Cisco 642-627 Online Practice Questions and Exam Preparation

Cisco 642-627 Online Questions & Answers

• Question 81:

  From Cisco Security Manager, which external component or service is used to access in-depth signature information?

  A. Cisco SensorBase
  B. Cisco Security MARS
  C. Cisco IntelliShield Service
  D. ScanSafe Service
  C. Cisco IntelliShield Service

  ---

  http://www.cisco.com/en/US/services/ps2827/ps6834/services_overview0900aecd803e85ee.pdf

• Question 82:

  Which IPS appliance inline deployment mode should be used to support the following requirements?

  - The IPS appliance will be installed in inline mode, on a dot1q trunk.

  - VLANs 10, 20, 30, 40, and 50 exist on the dot1q trunk.

  - Requirement is to inspect all VLANs except VLAN 50 with the IPS appliance.

  A. inline VLAN pair mode
  B. inline interface mode
  C. inline VLAN group mode
  D. inline trunk mode
  E. inline subinterface mode
  C. inline VLAN group mode

  ---

  http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configurati on/rtg_brdg/guide/vlansif.html#wp1004190

  New Questions

• Question 83:

  Defining the internal zone, external zone, and illegal zone is associated with which Cisco IPS appliance feature?

  A. reputation filtering
  B. threat detection
  C. event action overrides
  D. global correlation network participation
  E. threat rating adjustments
  F. anomaly detection
  F. anomaly detection

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_anomaly_detection.ht ml#wp1046814

  

• Question 84:

  The Cisco IPS appliance passive OS fingerprinting feature can use which three sources to determine the OS mappings information? (Choose three.)

  A. manually configured OS mappings
  B. OS mappings that are dynamically learned by the sensor through the fingerprinting of TCP packets with the SYN control bit set
  C. OS mappings information received from the Cisco Security Manager
  D. imported OS mappings from the Management Center for Cisco Security Agents
  E. OS mappings information learned by running Nessus scans
  A. manually configured OS mappings
  B. OS mappings that are dynamically learned by the sensor through the fingerprinting of TCP packets with the SYN control bit set
  D. imported OS mappings from the Management Center for Cisco Security Agents

  ---

  http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_event_action_rules. html#wp2119120

  Passive OS fingerprinting consists of three components:稰assive OS learning Passive OS learning occurs as the sensor observes traffic on the network. Based on the characteristics of TCP SYN and SYNACK packets, the sensor makes a determination of the OS running on the host of the source IP address.稶ser-configurable OS identification You can configure OS host mappings, which take precedence over learned OS mappings. 稢omputation of attack relevance rating and risk rating

  The sensor uses OS information to determine the relevance of the attack signature to the targeted host. The attack relevance is the attack relevance rating component of the risk rating value for the attack alert. The sensor uses the OS type reported in the host posture information imported from the CSA MC to compute the attack relevance rating.

  There are three sources of OS information. The sensor ranks the sources of OS information in the following order:

  1. Configured OS mappings--OS mappings you enter.

  Configured OS mappings reside in the Event Action Rules policy and can apply to one or many virtual sensors.

  2. Imported OS mappings--OS mappings imported from an external data source. Imported OS mappings are global and apply to all virtual sensors.

  3. Learned OS mappings--OS mappings observed by the sensor through the fingerprinting of TCP packets with the SYN control bit set.

  Learned OS mappings are local to the virtual sensor that sees the traffic.

• Question 85:

  Which ASA CLI command is used to configure the network parameters for downloading the AIP- SSM recovery image?

  A. hw-module 1 recover boot
  B. hw-module 1 recover configure
  C. sysopt ips recovery configure
  D. sysopt ips recover-location
  E. boot hw-module 1 tftp
  F. boot system tftp
  B. hw-module 1 recover configure

  ---

  http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/clissm.html#wp1034193

• Question 86:

  The custom signature ID of a Cisco IPS appliance has which range of values?

  A. 10000 to 19999
  B. 20000 to 29999
  C. 50000 to 59999
  D. 60000 to 65000
  E. 80000 to 90000
  F. 1 to 20000
  D. 60000 to 65000

• Question 87:

  When using the Cisco IPS signature and engine auto updates feature from Cisco.com, which password must be configured on the IDM Auto/Cisco.com Update pane?

