Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 41:

  Refer to the exhibit.

  

  A network administrator is duplicating a VPN client profile to send out to all members of the finance group. Three parameters might have been configured incorrectly. For each three letters, choose the correct answer. (Choose three.)

  A. A-Remote Client IP Address
  B. A-ASA Outside Interface IP Address
  C. B-Pre-Shared Keys Authentication Type
  D. B-Digital Certificate Authentication Type
  E. C-Save Password enabled
  F. C-Save Password disabled
  B. A-ASA Outside Interface IP Address
  C. B-Pre-Shared Keys Authentication Type
  E. C-Save Password enabled

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client500_501/administratio n/5vcAch5.html#wpmkr1201344

  

• Question 42:

  Your IT department needs to run a custom-built TCP application within the clientless SSL VPN tunnel. The network administrator suggests running the smart tunnel application. Which three statements concerning smart tunnel applications are true? (Choose three.)

  A. They support active FTP and other RTSP-based applications.
  B. They do not require administrator privileges on the remote system.
  C. They require the enabling of port forwarding.
  D. They are supported on Windows and MAC OS X platforms.
  E. They support native client applications over SSL VPN.
  F. They require the modification of the Host file on the end-user PC.
  B. They do not require administrator privileges on the remote system.
  D. They are supported on Windows and MAC OS X platforms.
  E. They support native client applications over SSL VPN.

  ---

  Smart Tunnel--Connects a Winsock 2, TCP-based application installed on the end station to a server on the intranet, using a clientless (browser-based) SSL VPN session with the security appliance as the pathway, and the security appliance

  as a proxy server. Smart Tunnel List--Select the list name from the drop-down menu if you want to provide smart tunnel access.

  Assigning a smart tunnel list to a group policy or username enables smart tunnel access for all users whose sessions are associated with the group policy or username, but restricts smart tunnel access to the applications specified in the list.

  To view, add, modify, or delete a smart tunnel list, click the adjacent Manage button. Auto Start (Smart Tunnel List)--Check to start smart tunnel access automatically upon user login. Uncheck to enable smart tunnel access upon user login,

  but require the user to start it manually, using the Application Access > Start Smart Tunnels button on the Clientless SSL VPN Portal Page. Auto Sign-on Server List--Select the list name from the drop-down menu if you want to reissue the

  user credentials when the user establishes a smart tunnel connection to a server. Each smart tunnel auto sign-on list entry identifies a server with which to automate the submission of user credentials. To view, add, modify, or delete a smart

  tunnel auto sign-on list, click the adjacent Manage button.

  Domain Name (Optional)--Specify the Windows domain to add it to the username during auto sign-on, if the universal naming convention (domain\username) is required for authentication. For example, enter CISCO to specify CISCO\jsmith

  when authenticating for the username jsmith. You must also check the "Use Windows domain name with user name" option when configuring associated entries in the auto sign-on server list.

• Question 43:

  While configuring a new clientless SSL VPN group in Cisco ASDM, the administrator chooses to accept a number of the default parameter values. The administrator decides to view the actual value for the parameter, rather than just checking the inherit box.

  Under which default group can the administrator verify the default value for the group parameter?

  A. DefaultRAGroup
  B. DefaultWEBVPNGroup
  C. DfltGrpPolicy
  D. DefaultSVCGroup
  C. DfltGrpPolicy

• Question 44:

  A Cisco AnyConnect user profile can be pushed to the PC of a remote user from a Cisco ASA. Which three user profile parameters are configurable? (Choose three.)

  A. Backup Server list
  B. DTLS Override
  C. Auto Reconnect
  D. Simultaneous Tunnels
  E. Connection Profile Lock
  F. Auto Update
  A. Backup Server list
  C. Auto Reconnect
  F. Auto Update

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect20/administrative/guide/ad minapa.pdf

• Question 45:

  Which option limits a clientless SSL VPN user to specific resources upon successful login?

