Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 51:

  Refer to the exhibit.

  

  Today was the first day on a new project for an offsite temporary worker at the XYZ Corporation. The worker was told to launch the SSL VPN session and then use the smart tunnel application to start a remote desktop application on the project server, projects_server.xyz.com. The worker looked at the portal screen that was provided, but she did not know how to access the smart tunnel application.

  As the help desk person, what should you instruct the temporary worker to do?

  A. Click the Web Applications button.
  B. Click the Applications Access button.
  C. Click the Browse Networks button.
  D. On the Home page, click the Address drop-down menu, choose RDP://, and fill in the destination host name, which is projects_server.abc.com.
  B. Click the Applications Access button.

• Question 52:

  Refer to the exhibit.

  

  You are the network security administrator. You have received calls from site-to-site IPsec VPN users saying that they cannot connect into the network. In troubleshooting this problem, you discover that some sites can connect, but other sites cannot. It is not always the same sites experiencing problems. You suspect that the permitted number of simultaneous logins has been reached and needs to be increased.

  In which configuration window or tab should you accomplish this task?

  A. in the IKE Policies window
  B. in the IKE Parameters window
  C. in the System Options window
  D. in the Device Management tab
  C. in the System Options window

  ---

  Limit the maximum number of active IPSec VPN sessions

  --Enables or disables limiting the maximum number of active IPSec VPN sessions. The range depends on the hardware platform and the software license.

  Maximum Active IPSec VPN Sessions--Specifies the maximum number of active IPSec VPN sessions allowed. This field is active only when you select the preceding check box to limit the maximum number of active IPSec VPN sessions.

• Question 53:

  What is the selection hierarchy to which attributes are applied to a clientless SSL VPN use? Drag an attribute policy on the to the correct priority level within the attribute hierarchy on the right.

  Select and Place:

  

  

• Question 54:

  Refer to following Exhibit and answer the following question below:

  

  

  Upon logging in, user, emploeyee1, gets two sets of privileges. Choose the two options that show the privileges that are held by employee1.(Choose two)

  A. Cisco ASDM, SSH, Telnet, and console access
  B. CLI login prompt for SSH, Telnet, and console only
  C. No Cisco ASDM, SSH, or console access
  D. Level 15
  E. Level 2
  F. Level 3
  D. Level 15
  E. Level 2

  ---

  Command authorization If you turn on command authorization using the local database, then the security appliance refers to the user privilege level to determine what commands are available. Otherwise, the privilege level is not generally used. By default, all commands are either privilege level 0 or level 15. ASDM allows you to enable three predefined privilege levels, with commands assigned to level 15 (Admin), level 5 (Read Only), and level 3 (Monitor Only). If you use the predefined levels, then assign users to one of these three privilege levels. This should show assigned levels for us:; on my demo version I could get the advanced tab to appear on aaa authorization to setup other commands but this shows how I setup contractor1

  

• Question 55:

  Which statement about plug-ins is false?

  A. Plug-ins do not require any installation on the remote system.
  B. Plug-ins require administrator privileges on the remote system.
  C. Plug-ins support interactive terminal access.
  D. Plug-ins are not supported on the Windows Mobile platform.
  B. Plug-ins require administrator privileges on the remote system.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/deployhtml#wp 1162435

  Plug-ins

  The security appliance supports Java plug-ins for clientless SSL VPN connections. Plug-ins are Java programs that operate in a browser. These plug-ins include SSH/Telnet, RDP, VNC, and Citrix.

  Per the GNU General Public License (GPL), Cisco redistributes plug-ins without making any changes to them. Per the GPL, Cisco cannot directly enhance these plug-ins. To use plug-ins you must install Java Runtime Environment (JRE)

  1.4.2.x or greater. You must also use a compatible browser specified here: http://www.cisco.com/en/US/docs/security/asa/compatibility/asa-vpncompatibility.html

• Question 56:

  When deploying remote-access IPsec VPN tunnels, what is the key benefit of digital certificates?

  A. resiliency
  B. simplification
  C. scalability
  D. centralization
  C. scalability

• Question 57:

  Which statement regarding hashing is correct?

