Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 1:

  Refer to following Exhibit and answer the following question below:

  

  

  

  The user, contractor1, receives an IP address when the VPN connection is established. Which statement regarding the IP address is true?

  A. it is sourced from the contractor pool.
  B. it is sourced from the employee pool.
  C. it is sourced from the engineering pool.
  D. it is sourced from the management pool.
  E. it is dedicated address (10.0.4.120)
  C. it is sourced from the engineering pool.

  ---

  First see username in device management >> see its group policy then go to remote access VPN >> connection profiles >> client address pools >> contractor >> select to see the address pool Through MonitoringVPN statistics > session >> see username and its assigned ip address >> then find it out in configuration tab above procedure old DD download contained Exam question 30 (As Q29) that had answer of contractor not engineering like for this question35.

• Question 2:

  When a VPN client that is using redundant peering and has obtained an IP address from the primary VPN gateway loses connection to that gateway, how is traffic rerouted?

  A. The secondary VPN gateway automatically routes the traffic back to the client using the same IP address.
  B. Redundant Internet routing protocols reroute the traffic to and from the client and the gateway.
  C. The secondary VPN gateway issues the client a new IP address and routes traffic accordingly.
  D. Traffic flow stops, and the client must reestablish connection. Once connection is established, the same IP address is issued to the client and similarly routed.
  C. The secondary VPN gateway issues the client a new IP address and routes traffic accordingly.

• Question 3:

  In clientless SSL VPN, administrators can control user access to the internal network or resources of a company. What is this control based on?

  A. interface ACLs
  B. WebType ACLs
  C. per-user or per-group ACLs
  D. MPF-configured service policies
  B. WebType ACLs

  ---

  

• Question 4:

  Which three statements concerning keystroke logger detection are correct? (Choose three.)

  A. It requires administrative privileges in order to run.
  B. It runs on Windows and MAC OS X systems.
  C. It detects loggers that run as a process or kernel module.
  D. It detects both hardware- and software-based keystroke loggers.
  E. It allows the administrator to define "safe" keystroke logger applications.
  A. It requires administrative privileges in order to run.
  C. It detects loggers that run as a process or kernel module.
  E. It allows the administrator to define "safe" keystroke logger applications.

  ---

  http://www.cisco.com/en/US/docs/security/csd/csd321/configuration/guide/CSDJfaq.html and http://www.cisco.com/en/US/docs/security/csd/csd_32/configuration/guide/CSDJtuto.html

• Question 5:

  Which three statements are Cisco AnyConnect VPN Client deployment options? (Choose three.)

  A. Configure the Cisco AnyConnect profile to automatically launch client or clientless SSL VPN upon discovering a trusted network.
  B. Automatically download the Cisco AnyConnect VPN Client upon Cisco IOS WebVPN login.
  C. Prompt user upon Cisco IOS WebVPN login to select client or clientless SSL VPN within X seconds.
  D. Configure the Cisco AnyConnect profile to automatically disconnect the client or clientless SSL VPN tunnel upon discovering an untrusted network.
  E. User manually launches client from SSL VPN clientless portal.
  B. Automatically download the Cisco AnyConnect VPN Client upon Cisco IOS WebVPN login.
  C. Prompt user upon Cisco IOS WebVPN login to select client or clientless SSL VPN within X seconds.
  E. User manually launches client from SSL VPN clientless portal.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/administration/guide/ac 01intro.html

• Question 6:

  Refer to following Exhibit and answer the following question below: The user, contractor1, will receive an IP address when the VPN connection is established. Which statement regarding the IP address is true?

  

  

  A. Is sourced from the contractor pool
  B. Is sourced from the employee pool
  C. Is sourced from the engineering pool
  D. Is sourced from the management pool
  E. Is a dedicated address (10.0.4.1 20)
  A. Is sourced from the contractor pool

  ---

  Explanation:

  

  Through configuration first see username in device management >> see its group policy then go to remote access VPN >> connection profiles >> client address pools >> contractor >> select t see the address pool Through Monitoring VPN statistics > session >> see username and its assigned ip address >> then find it out in configuration tab above procedure

  

• Question 7:

  When attempting to tunnel FTP traffic through a stateful firewall that might be performing NAT or PAT, which type of VPN tunneling should you use to allow the VPN traffic through the stateful firewall?

  A. clientless SSL VPN
  B. IPsec over TCP
  C. smart tunnel
  D. SSL VPN plug-ins
  B. IPsec over TCP

  ---

  IP Security (IPSec) over Transmission Control Protocol (TCP) enables a VPN Client to operate in an environment in which standard Encapsulating Security Protocol (ESP, Protocol 50) or Internet Key Exchange (IKE, User Datagram Protocol (UDP) 500) cannot function, or can function only with modification to existing firewall rules. IPSec over TCP encapsulates both the IKE and IPSec protocols within a TCP packet, and it enables secure tunneling through both Network Address Translation (NAT) and Port Address Translation (PAT) devices and firewalls

• Question 8:

  Which statement is correct concerning the trusted network detection (TND) feature?

