Official 2014 Latest Cisco 640-554 Dump Free Download(61-70)!

QUESTION 61
Which two characteristics of the TACACS+ protocol are true? (Choose two.)

A.    uses UDP ports 1645 or 1812
B.    separates AAA functions
C.    encrypts the body of every packet
D.    offers extensive accounting capabilities
E.    is an open RFC standard protocol

Answer: BC

QUESTION 62
Refer to the exhibit. Which statement about this partial CLI configuration of an access control list is true?

clip_image001

A.    The access list accepts all traffic on the 10.0.0.0 subnets.
B.    All traffic from the 10.10.0.0 subnets is denied.
C.    Only traffic from 10.10.0.10 is allowed.
D.    This configuration is invalid. It should be configured as an extended ACL to permit the associated
wildcard mask.
E.    From the 10.10.0.0 subnet, only traffic sourced from 10.10.0.10 is allowed; traffic sourced from the
other 10.0.0.0 subnets also is allowed.
F.    The access list permits traffic destined to the 10.10.0.10 host on FastEthernet0/0 from any source.

Answer: E

QUESTION 63
Which type of Cisco ASA access list entry can be configured to match multiple entries in a single statement?

A.    nested object-class
B.    class-map
C.    extended wildcard matching
D.    object groups

Answer: D

QUESTION 64
Which statement about an access control list that is applied to a router interface is true?

A.    It only filters traffic that passes through the router.
B.    It filters pass-through and router-generated traffic.
C.    An empty ACL blocks all traffic.
D.    It filters traffic in the inbound and outbound directions.

Answer: A

QUESTION 65
You have been tasked by your manager to implement syslog in your network. Which option is an important factor to consider in your implementation?

A.    Use SSH to access your syslog information.
B.    Enable the highest level of syslog function available to ensure that all possible event messages are logged.
C.    Log all messages to the system buffer so that they can be displayed when accessing the router.
D.    Synchronize clocks on the network with a protocol such as Network Time Protocol.

Answer: D

QUESTION 66
Which protocol secures router management session traffic?

A.    SSTP
B.    POP
C.    Telnet
D.    SSH

Answer: D

QUESTION 67
Which two considerations about secure network management are important? (Choose two.)

A.    log tampering
B.    encryption algorithm strength
C.    accurate time stamping
D.    off-site storage
E.    Use RADIUS for router commands authorization.
F.    Do not use a loopback interface for device management access.

Answer: AC

QUESTION 68
Which command enables Cisco IOS image resilience?

A.    secure boot-<IOS image filename>
B.    secure boot-running-config
C.    secure boot-start
D.    secure boot-image

Answer: D

QUESTION 69
Which router management feature provides for the ability to configure multiple administrative views?

A.    role-based CLI
B.    virtual routing and forwarding
C.    secure config privilege {level}
D.    parser view view name

Answer: A

QUESTION 70
You suspect that an attacker in your network has configured a rogue Layer 2 device to intercept traffic from multiple VLANs, which allows the attacker to capture potentially sensitive data.
Which two methods will help to mitigate this type of activity? (Choose two.)

A.    Turn off all trunk ports and manually configure each VLAN as required on each port
B.    Disable DTP on ports that require trunking
C.    Secure the native VLAN, VLAN 1 with encryption
D.    Set the native VLAN on the trunk ports to an unused VLAN
E.    Place unused active ports in an unused VLAN

Answer: BD

If you want to pass the Cisco 640-554 Exam sucessfully, recommend to read latest Cisco 640-554 Dump full version.

clip_image001

Official 2014 Latest Cisco 640-554 Dump Free Download(51-60)!

QUESTION 51
Which type of NAT would you configure if a host on the external network required access to an internal host?

A.    outside global NAT
B.    NAT overload
C.    dynamic outside NAT
D.    static NAT

Answer: D

QUESTION 52
Which two features are supported by Cisco IronPort Security Gateway? (Choose two.)