  A. MD5 produces a 64-bit message digest.
  B. SHA-1 produces a 160-bit message digest.
  C. MD5 takes more CPU cycles to compute than SHA-1.
  D. Changing 1 bit of the input to SHA-1 can change up to 5 bits in the output.
  B. SHA-1 produces a 160-bit message digest.

• Question 58:

  When initiating a new SSL or TLS session, the client receives the server SSL certificate and validates it. After validating the server certificate, what does the client use the certificate for?

  A. The client and server use the server public key to encrypt the SSL session data.
  B. The server creates a separate session key and sends it to the client. The client decrypts the session key by using the server public key.
  C. The client and server switch to a DH key exchange to establish a session key.
  D. The client generates a random session key, encrypts it with the server public key, and then sends it to the server.
  D. The client generates a random session key, encrypts it with the server public key, and then sends it to the server.

• Question 59:

  Refer to following Exhibit and answer the following question below:

  

  

  

  After providing the correct VPN login credentials, user, contractor1, is enabled to use which VPN access type?

  A. Cisco Any Connect VPN
  B. Clientless VPN
  C. Cisco Any Connect VPN and clientless VPN
  D. Cisco Any Connect VPN, clientless VPN, and IPsec VPN
  C. Cisco Any Connect VPN and clientless VPN

  ---

  Configuration > network client access > any connect connection profiles >connection profiles > edit for each profile > general > more options > tunneling protocol > see the check marks Monitoring > VPN > VPN statistics > sessions filter by >>> choose contractor1

  

  Monitoring > VPN > VPN statistics > sessions filter by >>> choose contractor1

  

• Question 60:

  In Cisco ASDM v6.4, what are four ways to implement single sign-on (SSO)? (Choose four.)

  A. Use SSO for smart tunnels.
  B. Use Kerberos SSO.
  C. Use the HTTP Form protocol.
  D. Use a dedicated SSO server.
  E. Use SSO for application plug-ins.
  F. Use auto sign-on for servers that do not require authentication credentials.
  A. Use SSO for smart tunnels.
  C. Use the HTTP Form protocol.
  D. Use a dedicated SSO server.
  E. Use SSO for application plug-ins.

  ---

  The security appliance can use the HTTP Form protocol for single sign-on (SSO) authentication of WebVPN users only. Single sign-on support lets WebVPN users enter a username and password only once to access multiple protected services and Web servers. The WebVPN server running on the security appliance acts as a proxy for the user to the authenticating server. When a user logs in, the WebVPN server sends an SSO authentication request, including username and password, to the authenticating server using HTTPS. If the server approves the authentication request, it returns an SSO authentication cookie to the WebVPN server. The security appliance keeps this cookie on behalf of the user and uses it to authenticate the user to secure websites within the domain protected by the SSO server. In addition to the HTTP Form protocol, WebVPN administrators can choose to configure SSO with the HTTP Basic and NTLM authentication protocols (the auto-signon command), or with Computer Associates eTrust SiteMinder SSO server (formerly Netegrity SiteMinder) as well. For an in-depth discussion of configuring SSO with either HTTP Forms, auto-signon or SiteMinder, The Auto Signon window or tab lets you configure or edit auto signon for users of Clientless SSL VPN. Auto signon is a simplified single signon method that you can use if you do not already have an SSO method deployed on your internal network. With auto signon configured for particular internal servers, the security appliance passes the login credentials that the user of Clientless SSL VPN entered to log in to the security appliance (username and password) to those particular internal servers. You configure the security appliance to respond to a specific authentication method for a particular range of servers. The authentication methods you can configure the security appliance to respond to consists of authentication using Basic (HTTP), NTLM, FTP and CIFS, or all of these methods. Auto signon is a straight-forward method for configuring SSO for particular internal servers. This section describes the procedure for setting up SSO with auto signon. If you already have SSO deployed using Computer Associates' SiteMinder SSO server, or if you have Security Assertion Markup Language (SAML) Browser Post Profile SSO,