Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 11:

  You are the network security administrator. You receive a call from a user stating that he cannot log onto the network. In the process of troubleshooting, you determine that this user is accessing the network via certificate-based Cisco AnyConnect SSL VPN.

  What is a troubleshooting step that you should perform to determine the cause of the access problem?

  A. Revoke and reissue the certificate, and have the user try again.
  B. Verify that a connection can be made without using certificates.
  C. Ask the user to use IPsec, and test the connection attempts.
  D. Check the WebACLs on the Cisco ASA.
  B. Verify that a connection can be made without using certificates.

• Question 12:

  Which Cisco ASA SSL VPN feature provides support for PCI compliance by allowing for the validation of two sets of username and password credentials on the SSL VPN login page?

  A. Single Sign-On
  B. Certificate to Profile Mapping
  C. Double Authentication
  D. RSA OTP
  C. Double Authentication

• Question 13:

  Refer to following Exhibit and answer the following question below:

  

  

  Which group policy restricts the VPN user access to VLAN 100?

  A. Employee
  B. Contractor
  C. Management
  D. Engineering
  B. Contractor

  ---

  Explanation:

  configuration > network client access > any connect connection profiles >connection profiles > edit

  

  For each profile > general > more options > restricted VLAN Monitoring > VPN > VPN statistics Sessions, vlan mapping sessions

  

• Question 14:

  The software-based Cisco IPsec VPN Client solution uses bidirectional authentication, in which the client authenticates the Cisco ASA, and the Cisco ASA authenticates the user. Which three methods are software-based Cisco IPsec VPN Client to Cisco ASA authentication methods? (Choose three.)

  A. Unified Client Certificate authentication
  B. Secure Unit authentication
  C. Hybrid authentication
  D. Certificate authentication
  E. Group authentication
  C. Hybrid authentication
  D. Certificate authentication
  E. Group authentication

  ---

  ASDM user guide Page 35-69

  Authentication Mode--Specifies the authentication mode: none, xauth, or hybrid. hybrid--Specifies the use of Hybrid mode, which lets you use digital certificates for security appliance authentication and a different, legacy method--such as

  RADIUS, TACACS+ or SecurID--for remote VPN user authentication. This mode breaks phase 1 of the Internet Key Exchange (IKE) into the following steps, together called hybrid authentication:

  xauth--Specifies the use of IKE Extended Authentication mode, which provides the capability of authenticating a user within IKE using TACACS+ or RADIUS.

• Question 15:

  You are the network security administrator troubleshooting a clientless SSL VPN issue. Users can connect using SSL VPN, but they cannot access file folder bookmarks that they need. Which problem could possibly cause this issue?

  A. a name mismatch from the certificate CN and the VPN URL
  B. misconfigured WebType ACLs
  C. disabled content rewriting
  D. disabled portal features
  B. misconfigured WebType ACLs

• Question 16:

  Refer to the exhibit.

  

  When an SSL VPN user, contractor1, enters https://192.168.4.2 (the outside address of the Cisco ASA appliance) into the browser, an SSL VPN Login screen appears.

  In addition to the information that is contained in the Cisco ASDM configuration screens, what can an administrator determine about the state of the connection after the user clicks the Login button?

  A. The user login will succeed, and an IP address of 10.0.4.120 will be assigned.
  B. The user will be presented with a clientless VPN portal page.
  C. The user login will succeed, but the user will be connected to the "contractor" tunnel group.
  D. The login will fail.
  D. The login will fail.

• Question 17:

  Which three options are characteristics of WebType ACLs? (Choose three.)

  A. They are assigned per-connection profile.
  B. They are assigned per-user or per-group policy.
  C. They can be defined in the Cisco AnyConnect Profile Editor.
  D. They support URL pattern matching.
  E. They support implicit deny all at the end of the ACL.
  F. They support standard and extended WebType ACLs.
  B. They are assigned per-user or per-group policy.
  D. They support URL pattern matching.
  E. They support implicit deny all at the end of the ACL.

