Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  The "level_2" digital certificate was installed on a laptop. What can cause an "invalid not active" status message?

  A. On first use, a CA server-supplied passphrase is entered to validate the certificate.
  B. A "newly installed" digital certificate does not become active until it is validated by the peer device upon its first usage.
  C. The user has not clicked the Verify button within the Cisco VPN Client.
  D. The CA server and laptop PC clocks are out of sync.
  D. The CA server and laptop PC clocks are out of sync.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/cert_cfg.html

  Certificates have a date and time that they become valid and that they expire. When the security appliance enrolls with a CA and gets a certificate, the security appliance checks that the current time is within the valid range for the certificate. If it is outside that range, enrollment fails. Same would apply to communication between ASA and PC

• Question 32:

  Refer to the exhibit.

  

  Which two statements are correct regarding these two Cisco ASA clientless SSL VPN bookmarks? (Choose two.)

  A. CSCO_WEBVPN_USERNAME is a user attribute.
  B. CSCO_WEBVPN_USERNAME is a Cisco predefined variable that is used for macro substitution.
  C. The CSCO_WEBVPN_USERNAME variable is enabled by using the Post SSO plug-in.
  D. CSCO_SSO is a Cisco predefined variable that is used for macro substitution.
  E. The CSCO_SSO=1 parameter enables SSO for the SSH plug-in.
  F. The CSCO_SSO variable is enabled by using the Post SSO plug-in.
  B. CSCO_WEBVPN_USERNAME is a Cisco predefined variable that is used for macro substitution.
  E. The CSCO_SSO=1 parameter enables SSO for the SSH plug-in.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/deploy.html

  Introduction to URL Variable Substitution:

  Your configuration will most likely require personalized resources that contain the username and password, for example, in URL lists or in group URLs. URL variable substitution lets the remote user enter username and password credentials once, when initiating the session, then login automatically to internal resources such as Citrix, OWA, Sharepoint, and the internal portal.

  Clientless SSL VPN supports the following macro substitutions:

  CSCO_WEBVPN_USERNAME--User login name

  CSCO_WEBVPN_PASSWORD--Obtained from user login password CSCO_WEBVPN_INTERNAL_PASSWORD--Obtained from the Internal password field. You can use this field as Domain for Single Signon operations.

  CSCO_WEBVPN_CONNECTION_PROFILE--User login group drop-down (tunnel group alias)

  CSCO_WEBVPN_MACRO1--Set via Radius or LDAP vendor specific attribute CSCO_WEBVPN_MACRO2--Set via Radius or LDAP vendor specific attribute Each time the security appliance recognizes one of these strings in an end-user

  request, it replaces the string with the user-specific value before passing the request to a remote server.

  For example, a URL list that contains the link:

  http://someserver/homepage/CSCO_WEBVPN_USERNAME.

  Html is translated by the security appliance to the following links for SSL VPN USER1 and USER2:

  http://someserver/homepage/USER1.html

  http://someserver/homepage/USER2.html

• Question 33:

  In Cisco ASA Software Release 8.4.1, which three plug-ins are Cisco ASA-supported plug-ins? (Choose three.)

  A. SSH
  B. TN3270
  C. SCP
  D. RDP
  E. ICA
  F. ARAP
  A. SSH
  D. RDP
  E. ICA

• Question 34:

  Which statement is true regarding Cisco ASA stateful failover?

  A. It is recommended to share the failover link with the inside interface for security purposes.
  B. The failover link is encrypted by default to protect eavesdropping.
  C. VPN users must reauthenticate, even though the connection remains established.
  D. Clientless features, such as smart tunnels and plug-ins, are not supported.
  D. Clientless features, such as smart tunnels and plug-ins, are not supported.

• Question 35:

  Refer to the exhibit.

  

  Given the example that is shown, what can you determine?

  A. Users are required to perform RADIUS or LDAP authentication when connecting with the Cisco AnyConnect client.
  B. Users are required to perform AAA authentication when connecting via WebVPN.
  C. Users are required to perform double AAA authentication.
  D. The user access identity is prefilled at login, requiring users to enter only their password.
  C. Users are required to perform double AAA authentication.

• Question 36:

  Which four statements about the Advanced Endpoint Assessment are correct? (Choose four.)

  A. It examines the remote computer for personal firewall applications.
  B. It examines the remote computer for antivirus applications.
  C. It examines the remote computer for antispyware applications.
  D. It examines the remote computer for malware applications.
  E. It does not perform any remediation, but it provides input that can be evaluated by DAP records.
  F. It performs active remediation by applying rules, activating modules, and providing updates where applicable.
  A. It examines the remote computer for personal firewall applications.
  B. It examines the remote computer for antivirus applications.
  C. It examines the remote computer for antispyware applications.
  F. It performs active remediation by applying rules, activating modules, and providing updates where applicable.

