Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 91:

  Authorization of a clientless SSL VPN defines the actions that a user may perform within a clientless SSL VPN session. Which statement is correct concerning the SSL VPN authorization process?

  A. Remote clients can be authorized by applying a dynamic access policy, which is configured on an external AAA server.
  B. Remote clients can be authorized externally by applying group parameters from an external database.
  C. Remote client authorization is supported by RADIUS and TACACS+ protocols.
  D. To configure external authorization, you must configure the Cisco ASA for cut-through proxy.
  B. Remote clients can be authorized externally by applying group parameters from an external database.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/vpn/vpn_extserver.html

• Question 92:

  Refer to the exhibit.

  

  You have configured two SSL VPN Certificate to Connection Profile Maps for all employee and management users. The Connection Profiles for the management users are not being applied when the "management" users connect.

  Based on the configuration that is shown, what is the most likely cause of this issue?

  A. The rule priority of the employee mapping is not low enough, and it needs to be lowered to 1.
  B. The priority of the employee mapping is too low, and it needs to be increased, but not higher than the rule priority of the management mapping.
  C. The priority of the management mapping is too high, and it needs to be lower than the rule priority of the employee mapping.
  D. The matching criteria for the management mapping is too specific, and the CN matching parameter should be removed.
  C. The priority of the management mapping is too high, and it needs to be lower than the rule priority of the employee mapping.

  ---

  ASDM user guide p[age 35 52 Use the Add/Edit Certificate Matching Rule dialog box to assign the name of a list (map) to a connection profile. Fields ?Map--Choose one of the following: - Existing--Select the name of the map to include the rule. New--Enter a new map name for a rule. ?Rule Priority--Type a decimal to specify the sequence with which the security appliance evaluates the map when it receives a connection request. For the first rule defined, the default priority is 10. The security appliance evaluates each connection against the map with the lowest priority number first. ?Mapped to Connection Profile--Select the connection profile, formerly called a "tunnel group," to map to this rule. If you do not assign a rule criterion to the map, as described in the next section, the security appliance ignores the map entry.

  

• Question 93:

  Datagram Transport Layer Security (DTLS) was introduced to solve performance issues. Choose three characteristics of DTLS. (Choose three.)

  A. It uses TLS to negotiate and establish DTLS connections.
  B. It uses DTLS to transmit datagrams.
  C. It is disabled by default.
  D. It uses TLS for data packet retransmission.
  E. It replaces underlying transport layer with UDP 443.
  F. It uses TLS to provide low-latency video application tunneling.
  A. It uses TLS to negotiate and establish DTLS connections.
  B. It uses DTLS to transmit datagrams.
  E. It replaces underlying transport layer with UDP 443.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect23/administration/23admin 2.html#wp1029596

  Enabling Datagram Transport Layer Security (DTLS) with AnyConnect (SSL) Connections Datagram Transport Layer Security avoids latency and bandwidth problems associated with some SSL-only connections, including AnyConnect connections, and improves the performance of real-time applications that are sensitive to packet delays. DTLS is a standards-based SSL protocol that provides a low-latency data path using UDP. For detailed information about DTLS, see RFC 4347 (http://www.ietf.org/rfc/rfc4347.txt). Datagram Transport Layer Security (DTLS) allows the AnyConnect client establishing an SSL VPN connection to use two simultaneous tunnels--an SSL tunnel and a DTLS tunnel. Using DTLS avoids latency and bandwidth problems associated with some SSL connections and improves the performance of real-time applications that are sensitive to packet delays. If you do not enable DTLS, AnyConnect/SSL VPN connections connect with an SSL VPN tunnel only. You cannot enable DTLS globally with ASDM. The following section describes how to enable DTLS for any specific interface. To enable DTLS for a specific interface, select Configuration > Remote Access VPN > Network (Client) Access > Advanced > SSL VPN Connection profiles. The SSL VPN Connection Profiles dialog box opens (Figure 2-3).Figure 2-3 Enable DTLS Check Box

