Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 91:

  When establishing a Cisco AnyConnect SSL VPN tunnel, a system administrator wants to restrict remote home office users to either print to their local printer or send the remaining traffic down the Cisco AnyConnect SSL VPN tunnel (with restricted Internet access). Choose both a tunnel policy option and an ACL type to accomplish this design goal. (Choose two.)

  A. tunnel all networks
  B. tunnel network list below
  C. exclude network list from the tunnel
  D. standard ACL
  E. web ACL
  F. extended ACL
  C. exclude network list from the tunnel
  D. standard ACL

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807029 92.shtml

• Question 92:

  Which statement is true about configuring the Cisco ASA for Active/Standby failover?

  A. All versions of Cisco ASA software need to have the same licensing on both devices.
  B. Both devices perform load sharing until a failure occurs.
  C. All VPN-related configurations and files are automatically replicated.
  D. VPN images, profiles, and plug-ins must be manually provisioned to both devices.
  D. VPN images, profiles, and plug-ins must be manually provisioned to both devices.

• Question 93:

  

  

  An engineer, while working at a home office, wants to launch the Cisco AnyConnect Client to the corporate offices while simultaneously printing network designs on the home network.

  Without allowing access to the Internet, what are the two best ways for the administrator to configure this application? (Choose two.)

  A. Select the Tunnel All Networks policy.
  B. Select the Tunnel Network List Below policy.
  C. Select the Exclude Network List Below policy.
  D. Configure an exempted network list.
  E. Configure a standard access list and apply it to the network list.
  F. Configure an extended access list and apply it to the network list.
  C. Select the Exclude Network List Below policy.
  E. Configure a standard access list and apply it to the network list.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702992.shtml

• Question 94:

  For clientless SSL VPN users, bookmarks can be assigned to their portal. What are three methods for assigning bookmarks? (Choose three.)

  A. connection profiles
  B. group policies
  C. XML profiles
  D. LDAP or RADIUS attributes
  E. the portal customization tool
  F. user policies
  B. group policies
  D. LDAP or RADIUS attributes
  F. user policies

  ---

  Create one or more bookmark list entries that specify the URLs of the web-enabled applications eligible for smart tunnel access, then assign the list to the DAPs, group policies, or local user policies for whom you want to provide smart tunnel access. e.g.

  

  Dynamic access policies (DAP)

  VPN gateways operate in dynamic environments. Multiple variables can affect each VPN connection, for example, intranet configurations that frequently change, the various roles each user may inhabit within an organization, and logins from

  remote access sites with different configurations and levels of security. The task of authorizing users is much more complicated in a VPN environment than it is in a network with a static configuration.

  Dynamic Access Policies (DAP) on the security appliance let you configure authorization that addresses these many variables. You create a dynamic access policy by setting a collection of access control attributes that you associate with a

  specific user tunnel or session. These attributes address issues of multiple group membership and endpoint security. That is, the security appliance grants access to a particular user for a particular session based on the policies you define. It

  generates a DAP at the time the user connects by selecting and/or aggregating attributes from one or more DAP records. It selects these DAP records based on the endpoint security information of the remote device and the AAA

  authorization information for the authenticated user. It then applies the DAP record to the user tunnel or session.

• Question 95:

  What is the selection hierarchy to which attributes are applied to a clientless SSL VPN use? Drag an attribute policy on the to the correct priority level within the attribute hierarchy on the right.

  Select and Place:

  

  

• Question 96:

  When using clientless SSL VPN, you might not want some applications or web resources to go through the Cisco ASA appliance. For these application and web resources, as a Cisco ASA administrator, which configuration should you use?

  A. Configure the Cisco ASA appliance for split tunneling.
  B. Configure network access exceptions in the SSL VPN customization editor.
  C. Configure the Cisco ASA appliance to disable content rewriting.
  D. Configure the Cisco ASA appliance to enable URL Entry bypass.
  E. Configure smart tunnel to bypass the Cisco ASA appliance proxy function.
  C. Configure the Cisco ASA appliance to disable content rewriting.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/user/guide/vpn_web.html

  Content Rewrite The Content Rewrite pane lists all applications for which content rewrite is enabled or disabled. Clientless SSL VPN processes application traffic through a content transformation/rewriting engine that includes advanced elements such as JavaScript, VBScript, Java, and multi-byte characters to proxy HTTP traffic which may have different semantics and access control rules depending on whether the user is using an application within or independently of an SSL VPN device.