  ---

  

• Question 37:

  Cisco AnyConnect profiles can be used to set which three options? (Choose three.)

  A. Define a list of VPN gateways that are presented to users upon login.
  B. Define a quarantine VLAN for remote devices that fail a host scan.
  C. Define a guest VLAN to all "noncompany" Cisco IOS WebVPN users.
  D. Define a list of backup servers if primary gateways are unavailable.
  E. Activate the SSL VPN tunnel as part of the Windows login sequence.
  F. Configure the Cisco Secure Desktop vault.
  A. Define a list of VPN gateways that are presented to users upon login.
  D. Define a list of backup servers if primary gateways are unavailable.
  E. Activate the SSL VPN tunnel as part of the Windows login sequence.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect20/administrative/guide/ad minapa.pdf

• Question 38:

  A Unified Communications Certificate is used on the Cisco ASA appliance to support which option?

  A. certificate + double AAA authentication
  B. certificate + AAA authentication
  C. certificate maps
  D. Cisco ASA VPN clustering load balancing
  D. Cisco ASA VPN clustering load balancing

  ---

  Server Certificate Types Cisco uses these self-signed (own) certificate types in Cisco Unified Communications Manager servers: HTTPS certificate (tomcat_cert)--This self-signed root certificate is generated during the Cisco Unified Communications Manager installation for the HTTPS server. Cisco Unified Communications Manager node certificate--This self-signed root certificate automatically installs when you install Cisco Unified Communications Manager 5.1 for the Cisco Unified Communications Manager server. Cisco Unified Communications Manager certificates provide server identification, which includes the Cisco Unified Communications Manager server name and the Global Unique Identifier (GUID). CAPF certificate--The system copies this root certificate to all servers in the cluster after you complete the Cisco CTL client configuration. IPsec certificate (ipsec_cert)--This self-signed root certificate is generated during Cisco Unified Communications Manager installation for IPsec connections with MGCP and H.323 gateways. SRST-enabled gateway certificate-When you configure a secure SRST reference in Cisco Unified

  Communications Manager Administration, Cisco Unified Communications Manager retrieves the SRST enabled gateway certificate from the gateway and stores it in the Cisco Unified Communications Manager database. After you reset the devices, the certificate is added to the phone configuration file. Because the certificate is stored in the database, this certificate is not integrated into the certificate management tool.

  https://supportforums.cisco.com/docs/DOC-5964

  For more information on VPN Load Balancing/Clustering High Availability services of the ASA appliances please consult the configuraiton guide at http:// www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ vpnsysop.html#wp104 8834. Please check cisco.com for new versions of the document. For more information on configuring Certificates on the the ASA appliances please consult the configuration guide at check http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/cert_cfg.html .Please cisco.com for new versions of the document.

• Question 39:

  For clientless SSL VPN users, bookmarks can be assigned to their portal. What are three methods for assigning bookmarks? (Choose three.)

  A. connection profiles
  B. group policies
  C. XML profiles
  D. LDAP or RADIUS attributes
  E. the portal customization tool
  F. user policies
  B. group policies
  D. LDAP or RADIUS attributes
  F. user policies

  ---

  Create one or more bookmark list entries that specify the URLs of the web-enabled applications eligible for smart tunnel access, then assign the list to the DAPs, group policies, or local user policies for whom you want to provide smart tunnel access. e.g.

  

  Dynamic access policies (DAP)

  VPN gateways operate in dynamic environments. Multiple variables can affect each VPN connection, for example, intranet configurations that frequently change, the various roles each user may inhabit within an organization, and logins from

  remote access sites with different configurations and levels of security. The task of authorizing users is much more complicated in a VPN environment than it is in a network with a static configuration.

  Dynamic Access Policies (DAP) on the security appliance let you configure authorization that addresses these many variables. You create a dynamic access policy by setting a collection of access control attributes that you associate with a

  specific user tunnel or session. These attributes address issues of multiple group membership and endpoint security. That is, the security appliance grants access to a particular user for a particular session based on the policies you define. It

  generates a DAP at the time the user connects by selecting and/or aggregating attributes from one or more DAP records. It selects these DAP records based on the endpoint security information of the remote device and the AAA

  authorization information for the authenticated user. It then applies the DAP record to the user tunnel or session.

• Question 40:

  Refer to following Exhibit and answer the following question below:

  

  

  Which connection profile supports SSL VPN Client access only.

  A. Employee
  B. Contractor
  C. Management
  D. Engineering
  E. New_hire
  B. Contractor

  ---

  (Answer can change so follow the procedure below)

  Configuration > network client access > any connect connection profiles >connection profiles > edit for each profile > general > more options > tunneling protocol > see the check marks