  A. the IPS appliance "cisco" user account password
  B. the IPS appliance "service" user account password
  C. the IPS appliance "support" user account password
  D. the IPS appliance enable password
  E. the CCO user account password
  E. the CCO user account password

  ---

  http://www.cisco.com/en/US/docs/security/security_management/cs- mars/6.0/device/configuration/guide/chIpsCisoc6x.html

  IPS Signature Dynamic Update Settings In releases 6.0 and later, Cisco IPS supports dynamic signature updates. MARS can discover the new signatures and correctly process and categorize received events that match those signatures. If this feature is not configured, the events appears as unknown event type in queries and reports, and MARS does not include these events in inspection rules. These updates provides event normalization and event group mapping, and they enable your MARS Appliance to parse Day Zero signatures from the IPS devices. The downloaded update information is am XML file that contains the IPS signatures. However, this file does not contain detailed information, such as vulnerability information. Detailed signature information is provided in later MARS signature upgrade packages just as with 3 rd -party signatures.

  Before You Begin稤ynamic IPS signature updates are disabled by default. 稢ustom IPS signatures are not supported. You must manually import these signatures using the process defined in Applying Custom Signature Updates.穀ou can retrieve updates from CCO or from a local web server. After downloading and installing an update, the MARS Appliance performs an auto-activate to load the new signature information. 稩f configured to retrieve the signatures from CCO, MARS downloads the most recent package as determined by a combination of package name and the MD5 sum. 稭ARS checks for updates at the specified interval, hourly (1, 2, 3, 6, or 12) or daily (1 through 14).稩n a Global Controller-Local Controller deployment, configure the dynamic signature URL and all relevant settings on the Global Controller. Do not attempt to configure these features on the Local Controllers even though the web interface allows you to do so. 稺hen the Global Controller pulls the new signatures from CCO, all managed Local Controllers download the new signatures from the Global Controller.

• Question 88:

  

  

  

  Which signature definition is virtual sensor 0 assigned to use?

  A. rules0
  B. vs0
  C. sig0
  D. ad0
  E. ad1
  F. sigl
  B. vs0

  ---

  Default signature http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_signature_definition s.html

  You can create multiple security policies and apply them to individual virtual sensors. A security policy is made up of a signature definition policy, an event action rules policy, and an anomaly detection policy. Cisco IPS contains a default signature definition policy called sig0, a default event action rules policy called rules0, and a default anomaly detection policy called ad0. You can assign the default policies to a virtual sensor or you can create new policies.

  

• Question 89:

  With a Cisco IPS appliance running v7.0, which three event actions support IPv4 and IPv6? (Choose three.)

  A. log attacker/victim pair packets
  B. request block connection
  C. request rate limit
  D. reset TCP connection
  E. modify packet inline
  F. request block host
  A. log attacker/victim pair packets
  D. reset TCP connection
  E. modify packet inline

  ---

  http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_event_action_rules.ht ml

  It's important to understand that there are some limitations when implementing IPv6 IPS inspection:

  AIM-IPS and NME-IPS do not currently support IPv6 features. IPv6 inspection might work on the Intrusion Detection System Module (IDSM-2), but it is not officially supported. VLAN access control lists (VACL) on Catalyst switches do not

  support IPv6, but IPv6 with promiscuous mode using SPAN ports instead with lower capture granularity is another option.

  IPv6 is not supported on the management or command and control interface. IPv6 does not support event actions such as Request Block Host, Request Block Connection, and Request Rate Limit.

  The Anomaly Detection (AD) feature does not support IPv6 traffic.

• Question 90:

  Which three of these are true with respect to the numeric values associated with the target value rating? (Choose three.)

  A. Mission Critical = 100
  B. Mission Critical = 200
  C. High = 75
  D. Medium = 50
  E. Low = 75
  F. 100 is the default target value rating
  B. Mission Critical = 200
  E. Low = 75
  F. 100 is the default target value rating

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper09 00aecd806e7299.html