Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 111:

  Match the action on the left with the correct SSL VPN Portal Navigation button on the right.

  Select and Place:

  

  

• Question 112:

  What are three methods for VPN address assignment? (Choose three.)

  A. RADIUS authentication server
  B. Kerberos server
  C. internal address pool
  D. RSA SecureID authentication server
  E. LDAP server
  A. RADIUS authentication server
  C. internal address pool
  E. LDAP server

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/vpnadd.html

  Configuring an IP Address Assignment Method The ASA can use one or more of the following methods for assigning IP addresses to remote access clients. If you configure more than one address assignment method, the ASA searches each of the options until it finds an IP address. By default, all methods are enabled. To view the current configuration, enter the show runningconfig all vpn-addr-assign command.穉aa--Retrieves addresses from an external authentication server on a per-user basis. If you are using an authentication server that has IP addresses configured, we recommend using this method. 穌hcp--Obtains IP addresses from a DHCP server. If you want to use DHCP, you must configure a DHCP server. You must also define the range of IP addresses that the DHCP server can use.穕ocal--Use an internal address pool. Internally configured address pools are the easiest method of address pool assignment to configure. If you choose local, you must also use the ip-local-pool command to define the range of IP addresses to use. To specify a method for assigning IP addresses to remote access clients, enter the vpn-addr- assign command in global configuration mode. The syntax is vpn- addr-assign {aaa | dhcp | local}.

• Question 113:

  Your corporate finance department purchased a new non-web-based TCP application tool to run on one of its servers. Certain finance employees need remote access to the software during nonbusiness hours. These employees do not have "admin" privileges to their PCs.

  What is the correct way to configure the SSL VPN tunnel to allow this application to run?

  A. Configure a smart tunnel for the application.
  B. Configure a "finance tool" VNC bookmark on the employee clientless SSL VPN portal.
  C. Configure the plug-in that best fits the application.
  D. Configure the Cisco ASA appliance to download the Cisco AnyConnect SSL VPN Client to the finance employee each time an SSL VPN tunnel is established.
  A. Configure a smart tunnel for the application.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/webvpn.html A smart tunnel is a connection between a TCP-based application and a private site, using a clientless (browser based) SSL VPN session with the security appliance as the pathway, and the security appliance as a proxy server. You can identify applications to which you want to grant smart tunnel access, and specify the local path to each application. For applications running on Microsoft Windows, you can also require a match of the SHA-1 hash of the checksum as a condition for granting smart tunnel access. Lotus SameTime and Microsoft Outlook Express are examples of applications to which you might want to grant smart tunnel access. Configuring smart tunnels requires one of the following procedures, depending on whether the application is a client or is a web-enabled application:稢reate one or more smart tunnel lists of the client applications, then assign the list to the group policies or local user policies for whom you want to provide smart tunnel access. 稢reate one or more bookmark list entries that specify the URLs of the web-enabled applications eligible for smart tunnel access, then assign the list to the DAPs, group policies, or local user policies for whom you want to provide smart tunnel access. You can also list web-enabled applications for which to automate the submission of login credentials in smart tunnel connections over clientless SSL VPN sessions. Why Smart Tunnels? Smart tunnel access lets a client TCP-based application use a browser-based VPN connection to connect to a service. It offers the following advantages to users, compared to plug-ins and the legacy technology, port forwarding:稴mart tunnel offers better performance than plug-ins. 稶nlike port forwarding, smart tunnel simplifies the user experience by not requiring the user connection of the local application to the local port. 稶nlike port forwarding, smart tunnel does not require users to have administrator privileges. The advantage of a plug-in is that it does not require the client application to be installed on the remote computer. Smart Tunnel Requirements, Restrictions, and Limitations The following sections categorize the smart tunnel requirements and limitations. General Requirements and Limitations Smart tunnel has the following general requirements and limitations:稵he remote host originating the smart tunnel must be running a 32-bit version of Microsoft Windows Vista, Windows XP, or Windows 2000; or Mac OS 10.4 or 10.5. 稴mart tunnel auto sign-on supports only Microsoft Internet Explorer on Windows. 稵he browser must be enabled with Java, Microsoft ActiveX, or both. 稴mart tunnel supports only proxies placed between computers running Microsoft Windows and the security appliance. Smart tunnel uses the Internet Explorer configuration (that is, the one intended for system-wide use in Windows). If the remote computer requires a proxy server to reach the security appliance, the URL of the terminating end of the connection must be in the list of URLs excluded from proxy services. If the proxy configuration specifies that traffic destined for the ASA goes through a proxy, all smart tunnel traffic goes through the proxy.

  In an HTTP-based remote access scenario, sometimes a subnet does not provide user access to the VPN gateway. In this case, a proxy placed in front of the ASA to route traffic between the web and the end user's location provides web access. However, only VPN users can configure proxies placed in front of the ASA.