  ---

  You can configure ACLs (Access Control Lists) to apply to user sessions. These are filters that permit or deny user access to specific networks, subnets, hosts, and web servers. ?If you do not define any filters, all connections are permitted. ? The security appliance supports only an inbound ACL on an interface. ?At the end of each ACL, there is an implicit, unwritten rule that denies all traffic that is not permitted. If traffic is not explicitly permitted by an access control entry (ACE), the security appliance denies it. ACEs are referred to as rules in this topic. This pane lets you add and edit ACLs to be used for Clientless SSL VPN sessions, and the ACL entries each ACL contains. It also displays summary information about ACLs and ACEs, and lets you enable or disable them, and change their priority order.

• Question 18:

  When configuring the Cisco ASA for VPN clustering, which IP address or addresses does the end-user device connect to?

  A. It connects to individual device addresses of the cluster as provided in the connection profile.
  B. It connects to the virtual address.
  C. The virtual cluster manager sends the IP address of the least loaded device. The client then connects directly to that device.
  D. The connection IP address is dependent upon whether the initiator is using SSL or IPsec.
  B. It connects to the virtual address.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805fda25.shtml

• Question 19:

  Which four parameters must be defined in an ISAKMP policy when you are creating an IPsec site-to-site VPN using the Cisco ASDM? (Choose four.)

  A. encryption algorithm
  B. hash algorithm
  C. authentication method
  D. IP address of remote IPsec peer
  E. D-H group
  F. perfect forward secrecy
  A. encryption algorithm
  B. hash algorithm
  C. authentication method
  E. D-H group

  ---

  ASDM User guide Page 34-5 Should this not be IKE policy?

  

  

• Question 20:

  Cisco Secure Desktop seeks to minimize the risks that are posed by the use of remote devices in establishing a Cisco clientless SSL VPN or Cisco AnyConnect VPN Client session. Which two statements concerning the Cisco Secure Desktop Host Scan feature are correct? (Choose two.)

  A. It is performed before a user establishes a connection to the Cisco ASA.
  B. It is performed after a user establishes a connection to the Cisco ASA but before logging in.
  C. It is performed after a user logs in but before a group profile is applied.
  D. It is supported on endpoints that run a Windows operating system only.
  E. It is supported on endpoints that run Windows and MAC operating systems only.
  F. It is supported on endpoints that run Windows, MAC, and Linux operating systems.
  B. It is performed after a user establishes a connection to the Cisco ASA but before logging in.
  F. It is supported on endpoints that run Windows, MAC, and Linux operating systems.

  ---

  DAP and Anti-Virus, Anti-Spyware, and Personal Firewall Programs The security appliance uses a DAP policy when the user attributes matches the configured AAA and endpoint attributes. The Pre login Assessment and Host Scan modules

  of Cisco Secure Desktop return information to the security appliance about the configured endpoint attributes, and the DAP subsystem uses that information to select a DAP record that matches the values of those attributes. Most, but not all,

  anti-virus, anti-spyware, and personal firewall programs support active scan, which means that the programs are memory-resident, and therefore always running. Host Scan checks to see if an endpoint has a program installed, and if it is

  memory resident as follows:

  ?If the installed program does not support active scan, Host Scan reports the presence of the software. The DAP system selects DAP records that specify the program. ?If the installed program does support active scan, and active scan is

  enabled for the program, Host Scan reports the presence of the software. Again the security appliance selects DAP records that specify the program.

  ?If the installed program does support active scan and active scan is disabled for the program, Host Scan ignores the presence of the software. The security appliance does not select DAP records that specify the program. Further, the output

  of the debug trace command, which includes a lot of information about DAP, does not indicate the program presence, even though it is installed.

  The following sequence outlines a typical remote access connection establishment.

  1.

  A remote client attempts a VPN connection.

  2.

  The security appliance performs posture assessment, using configured NAC and Cisco Secure Desktop Host Scan values.

  Operating system support

  ?Microsoft Windows 2000, Windows XP, or Windows Vista ?Macintosh OS X 10.4.6

  ?Linux (Redhat RHEL 3.0 +, FEDORA 5, or FEDORA 6)

  3.

  The security appliance authenticates the user via AAA. The AAA server also returns authorization attributes for the user.

  4.

  The security appliance applies AAA authorization attributes to the session, and establishes the VPN tunnel.

  5.

  The security appliance selects DAP records based on the user AAA authorization information and the session posture assessment information. 6. The security appliance aggregates DAP attributes from the selected DAP records, and they

  become the DAP policy.

  7. The security appliance applies the DAP policy to the session.