Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 61:

  Match the action on the left with the correct SSL VPN Portal Navigation button on the right.

  Select and Place:

  

  

• Question 62:

  When deploying remote-access IPsec VPN tunnels, what is the key benefit of digital certificates?

  A. resiliency
  B. simplification
  C. scalability
  D. centralization
  C. scalability

• Question 63:

  Refer to the exhibit.

  

  You are the network security administrator. You have received calls from site-to-site IPsec VPN users saying that they cannot connect into the network. In troubleshooting this problem, you discover that some sites can connect, but other sites cannot. It is not always the same sites experiencing problems. You suspect that the permitted number of simultaneous logins has been reached and needs to be increased.

  In which configuration window or tab should you accomplish this task?

  A. in the IKE Policies window
  B. in the IKE Parameters window
  C. in the System Options window
  D. in the Device Management tab
  C. in the System Options window

  ---

  Limit the maximum number of active IPSec VPN sessions

  --Enables or disables limiting the maximum number of active IPSec VPN sessions. The range depends on the hardware platform and the software license.

  Maximum Active IPSec VPN Sessions--Specifies the maximum number of active IPSec VPN sessions allowed. This field is active only when you select the preceding check box to limit the maximum number of active IPSec VPN sessions.

• Question 64:

  Your IT department needs to run a custom-built TCP application within the clientless SSL VPN tunnel. The network administrator suggests running the smart tunnel application. Which three statements concerning smart tunnel applications are true? (Choose three.)

  A. They support active FTP and other RTSP-based applications.
  B. They do not require administrator privileges on the remote system.
  C. They require the enabling of port forwarding.
  D. They are supported on Windows and MAC OS X platforms.
  E. They support native client applications over SSL VPN.
  F. They require the modification of the Host file on the end-user PC.
  B. They do not require administrator privileges on the remote system.
  D. They are supported on Windows and MAC OS X platforms.
  E. They support native client applications over SSL VPN.

  ---

  Smart Tunnel--Connects a Winsock 2, TCP-based application installed on the end station to a server on the intranet, using a clientless (browser-based) SSL VPN session with the security appliance as the pathway, and the security appliance

  as a proxy server. Smart Tunnel List--Select the list name from the drop-down menu if you want to provide smart tunnel access.

  Assigning a smart tunnel list to a group policy or username enables smart tunnel access for all users whose sessions are associated with the group policy or username, but restricts smart tunnel access to the applications specified in the list.

  To view, add, modify, or delete a smart tunnel list, click the adjacent Manage button. Auto Start (Smart Tunnel List)--Check to start smart tunnel access automatically upon user login. Uncheck to enable smart tunnel access upon user login,

  but require the user to start it manually, using the Application Access > Start Smart Tunnels button on the Clientless SSL VPN Portal Page. Auto Sign-on Server List--Select the list name from the drop-down menu if you want to reissue the

  user credentials when the user establishes a smart tunnel connection to a server. Each smart tunnel auto sign-on list entry identifies a server with which to automate the submission of user credentials. To view, add, modify, or delete a smart

  tunnel auto sign-on list, click the adjacent Manage button.

  Domain Name (Optional)--Specify the Windows domain to add it to the username during auto sign-on, if the universal naming convention (domain\username) is required for authentication. For example, enter CISCO to specify CISCO\jsmith

  when authenticating for the username jsmith. You must also check the "Use Windows domain name with user name" option when configuring associated entries in the auto sign-on server list.

• Question 65:

  Which statement is correct concerning the trusted network detection (TND) feature?

  A. The Cisco AnyConnect 3.0 Client supports TND on Windows, Mac, and Linux platforms.
  B. With TND, one result of a Cisco Secure Desktop basic scan on an endpoint is to determine whether a device is a member of a trusted or an untrusted network.
  C. If enabled, and a CSD scan determines that a host is a member of an untrusted network, an administrator can configure the TND feature to prohibit an end user from launching the Cisco AnyConnect VPN Client.
  D. When the user is inside the corporate network, TND can be configured to automatically disconnect a Cisco AnyConnect session.
  D. When the user is inside the corporate network, TND can be configured to automatically disconnect a Cisco AnyConnect session.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect25/administration/guide/ac 03features.html

  Trusted Network Detection Trusted Network Detection (TND) gives you the ability to have AnyConnect automatically disconnect a VPN connection when the user is inside the corporate network (the trusted network) and start the VPN connection when the user is outside the corporate network (the untrusted network). This feature encourages greater security awareness by initiating a VPN connection when the user is outside the trusted network.

  If AnyConnect is also running Start Before Logon (SBL), and the user moves into the trusted network, the SBL window displayed on the computer automatically closes. TND does not interfere with the ability of the user to manually establish a VPN connection. It does not disconnect a VPN connection that the user starts manually in the trusted network. TND only disconnects the VPN session if the user first connects in an untrusted network and moves into a trusted network. For example, TND disconnects the VPN session if the user makes a VPN connection at home and then moves into the corporate office. Because the TND feature controls the AnyConnect GUI and automatically initiates connections, the GUI should run at all times. If the user exits the GUI, TND does not automatically start the VPN connection.

