Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 101:

  Your corporation has contractors that need remote access to server desktops, in order to diagnose issues and load software during nonbusiness hours. Which three clientless SSL VPN configurations allow these contractors to access the desktops of remote servers? (Choose three.)

  A. XWindows bookmark by using the XWindows plug-in
  B. RDP bookmark by using the RDP plug-in
  C. SCP bookmark by using SCP plug-in
  D. VNC bookmark by using the VNC plug-in
  E. SSH bookmark by using the SSH plug-in
  F. Citrix plug-in by using the Citrix plug-in
  B. RDP bookmark by using the RDP plug-in
  D. VNC bookmark by using the VNC plug-in
  F. Citrix plug-in by using the Citrix plug-in

  ---

  

• Question 102:

  In which three ways can a Cisco ASA security appliance obtain a certificate revocation list? (Choose three.)

  A. FTP
  B. SCEP
  C. TFTP
  D. HTTP
  E. LDAP
  F. SCP
  B. SCEP
  D. HTTP
  E. LDAP

  ---

  CRLs

  CRLs provide the ASA with one way of determining whether a certificate that is within its valid time range has been revoked by the issuing CA. CRL configuration is part of configuration of a trustpoint.

  You can configure the ASA to make CRL checks mandatory when authenticating a certificate by using the revocation-check crl command. You can also make the CRL check optional by using the revocation-check crl none command, which

  allows the certificate authentication to succeed when the CA is unavailable to provide updated CRL data.

  The ASA can retrieve CRLs from CAs using HTTP, SCEP, or LDAP. CRLs retrieved for each trustpoint are cached for a configurable amount of time for each trustpoint.

  When the ASA has cached a CRL for longer than the amount of time it is configured to cache CRLs, the ASA considers the CRL too old to be reliable, or "stale." The ASA tries to retrieve a newer version of the CRL the next time that a

  certificate authentication requires a check of the stale CRL.

  The ASA caches CRLs for an amount of time determined by the following two factors:

  稵he number of minutes specified with the cache-time command. The default value is 60 minutes. 稵he NextUpdate field in the CRLs retrieved, which may be absent from CRLs. You control whether the ASA requires and uses the NextUpdate

  field with the enforcenextupdate command. The ASA uses these two factors in the following ways:

  稩f the NextUpdate field is not required, the ASA marks CRLs as stale after the length of time defined by the cache-time command. 稩f the NextUpdate field is required, the ASA marks CRLs as stale at the sooner of the two times specified by

  the cache-time command and the NextUpdate field. For example, if the cache-time command is set to 100 minutes and the NextUpdate field specifies that the next update is 70 minutes away, the ASA marks CRLs as stale in 70 minutes.

• Question 103:

  You have just configured new clientless SSL VPN access parameters.

  However, when users connect, they are not getting the expected access that was configured.

  What is one possible reason this is occurring?

  A. The correct Tunnel Group Lock is not properly set.
  B. The corresponding Cisco ASA interface is not enabled for SSL VPN access.
  C. The Connection Alias is not enabled.
  D. Portal features are disabled.
  A. The correct Tunnel Group Lock is not properly set.

• Question 104:

  A temporary worker must use clientless SSL VPN with an SSH plug-in, in order to access the console of an internal corporate server, the projects.xyz.com server. For security reasons, the network security auditor insists that the temporary user is restricted to the one internal corporate server, 10.0.4.18. You are the network engineer who is responsible for the network access of the temporary user.

  What should you do to restrict SSH access to the one projects.xyz.com server?

  A. Configure access-list temp_user_acl extended permit TCP any host 10.0.4.18 eq 22.
  B. Configure access-list temp_user_acl standard permit host 10.0.4.18 eq 22.
  C. Configure access-list temp_acl webtype permit url ssh://10.0.4.18.
  D. Configure a plug-in SSH bookmark for host 10.0.4.18, and disable network browsing on the clientless SSL VPN portal of the temporary worker.
  C. Configure access-list temp_acl webtype permit url ssh://10.0.4.18.