  By default, the security appliance rewrites, or transforms, all clientless traffic. You might not want some applications and web resources (for example, public websites) to go through the security appliance. The security appliance therefore lets you create rewrite rules that let users browse certain sites and applications without going through the security appliance. This is similar to split-tunneling in an IPSec VPN connection.

  You can create multiple rewrite rules. The rule number is important because the security appliance searches rewrite rules by order number, starting with the lowest, and applies the first rule that matches.

• Question 97:

  Refer to the exhibit.

  

  A new NOC engineer, while viewing a real-time log from an SSL VPN tunnel, has a question about a line in the log. The IP address 172.26.26.30 is attached to which interface in the network?

  A. the Cisco ASA physical interface
  B. the physical interface of the end user
  C. the Cisco ASA SSL VPN tunnel interface
  D. the SSL VPN tunnel interface of the end user
  B. the physical interface of the end user

• Question 98:

  Refer to the exhibit.

  

  The ABC Corporation is changing remote-user authentication from pre-shared keys to certificate-based authentication. For most employee authentication, its group membership (the employees) governs corporate access. Certain management personnel need access to more confidential servers. Access is based on the group and name, such as finance and level_2. When it is time to pilot the new authentication policy, a finance manager is able to access the department-assigned servers but cannot access the restricted servers.

  As the network engineer, where would you look for the problem?

  A. Check the validity of the identity and root certificate on the PC of the finance manager.
  B. Change the Management Certificate to Connection Profile Maps > Rule Priority to a number that is greater than 10.
  C. Check if the Management Certificate to Connection Profile Maps > Rules is configured correctly.
  D. Check if the Certificate to Connection Profile Maps > Policy is set correctly.
  D. Check if the Certificate to Connection Profile Maps > Policy is set correctly.

  ---

  Cisco ASDM User Guide Version 6.1

  

• Question 99:

  Which four parameters must be defined in an ISAKMP policy when you are creating an IPsec site-to-site VPN using the Cisco ASDM? (Choose four.)

  A. encryption algorithm
  B. hash algorithm
  C. authentication method
  D. IP address of remote IPsec peer
  E. D-H group
  F. perfect forward secrecy
  A. encryption algorithm
  B. hash algorithm
  C. authentication method
  E. D-H group

  ---

  ASDM User guide Page 34-5 Should this not be IKE policy?

  

  

• Question 100:

  Refer to the exhibit.

  

  For the ABC Corporation, members of the NOC need the ability to select tunnel groups from a drop-down menu on the Cisco WebVPN login page.

  As the Cisco ASA administrator, how would you accomplish this task?

  A. Define a special identity certificate with multiple groups, which are defined in the certificate OU field, that will grant the certificate holder access to the named groups on the login page.
  B. Under Group Policies, define a default group that encompasses the required individual groups that will appear on the login page.
  C. Under Connection Profiles, define a NOC profile that encompasses the required individual profiles that will appear on the login page.
  D. Under Connection Profiles, enable "Allow user to select connection profile."
  D. Under Connection Profiles, enable "Allow user to select connection profile."

  ---

  Cisco ASDM User Guide Version 6.1 Add or Edit SSL VPN Connections > Advanced > SSL VPN This dialog box lets you configure attributes that affect what the remote user sees upon login. Fields ?Login Page Customization--Configures the look and feel of the user login page by specifying which preconfigured customization attributes to apply. The default is DfltCustomization. ?Manage--Opens the Configure GUI Customization Objects window. ?Connection Aliases--Lists in a table the existing connection aliases and their status and lets you add or delete items in that table. A connection alias appears on the user login page if the connection is configured to allow users to select a particular connection (tunnel group) at login. Add--Opens the Add Connection Alias window, on which you can add and enable a connection alias. Delete-- Removes the selected row from the connection alias table. There is no confirmation or undo. ?Group URLs--Lists in a table the existing group URLs and their status and lets you add or delete items in that table. A group URL appears on the user login page if the connection is configured to allow users to select a particular group at login. Add--Opens the Add Group URL window, on which you can add and enable a group URL. Delete--Removes the selected row from the connection alias table. There is no confirmation or undo.