  

  Enabling Datagram Transport Layer Security (DTLS) allows the AnyConnect VPN Client establishing an SSL VPN connection to use two simultaneous tunnels--an SSL tunnel and a DTLS tunnel. Using DTLS avoids latency and bandwidth problems associated with some SSL connections and improves the performance of realtime applications that are sensitive to packet delays. If you do not enable DTLS, AnyConnect client users establishing SSL VPN connections connect with an SSL VPN tunnel only. Fields ?Interface--Displays a list of interfaces on the security appliance. ?DTLS Enabled--Check to enable DTLS connections with the AnyConnect client on the interfaces. ?UDP Port (default 443)--(Optional) Specify a separate UDP port for DTLS connections.

• Question 94:

  Refer to the exhibit.

  

  While troubleshooting on a remote-access VPN application, a new NOC engineer received the message that is shown. What is the most likely cause of the problem?

  A. The IP address that is assigned to the PC of the VPN user is not within the range of addresses that are assigned to the SVC connection.
  B. The IP address that is assigned to the PC of the VPN user is in use. The remote user needs to select a different host address within the range.
  C. The IP address that is assigned to the PC of the VPN user is in the wrong subnet. The remote user needs to select a different host number within the correct subnet.
  D. The IP address pool for contractors was not applied to their connection profile.
  D. The IP address pool for contractors was not applied to their connection profile.

  ---

  %ASA-5-722006: Group group User user-name IP IP_address Invalid address IP_address assigned to SVC connection. An invalid address was assigned to the user. Recommended Action Verify and correct the address assignment, if possible.

• Question 95:

  Refer to the exhibit.

  

  While troubleshooting a remote-access application, a new NOC engineer received the logging message that is shown in the exhibit. Which configuration is most likely to be mismatched?

  A. IKE configuration
  B. extended authentication configuration
  C. IPsec configuration
  D. digital certificate configuration
  C. IPsec configuration

  ---

  http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtmland %ASA-5-713259: Group = groupname, Username = username, IP = peerIP, Session is being torn down. Reason: reason The termination reason for the ISAKMP session appears, which occurs when the session is torn down through session management. 穏roupname--The tunnel group of the session being terminated 穟sername--The username of the session being terminated 穚eerIP--The peer address of the session being terminated 穜eason--The RADIUS termination reason of the session being terminated. Reasons include the following:

  - Port Preempted (simultaneous logins)

  - Idle Timeout

  - Max Time Exceeded

  - Administrator Reset

• Question 96:

  The administrator configured a Cisco ASA 5505 as a Cisco Easy VPN hardware client and also defined a list of Cisco Easy VPN backup servers in the Cisco ASA 5505. After an outage of the primary VPN server, you notice that your Cisco Easy VPN hardware client has now reconnected via a backup server that was not defined within the original Cisco Easy VPN backup servers list. Where did your Cisco Easy VPN hardware client get this backup server?

  A. The backup servers that you listed were no longer available, so the Cisco Easy VPN hardware client queried the load balance server for a "new" backup server address.
  B. The backup servers that you listed were no longer available, so a Group Policy that was configured on the primary VPN server pushed "new" backup server addresses to your client.
  C. The backup servers that you listed were no longer available, so the Cisco Easy VPN hardware client queried the primary VPN server via RADIUS protocol for a "new" backup server address.
  D. The backup servers that you listed were no longer available, so the Cisco Easy VPN hardware client queried and received from a predefined LDAP server a "new" backup server address.
  B. The backup servers that you listed were no longer available, so a Group Policy that was configured on the primary VPN server pushed "new" backup server addresses to your client.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/b.html#wp1366328

  Usage Guidelines To remove the backup-servers attribute from the running configuration, use the no form of this command without arguments. This enables inheritance of a value for backup-servers from another group policy. IPsec backup servers let a VPN client connect to the central site when the primary ASA is unavailable. When you configure backup servers, the ASA pushes the server list to the client as the IPSsec tunnel is established.

