Cisco
Exam Name: Securing Networks with Cisco Routers and Switches (SECURE v1.0)
642-637 PDF
http://www.examcertify.co.uk/642-637.html
Click the link below to buy full version as Low as $39
One of the most
essential means on how you can prepare for Securing
Networks with Cisco Routers and Switches (SECURE v1.0) exam is by acquiring
the right 642-637 study materials.
This is essential for the reason that not getting the right study materials
will not surely help you prepare and eventually passing the Securing Networks with Cisco Routers and Switches (SECURE v1.0) certification
exam. Getting wrong study material will just waste your time and money. Some of
the common forms of the 642-637 PDF study material are pdf, CDs and books as well as other
journals. As there are numerous Securing
Networks with Cisco Routers and Switches (SECURE v1.0) materials available
out there, be sure to acquire the right one that offers you the most recent and
applicable 642-637 materials. It
would be best if you can get some 642-637
samples because getting sample will able to help you determine if the Microsoft
materials you have are designed or intended with the certification you wish to
obtain.
|
Question:
1
|
Refer to the exhibit.
Given the partial output of the debug command, what can be determined?
A. There is no ID payload
in the packet, as indicated by the message ID = 0.
B. The peer has not
matched any offered profiles.
C. This is an IKE quick
mode negotiation.
D. This is normal output
of a successful Phase 1 IKE exchange.
|
Answer: D
|
Explanation:
Although the authentication
of IKe phase 1 is authenticated, the exhibit question says "Given the
partial output of the "debug command", what can be determined? 2 is
best for the peer has not matched any offered profiles.
|
Question:
2
|
DRAG DROP
|
Answer:
|
Explanation:
Page 113 of the CCNP
Secure guide
Gathering Input Parameters
Because 802.1X
authentication requires several technologies to work together, up-front
planning helps ensure the success of the deployment.
Part of this planning
involves gathering important input information:
• Determine the list of
LAN switches that currently allow unauthorized users full access to the
network. Use this list to determine which of these devices should be configured
with 802.1X and the feature availability on the switches.
• Determine what
authentication database (such as Windows AD) is being used for user
credentials. This allows you to determine whether you can leverage the same one
and make the 802.1X deployment transparent to your users.
• Determine the types of
clients being used on the network (platform and operating systems). This is
required to choose a compatible supplicant and to configure it appropriately.
• Determine the software
distribution mechanism in use by the organization. This will affect provisioning
and supporting the supplicant on current and future client workstations.
• Determine whether the
network path between the supplicant and the authentication server is trusted. A
trusted network path allows an anonymous EAP-FAST implementation, whereas a nontrusted
network path requires separate EAP-FAST credentials.
|
Question:
3
|
Refer to the exhibit.
Which two Cisco IOS WebVPN
features are enabled with the partial configuration shown? (Choose two.)
A. The end-user Cisco
AnyConnect VPN software will remain installed on the end system.
B. If the Cisco AnyConnect
VPN software fails to install on the end-user PC, the end user cannot use other
modes.
C. Client based full
tunnel access has been enabled.
D. Traffic destined to the
10.0.0.0/8 network will not be tunneled and will be allowed access via a split
tunnel.
E. Clients will be
assigned IP addresses in the 10.10.0.0/16 range.
|
Answer: A, C
|
|
Question:
4
|
Which two of these are
benefits of implementing a zone-based policy firewall in transparent mode?
(Choose two.)
A. Less firewall
management is needed.
B. It can be easily
introduced into an existing network.
C. IP readdressing is
unnecessary.
D. It adds the ability to
statefully inspect non-IP traffic.
E. It has less impact on
data flows.
|
Answer: B, C
|
|
Question:
5
|
When configuring a
zone-based policy firewall, what will be the resulting action if you do not
specify any zone pairs for a possible pair of zones?
A. All sessions will pass
through the zone without being inspected.
B. All sessions will be
denied between these two zones by default.
C. All sessions will have
to pass through the router "self zone" for inspection before being
allowed to pass to the destination zone.
D. This configuration
statelessly allows packets to be delivered to the destination zone.
|
Answer: B
|
Explanation:
Zone Pair Configuration
The configuration of the
zone pair is important because its configuration dictates the direction in
which traffic is allowed to flow. As stated previously, a zone pair is
unidirectional and is the part of the configuration that controls traffic
between zones; this is referred to as interzone. If no zone pair is defined,
traffic will not flow between zones
|
Question:
6
|
Refer to the exhibit. What
can be determined from the output of this show command?
A. The IPsec connection is
in an idle state.
B. The IKE association is
in the process of being set up.
C. The IKE status is
authenticated.
