Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 61:

  When deploying clientless SSL VPNs, what should you do to support external unmanaged VPN clients?

  A. Deploy a private PKI service.
  B. Issue self-signed identity certificates for the external clients that you wish to provide with access to your enterprise.
  C. Configure policies specifically for the clients that have a group userID and password.
  D. Implement a global PKI service.
  D. Implement a global PKI service.

• Question 62:

  Which three Host Scan checks on a remote endpoint can you configure Cisco Secure Desktop to perform? (Choose three.)

  A. registry checks
  B. user rights checks
  C. group policy objects checks
  D. file checks
  E. virus software checks F. process checks
  A. registry checks
  D. file checks

  ---

  http://www.cisco.com/en/US/docs/security/csd/csd341/configuration/guide/CSDhscan.html You can specify a set of registry entries, filenames, and process names, which form a part of Basic Host Scan. Host Scan, which includes Basic Host Scan and Endpoint Assessment, or Advanced Endpoint Assessment; occurs after the prelogin assessment but before the assignment of a DAP. Following the Basic Host Scan, the security appliance uses the login credentials, the host scan results, prelogin policy, and other criteria you configure to assign a DAP. See the sections that name the types of Basic Host Scan entries you would like to configure:稟dding a File Check稟dding a Registry Key Check稟dding a Process Check

• Question 63:

  Match the Diffie-Hellman group on the left with the correct application on the right. (Not all items will be used.)

  Select and Place:

  

  

• Question 64:

  

  

  An engineer, while working at a home office, wants to launch the Cisco AnyConnect Client to the corporate offices while simultaneously printing network designs on the home network.

  Without allowing access to the Internet, what are the two best ways for the administrator to configure this application? (Choose two.)

  A. Select the Tunnel All Networks policy.
  B. Select the Tunnel Network List Below policy.
  C. Select the Exclude Network List Below policy.
  D. Configure an exempted network list.
  E. Configure a standard access list and apply it to the network list.
  F. Configure an extended access list and apply it to the network list.
  C. Select the Exclude Network List Below policy.
  E. Configure a standard access list and apply it to the network list.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702992.shtml

• Question 65:

  Refer to the exhibit.

  

  You are configuring a laptop with the Cisco VPN Client, which uses digital certificates for authentication. Which protocol does the Cisco VPN Client use to retrieve the digital certificate from the CA server?

  A. FTP
  B. LDAP
  C. HTTPS
  D. SCEP
  E. OCSP
  D. SCEP

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/cert_cfg.html

  About CRLs Certificate Revocation Lists provide the security appliance with one means of determining whether a certificate that is within its valid time range has been revoked by its issuing CA. CRL configuration is a part of the configuration of a trustpoint.

  You can configure the security appliance to make CRL checks mandatory when authenticating a certificate (revocation-check crl command). You can also make the CRL check optional by adding the none argument (revocation-check crl none command), which allows the certificate authentication to succeed when the CA is unavailable to provide updated CRL data. The security appliance can retrieve CRLs from CAs using HTTP, SCEP, or LDAP. CRLs retrieved for each trustpoint are cached for a length of time configurable for each trustpoint. When the security appliance has cached a CRL for more than the length of time it is configured to cache CRLs, the security appliance considers the CRL too old to be reliable, or "stale". The security appliance attempts to retrieve a newer version of the CRL the next time a certificate authentication requires checking the stale CRL.

• Question 66:

  With SCEP enabled in a Cisco AnyConnect Connection Profile, what additional configuration step must you do when using Cisco ASA 8.4 software?

  A. Configure local authentication prior to the enrollment process.
  B. Configure the client to poll the CA for a response to the certificate request.
  C. Configure the location of the CA server.
  D. Configure the profile to inherit the SCEP forwarding URL.
  C. Configure the location of the CA server.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/administration/guide/ac 03features.html#wp1072891

  

• Question 67:

  Which two options are correct regarding IKE and IPv6 VPN support on the Cisco ASA using version 8.4? (Choose two.)

  A. The Cisco ASA supports full IKEv2 IPv6 for site-to-site VPNs only.
  B. The Cisco ASA supports full IKEv2 IPv6 for remote-access VPNs.
  C. The Cisco ASA supports IKEv1 and IKEv2 configuration on the same crypto map.
  D. The Cisco ASA supports negotiation of authentication type using IKEv2 with IPv6.
  E. The Cisco ASA supports all types of VPN configurations when using IPv6
  A. The Cisco ASA supports full IKEv2 IPv6 for site-to-site VPNs only.
  C. The Cisco ASA supports IKEv1 and IKEv2 configuration on the same crypto map.

  ---

  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c25- 593781.html

  ?IPv6 IPsec Site-to-Site VPN: Customers can now create encrypted IPsec VPN connections over IPv6 networks

  http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_site2site.html#wp1061313

  For IKEv2, you can configure multiple encryption and authentication types, and multiple integrity algorithms for a single policy. The ASA orders the settings from the most secure to the least secure and negotiates with the peer using that order. This allows you to potentially send a single proposal to convey all the allowed transforms instead of the need to send each allowed combination as with IKEv1.

• Question 68:

  You are configuring bookmarks for the clientless SSL VPN portal without the use of plug-ins.

  Which three bookmark types are supported? (Choose three.)

  A. RDP
  B. HTTP
  C. FTP
  D. CIFS
  E. SSH
  F. Telnet
  B. HTTP
  C. FTP
  D. CIFS

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/deploy.html#w p1227212

• Question 69:

  A remote user who establishes a clientless SSL VPN session is presented with a web page. The administrator has the option to customize the "look and feel" of the page. What are three components of the VPN Customization Editor? (Choose three.)

  A. Application page
  B. Logon page
  C. Networking page
  D. Logout page
  E. Home page
  F. Portal page
  B. Logon page
  D. Logout page
  F. Portal page

  ---

  GUI Enhancements In Cisco IOS Release 12.4(15)T, ergonomic improvements were made to the GUI user interface of the Cisco IOS SSL VPN gateway. The improved customization of the user interface provides for greater flexibility and the ability to tailor portal pages for individualized looks. Enhancements were made to the following web screens: ?Login screen ?Portal page

• Question 70:

  In a remote-access VPN solution, on which device or devices can dead peer detection be configured?

  A. remote device
  B. headend device
  C. both headend and remote devices
  D. Dead peer detection can be configured only on site-to-site VPN.
  C. both headend and remote devices

  ---

  Dead Peer Detection Dead Peer Detection (DPD) ensures that the security appliance (gateway) or the client can quickly detect a condition where the peer is not responding, and the connection has failed.

  Fields

  ?Gateway Side Detection--Uncheck the Disable check box to specify that DPD is performed by the security appliance (gateway). Enter the interval, from 30 to 3600 seconds, with which the security appliance performs

  DPD.

  ?Client Side Detection--Uncheck the Disable check box to specify that DPD is performed by the client.

  Enter the interval, from 30 to 3600 seconds, with which the client performs DPD.