Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 31:

  An IT manager and a Security manager are discussing the deployment options for clientless SSL VPN. They are trying to decide which groups are best suited for this new deployment option. Which two groups are the best candidates for the clientless SSL VPN rollout? (Choose two.)

  A. an IT administrator who needs to manage servers from a corporate laptop
  B. employees who need occasional access to check their email accounts
  C. a vendor who needs access to confidential corporate presentations via Secure FTP
  D. customers who need interactive access to the corporate invoice server
  B. employees who need occasional access to check their email accounts
  C. a vendor who needs access to confidential corporate presentations via Secure FTP

• Question 32:

  Cisco Secure Desktop seeks to minimize the risks that are posed by the use of remote devices in establishing a Cisco clientless SSL VPN or Cisco AnyConnect VPN Client session. Which two statements concerning the Cisco Secure Desktop Host Scan feature are correct? (Choose two.)

  A. It is performed before a user establishes a connection to the Cisco ASA.
  B. It is performed after a user establishes a connection to the Cisco ASA but before logging in.
  C. It is performed after a user logs in but before a group profile is applied.
  D. It is supported on endpoints that run a Windows operating system only.
  E. It is supported on endpoints that run Windows and MAC operating systems only.
  F. It is supported on endpoints that run Windows, MAC, and Linux operating systems.
  B. It is performed after a user establishes a connection to the Cisco ASA but before logging in.
  F. It is supported on endpoints that run Windows, MAC, and Linux operating systems.

  ---

  DAP and Anti-Virus, Anti-Spyware, and Personal Firewall Programs The security appliance uses a DAP policy when the user attributes matches the configured AAA and endpoint attributes. The Pre login Assessment and Host Scan modules

  of Cisco Secure Desktop return information to the security appliance about the configured endpoint attributes, and the DAP subsystem uses that information to select a DAP record that matches the values of those attributes. Most, but not all,

  anti-virus, anti-spyware, and personal firewall programs support active scan, which means that the programs are memory-resident, and therefore always running. Host Scan checks to see if an endpoint has a program installed, and if it is

  memory resident as follows:

  ?If the installed program does not support active scan, Host Scan reports the presence of the software. The DAP system selects DAP records that specify the program. ?If the installed program does support active scan, and active scan is

  enabled for the program, Host Scan reports the presence of the software. Again the security appliance selects DAP records that specify the program.

  ?If the installed program does support active scan and active scan is disabled for the program, Host Scan ignores the presence of the software. The security appliance does not select DAP records that specify the program. Further, the output

  of the debug trace command, which includes a lot of information about DAP, does not indicate the program presence, even though it is installed.

  The following sequence outlines a typical remote access connection establishment.

  1.

  A remote client attempts a VPN connection.

  2.

  The security appliance performs posture assessment, using configured NAC and Cisco Secure Desktop Host Scan values.

  Operating system support

  ?Microsoft Windows 2000, Windows XP, or Windows Vista ?Macintosh OS X 10.4.6

  ?Linux (Redhat RHEL 3.0 +, FEDORA 5, or FEDORA 6)

  3.

  The security appliance authenticates the user via AAA. The AAA server also returns authorization attributes for the user.

  4.

  The security appliance applies AAA authorization attributes to the session, and establishes the VPN tunnel.

  5.

  The security appliance selects DAP records based on the user AAA authorization information and the session posture assessment information. 6. The security appliance aggregates DAP attributes from the selected DAP records, and they

  become the DAP policy.

  7. The security appliance applies the DAP policy to the session.

• Question 33:

  Which three statements concerning keystroke logger detection are correct? (Choose three.)

  A. It requires administrative privileges in order to run.
  B. It runs on Windows and MAC OS X systems.
  C. It detects loggers that run as a process or kernel module.
  D. It detects both hardware- and software-based keystroke loggers.
  E. It allows the administrator to define "safe" keystroke logger applications.
  A. It requires administrative privileges in order to run.
  C. It detects loggers that run as a process or kernel module.
  E. It allows the administrator to define "safe" keystroke logger applications.

  ---

  http://www.cisco.com/en/US/docs/security/csd/csd321/configuration/guide/CSDJfaq.html and http://www.cisco.com/en/US/docs/security/csd/csd_32/configuration/guide/CSDJtuto.html

• Question 34:

  A network architect designed a redundant site-to-site IPsec VPN. In this site-to-site IPsec VPN solution are two standalone Cisco ASA appliances that are deployed at the headquarters office site. A site-to-site VPN tunnel is established between the remote office and online peer (192.168.4.1).