  You configure TND in the AnyConnect profile. No changes are required to the ASA configuration.

• Question 66:

  In Cisco ASDM v6.4, what are four ways to implement single sign-on (SSO)? (Choose four.)

  A. Use SSO for smart tunnels.
  B. Use Kerberos SSO.
  C. Use the HTTP Form protocol.
  D. Use a dedicated SSO server.
  E. Use SSO for application plug-ins.
  F. Use auto sign-on for servers that do not require authentication credentials.
  A. Use SSO for smart tunnels.
  C. Use the HTTP Form protocol.
  D. Use a dedicated SSO server.
  E. Use SSO for application plug-ins.

  ---

  The security appliance can use the HTTP Form protocol for single sign-on (SSO) authentication of WebVPN users only. Single sign-on support lets WebVPN users enter a username and password only once to access multiple protected services and Web servers. The WebVPN server running on the security appliance acts as a proxy for the user to the authenticating server. When a user logs in, the WebVPN server sends an SSO authentication request, including username and password, to the authenticating server using HTTPS. If the server approves the authentication request, it returns an SSO authentication cookie to the WebVPN server. The security appliance keeps this cookie on behalf of the user and uses it to authenticate the user to secure websites within the domain protected by the SSO server. In addition to the HTTP Form protocol, WebVPN administrators can choose to configure SSO with the HTTP Basic and NTLM authentication protocols (the auto-signon command), or with Computer Associates eTrust SiteMinder SSO server (formerly Netegrity SiteMinder) as well. For an in-depth discussion of configuring SSO with either HTTP Forms, auto-signon or SiteMinder, The Auto Signon window or tab lets you configure or edit auto signon for users of Clientless SSL VPN. Auto signon is a simplified single signon method that you can use if you do not already have an SSO method deployed on your internal network. With auto signon configured for particular internal servers, the security appliance passes the login credentials that the user of Clientless SSL VPN entered to log in to the security appliance (username and password) to those particular internal servers. You configure the security appliance to respond to a specific authentication method for a particular range of servers. The authentication methods you can configure the security appliance to respond to consists of authentication using Basic (HTTP), NTLM, FTP and CIFS, or all of these methods. Auto signon is a straight-forward method for configuring SSO for particular internal servers. This section describes the procedure for setting up SSO with auto signon. If you already have SSO deployed using Computer Associates' SiteMinder SSO server, or if you have Security Assertion Markup Language (SAML) Browser Post Profile SSO,

• Question 67:

  Refer to the exhibit.

  

  Today was the first day on a new project for an offsite temporary worker at the XYZ Corporation. The worker was told to launch the SSL VPN session and then use the smart tunnel application to start a remote desktop application on the project server, projects_server.xyz.com. The worker looked at the portal screen that was provided, but she did not know how to access the smart tunnel application.

  As the help desk person, what should you instruct the temporary worker to do?

  A. Click the Web Applications button.
  B. Click the Applications Access button.
  C. Click the Browse Networks button.
  D. On the Home page, click the Address drop-down menu, choose RDP://, and fill in the destination host name, which is projects_server.abc.com.
  B. Click the Applications Access button.

• Question 68:

  Select and Place:

  Select and Place:

  

  

• Question 69:

  Refer to following Exhibit and answer the following question below:

  

  

  Which connection profile supports SSL VPN Client access only.

  A. Employee
  B. Contractor
  C. Management
  D. Engineering
  E. New_hire
  B. Contractor

  ---

  (Answer can change so follow the procedure below)

  Configuration > network client access > any connect connection profiles >connection profiles > edit for each profile > general > more options > tunneling protocol > see the check marks

  

• Question 70:

  Refer to the exhibit.

  

  What is the likely cause of the failure?

  A. A msgid of 0 signifies a zero payload, indicating that the peer did not send any IKE proposals.
  B. The remote peer did not respond to the 11 notifications that were sent by the originating IPsec endpoint.
  C. There are mismatched IKE policies.
  D. There are mismatched tunnel groups.
  C. There are mismatched IKE policies.

  ---

  %ASA-5-713257: Phase var1 failure: Mismatched attribute types for class var2: Rcv'd: var3 Cfg'd: var4

  An adaptive security appliance has acted as the responder in a LAN-to-LAN connection. It indicates that the adaptive security appliance crypto configuration does not match the configuration of the initiator. The message specifies during which phase the mismatch occurred, and which attributes both the responder and the initiator had that were different.

  穠ar1--The phase during which the mismatch occurred穠ar2--The class to which the attributes that do not match belong穠ar3--The attribute received from the initiator 穠ar4--The attribute configured