D. The ISAKMP state is
waiting for quick mode status to authenticate before IPsec parameters are
passed between peers
E. IKE Quick Mode is in
the idle state, indicating a problem with IKE phase 1.
|
Answer: C
|
Explanation:
Verify Local IKE Sessions
Use the show crypto isakmp
sa command to display the current IKE Security Associations (SA) on the local router.
The QM_IDLE status indicates successful establishment of the IKE SA, meaning
that the ISAKMP process is idle after having successfully negotiated and
established SAs. Example 15-5 shows the output of the show crypto isakmp sa
command.
|
Question:
7
|
DRAG DROP
|
Answer:
|
Explanation:
Verify cryptographic
configs
router# show crypto isakmp
policy
rotection suite priority
15
ncryption algorithm: DES -
Data Encryption Standard (56 bit keys)
ash algorithm: Message
Digest 5
uthentication method: Rivest-Shamir-Adleman
Signature
iffie-Hellman Group: #2
(1024 bit)
ifetime: 5000 seconds, no
volume limit
rotection suite priority
20
ncryption algorithm: DES -
Data Encryption Standard (56 bit keys)
ash algorithm: Secure Hash
Standard authentication method: preshared Ke
|
Question:
8
|
You are running Cisco IOS
IPS software on your edge router. A new threat has become an issue. The Cisco
IOS IPS software has a signature that can address the new threat, but you
previously retired the signature. You decide to unretire that signature to
regain the desired protection level. How should you act on your decision?
A. Retired signatures are
not present in the routers memory. You will need to download a new signature
package to regain the retired signature.
B. You should re-enable
the signature and start inspecting traffic for signs of the new threat.
C. Unretiring a signature
will cause the router to recompile the signature database, which can
temporarily affect performance.
D. You cannot unretire a
signature. To avoid a disruption in traffic flow, it's best to create a custom
signature until you can download a new signature package and reload the router.
|
Answer: C
|
Explanation:
Some signatures can be
retired. This signature is not present in the router’s memory. Unretiring a
retired signature requires that the router recompile the signature database.
This can temporarily
affect performance and take a long time with a large signature database.
|
Question:
9
|
Which statement best
describes inside policy based NAT?
A. Policy NAT rules are
those that determine which addresses need to be translated per the enterprise
security policy
B. Policy NAT consists of
policy rules based on outside sources attempting to communicate with inside
endpoints.
C. These rules use source
addresses as the decision for translation policies.
D. These rules are
sensitive to all communicating endpoints.
|
Answer: A
|
|
Question:
10
|
Refer to the exhibit. What
can be determined about the IPS category configuration shown?
A. All categories are disabled.
B. All categories are
retired.
C. After all other
categories were disabled, a custom category named "os ios" was
created
D. Only attacks on the
Cisco IOS system result in preventative actions.
|
Answer: D
|
Explanation:
This configuration task is
completed by entering the signature category configuration mode using the ip
ips signature-category command. See Example 13-3 for the relevant
configuration. First, retire and disable all signatures because only the
desired signatures will be enabled. This is achieved using the category all
command. Then, use the retired true and enabled false commands to disable and
retire all signatures by default. Next, enable all signatures that are designed
to prevent attacks against Cisco IOS Software devices and assign a preventative
action to them. Enter the category that comprises these signatures using the
category os ios command and enable them by using the retired false and enabled
true commands. Use the event-action produce-alert deny-packet-inline command to
enable these signatures to generate an alert and drop the offending packets
when they trigger.
|
Question:
11
|
When Cisco IOS IPS is
configured to use SDEE for event notification, how are events managed?
A. They are stored in the
router's event store and will allow authenticated remote systems to pull events
from the event store.
B. All events are
immediately sent to the remote SDEE server.
C. Events are sent via
syslog over a secure SSUTLS communications channel.
D. When the event store
reaches its maximum configured number of event notifications, the stored events
are sent via SDEE to a remote authenticated server and a new event store is
created.
|
Answer: A
|
Explanation:
SDEE uses a pull
communication model for event messages. This allows management consoles to pull
alerts from the Cisco IPS sensors over an HTTPS connection.
When Cisco SDEE
notification is enabled, by default, 200 events can be stored in the local
event store. This number can be increased to hold a maximum of 1000. All stored
events are lost if SDEE notifications are disabled, and a new local event store
is allocated when the notification feature is enabled again.
|
Question:
12
|
Which two of these will
match a regular expression with the following configuration parameters? [a-zA-Z][0-9][a-z]
(Choose two.)
A. Q3h
B. B4Mn
C. aaB132AA
D. c7lm
E. BBpjnrIT
|
Answer: A, D
|
No comments:
Post a Comment