Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 21:

  Refer to the exhibit.

  

  After a remote user established a Cisco AnyConnect session from a wireless card through the Cisco ASA appliance of a partner to a remote server, the user opened the Cisco AnyConnect VPN Client Statistics Details screen.

  What are the two sources of the IP addresses that are marked A and B? (Choose two.)

  A. IP address that is assigned to the wireless Ethernet adapter of the remote user
  B. IP address that is assigned to the remote user from the Cisco ASA address pool
  C. IP address of the Cisco ASA physical interface of the partner
  D. IP address of the Cisco ASA virtual HTTP server of the partner
  E. IP address of the default gateway router of the remote user
  F. IP address of the default gateway router of the partner
  B. IP address that is assigned to the remote user from the Cisco ASA address pool
  C. IP address of the Cisco ASA physical interface of the partner

• Question 22:

  When establishing a Cisco AnyConnect SSL VPN tunnel, a system administrator wants to restrict remote home office users to either print to their local printer or send the remaining traffic down the Cisco AnyConnect SSL VPN tunnel (with restricted Internet access). Choose both a tunnel policy option and an ACL type to accomplish this design goal. (Choose two.)

  A. tunnel all networks
  B. tunnel network list below
  C. exclude network list from the tunnel
  D. standard ACL
  E. web ACL
  F. extended ACL
  C. exclude network list from the tunnel
  D. standard ACL

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807029 92.shtml

• Question 23:

  After adding a remote-access IPsec tunnel via the VPN wizard, an administrator needs to tune the IPsec policy parameters. Where is the correct place to tune the IPsec policy parameters in Cisco ASDM?

  A. IPsec user profile
  B. Crypto Map
  C. Group Policy
  D. IPsec Policy
  E. IKE Policy
  B. Crypto Map

• Question 24:

  Which statement is true about configuring the Cisco ASA for Active/Standby failover?

  A. All versions of Cisco ASA software need to have the same licensing on both devices.
  B. Both devices perform load sharing until a failure occurs.
  C. All VPN-related configurations and files are automatically replicated.
  D. VPN images, profiles, and plug-ins must be manually provisioned to both devices.
  D. VPN images, profiles, and plug-ins must be manually provisioned to both devices.

• Question 25:

  Refer to the exhibit.

  

  The ABC Corporation is changing remote-user authentication from pre-shared keys to certificate-based authentication. For most employee authentication, its group membership (the employees) governs corporate access. Certain management personnel need access to more confidential servers. Access is based on the group and name, such as finance and level_2. When it is time to pilot the new authentication policy, a finance manager is able to access the department-assigned servers but cannot access the restricted servers.

  As the network engineer, where would you look for the problem?

  A. Check the validity of the identity and root certificate on the PC of the finance manager.
  B. Change the Management Certificate to Connection Profile Maps > Rule Priority to a number that is greater than 10.
  C. Check if the Management Certificate to Connection Profile Maps > Rules is configured correctly.
  D. Check if the Certificate to Connection Profile Maps > Policy is set correctly.
  D. Check if the Certificate to Connection Profile Maps > Policy is set correctly.

  ---

  Cisco ASDM User Guide Version 6.1

  

• Question 26:

  Which three statements about clientless SSL VPN are true? (Choose three.)

  A. Users are not tied to a particular PC or workstation.
  B. Users have full application access to internal corporate resources.
  C. Minimal IT support is required.
  D. Cisco AnyConnect SSL VPN software is automatically downloaded to the remote user at the start of the clientless session.
  E. For security reasons, browser cookies are disabled for clientless SSL VPN sessions.
  F. Clientless SSL VPN requires an SSL-enabled web browser.
  A. Users are not tied to a particular PC or workstation.
  C. Minimal IT support is required.
  F. Clientless SSL VPN requires an SSL-enabled web browser.

• Question 27:

  Refer to the exhibit.

  

  As the administrator of a Cisco ASA security appliance for remote-access IPsec VPNs, you are assisting a user who has a digital certificate that is configured for the Cisco VPN Client. Based on the exhibit, what do you do to find the MD5 thumbprint of the "level_2" certificate?

  A. Choose the certificate, then click Status > Certificates from the menu bar.
  B. Choose the certificate, then click the View button.
  C. Choose the certificate, then click Options > Properties from the menu bar.
  D. Choose the certificate, then click the Verify button.
  B. Choose the certificate, then click the View button.

• Question 28:

  Drag and drop each advanced application deployment option on the left to its correct definition on the right.

  Select and Place:

  

  

• Question 29:

  The LAN-to-LAN tunnel is not established, but an administrator can ping the remote Cisco ASA.

  Which three IPsec LAN-to-LAN configuration parameters should the administrator verify at both ends of the tunnel? (Choose three.)

  A. pre-shared key
  B. extended authentication password
  C. extended authentication username
  D. crypto ACL source IP address
  E. crypto ACL destination IP address
  F. tunnel connection-typE. originate or answer
  A. pre-shared key
  D. crypto ACL source IP address
  E. crypto ACL destination IP address

• Question 30:

  Refer to the exhibit.

  

  A new NOC engineer is troubleshooting a VPN connection.

  Which statement about the fields within the Cisco VPN Client Statistics screen is correct?

  A. The ISP-assigned IP address of 10.0.21.1 is assigned to the VPN adapter of the PC.
  B. The IP address of the security appliance to which the Cisco VPN Client is connected is 192.168.1.2.
  C. CorpNet is the name of the Cisco ASA group policy whose tunnel parameters the connection is using.
  D. The ability of the client to send packets transparently and unencrypted through the tunnel for test purposes is turned off.
  E. With split tunneling enabled, the Cisco VPN Client registers no decrypted packets.
  B. The IP address of the security appliance to which the Cisco VPN Client is connected is 192.168.1.2.