Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 51:

  ABC Corporation has hired a temporary worker to help out with a new project. The network administrator gives you the task of restricting the internal clientless SSL VPN network access of the temporary worker to one server with the IP address of 172.26.26.50 via HTTP.

  Which two actions should you take to complete the assignment? (Choose two.)

  A. Configure access-list temp_acl webtype permit url http://172.26.26.50.
  B. Configure access-list temp_acl_stand_ACL standard permit host 172.26.26.50.
  C. Configure access-list temp_acl_extended extended permit http any host 172.26.26.50.
  D. Apply the access list to the temporary worker Group Policy.
  E. Apply the access list to the temporary worker Connection Profile.
  F. Apply the access list to the outside interface in the inbound direction.
  A. Configure access-list temp_acl webtype permit url http://172.26.26.50.
  D. Apply the access list to the temporary worker Group Policy.

  ---

  Web ACLs The Web ACLs table displays the filters configured on the security appliance applicable to Clientless SSL VPN traffic. The table shows the name of each access control list (ACL), and below and indented to the right of the ACL name, the access control entries (ACEs) assigned to the ACL. Each ACL permits or denies access permits or denies access to specific networks, subnets, hosts, and web servers. Each ACE specifies one rule that serves the function of the ACL. You can configure ACLs to apply to Clientless SSL VPN traffic. The following rules apply: ?If you do not configure any filters, all connections are permitted. ?The security appliance supports only an inbound ACL on an interface. ?At the end of each ACL, an implicit, unwritten rule denies all traffic that is not explicitly permitted. You can use the following wildcard characters to define more than one wildcard in the Webtype access list entry: ?Enter an asterisk";"; to match no characters or any number of characters. ?Enter a question mark";"; to match any one character exactly. ?Enter square bracket"t;"t; to create a range operator that matches any one character in a range. The following examples show how to use wildcards in Webtype access lists. ?The following example matches URLs such as http:// www.cisco.com/ and http://wwz.caco.com/: access-list test webtype permit url http://ww?.c*co*/

• Question 52:

  The software-based Cisco IPsec VPN Client solution uses bidirectional authentication, in which the client authenticates the Cisco ASA, and the Cisco ASA authenticates the user. Which three methods are software-based Cisco IPsec VPN Client to Cisco ASA authentication methods? (Choose three.)

  A. Unified Client Certificate authentication
  B. Secure Unit authentication
  C. Hybrid authentication
  D. Certificate authentication
  E. Group authentication
  C. Hybrid authentication
  D. Certificate authentication
  E. Group authentication

  ---

  ASDM user guide Page 35-69

  Authentication Mode--Specifies the authentication mode: none, xauth, or hybrid. hybrid--Specifies the use of Hybrid mode, which lets you use digital certificates for security appliance authentication and a different, legacy method--such as

  RADIUS, TACACS+ or SecurID--for remote VPN user authentication. This mode breaks phase 1 of the Internet Key Exchange (IKE) into the following steps, together called hybrid authentication:

  xauth--Specifies the use of IKE Extended Authentication mode, which provides the capability of authenticating a user within IKE using TACACS+ or RADIUS.

• Question 53:

  Refer to the exhibit.

  

  As the administrator of a Cisco ASA security appliance for remote-access IPsec VPNs, you are assisting a user who has a digital certificate that is configured for the Cisco VPN Client. Based on the exhibit, what do you do to find the MD5 thumbprint of the "level_2" certificate?

  A. Choose the certificate, then click Status > Certificates from the menu bar.
  B. Choose the certificate, then click the View button.
  C. Choose the certificate, then click Options > Properties from the menu bar.
  D. Choose the certificate, then click the Verify button.
  B. Choose the certificate, then click the View button.

• Question 54:

  When troubleshooting a site-to-site IPsec VPN deployment, you see a QM FSM message. What is the most likely cause of this message?

  A. The Quick Mode timers have expired.
  B. There are mismatched proxy identities.
  C. Forward Secrecy Mode has failed.
  D. IKE Phase 1 has failed authentication due to mismatched DH groups.
  B. There are mismatched proxy identities.

  ---

  http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml#qms

  QM FSM Error

  The IPsec L2L VPN tunnel does not come up on the PIX firewall or ASA, and the QM FSM error message appears. One possible reason is the proxy identities, such as interesting traffic, access control list (ACL) or crypto ACL, do not match

  on both the ends. Check the configuration on both the devices, and make sure that the crypto ACLs match.

  Another possible reason is mismatching of the transform set parameters. Make sure that at both ends, VPN gateways use the same transform set with the exact same parameters.

• Question 55:

  Which feature is supported when implementing an IPsec VPN configuration using IKEv2?

  A. IKEv2 authentication can be configured to negotiate authentication modes within the IKE policy when using Cisco ASDM.
  B. IKEv2 proposals are identical to IKEv1 policies.
  C. When implementing IKEv2 with a site-to-site VPN, authentication parameters should contain a fallback to to PSKs, in case certificate-based authentication fails.
  D. IKEv2 peer authentication can be implemented with asymmetric authentication methods.
  D. IKEv2 peer authentication can be implemented with asymmetric authentication methods.