A.    spam protection
B.    outbreak intelligence
C.    HTTP and HTTPS scanning
D.    email encryption
E.    DDoS protection

Answer: AD

QUESTION 53
Which option is a feature of Cisco ScanSafe technology?

A.    spam protection
B.    consistent cloud-based policy
C.    DDoS protection
D.    RSA Email DLP

Answer: B

QUESTION 54
Which two characteristics represent a blended threat? (Choose two.)

A.    man-in-the-middle attack
B.    trojan horse attack
C.    pharming attack
D.    denial of service attack
E.    day zero attack

Answer: BE

QUESTION 55
Under which higher-level policy is a VPN security policy categorized?

A.    application policy
B.    DLP policy
C.    remote access policy
D.    compliance policy
E.    corporate WAN policy

Answer: C

QUESTION 56
What does level 5 in this enable secret global configuration mode command indicate?

A.    router#enable secret level 5 password
B.    The enable secret password is hashed using MD5.
C.    The enable secret password is hashed using SHA.
D.    The enable secret password is encrypted using Cisco proprietary level 5 encryption.
E.    Set the enable secret command to privilege level 5.
F.    The enable secret password is for accessing exec privilege level 5.

Answer: E

QUESTION 57
Which Cisco management tool provides the ability to centrally provision all aspects of device configuration across the Cisco family of security products?

A.    Cisco Configuration Professional
B.    Security Device Manager
C.    Cisco Security Manager
D.    Cisco Secure Management Server

Answer: C

QUESTION 58
Which option is the correct representation of the IPv6 address 2001:0000:150C:0000:0000:41B1:45A3:041D?

A.    2001::150c::41b1:45a3:041d
B.    2001:0:150c:0::41b1:45a3:04d1
C.    2001:150c::41b1:45a3::41d
D.    2001:0:150c::41b1:45a3:41d

Answer: D

QUESTION 59
Which three options are common examples of AAA implementation on Cisco routers? (Choose
three.)

A.    authenticating remote users who are accessing the corporate LAN through IPsec VPN connections
B.    authenticating administrator access to the router console port, auxiliary port, and vty ports
C.    implementing PKI to authenticate and authorize IPsec VPN peers using digital certificates
D.    tracking Cisco NetFlow accounting statistics
E.    securing the router by locking down all unused services
F.    performing router commands authorization using TACACS+

Answer: ABF

QUESTION 60
When AAA login authentication is configured on Cisco routers, which two authentication methods should be used as the final method to ensure that the administrator can still log in to the router in case the external AAA server fails? (Choose two.)

A.    group RADIUS
B.    group TACACS+
C.    local
D.    krb5
E.    enable
F.    if-authenticated

Answer: CE

If you want to pass the Cisco 640-554 Exam sucessfully, recommend to read latest Cisco 640-554 Dump full version.

clip_image001

Official 2014 Latest Cisco 640-554 Dump Free Download(41-50)!

QUESTION 41
Refer to the exhibit.
*** Exhibit is Missing ***
This Cisco IOS access list has been configured on the FA0/0 interface in the inbound direction.
Which four TCP packets sourced from 10.1.1.1 port 1030 and routed to the FA0/0 interface are permitted? (Choose four.)

A.    destination ip address: 192.168.15.37 destination port: 22
B.    destination ip address: 192.168.15.80 destination port: 23
C.    destination ip address: 192.168.15.66 destination port: 8080
D.    destination ip address: 192.168.15.36 destination port: 80
E.    destination ip address: 192.168.15.63 destination port: 80
F.    destination ip address: 192.168.15.40 destination port: 21

Answer: BCDE

QUESTION 42
You use Cisco Configuration Professional to enable Cisco IOS IPS. Which state must a signature be in before any actions can be taken when an attack matches that signature?

A.    enabled
B.    unretired
C.    successfully complied
D.    successfully complied and unretired
E.    successfully complied and enabled
F.    unretired and enabled
G.    enabled, unretired, and successfully complied

Answer: G

QUESTION 43
Which statement describes how the sender of the message is verified when asymmetric encryption is used?

