Cisco 642-648 Online Practice Questions and Exam Preparation

Cisco 642-648 Online Questions & Answers

• Question 71:

  When using clientless SSL VPN, you might not want some applications or web resources to go through the Cisco ASA appliance. For these application and web resources, as a Cisco ASA administrator, which configuration should you use?

  A. Configure the Cisco ASA appliance for split tunneling.
  B. Configure network access exceptions in the SSL VPN customization editor.
  C. Configure the Cisco ASA appliance to disable content rewriting.
  D. Configure the Cisco ASA appliance to enable URL Entry bypass.
  E. Configure smart tunnel to bypass the Cisco ASA appliance proxy function.
  C. Configure the Cisco ASA appliance to disable content rewriting.

  ---

  http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/user/guide/vpn_web.html

  Content Rewrite The Content Rewrite pane lists all applications for which content rewrite is enabled or disabled. Clientless SSL VPN processes application traffic through a content transformation/rewriting engine that includes advanced elements such as JavaScript, VBScript, Java, and multi-byte characters to proxy HTTP traffic which may have different semantics and access control rules depending on whether the user is using an application within or independently of an SSL VPN device.

  By default, the security appliance rewrites, or transforms, all clientless traffic. You might not want some applications and web resources (for example, public websites) to go through the security appliance. The security appliance therefore lets you create rewrite rules that let users browse certain sites and applications without going through the security appliance. This is similar to split-tunneling in an IPSec VPN connection.

  You can create multiple rewrite rules. The rule number is important because the security appliance searches rewrite rules by order number, starting with the lowest, and applies the first rule that matches.

• Question 72:

  After adding a remote-access IPsec tunnel via the VPN wizard, an administrator needs to tune the IKE policy parameters. Where is the correct place to tune IKE policy parameters?

  A. Cisco IPsec VPN SW Client > Client Profile
  B. IPsec User Profile
  C. Group Policy
  D. IKE Policy
  E. Crypto Map
  D. IKE Policy

• Question 73:

  SSL server-side authentication is used for a client to verify the identity of a server. This type of authentication is commonly used for servers that require secured transactions to protect user data or account information for online purchases. Which one of these steps is not a step in the authentication process?

  A. The client sends Hello to the server, listing all of its supported cipher suites.
  B. The server sends Hello to the client, listing all of its supported cipher suites.
  C. The server sends its certificate to the client.
  D. The client generates, encrypts, and sends a session key.
  E. The server sends Change Cipher Spec to indicate a shift to encrypted mode.
  B. The server sends Hello to the client, listing all of its supported cipher suites.

• Question 74:

  Two temporary workers are given clientless SSL VPN access to the corporate network. To restrict their access to the network, match the Cisco ASDM attribute on the left to the restrictive action on the right.

  Select and Place:

  

  

• Question 75:

  Refer to the exhibit.

  

  A NOC engineer is in the process of entering information into the Create New VPN Connection Entry fields. Which statement correctly describes how to do this?

  A. In the Connection Entry field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.
  B. In the Host field, enter the IP address of the remote client device.
  C. In the Authentication tab, click the Group Authentication or Mutual Group Authentication radio button to enable symmetrical pre-shared key authentication.
  D. In the Name field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.
  D. In the Name field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client46/win/user/guide/vc4.

  html#wp1074766

  Step 1 Start the VPN Client by choosing Start > Programs > Cisco Systems VPN Client > VPN Client.

  Step 2 The VPN Client application starts and displays the advanced mode main window (Figure 4-1). If you are not already there, open the Options menu in simple mode and choose Advanced Mode or press Ctrl-M.

  

  Step 3 Select New from the toolbar or the Connection Entries menu. The VPN Client displays a form

  

  Step 4 Enter a unique name for this new connection. You can use any name to identify this connection; for example, Engineering. This name can contain spaces, and it is not case-sensitive. Step 5 Enter a description of this connection. This

  field is optional, but it helps further identify this connection.

  For example, Connection to Engineering remote server. Step 6 Enter the hostname or IP address of the remote VPN device you want to access.

  Group Authentication

  Your network administrator usually configures group authentication for you. If this is not the case, use the following procedure:

  Step 1 Click the Group Authentication radio button.

  Step 2 In the Name field, enter the name of the IPSec group to which you belong. This entry is case-sensitive.

  Step 3 In the Password field, enter the password (which is also case-sensitive) for your IPSec group. The field displays only asterisks.

  Step 4 Verify your password by entering it again in the Confirm Password field.

• Question 76:

  Refer to the exhibit.

  

  What is the likely cause of the failure?

  A. A msgid of 0 signifies a zero payload, indicating that the peer did not send any IKE proposals.
  B. The remote peer did not respond to the 11 notifications that were sent by the originating IPsec endpoint.
  C. There are mismatched IKE policies.
  D. There are mismatched tunnel groups.
  C. There are mismatched IKE policies.

  ---

  %ASA-5-713257: Phase var1 failure: Mismatched attribute types for class var2: Rcv'd: var3 Cfg'd: var4

  An adaptive security appliance has acted as the responder in a LAN-to-LAN connection. It indicates that the adaptive security appliance crypto configuration does not match the configuration of the initiator. The message specifies during which phase the mismatch occurred, and which attributes both the responder and the initiator had that were different.

  穠ar1--The phase during which the mismatch occurred穠ar2--The class to which the attributes that do not match belong穠ar3--The attribute received from the initiator 穠ar4--The attribute configured

• Question 77:

  When preconfiguring a Cisco AnyConnect profile for the user group, which file is output by the Cisco AnyConnect profile editor?

  A. user.ini
  B. user.html
  C. user.pcf
  D. user.xml
  D. user.xml

  ---

  http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/ac 02asaconfig.html

• Question 78:

  Which two types of digital certificate enrollment processes are available for the Cisco ASA security appliance? (Choose two.)

  A. LDAP
  B. FTP
  C. TFTP
  D. HTTP
  E. SCEP
  F. Manual
  E. SCEP
  F. Manual

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b25dc1.shtml and http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808b3cff.shtml

• Question 79:

  Refer to the exhibit.

  

  While configuring a site-to-site VPN tunnel, a new NOC engineer encounters the Reverse Route Injection parameter.

  Assuming that static routes are redistributed by the Cisco ASA to the IGP, what effect does enabling Reverse Route Injection on the local Cisco ASA have on a configuration?

  A. The local Cisco ASA advertises its default routes to the distant end of the site-to-site VPN tunnel.
  B. The local Cisco ASA advertises routes from the dynamic routing protocol that is running on the local Cisco ASA to the distant end of the site-to-site VPN tunnel.
  C. The local Cisco ASA advertises routes that are at the distant end of the site-to-site VPN tunnel.
  D. The local Cisco ASA advertises routes that are on its side of the site-to-site VPN tunnel to the distant end of the site-to-site VPN tunnel.
  C. The local Cisco ASA advertises routes that are at the distant end of the site-to-site VPN tunnel.

  ---

  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00809d07 de.shtml

• Question 80:

  What is a valid reason for configuring a list of backup servers on the Cisco AnyConnect VPN Client profile?

  A. to access a backup authentication server
  B. to access a backup DHCP server
  C. to access a backup VPN server
  D. to access a backup CA server
  C. to access a backup VPN server