Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 1:

  After adding a remote-access IPsec tunnel via the VPN wizard, an administrator needs to tune the IKE policy parameters. Where is the correct place to tune IKE policy parameters?

  A. Cisco IPsec VPN SW Client > Client Profile
  B. IPsec User Profile
  C. Group Policy
  D. IKE Policy
  E. Crypto Map
  D. IKE Policy

• Question 2:

  Refer to the exhibit.

  

  A NOC engineer needs to tune some postlogin parameters on an SSL VPN tunnel.

  From the information shown, where should the engineer navigate to, in order to find all the postlogin session parameters?

  A. "engineering" Group Policy
  B. "contractor" Connection Profile
  C. DefaultWEBVPNGroup Group Policy
  D. DefaultRAGroup Group Policy
  E. "engineer1" AAA/Local Users
  A. "engineering" Group Policy

  ---

  http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htwebvpn.html#wp1054618

  The policy group is a container that defines the presentation of the portal and the permissions for resources that are configured for a group of remote users. Entering the policy group command places the router in webvpn group policy

  configuration mode. After it is configured, the group policy is attached to the SSL VPN context configuration by configuring the default-group-policy command.

  The following tasks are accomplished in this configuration:

  The presentation of the SSL VPN portal page is configured.

  A NetBIOS server list is referenced.

  A port-forwarding list is referenced.

  The idle and session timers are configured.

  A URL list is referenced.

• Question 3:

  Which three options are characteristics of WebType ACLs? (Choose three.)

  A. They are assigned per-connection profile.
  B. They are assigned per-user or per-group policy.
  C. They can be defined in the Cisco AnyConnect Profile Editor.
  D. They support URL pattern matching.
  E. They support implicit deny all at the end of the ACL.
  F. They support standard and extended WebType ACLs.
  B. They are assigned per-user or per-group policy.
  D. They support URL pattern matching.
  E. They support implicit deny all at the end of the ACL.

  ---

  You can configure ACLs (Access Control Lists) to apply to user sessions. These are filters that permit or deny user access to specific networks, subnets, hosts, and web servers. ?If you do not define any filters, all connections are permitted. ? The security appliance supports only an inbound ACL on an interface. ?At the end of each ACL, there is an implicit, unwritten rule that denies all traffic that is not permitted. If traffic is not explicitly permitted by an access control entry (ACE), the security appliance denies it. ACEs are referred to as rules in this topic. This pane lets you add and edit ACLs to be used for Clientless SSL VPN sessions, and the ACL entries each ACL contains. It also displays summary information about ACLs and ACEs, and lets you enable or disable them, and change their priority order.

• Question 4:

  The LAN-to-LAN tunnel is not established, but an administrator can ping the remote Cisco ASA.

  Which three IPsec LAN-to-LAN configuration parameters should the administrator verify at both ends of the tunnel? (Choose three.)

  A. pre-shared key
  B. extended authentication password
  C. extended authentication username
  D. crypto ACL source IP address
  E. crypto ACL destination IP address
  F. tunnel connection-typE. originate or answer
  A. pre-shared key
  D. crypto ACL source IP address
  E. crypto ACL destination IP address

• Question 5:

  You are the network security administrator troubleshooting a clientless SSL VPN issue. Users can connect using SSL VPN, but they cannot access file folder bookmarks that they need. Which problem could possibly cause this issue?

  A. a name mismatch from the certificate CN and the VPN URL
  B. misconfigured WebType ACLs
  C. disabled content rewriting
  D. disabled portal features
  B. misconfigured WebType ACLs

• Question 6:

  Two temporary workers are given clientless SSL VPN access to the corporate network. To restrict their access to the network, match the Cisco ASDM attribute on the left to the restrictive action on the right.

  Select and Place:

  

  

• Question 7:

  When attempting to tunnel FTP traffic through a stateful firewall that might be performing NAT or PAT, which type of VPN tunneling should you use to allow the VPN traffic through the stateful firewall?

  A. clientless SSL VPN
  B. IPsec over TCP
  C. smart tunnel
  D. SSL VPN plug-ins
  B. IPsec over TCP

  ---

  IP Security (IPSec) over Transmission Control Protocol (TCP) enables a VPN Client to operate in an environment in which standard Encapsulating Security Protocol (ESP, Protocol 50) or Internet Key Exchange (IKE, User Datagram Protocol (UDP) 500) cannot function, or can function only with modification to existing firewall rules. IPSec over TCP encapsulates both the IKE and IPSec protocols within a TCP packet, and it enables secure tunneling through both Network Address Translation (NAT) and Port Address Translation (PAT) devices and firewalls

• Question 8:

  Refer to following Exhibit and answer the following question below:

  

  

  

  After providing the correct VPN login credentials, user, contractor1, is enabled to use which VPN access type?