• Question 56:

  You are configuring bookmarks for the clientless SSL VPN portal without the use of plug-ins.

  Which three bookmark types are supported? (Choose three.)

  A. RDP
  B. HTTP
  C. FTP
  D. CIFS
  E. SSH
  F. Telnet
  B. HTTP
  C. FTP
  D. CIFS

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/deploy.html#w p1227212

• Question 57:

  An XYZ Corporation systems engineer, while making a sales call on the ABC Corporation headquarters, tried to access the XYZ sales demonstration folder to transfer a demonstration via FTP from an ABC conference room behind the firewall. The engineer could not reach XYZ through the remote-access VPN tunnel. From home the previous day, however, the engineer did connect to the XYZ sales demonstration folder and transferred the demonstration via IPsec over DSL.

  To get the connection to work and transfer the demonstration, what should the engineer do?

  A. Change the MTU size on the IPsec client to account for the change from DSL to cable transmission.
  B. Enable the local LAN access option on the IPsec client.
  C. Enable the IPsec over TCP option on the IPsec client.
  D. Enable the clientless SSL VPN option on the PC.
  C. Enable the IPsec over TCP option on the IPsec client.

  ---

  IP Security (IPSec) over Transmission Control Protocol (TCP) enables a VPN Client to operate in an environment in which standard Encapsulating Security Protocol (ESP, Protocol 50) or Internet Key Exchange (IKE, User Datagram Protocol (UDP) 500) cannot function, or can function only with modification to existing firewall rules. IPSec over TCP encapsulates both the IKE and IPSec protocols within a TCP packet, and it enables secure tunneling through both Network Address Translation (NAT) and Port Address Translation (PAT) devices and firewalls

• Question 58:

  A remote user who establishes a clientless SSL VPN session is presented with a web page. The administrator has the option to customize the "look and feel" of the page. What are three components of the VPN Customization Editor? (Choose three.)

  A. Application page
  B. Logon page
  C. Networking page
  D. Logout page
  E. Home page
  F. Portal page
  B. Logon page
  D. Logout page
  F. Portal page

  ---

  GUI Enhancements In Cisco IOS Release 12.4(15)T, ergonomic improvements were made to the GUI user interface of the Cisco IOS SSL VPN gateway. The improved customization of the user interface provides for greater flexibility and the ability to tailor portal pages for individualized looks. Enhancements were made to the following web screens: ?Login screen ?Portal page

• Question 59:

  Refer to the exhibit.

  

  Which two statements are correct regarding these two Cisco ASA clientless SSL VPN bookmarks? (Choose two.)

  A. CSCO_WEBVPN_USERNAME is a user attribute.
  B. CSCO_WEBVPN_USERNAME is a Cisco predefined variable that is used for macro substitution.
  C. The CSCO_WEBVPN_USERNAME variable is enabled by using the Post SSO plug-in.
  D. CSCO_SSO is a Cisco predefined variable that is used for macro substitution.
  E. The CSCO_SSO=1 parameter enables SSO for the SSH plug-in.
  F. The CSCO_SSO variable is enabled by using the Post SSO plug-in.
  B. CSCO_WEBVPN_USERNAME is a Cisco predefined variable that is used for macro substitution.
  E. The CSCO_SSO=1 parameter enables SSO for the SSH plug-in.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/deploy.html

  Introduction to URL Variable Substitution:

  Your configuration will most likely require personalized resources that contain the username and password, for example, in URL lists or in group URLs. URL variable substitution lets the remote user enter username and password credentials once, when initiating the session, then login automatically to internal resources such as Citrix, OWA, Sharepoint, and the internal portal.

  Clientless SSL VPN supports the following macro substitutions:

  CSCO_WEBVPN_USERNAME--User login name

  CSCO_WEBVPN_PASSWORD--Obtained from user login password CSCO_WEBVPN_INTERNAL_PASSWORD--Obtained from the Internal password field. You can use this field as Domain for Single Signon operations.

  CSCO_WEBVPN_CONNECTION_PROFILE--User login group drop-down (tunnel group alias)

  CSCO_WEBVPN_MACRO1--Set via Radius or LDAP vendor specific attribute CSCO_WEBVPN_MACRO2--Set via Radius or LDAP vendor specific attribute Each time the security appliance recognizes one of these strings in an end-user request, it replaces the string with the user-specific value before passing the request to a remote server.

  For example, a URL list that contains the link:

  http://someserver/homepage/CSCO_WEBVPN_USERNAME.

  Html is translated by the security appliance to the following links for SSL VPN USER1 and USER2:

  http://someserver/homepage/USER1.html

  http://someserver/homepage/USER2.html

• Question 60:

  Which Cisco ASA SSL VPN feature provides support for PCI compliance by allowing for the validation of two sets of username and password credentials on the SSL VPN login page?

  A. Single Sign-On
  B. Certificate to Profile Mapping
  C. Double Authentication
  D. RSA OTP
  C. Double Authentication