  A. The Cisco AnyConnect 3.0 Client supports TND on Windows, Mac, and Linux platforms.
  B. With TND, one result of a Cisco Secure Desktop basic scan on an endpoint is to determine whether a device is a member of a trusted or an untrusted network.
  C. If enabled, and a CSD scan determines that a host is a member of an untrusted network, an administrator can configure the TND feature to prohibit an end user from launching the Cisco AnyConnect VPN Client.
  D. When the user is inside the corporate network, TND can be configured to automatically disconnect a Cisco AnyConnect session.
  D. When the user is inside the corporate network, TND can be configured to automatically disconnect a Cisco AnyConnect session.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect25/administration/guide/ac 03features.html

  Trusted Network Detection Trusted Network Detection (TND) gives you the ability to have AnyConnect automatically disconnect a VPN connection when the user is inside the corporate network (the trusted network) and start the VPN connection when the user is outside the corporate network (the untrusted network). This feature encourages greater security awareness by initiating a VPN connection when the user is outside the trusted network.

  If AnyConnect is also running Start Before Logon (SBL), and the user moves into the trusted network, the SBL window displayed on the computer automatically closes. TND does not interfere with the ability of the user to manually establish a VPN connection. It does not disconnect a VPN connection that the user starts manually in the trusted network. TND only disconnects the VPN session if the user first connects in an untrusted network and moves into a trusted network. For example, TND disconnects the VPN session if the user makes a VPN connection at home and then moves into the corporate office. Because the TND feature controls the AnyConnect GUI and automatically initiates connections, the GUI should run at all times. If the user exits the GUI, TND does not automatically start the VPN connection.

  You configure TND in the AnyConnect profile. No changes are required to the ASA configuration.

• Question 9:

  When troubleshooting a site-to-site IPsec VPN deployment, you see a QM FSM message. What is the most likely cause of this message?

  A. The Quick Mode timers have expired.
  B. There are mismatched proxy identities.
  C. Forward Secrecy Mode has failed.
  D. IKE Phase 1 has failed authentication due to mismatched DH groups.
  B. There are mismatched proxy identities.

  ---

  http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml#qms

  QM FSM Error

  The IPsec L2L VPN tunnel does not come up on the PIX firewall or ASA, and the QM FSM error message appears. One possible reason is the proxy identities, such as interesting traffic, access control list (ACL) or crypto ACL, do not match

  on both the ends. Check the configuration on both the devices, and make sure that the crypto ACLs match.

  Another possible reason is mismatching of the transform set parameters. Make sure that at both ends, VPN gateways use the same transform set with the exact same parameters.

• Question 10:

  ABC Corporation has hired a temporary worker to help out with a new project. The network administrator gives you the task of restricting the internal clientless SSL VPN network access of the temporary worker to one server with the IP address of 172.26.26.50 via HTTP.

  Which two actions should you take to complete the assignment? (Choose two.)

  A. Configure access-list temp_acl webtype permit url http://172.26.26.50.
  B. Configure access-list temp_acl_stand_ACL standard permit host 172.26.26.50.
  C. Configure access-list temp_acl_extended extended permit http any host 172.26.26.50.
  D. Apply the access list to the temporary worker Group Policy.
  E. Apply the access list to the temporary worker Connection Profile.
  F. Apply the access list to the outside interface in the inbound direction.
  A. Configure access-list temp_acl webtype permit url http://172.26.26.50.
  D. Apply the access list to the temporary worker Group Policy.

  ---

  Web ACLs The Web ACLs table displays the filters configured on the security appliance applicable to Clientless SSL VPN traffic. The table shows the name of each access control list (ACL), and below and indented to the right of the ACL name, the access control entries (ACEs) assigned to the ACL. Each ACL permits or denies access permits or denies access to specific networks, subnets, hosts, and web servers. Each ACE specifies one rule that serves the function of the ACL. You can configure ACLs to apply to Clientless SSL VPN traffic. The following rules apply: ?If you do not configure any filters, all connections are permitted. ?The security appliance supports only an inbound ACL on an interface. ?At the end of each ACL, an implicit, unwritten rule denies all traffic that is not explicitly permitted. You can use the following wildcard characters to define more than one wildcard in the Webtype access list entry: ?Enter an asterisk";"; to match no characters or any number of characters. ?Enter a question mark";"; to match any one character exactly. ?Enter square bracket"t;"t; to create a range operator that matches any one character in a range. The following examples show how to use wildcards in Webtype access lists. ?The following example matches URLs such as http:// www.cisco.com/ and http://wwz.caco.com/: access-list test webtype permit url http://ww?.c*co*/