Cisco 642-647 Online Practice Questions and Exam Preparation

Cisco 642-647 Online Questions & Answers

• Question 71:

  Refer to the exhibit.

  

  A new NOC engineer is troubleshooting a VPN connection.

  Which statement about the fields within the Cisco VPN Client Statistics screen is correct?

  A. The ISP-assigned IP address of 10.0.21.1 is assigned to the VPN adapter of the PC.
  B. The IP address of the security appliance to which the Cisco VPN Client is connected is 192.168.1.2.
  C. CorpNet is the name of the Cisco ASA group policy whose tunnel parameters the connection is using.
  D. The ability of the client to send packets transparently and unencrypted through the tunnel for test purposes is turned off.
  E. With split tunneling enabled, the Cisco VPN Client registers no decrypted packets.
  B. The IP address of the security appliance to which the Cisco VPN Client is connected is 192.168.1.2.

• Question 72:

  A Unified Communications Certificate is used on the Cisco ASA appliance to support which option?

  A. certificate + double AAA authentication
  B. certificate + AAA authentication
  C. certificate maps
  D. Cisco ASA VPN clustering load balancing
  D. Cisco ASA VPN clustering load balancing

  ---

  Server Certificate Types Cisco uses these self-signed (own) certificate types in Cisco Unified Communications Manager servers: HTTPS certificate (tomcat_cert)--This self-signed root certificate is generated during the Cisco Unified Communications Manager installation for the HTTPS server. Cisco Unified Communications Manager node certificate--This self-signed root certificate automatically installs when you install Cisco Unified Communications Manager 5.1 for the Cisco Unified Communications Manager server. Cisco Unified Communications Manager certificates provide server identification, which includes the Cisco Unified Communications Manager server name and the Global Unique Identifier (GUID). CAPF certificate--The system copies this root certificate to all servers in the cluster after you complete the Cisco CTL client configuration. IPsec certificate (ipsec_cert)--This self-signed root certificate is generated during Cisco Unified Communications Manager installation for IPsec connections with MGCP and H.323 gateways. SRST-enabled gateway certificate-When you configure a secure SRST reference in Cisco Unified

  Communications Manager Administration, Cisco Unified Communications Manager retrieves the SRST enabled gateway certificate from the gateway and stores it in the Cisco Unified Communications Manager database. After you reset the devices, the certificate is added to the phone configuration file. Because the certificate is stored in the database, this certificate is not integrated into the certificate management tool.

  https://supportforums.cisco.com/docs/DOC-5964

  For more information on VPN Load Balancing/Clustering High Availability services of the ASA appliances please consult the configuraiton guide at http:// www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ vpnsysop.html#wp104 8834. Please check cisco.com for new versions of the document. For more information on configuring Certificates on the the ASA appliances please consult the configuration guide at check http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/cert_cfg.html .Please cisco.com for new versions of the document.

• Question 73:

  An on-screen keyboard is a programmable SSL VPN option. Which three options are keyboard- configurable parameters that the administrator can enable or disable? (Choose three.)

  A. Show only if Secure Desktop Vault is disabled.
  B. Do not show onscreen keyboard.
  C. Show only for the login page.
  D. Show for all user input fields.
  E. Show for all portal pages that require authentication.
  F. Show for all plug-in pages.
  B. Do not show onscreen keyboard.
  C. Show only for the login page.
  E. Show for all portal pages that require authentication.

  ---

  Onscreen keyboard The security appliance includes an onscreen keyboard option for the login page and subsequent authentication requests for internal resources. This provides additional protection against software-based keystroke loggers by requiring a user to use a mouse to click characters in an onscreen keyboard for authentication, rather than entering the characters on a physical keyboard.

• Question 74:

  Which option limits a clientless SSL VPN user to specific resources upon successful login?

  A. modify the Cisco ASA Modular Policy Framework access control
  B. user-defined bookmarks
  C. RADIUS authorization
  D. disable portal features
  B. user-defined bookmarks

  ---

  Effective with Cisco IOS Release 12.4(15)T, users can bookmark URLs while connected through an SSL VPN tunnel. Users can access the bookmarked URLs by clicking the URLs. User-level bookmarking is turned by default. There is no way to turn it off. To set the storage location, administrators can use the user-profile location command. If the user-profile location command is not configured, the location flash:/webvpn/{context name}/ is used.

• Question 75:

  Your corporation has contractors that need remote access to server desktops, in order to diagnose issues and load software during nonbusiness hours. Which three clientless SSL VPN configurations allow these contractors to access the desktops of remote servers? (Choose three.)

  A. XWindows bookmark by using the XWindows plug-in
  B. RDP bookmark by using the RDP plug-in
  C. SCP bookmark by using SCP plug-in
  D. VNC bookmark by using the VNC plug-in
  E. SSH bookmark by using the SSH plug-in
  F. Citrix plug-in by using the Citrix plug-in
  B. RDP bookmark by using the RDP plug-in
  D. VNC bookmark by using the VNC plug-in
  F. Citrix plug-in by using the Citrix plug-in

  ---

  

• Question 76:

  In a remote-access VPN solution, on which device or devices can dead peer detection be configured?

  A. remote device
  B. headend device
  C. both headend and remote devices
  D. Dead peer detection can be configured only on site-to-site VPN.
  C. both headend and remote devices

  ---

  Dead Peer Detection Dead Peer Detection (DPD) ensures that the security appliance (gateway) or the client can quickly detect a condition where the peer is not responding, and the connection has failed.

  Fields

  ?Gateway Side Detection--Uncheck the Disable check box to specify that DPD is performed by the security appliance (gateway). Enter the interval, from 30 to 3600 seconds, with which the security appliance performs

  DPD.

  ?Client Side Detection--Uncheck the Disable check box to specify that DPD is performed by the client.

  Enter the interval, from 30 to 3600 seconds, with which the client performs DPD.

• Question 77:

  When configuring the Cisco ASA for VPN clustering, which IP address or addresses does the end-user device connect to?

  A. It connects to individual device addresses of the cluster as provided in the connection profile.
  B. It connects to the virtual address.
  C. The virtual cluster manager sends the IP address of the least loaded device. The client then connects directly to that device.
  D. The connection IP address is dependent upon whether the initiator is using SSL or IPsec.
  B. It connects to the virtual address.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805fda25.shtml

• Question 78:

  Which statement about plug-ins is false?

  A. Plug-ins do not require any installation on the remote system.
  B. Plug-ins require administrator privileges on the remote system.
  C. Plug-ins support interactive terminal access.
  D. Plug-ins are not supported on the Windows Mobile platform.
  B. Plug-ins require administrator privileges on the remote system.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/deployhtml#wp 1162435

  Plug-ins

  The security appliance supports Java plug-ins for clientless SSL VPN connections. Plug-ins are Java programs that operate in a browser. These plug-ins include SSH/Telnet, RDP, VNC, and Citrix.

  Per the GNU General Public License (GPL), Cisco redistributes plug-ins without making any changes to them. Per the GPL, Cisco cannot directly enhance these plug-ins. To use plug-ins you must install Java Runtime Environment (JRE)

  1.4.2.x or greater. You must also use a compatible browser specified here: http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpncompatibility.html

• Question 79:

  Cisco AnyConnect profiles can be used to set which three options? (Choose three.)

  A. Define a list of VPN gateways that are presented to users upon login.
  B. Define a quarantine VLAN for remote devices that fail a host scan.
  C. Define a guest VLAN to all "noncompany" Cisco IOS WebVPN users.
  D. Define a list of backup servers if primary gateways are unavailable.
  E. Activate the SSL VPN tunnel as part of the Windows login sequence.
  F. Configure the Cisco Secure Desktop vault.
  A. Define a list of VPN gateways that are presented to users upon login.
  D. Define a list of backup servers if primary gateways are unavailable.
  E. Activate the SSL VPN tunnel as part of the Windows login sequence.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect20/administrative/guide/ad minapa.pdf

• Question 80:

  Refer to the exhibit.

  

  While configuring a site-to-site VPN tunnel, a new NOC engineer encounters the Reverse Route Injection parameter.

  Assuming that static routes are redistributed by the Cisco ASA to the IGP, what effect does enabling Reverse Route Injection on the local Cisco ASA have on a configuration?

  A. The local Cisco ASA advertises its default routes to the distant end of the site-to-site VPN tunnel.
  B. The local Cisco ASA advertises routes from the dynamic routing protocol that is running on the local Cisco ASA to the distant end of the site-to-site VPN tunnel.
  C. The local Cisco ASA advertises routes that are at the distant end of the site-to-site VPN tunnel.
  D. The local Cisco ASA advertises routes that are on its side of the site-to-site VPN tunnel to the distant end of the site-to-site VPN tunnel.
  C. The local Cisco ASA advertises routes that are at the distant end of the site-to-site VPN tunnel.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00809d07 de.shtml