  Configure backup servers either on the client or on the primary ASA. If you configure backup servers on the ASA, it pushes the backup server policy to the clients in the group, replacing the backup server list on the client if one is configured.

• Question 97:

  Refer to the exhibit.

  

  After being with the company for more than six months, Sue is no longer considered a new hire employee. In converting her from a new hire to a full-time employee, her SSL VPN address will change from the "Client requested address 10.0.4.120" to a random address from the employee address pool.

  To "disable" the 10.0.4.120 IP address, the network administrator should navigate to which Cisco ASDM pane?

  A. Connection Profile
  B. Group Policies
  C. Local Users
  D. Address Pools
  C. Local Users

  ---

  Users are assigned IP addresses based on the address pool associated with their group. Change group of Sue to use employee address pool

  

• Question 98:

  Refer to the exhibit.

  

  A NOC engineer needs to tune some postlogin parameters on an SSL VPN tunnel.

  From the information shown, where should the engineer navigate to, in order to find all the postlogin session parameters?

  A. "engineering" Group Policy
  B. "contractor" Connection Profile
  C. DefaultWEBVPNGroup Group Policy
  D. DefaultRAGroup Group Policy
  E. "engineer1" AAA/Local Users
  A. "engineering" Group Policy

  ---

  http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htwebvpn.html#wp1054618

  The policy group is a container that defines the presentation of the portal and the permissions for resources that are configured for a group of remote users. Entering the policy group command places the router in webvpn group policy

  configuration mode. After it is configured, the group policy is attached to the SSL VPN context configuration by configuring the default-group-policy command.

  The following tasks are accomplished in this configuration:

  The presentation of the SSL VPN portal page is configured.

  A NetBIOS server list is referenced.

  A port-forwarding list is referenced.

  The idle and session timers are configured.

  A URL list is referenced.

• Question 99:

  Refer to the exhibit.

  

  For the ABC Corporation, members of the NOC need the ability to select tunnel groups from a drop-down menu on the Cisco WebVPN login page.

  As the Cisco ASA administrator, how would you accomplish this task?

  A. Define a special identity certificate with multiple groups, which are defined in the certificate OU field, that will grant the certificate holder access to the named groups on the login page.
  B. Under Group Policies, define a default group that encompasses the required individual groups that will appear on the login page.
  C. Under Connection Profiles, define a NOC profile that encompasses the required individual profiles that will appear on the login page.
  D. Under Connection Profiles, enable "Allow user to select connection profile."
  D. Under Connection Profiles, enable "Allow user to select connection profile."

  ---

  Cisco ASDM User Guide Version 6.1 Add or Edit SSL VPN Connections > Advanced > SSL VPN This dialog box lets you configure attributes that affect what the remote user sees upon login. Fields ?Login Page Customization--Configures the look and feel of the user login page by specifying which preconfigured customization attributes to apply. The default is DfltCustomization. ?Manage--Opens the Configure GUI Customization Objects window. ?Connection Aliases--Lists in a table the existing connection aliases and their status and lets you add or delete items in that table. A connection alias appears on the user login page if the connection is configured to allow users to select a particular connection (tunnel group) at login. Add--Opens the Add Connection Alias window, on which you can add and enable a connection alias. Delete-- Removes the selected row from the connection alias table. There is no confirmation or undo. ?Group URLs--Lists in a table the existing group URLs and their status and lets you add or delete items in that table. A group URL appears on the user login page if the connection is configured to allow users to select a particular group at login. Add--Opens the Add Group URL window, on which you can add and enable a group URL. Delete--Removes the selected row from the connection alias table. There is no confirmation or undo.

• Question 100:

  Match the protocol or port number on the left with the correct protocol or application on the right. (Not all items used.)

  Select and Place: