

  EtherChannel based HA STP based HA

• Question 79:

  Which three statements about the Cisco IntelliShield Alert Manager are true? (Choose three.)

  A. Alert information is analyzed and validated by Cisco security analysts.
  B. Alert analysis is vendor-neutral.
  C. The built-in workflow system provides a mechanism for tracking vulnerability remediation and integration with Cisco Security Manager and Cisco Security MARS.
  D. Users can customize the notification to deliver tailored information relevant to the needs of the organization
  E. Customers are automatically subscribed to use Cisco Security IntelliShield Alert Manager Service with the Cisco IPS license.
  F. More than 10 report types are available within the Cisco Security IntelliShield Alert Manager Service.
  A. Alert information is analyzed and validated by Cisco security analysts.
  B. Alert analysis is vendor-neutral.
  D. Users can customize the notification to deliver tailored information relevant to the needs of the organization

  ---

  http://www.cisco.com/en/US/products/ps6834/serv_group_home.html A and D are clear.

  Still in doubt for B or C (and F - added by DD)

  Features

  Continuous threat and vulnerability updates

  Customized notifications that deliver tailored information relevant to IT needs = D Actionable alert intelligence analyzed and validated by security analysts to assist in proactive prevention =A

  Integrated, easy to use tools for easy management of remediation efforts Comprehensive intelligence information including historical coverage of over 14,000 alerts Benefits

  Accelerated elimination of threats through actionable security intelligence Customized intelligence to avoid sifting through irrelevant information Vendor-neutral analysis of threats and vulnerabilities help prevent IT attacks across business

  environments = B

  Workflow management tools enable efficient use of security staff resources http://www.cisco.com/en/US/services/ps2827/ps6834/services_overview0900aecd803e85ee.pdf Option C removal!

  No mention of integration at all with CSM or CS MARS.

  Added by DD

  Originally suggested F as an option but one of the report types specifically mentions vendor neutral analysis on security vulnerabilities

  http://www.cisco.com/web/services/portfolio/product-technical-support/intellishield/index.html says "....Vendorneutral analysis of threats and vulnerabilities that prevent IT attacks across business environments..."

  There is also this about reports from

  The Cisco Security Intelligence Operations information is published in many forms for the benefit of end customers, enterprises, governments, and the general public. Some examples of the other forms of Cisco Security Intelligence

  Operations information arc as follows:

  Cyber risk reports

  Cisco annual security reports

  Cisco PSIRT security advisories and security responses

  Cisco IntelliShield alerts, including malicious code alerts, security activity bulletins, security issue alerts, threat outbreak alerts, and geopolitical security reports Service provider security best practices

  Security Intelligence best practices

  Cisco IPS active update bulletins

  Applied mitigation bulletins

  Cisco IronPort outbreak reports

  IntelliShield event responses

  And also something from:

  http://www.cisco.com/web/about/doing_business/legal/service_descriptions/docs/ Cisco_Security_IntelliShield_Alert_Manager_Service.pdf

  Because it mentions these, not convinced that F is not a valid option:

  The Service provides, among other things:

  ?Vulnerability Alerts -- vendor-neutral reports on security vulnerabilities. ?Malicious Code Alerts - reports on malicious codes that have a minimum of level 3 urgency rating described in the user documentation provided by Cisco.

  ?Activity Reports -- reports on attacks, outages and threat activity identified by Cisco's global network of sources.

  ?Threat Outbreak Alert - reports on the latest spam activity from the Cisco IronPort Threat Operations Center.

  ?Applied Mitigation Bulletins -- reports on how to use your existing Cisco security products to mitigate and block threats.

  ?Cyber Risk Reports -- weekly Cyber Risk Reports provide strategic intelligence that highlight current security activity. The reports address seven major risk management categories:

  vulnerability. physical, legal, trust, identity, human, and geopolitical. ?Enterprise Task Management - a web-based console that helps customers to manage, assign and track security-related tasks within Customer's

• Question 80:

  Which three statements are true with respect to IPS false positives? (Choose three.)

  A. An example of a false positive is when the IPS appliance produces an alert in response to the normal activities of the company's network management system.
  B. Increasing the set of TCP ports that a signature matches on may reduce false positives.
  C. False positives may be reduced by disabling certain signatures.
  D. Event action filters can be implemented to reduce false positives.
  E. An example of a false positive is the IPS not reacting to a successful denial of service attack.
  A. An example of a false positive is when the IPS appliance produces an alert in response to the normal activities of the company's network management system.
  C. False positives may be reduced by disabling certain signatures.
  D. Event action filters can be implemented to reduce false positives.

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_definitions.h tml#wp1094231

  Understanding Signatures

  Attacks or other misuses of network resources can be defined as network intrusions. Sensors that use a signature-based technology can detect network intrusions. A signature is a set of rules that your sensor uses to detect typical intrusive

  activity, such as DoS attacks. As sensors scan network packets, they use signatures to detect known attacks and respond with actions that you define. The sensor compares the list of signatures with network activity. When a match is found,

  the sensor takes an action, such as logging the event or sending an alert. Sensors let you modify existing signatures and define new ones.

  Signature-based intrusion detection can produce false positives because certain normal network activity can be misinterpreted as malicious activity. For example, some network applications or operating systems may send out numerous ICMP

  messages, which a signature-based detection system might interpret as an attempt by an attacker to map out a network segment. You can minimize false positives by tuning your signatures.

  To configure a sensor to monitor network traffic for a particular signature, you must enable the signature. By default, the most critical signatures are enabled when you install the signature update. When an attack is detected that matches an

  enabled signature, the sensor generates an alert, which is stored in the Event Store of the sensor. The alerts, as well as other events, may be retrieved from the Event Store by web-based clients. By default the sensor logs all Informational

  alerts or higher.

  Some signatures have subsignatures, that is, the signature is divided into subcategories. When you configure a subsignature, changes made to the parameters of one subsignature apply only to that subsignature. For example, if you edit

  signature 3050 subsignature 1 and change the severity, the severity change applies to only subsignature 1 and not to 3050 2, 3050 3, and 3050 4.

  Cisco IPS 6.1 contains over 10,000 built-in default signatures. You cannot rename or delete signatures from the list of built-in signatures, but you can retire signatures to remove them from the sensing engine. You can later activate retired

  signatures; however, this process requires the sensing engines to rebuild their configuration, which takes time and could delay the processing of traffic. You can tune built-in signatures by adjusting several signature parameters. Built-in

  signatures that have been modified are called tuned signatures.