  When doing so, they must make sure these proxies support the CONNECT method. For proxies that require authentication, smart tunnel supports only the basic digest authentication type. 稺hen smart tunnel starts, the security appliance by default passes all browser traffic through the VPN session if the browser process is the same. The security appliance also does this if a tunnel- all policy applies. If the user starts another instance of the browser process, it passes all traffic through the VPN session. If the browser process is the same and the security appliance does not provide access to a URL, the user cannot open it. As a workaround, assign a tunnel policy that is not tunnel-all.

  稟 stateful failover does not retain smart tunnel connections. Users must reconnect following a failover.

• Question 114:

  An on-screen keyboard is a programmable SSL VPN option. Which three options are keyboard- configurable parameters that the administrator can enable or disable? (Choose three.)

  A. Show only if Secure Desktop Vault is disabled.
  B. Do not show onscreen keyboard.
  C. Show only for the login page.
  D. Show for all user input fields.
  E. Show for all portal pages that require authentication.
  F. Show for all plug-in pages.
  B. Do not show onscreen keyboard.
  C. Show only for the login page.
  E. Show for all portal pages that require authentication.

  ---

  Onscreen keyboard The security appliance includes an onscreen keyboard option for the login page and subsequent authentication requests for internal resources. This provides additional protection against software-based keystroke loggers by requiring a user to use a mouse to click characters in an onscreen keyboard for authentication, rather than entering the characters on a physical keyboard.

• Question 115:

  Which statement about CRL configuration is correct?

  A. CRL checking is enabled by default.
  B. The Cisco ASA relies on HTTPS access to procure the CRL list.
  C. The Cisco ASA relies on LDAP access to procure the CRL list.
  D. The Cisco Secure ACS can be configured as the CRL server.
  C. The Cisco ASA relies on LDAP access to procure the CRL list.

  ---

  ASA SSLVPN deployment guide:

  The security appliance supports various authentication methods: RSA one-time passwords, Radius, Kerberos, LDAP, NT Domain, TACACS, Local/Internal, digital certificates, and a combination of both authentication and certificates.

  

• Question 116:

  Which statement is correct regarding IKEv2 when implementing IPsec site-to-site VPNs?

  A. IKEv2 should be configured with a higher priority over IKEv1 policies within the same tunnel group.
  B. IKEv2 crypto maps can be configured to inherit IKEv1 parameters, if configured.
  C. IKE v1 and IKEv2 can coexist in the same tunnel group, with fallback to IKEv1 if the remote endpoint does not support IKEv2.
  D. IKEv2 can be configured to support multiple peers.
  C. IKE v1 and IKEv2 can coexist in the same tunnel group, with fallback to IKEv1 if the remote endpoint does not support IKEv2.

• Question 117:

  Refer to the exhibit.

  

  A new network engineer configured the ABC adaptive security appliance with two bookmarks for a new temporary worker. The temporary worker can connect to the administrator server via the temp_worker_admin bookmark but cannot

  connect to the project server via the temp_worker_projects bookmark (which is grayed out). It was determined that the URL and IP addressing information in the GUI screens is correct.

  What is wrong with the configuration?

  A. URL Entry should be enabled.
  B. The File Server Entry Inherit parameter should be overwritten and set for enabled.
  C. The DNS server information is incorrect.
  D. File Server Browsing should be enabled.
  C. The DNS server information is incorrect.

• Question 118:

  Refer to the exhibit.

  

  The ABC Corporation has a Cisco ASA in its test bed. A new network administrator is instructed to add a smart tunnel application to the existing configuration. The configuration will enable a "temp_worker" who is using Microsoft native RDP to have RDP access to server 10.0.4.4 only.

  Which statement is correct concerning the smart-tunnel configuration?

  A. The WebType access list is misconfigured.
  B. The smart tunnel list parameter is misconfigured.
  C. The smart tunnel group policy parameters are misconfigured.
  D. The smart tunnel configuration is configured correctly.
  D. The smart tunnel configuration is configured correctly.

• Question 119:

  Refer to the exhibit.

  

  A new NOC engineer, while viewing a real-time log from an SSL VPN tunnel, has a question about a line in the log. The IP address 172.26.26.30 is attached to which interface in the network?

  A. the Cisco ASA physical interface
  B. the physical interface of the end user
  C. the Cisco ASA SSL VPN tunnel interface
  D. the SSL VPN tunnel interface of the end user
  B. the physical interface of the end user

• Question 120:

  On the right, a permanent (P) or temporary (T) license is added to a Cisco ASA 5520. The merged license result in new capabilities for the Cisco ASA 5520. Drag the new resultant license on the left to the merging licenses on the right.

  Select and Place: