Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 111:

  Refer to following Exhibit and answer the following question below:

  

  

  Which group policy restricts the VPN user access to VLAN 100?

  A. Employee
  B. Contractor
  C. Management
  D. Engineering
  B. Contractor

  ---

  Explanation:

  configuration > network client access > any connect connection profiles >connection profiles > edit

  

  For each profile > general > more options > restricted VLAN Monitoring > VPN > VPN statistics Sessions, vlan mapping sessions

  

• Question 112:

  What are three methods for VPN address assignment? (Choose three.)

  A. RADIUS authentication server
  B. Kerberos server
  C. internal address pool
  D. RSA SecureID authentication server
  E. LDAP server
  A. RADIUS authentication server
  C. internal address pool
  E. LDAP server

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/vpnadd.html

  Configuring an IP Address Assignment Method The ASA can use one or more of the following methods for assigning IP addresses to remote access clients. If you configure more than one address assignment method, the ASA searches each of the options until it finds an IP address. By default, all methods are enabled. To view the current configuration, enter the show runningconfig all vpn-addr-assign command.穉aa--Retrieves addresses from an external authentication server on a per-user basis. If you are using an authentication server that has IP addresses configured, we recommend using this method. 穌hcp--Obtains IP addresses from a DHCP server. If you want to use DHCP, you must configure a DHCP server. You must also define the range of IP addresses that the DHCP server can use.穕ocal--Use an internal address pool. Internally configured address pools are the easiest method of address pool assignment to configure. If you choose local, you must also use the ip-local-pool command to define the range of IP addresses to use. To specify a method for assigning IP addresses to remote access clients, enter the vpn-addr- assign command in global configuration mode. The syntax is vpn- addr-assign {aaa | dhcp | local}.

• Question 113:

  When preconfiguring a Cisco AnyConnect profile for the user group, which file is output by the Cisco AnyConnect profile editor?

  A. user.ini
  B. user.html
  C. user.pcf
  D. user.xml
  D. user.xml

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/ac 02asaconfig.html

• Question 114:

  Which two statements about the Cisco ASA cluster load-balancing feature are correct? (Choose two.)

  A. The Cisco ASA load-balances both site-to-site and remote-access VPN tunnels.
  B. The Cisco ASA load-balances remote-access VPN tunnels only.
  C. The Cisco ASA load-balances IPsec VPN tunnels only.
  D. The Cisco ASA load-balances IPsec VPN and Cisco AnyConnect SSL VPN tunnels only.
  E. The Cisco ASA load-balances IPsec VPN, clientless, and Cisco AnyConnect SSL VPN tunnels.
  B. The Cisco ASA load-balances remote-access VPN tunnels only.
  E. The Cisco ASA load-balances IPsec VPN, clientless, and Cisco AnyConnect SSL VPN tunnels.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa71/asdm51/selected_procedures/asdm_lb.html#wp1005 Eligible Clients Load balancing is effective only on remote sessions initiated with the following clients:

  稢isco VPN Client (Release 3.0 and later)

  稢isco VPN 3002 Hardware Client (Release 3.5 or later) 稢isco ASA model 5505 when configured as a hardware client 稢isco PIX 501/506E when acting as an Easy VPN client. Load balancing works with both IPSec clients and WebVPN

  sessions. All other clients, including LAN-to-LAN connections, can connect to a security appliance on which load balancing is enabled, but they cannot participate in load balancing.

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_params.html#wp1048834

  Load Balancing

  Load balancing is a mechanism for equitably distributing remote-access VPN traffic among the devices in a virtual cluster. It is based on simple distribution of traffic without taking into account throughput or other factors.

  A load-balancing cluster consists of two or more devices, one is the virtual master, and the other devices are the backup. These devices do not need to be of the exact same type, or have identical software versions or configurations.

• Question 115:

  Which statement regarding hashing is correct?

  A. MD5 produces a 64-bit message digest.
  B. SHA-1 produces a 160-bit message digest.
  C. MD5 takes more CPU cycles to compute than SHA-1.
  D. Changing 1 bit of the input to SHA-1 can change up to 5 bits in the output.
  B. SHA-1 produces a 160-bit message digest.

• Question 116:

  When a VPN client that is using redundant peering and has obtained an IP address from the primary VPN gateway loses connection to that gateway, how is traffic rerouted?

  A. The secondary VPN gateway automatically routes the traffic back to the client using the same IP address.
  B. Redundant Internet routing protocols reroute the traffic to and from the client and the gateway.
  C. The secondary VPN gateway issues the client a new IP address and routes traffic accordingly.
  D. Traffic flow stops, and the client must reestablish connection. Once connection is established, the same IP address is issued to the client and similarly routed.
  C. The secondary VPN gateway issues the client a new IP address and routes traffic accordingly.

• Question 117:

  Which three statements are Cisco AnyConnect VPN Client deployment options? (Choose three.)

  A. Configure the Cisco AnyConnect profile to automatically launch client or clientless SSL VPN upon discovering a trusted network.
  B. Automatically download the Cisco AnyConnect VPN Client upon Cisco IOS WebVPN login.
  C. Prompt user upon Cisco IOS WebVPN login to select client or clientless SSL VPN within X seconds.
  D. Configure the Cisco AnyConnect profile to automatically disconnect the client or clientless SSL VPN tunnel upon discovering an untrusted network.
  E. User manually launches client from SSL VPN clientless portal.
  B. Automatically download the Cisco AnyConnect VPN Client upon Cisco IOS WebVPN login.
  C. Prompt user upon Cisco IOS WebVPN login to select client or clientless SSL VPN within X seconds.
  E. User manually launches client from SSL VPN clientless portal.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/administration/guide/ac 01intro.html

• Question 118:

  When initiating a new SSL or TLS session, the client receives the server SSL certificate and validates it. After validating the server certificate, what does the client use the certificate for?

  A. The client and server use the server public key to encrypt the SSL session data.
  B. The server creates a separate session key and sends it to the client. The client decrypts the session key by using the server public key.
  C. The client and server switch to a DH key exchange to establish a session key.
  D. The client generates a random session key, encrypts it with the server public key, and then sends it to the server.
  D. The client generates a random session key, encrypts it with the server public key, and then sends it to the server.

• Question 119:

  Some users are having problems connecting via clientless SSL VPN, while other users are experiencing no problems. What is one possible cause of this issue?

  A. The Cisco ASA identity certificates have not been generated.
  B. SSL version checking is enabled, and clients are connecting with denied versions.
  C. SSL VPN termination is not enabled.
  D. The Cisco ASA identity certificate is not bound to the SSL interface.
  B. SSL version checking is enabled, and clients are connecting with denied versions.

  ---

  http://www.cisco.com/web/about/security/intelligence/05_08_SSL-VPN-Security.html

  Host identity verification There is a difference between trusting a user (after passing strong user authentication) and trusting that user's computer. While the former has traditionally been emphasized, only recently has the latter been given sufficient attention (see Trusted Platform Module - TPM). As discussed earlier, a Trojan-laden computer defeats strong user authentication. But a "company computer", which is typically supported and managed according to corporate security policies, typically deserves more trust than a "non-company computer". A secure SSL VPN infrastructure should allow you to verify a remote host's identity by checking on predefined end device parameters. Examples include registry entries, special files in a specified location, or digital certificates (as a form of device authentication). The host identity information can be used to make your access permission decisions.

• Question 120:

  In clientless SSL VPN, administrators can control user access to the internal network or resources of a company. What is this control based on?

  A. interface ACLs
  B. WebType ACLs
  C. per-user or per-group ACLs
  D. MPF-configured service policies
  B. WebType ACLs

  ---