Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 41:

  While configuring a new clientless SSL VPN group in Cisco ASDM, the administrator chooses to accept a number of the default parameter values. The administrator decides to view the actual value for the parameter, rather than just checking the inherit box.

  Under which default group can the administrator verify the default value for the group parameter?

  A. DefaultRAGroup
  B. DefaultWEBVPNGroup
  C. DfltGrpPolicy
  D. DefaultSVCGroup
  C. DfltGrpPolicy

• Question 42:

  You have been using pre-shared keys for IKE authentication on your VPN. Your network has grown rapidly, and now you need to create VPNs with numerous IPsec peers. How can you enable scaling to numerous IPsec peers?

  A. Migrate to external CA-based digital certificate authentication.
  B. Migrate to a load-balancing server.
  C. Migrate to a shared license server.
  D. Migrate from IPsec to SSL VPN client extended authentication.
  A. Migrate to external CA-based digital certificate authentication.

• Question 43:

  Refer to the exhibit.

  

  While troubleshooting a remote-access application, a new NOC engineer received the logging message that is shown in the exhibit. Which configuration is most likely to be mismatched?

  A. IKE configuration
  B. extended authentication configuration
  C. IPsec configuration
  D. digital certificate configuration
  C. IPsec configuration

  ---

  http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtmland %ASA-5-713259: Group = groupname, Username = username, IP = peerIP, Session is being torn down. Reason: reason The termination reason for the ISAKMP session appears, which occurs when the session is torn down through session management. 穏roupname--The tunnel group of the session being terminated 穟sername--The username of the session being terminated 穚eerIP--The peer address of the session being terminated 穜eason--The RADIUS termination reason of the session being terminated. Reasons include the following:

  - Port Preempted (simultaneous logins)

  - Idle Timeout

  - Max Time Exceeded

  - Administrator Reset

• Question 44:

  When deploying clientless SSL VPN advanced application access, the administrator needs to collect information about the end-user system. Which three input parameters of an end-user system are important for the administrator to identify? (Choose three.)

  A. types of applications and application protocols that are supported
  B. types of encryption that are supported on the end-user system
  C. the local privilege level of the remote user
  D. types of wireless security that are applied to the end-user tunnel interface
  E. types of operating systems that are supported on the end-user system
  F. type of antivirus software that is supported on the end-user system
  A. types of applications and application protocols that are supported
  C. the local privilege level of the remote user
  E. types of operating systems that are supported on the end-user system

  ---

  When enabling port forwarding, the SSL VPN gateway will modify the hosts file on the PC of the remote user. Some software configurations and software security applications will detect this modification and prompt the remote user to select "Yes" to permit. To permit the modification, the remote user must have local administrative privileges. To securely access resources on a private network behind an SSL VPN gateway, the remote user of an SSL VPN service must have the following: ?;Thin Clien"; support used for TCP port-forwarding applications requires administrative privileges on the computer of the remote user. ?;Tunnel mod"; for Cisco SSL VPN requires administrative privileges for initial installation of the full tunnel client. ?The remote user must have local administrative privileges to use thin client or full tunnel client features. Operating system support ?Microsoft Windows 2000, Windows XP, or Windows Vista ?Macintosh OS X 10.4.6 ?Linux (Redhat RHEL 3.0 +, FEDORA 5, or FEDORA 6) SSL VPN-supported browser--The following browsers have been verified for SSL VPN. Other browsers might not fully support SSL VPN features.

• Question 45:

  Which two options are correct regarding IKE and IPv6 VPN support on the Cisco ASA using version 8.4? (Choose two.)

  A. The Cisco ASA supports full IKEv2 IPv6 for site-to-site VPNs only.
  B. The Cisco ASA supports full IKEv2 IPv6 for remote-access VPNs.
  C. The Cisco ASA supports IKEv1 and IKEv2 configuration on the same crypto map.
  D. The Cisco ASA supports negotiation of authentication type using IKEv2 with IPv6.
  E. The Cisco ASA supports all types of VPN configurations when using IPv6
  A. The Cisco ASA supports full IKEv2 IPv6 for site-to-site VPNs only.
  C. The Cisco ASA supports IKEv1 and IKEv2 configuration on the same crypto map.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c25- 593781.html

  ?IPv6 IPsec Site-to-Site VPN: Customers can now create encrypted IPsec VPN connections over IPv6 networks

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_site2site.html#wp1061313

  For IKEv2, you can configure multiple encryption and authentication types, and multiple integrity algorithms for a single policy. The ASA orders the settings from the most secure to the least secure and negotiates with the peer using that order. This allows you to potentially send a single proposal to convey all the allowed transforms instead of the need to send each allowed combination as with IKEv1.

• Question 46:

  Refer to the exhibit.

  

  After being with the company for more than six months, Sue is no longer considered a new hire employee. In converting her from a new hire to a full-time employee, her SSL VPN address will change from the "Client requested address 10.0.4.120" to a random address from the employee address pool.

  To "disable" the 10.0.4.120 IP address, the network administrator should navigate to which Cisco ASDM pane?

  A. Connection Profile
  B. Group Policies
  C. Local Users
  D. Address Pools
  C. Local Users

  ---

  Users are assigned IP addresses based on the address pool associated with their group. Change group of Sue to use employee address pool

  

• Question 47:

  To enable the Cisco ASA Host Scan with remediation capabilities, an administrator must have which two Cisco ASA licenses enabled on its security appliance? (Choose two.)

  A. Cisco AnyConnect Premium license
  B. Cisco AnyConnect Essentials license
  C. Cisco AnyConnect Mobile license
  D. Host Scan license
  E. Advanced Endpoint Assessment license
  F. Cisco Security Agent license
  A. Cisco AnyConnect Premium license
  E. Advanced Endpoint Assessment license

• Question 48:

  Refer to the exhibit.

  

  While troubleshooting on a remote-access VPN application, a new NOC engineer received the message that is shown. What is the most likely cause of the problem?

  A. The IP address that is assigned to the PC of the VPN user is not within the range of addresses that are assigned to the SVC connection.
  B. The IP address that is assigned to the PC of the VPN user is in use. The remote user needs to select a different host address within the range.
  C. The IP address that is assigned to the PC of the VPN user is in the wrong subnet. The remote user needs to select a different host number within the correct subnet.
  D. The IP address pool for contractors was not applied to their connection profile.
  D. The IP address pool for contractors was not applied to their connection profile.

  ---

  %ASA-5-722006: Group group User user-name IP IP_address Invalid address IP_address assigned to SVC connection. An invalid address was assigned to the user. Recommended Action Verify and correct the address assignment, if possible.

• Question 49:

  In Cisco ASA Software Release 8.4.1, which three plug-ins are Cisco ASA-supported plug-ins? (Choose three.)

  A. SSH
  B. TN3270
  C. SCP
  D. RDP
  E. ICA
  F. ARAP
  A. SSH
  D. RDP
  E. ICA

• Question 50:

  Refer to the exhibit.

  

  A network administrator is duplicating a VPN client profile to send out to all members of the finance group. Three parameters might have been configured incorrectly. For each three letters, choose the correct answer. (Choose three.)

  A. A-Remote Client IP Address
  B. A-ASA Outside Interface IP Address
  C. B-Pre-Shared Keys Authentication Type
  D. B-Digital Certificate Authentication Type
  E. C-Save Password enabled
  F. C-Save Password disabled
  B. A-ASA Outside Interface IP Address
  C. B-Pre-Shared Keys Authentication Type
  E. C-Save Password enabled

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client500_501/administratio n/5vcAch5.html#wpmkr1201344