  ---

  Web ACLs The Web ACLs table displays the filters configured on the security appliance applicable to Clientless SSL VPN traffic. The table shows the name of each access control list (ACL), and below and indented to the right of the ACL name, the access control entries (ACEs) assigned to the ACL. Each ACL permits or denies access permits or denies access to specific networks, subnets, hosts, and web servers. Each ACE specifies one rule that serves the function of the ACL. You can configure ACLs to apply to Clientless SSL VPN traffic. The following rules apply: ?If you do not configure any filters, all connections are permitted. ?The security appliance supports only an inbound ACL on an interface. ?At the end of each ACL, an implicit, unwritten rule denies all traffic that is not explicitly permitted. You can use the following wildcard characters to define more than one wildcard in the Webtype access list entry: ?Enter an asterisk";"; to match no characters or any number of characters. ?Enter a question mark";"; to match any one character exactly. ?Enter square bracket"t;"t; to create a range operator that matches any one character in a range. The following examples show how to use wildcards in Webtype access lists. ?The following example matches URLs such as http:// www.cisco.com/ and http://wwz.caco.com/: access-list test webtype permit url http://ww?.c*co*/

• Question 105:

  An IT manager and a Security manager are discussing the deployment options for clientless SSL VPN. They are trying to decide which groups are best suited for this new deployment option. Which two groups are the best candidates for the clientless SSL VPN rollout? (Choose two.)

  A. an IT administrator who needs to manage servers from a corporate laptop
  B. employees who need occasional access to check their email accounts
  C. a vendor who needs access to confidential corporate presentations via Secure FTP
  D. customers who need interactive access to the corporate invoice server
  B. employees who need occasional access to check their email accounts
  C. a vendor who needs access to confidential corporate presentations via Secure FTP

• Question 106:

  Refer to the exhibit.

  

  When you are testing SSL VPN in a non-production environment, certain variables in the Cisco ASDM session details can be viewed or changed under Configuration > AnyConnect Connection Profiles.

  Which parameter can be viewed or changed in the AnyConnect Connection Profiles?

  A. Assigned IP address 10.0.1.50
  B. Client TypE. SSL VPN Client
  C. Authentication ModE. Certificate and User Password
  D. Client Ver: Cisco AnyConnect VPN Agent for Windows
  C. Authentication ModE. Certificate and User Password

• Question 107:

  When deploying clientless SSL VPN advanced application access, the administrator needs to collect information about the end-user system. Which three input parameters of an end-user system are important for the administrator to identify? (Choose three.)

  A. types of applications and application protocols that are supported
  B. types of encryption that are supported on the end-user system
  C. the local privilege level of the remote user
  D. types of wireless security that are applied to the end-user tunnel interface
  E. types of operating systems that are supported on the end-user system
  F. type of antivirus software that is supported on the end-user system
  A. types of applications and application protocols that are supported
  C. the local privilege level of the remote user
  E. types of operating systems that are supported on the end-user system

  ---

  When enabling port forwarding, the SSL VPN gateway will modify the hosts file on the PC of the remote user. Some software configurations and software security applications will detect this modification and prompt the remote user to select "Yes" to permit. To permit the modification, the remote user must have local administrative privileges. To securely access resources on a private network behind an SSL VPN gateway, the remote user of an SSL VPN service must have the following: ?;Thin Clien"; support used for TCP port-forwarding applications requires administrative privileges on the computer of the remote user. ?;Tunnel mod"; for Cisco SSL VPN requires administrative privileges for initial installation of the full tunnel client. ?The remote user must have local administrative privileges to use thin client or full tunnel client features. Operating system support ?Microsoft Windows 2000, Windows XP, or Windows Vista ?Macintosh OS X 10.4.6 ?Linux (Redhat RHEL 3.0 +, FEDORA 5, or FEDORA 6) SSL VPN-supported browser--The following browsers have been verified for SSL VPN. Other browsers might not fully support SSL VPN features.

• Question 108:

  If CRL checking is enabled on the Cisco ASA, where can the Cisco ASA find the CRL?

  A. The Cisco ASA polls the CA for an updated list at a predefined rate.
  B. The CA sends a CRL to the Cisco ASA directly at least once a week.
  C. The CRL distribution point is listed on the identity certificate.
  D. The CRL is sent out-of-band to the administrator at a negotiated rate, typically biweekly.
  E. The CRL distribution point can be configured in the Connection Profile or Group Policy.
  C. The CRL distribution point is listed on the identity certificate.

• Question 109:

  To enable the Cisco ASA Host Scan with remediation capabilities, an administrator must have which two Cisco ASA licenses enabled on its security appliance? (Choose two.)

  A. Cisco AnyConnect Premium license
  B. Cisco AnyConnect Essentials license
  C. Cisco AnyConnect Mobile license
  D. Host Scan license
  E. Advanced Endpoint Assessment license
  F. Cisco Security Agent license
  A. Cisco AnyConnect Premium license
  E. Advanced Endpoint Assessment license

• Question 110:

  Refer to the exhibit.

  

  The user "contractor" inherits which VPN group policy?

  A. employee
  B. management
  C. DefaultWEBVPNGroup
  D. DfltGrpPolicy
  E. new_hire
  D. DfltGrpPolicy