  A. Cisco Any Connect VPN
  B. Clientless VPN
  C. Cisco Any Connect VPN and clientless VPN
  D. Cisco Any Connect VPN, clientless VPN, and IPsec VPN
  C. Cisco Any Connect VPN and clientless VPN

  ---

  Configuration > network client access > any connect connection profiles >connection profiles > edit for each profile > general > more options > tunneling protocol > see the check marks Monitoring > VPN > VPN statistics > sessions filter by >>> choose contractor1

  

  Monitoring > VPN > VPN statistics > sessions filter by >>> choose contractor1

  

• Question 9:

  The administrator configured a Cisco ASA 5505 as a Cisco Easy VPN hardware client and also defined a list of Cisco Easy VPN backup servers in the Cisco ASA 5505. After an outage of the primary VPN server, you notice that your Cisco Easy VPN hardware client has now reconnected via a backup server that was not defined within the original Cisco Easy VPN backup servers list. Where did your Cisco Easy VPN hardware client get this backup server?

  A. The backup servers that you listed were no longer available, so the Cisco Easy VPN hardware client queried the load balance server for a "new" backup server address.
  B. The backup servers that you listed were no longer available, so a Group Policy that was configured on the primary VPN server pushed "new" backup server addresses to your client.
  C. The backup servers that you listed were no longer available, so the Cisco Easy VPN hardware client queried the primary VPN server via RADIUS protocol for a "new" backup server address.
  D. The backup servers that you listed were no longer available, so the Cisco Easy VPN hardware client queried and received from a predefined LDAP server a "new" backup server address.
  B. The backup servers that you listed were no longer available, so a Group Policy that was configured on the primary VPN server pushed "new" backup server addresses to your client.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/b.html#wp1366328

  Usage Guidelines To remove the backup-servers attribute from the running configuration, use the no form of this command without arguments. This enables inheritance of a value for backup-servers from another group policy. IPsec backup servers let a VPN client connect to the central site when the primary ASA is unavailable. When you configure backup servers, the ASA pushes the server list to the client as the IPSsec tunnel is established.

  Configure backup servers either on the client or on the primary ASA. If you configure backup servers on the ASA, it pushes the backup server policy to the clients in the group, replacing the backup server list on the client if one is configured.

• Question 10:

  Refer to the exhibit.

  

  A NOC engineer is in the process of entering information into the Create New VPN Connection Entry fields. Which statement correctly describes how to do this?

  A. In the Connection Entry field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.
  B. In the Host field, enter the IP address of the remote client device.
  C. In the Authentication tab, click the Group Authentication or Mutual Group Authentication radio button to enable symmetrical pre-shared key authentication.
  D. In the Name field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.
  D. In the Name field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client46/win/user/guide/vc4.

  html#wp1074766

  Step 1 Start the VPN Client by choosing Start > Programs > Cisco Systems VPN Client > VPN Client.

  Step 2 The VPN Client application starts and displays the advanced mode main window (Figure 4-1). If you are not already there, open the Options menu in simple mode and choose Advanced Mode or press Ctrl-M.

  

  Step 3 Select New from the toolbar or the Connection Entries menu. The VPN Client displays a form

  

  Step 4 Enter a unique name for this new connection. You can use any name to identify this connection; for example, Engineering. This name can contain spaces, and it is not case-sensitive. Step 5 Enter a description of this connection. This

  field is optional, but it helps further identify this connection.

  For example, Connection to Engineering remote server. Step 6 Enter the hostname or IP address of the remote VPN device you want to access.

  Group Authentication

  Your network administrator usually configures group authentication for you. If this is not the case, use the following procedure:

  Step 1 Click the Group Authentication radio button.

  Step 2 In the Name field, enter the name of the IPSec group to which you belong. This entry is case-sensitive.

  Step 3 In the Password field, enter the password (which is also case-sensitive) for your IPSec group. The field displays only asterisks.

  Step 4 Verify your password by entering it again in the Confirm Password field.