  To enable the remote office devices to be advertised correctly at headquarters, select the three Cisco ASA parameters and the ends in which they should be applied. R=remote end; H=headquarters end. (Choose three)

  A. R-Configure Originate-Only
  B. H-Configure Originate-Only
  C. R-Configure Answer-Only
  D. H-Configure Answer-Only
  E. R-Enable RRI
  F. H-Enable RRI
  A. R-Configure Originate-Only
  D. H-Configure Answer-Only
  F. H-Enable RRI

  ---

  http://secret-epedemiology-statistic.org.ua/1587052091/ch15lev1sec4.html

  Connection Type The Cisco ASA in the site-to-site tunnel can respond and initiate a VPN connection. This bidirectional default behavior can be changed to answer-only or originate- only mode. For example, if you want to limit the security Cisco ASA to just initiate IKE tunnels, you can set the connection type to originate-only. This way, if the remote VPN peer tries to initiate the connection, the local Cisco ASA will not honor the request. Similarly, if you want the security Cisco ASA to accept IKE tunnels only from the peer, then you can set the connection type to answer-only. The command syntax to set the connection type is Crypto map map-name seq-num set connection-type {answer-only | bidirectional |

• Question 35:

  Which statement is true regarding Cisco ASA stateful failover?

  A. It is recommended to share the failover link with the inside interface for security purposes.
  B. The failover link is encrypted by default to protect eavesdropping.
  C. VPN users must reauthenticate, even though the connection remains established.
  D. Clientless features, such as smart tunnels and plug-ins, are not supported.
  D. Clientless features, such as smart tunnels and plug-ins, are not supported.

• Question 36:

  Which statement about CRL configuration is correct?

  A. CRL checking is enabled by default.
  B. The Cisco ASA relies on HTTPS access to procure the CRL list.
  C. The Cisco ASA relies on LDAP access to procure the CRL list.
  D. The Cisco Secure ACS can be configured as the CRL server.
  C. The Cisco ASA relies on LDAP access to procure the CRL list.

  ---

  ASA SSLVPN deployment guide:

  The security appliance supports various authentication methods: RSA one-time passwords, Radius, Kerberos, LDAP, NT Domain, TACACS, Local/Internal, digital certificates, and a combination of both authentication and certificates.

  

• Question 37:

  Refer to following Exhibit and answer the following question below: The user, contractor1, will receive an IP address when the VPN connection is established. Which statement regarding the IP address is true?

  

  

  A. Is sourced from the contractor pool
  B. Is sourced from the employee pool
  C. Is sourced from the engineering pool
  D. Is sourced from the management pool
  E. Is a dedicated address (10.0.4.1 20)
  A. Is sourced from the contractor pool

  ---

  Explanation:

  

  Through configuration first see username in device management >> see its group policy then go to remote access VPN >> connection profiles >> client address pools >> contractor >> select t see the address pool Through Monitoring VPN statistics > session >> see username and its assigned ip address >> then find it out in configuration tab above procedure

  

• Question 38:

  Refer to the exhibit.

  

  When an SSL VPN user, contractor1, enters https://192.168.4.2 (the outside address of the Cisco ASA appliance) into the browser, an SSL VPN Login screen appears.

  In addition to the information that is contained in the Cisco ASDM configuration screens, what can an administrator determine about the state of the connection after the user clicks the Login button?

  A. The user login will succeed, and an IP address of 10.0.4.120 will be assigned.
  B. The user will be presented with a clientless VPN portal page.
  C. The user login will succeed, but the user will be connected to the "contractor" tunnel group.
  D. The login will fail.
  D. The login will fail.

• Question 39:

  Authorization of a clientless SSL VPN defines the actions that a user may perform within a clientless SSL VPN session. Which statement is correct concerning the SSL VPN authorization process?

  A. Remote clients can be authorized by applying a dynamic access policy, which is configured on an external AAA server.
  B. Remote clients can be authorized externally by applying group parameters from an external database.
  C. Remote client authorization is supported by RADIUS and TACACS+ protocols.
  D. To configure external authorization, you must configure the Cisco ASA for cut-through proxy.
  B. Remote clients can be authorized externally by applying group parameters from an external database.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/vpn/vpn_extserver.html

• Question 40:

  Which two types of digital certificate enrollment processes are available for the Cisco ASA security appliance? (Choose two.)

  A. LDAP
  B. FTP
  C. TFTP
  D. HTTP
  E. SCEP
  F. Manual
  E. SCEP
  F. Manual

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b25dc1.shtml and http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808b3cff.shtml