  A. modify the Cisco ASA Modular Policy Framework access control
  B. user-defined bookmarks
  C. RADIUS authorization
  D. disable portal features
  B. user-defined bookmarks

  ---

  Effective with Cisco IOS Release 12.4(15)T, users can bookmark URLs while connected through an SSL VPN tunnel. Users can access the bookmarked URLs by clicking the URLs. User-level bookmarking is turned by default. There is no way to turn it off. To set the storage location, administrators can use the user-profile location command. If the user-profile location command is not configured, the location flash:/webvpn/{context name}/ is used.

• Question 46:

  Some users are having problems connecting via clientless SSL VPN, while other users are experiencing no problems. What is one possible cause of this issue?

  A. The Cisco ASA identity certificates have not been generated.
  B. SSL version checking is enabled, and clients are connecting with denied versions.
  C. SSL VPN termination is not enabled.
  D. The Cisco ASA identity certificate is not bound to the SSL interface.
  B. SSL version checking is enabled, and clients are connecting with denied versions.

  ---

  http://www.cisco.com/web/about/security/intelligence/05_08_SSL-VPN-Security.html

  Host identity verification There is a difference between trusting a user (after passing strong user authentication) and trusting that user's computer. While the former has traditionally been emphasized, only recently has the latter been given sufficient attention (see Trusted Platform Module - TPM). As discussed earlier, a Trojan-laden computer defeats strong user authentication. But a "company computer", which is typically supported and managed according to corporate security policies, typically deserves more trust than a "non-company computer". A secure SSL VPN infrastructure should allow you to verify a remote host's identity by checking on predefined end device parameters. Examples include registry entries, special files in a specified location, or digital certificates (as a form of device authentication). The host identity information can be used to make your access permission decisions.

• Question 47:

  Select and Place:

  Select and Place:

  

  

• Question 48:

  SIMULATION A. Please check the explanation

  Correct Answer. A
  A

  ---

  

  

  Explanation: Navigate to:

  

  Address Pools:

  

  Navigate to:

  

  Connection Profiles ADD

  

  Advanced SSLVPN:

  

  Basic:

  

  Navigate to:

  

  

  Navigate back to:

  

  And update Default Group Policy

  

  Navigate to:

  

  

  Then

  

  And we have:

  

• Question 49:

  When configuring dead peer detection for remote-access VPN, what does the confidence level parameter represent?

  A. It specifies the number of seconds the adaptive security appliance should allow a peer to idle before beginning keepalive monitoring.
  B. It specifies the number of seconds to wait between IKE keepalive retries.
  C. The higher the number, the more reliable the link is.
  D. It is determined dynamically based on reliability, uptime, and load.
  A. It specifies the number of seconds the adaptive security appliance should allow a peer to idle before beginning keepalive monitoring.

  ---

  

• Question 50:

  An XYZ Corporation systems engineer, while making a sales call on the ABC Corporation headquarters, tried to access the XYZ sales demonstration folder to transfer a demonstration via FTP from an ABC conference room behind the firewall. The engineer could not reach XYZ through the remote-access VPN tunnel. From home the previous day, however, the engineer did connect to the XYZ sales demonstration folder and transferred the demonstration via IPsec over DSL.

  To get the connection to work and transfer the demonstration, what should the engineer do?

  A. Change the MTU size on the IPsec client to account for the change from DSL to cable transmission.
  B. Enable the local LAN access option on the IPsec client.
  C. Enable the IPsec over TCP option on the IPsec client.
  D. Enable the clientless SSL VPN option on the PC.
  C. Enable the IPsec over TCP option on the IPsec client.

  ---

  IP Security (IPSec) over Transmission Control Protocol (TCP) enables a VPN Client to operate in an environment in which standard Encapsulating Security Protocol (ESP, Protocol 50) or Internet Key Exchange (IKE, User Datagram Protocol (UDP) 500) cannot function, or can function only with modification to existing firewall rules. IPSec over TCP encapsulates both the IKE and IPSec protocols within a TCP packet, and it enables secure tunneling through both Network Address Translation (NAT) and Port Address Translation (PAT) devices and firewalls