A.    The sender encrypts the message using the sender’s public key, and the receiver decrypts the message
using the sender’s private key.
B.    The sender encrypts the message using the sender’s private key, and the receiver decrypts the message
using the sender’s public key.
C.    The sender encrypts the message using the receiver’s public key, and the receiver decrypts the message
using the receiver’s private key.
D.    The sender encrypts the message using the receiver’s private key, and the receiver decrypts the message
using the receiver’s public key.
E.    The sender encrypts the message using the receiver’s public key, and the receiver decrypts the message
using the sender’s public key.

Answer: B

QUESTION 44
Refer to the exhibit.
***Exhibit is Missing***
Which three statements about these three show outputs are true? (Choose three.)

A.    Traffic matched by ACL 110 is encrypted.
B.    The IPsec transform set uses SHA for data confidentiality.
C.    The crypto map shown is for an IPsec site-to-site VPN tunnel.
D.    The default ISAKMP policy uses a digital certificate to authenticate the IPsec peer.
E.    The IPsec transform set specifies the use of GRE over IPsec tunnel mode.
F.    The default ISAKMP policy has higher priority than the other two ISAKMP policies with a priority of 1 and 2

Answer: ACD

QUESTION 45
Which type of security control is defense in depth?

A.    threat mitigation
B.    risk analysis
C.    botnet mitigation
D.    overt and covert channels

Answer: A

QUESTION 46
Which two options are two of the built-in features of IPv6? (Choose two.)

A.    VLSM
B.    native IPsec
C.    controlled broadcasts
D.    mobile IP
E.    NAT

Answer: BD

QUESTION 47
Which option is a characteristic of the RADIUS protocol?

A.    uses TCP
B.    offers multiprotocol support
C.    combines authentication and authorization in one process
D.    supports bi-directional challenge

Answer: C

QUESTION 48
Refer to the exhibit.
***Exhibit is Missing***
Which statement about this debug output is true?

A.    The requesting authentication request came from username GETUSER.
B.    The TACACS+ authentication request came from a valid user.
C.    The TACACS+ authentication request passed, but for some reason the user’s connection was closed
immediately.
D.    The initiating connection request was being spoofed by a different source address.

Answer: B

QUESTION 49
When STP mitigation features are configured, where should the root guard feature be deployed?

A.    toward ports that connect to switches that should not be the root bridge
B.    on all switch ports
C.    toward user-facing ports
D.    Root guard should be configured globally on the switch.

Answer: A

QUESTION 50
Which option is a characteristic of a stateful firewall?

A.    can analyze traffic at the application layer
B.    allows modification of security rule sets in real time to allow return traffic
C.    will allow outbound communication, but return traffic must be explicitly permitted
D.    supports user authentication

Answer: B

 

If you want to pass the Cisco 640-554 Exam sucessfully, recommend to read latest Cisco 640-554 Dump full version.

clip_image001

Official 2014 Latest Cisco 640-554 Dump Free Download(31-40)!

QUESTION 31
Which security measure must you take for native VLANs on a trunk port?

A.    Native VLANs for trunk ports should never be used anywhere else on the switch.
B.    The native VLAN for trunk ports should be VLAN 1.
C.    Native VLANs for trunk ports should match access VLANs to ensure that cross-VLAN traffic from
multiple switches can be delivered to physically disparate switches.
D.    Native VLANs for trunk ports should be tagged with 802.1Q.

Answer: A

QUESTION 32
Refer to the exhibit.
***Exhibit is Missing***
Which switch is designated as the root bridge in this topology?

A.    It depends on which switch came on line first.
B.    Neither switch would assume the role of root bridge because they have the same default priority.
C.    switch X
D.    switch Y

Answer: C

QUESTION 33
Which type of firewall technology is considered the versatile and commonly used firewall technology?

A.    static packet filter firewall
B.    application layer firewall
C.    stateful packet filter firewall
D.    proxy firewall
E.    adaptive layer firewall

Answer: C

QUESTION 34
Which type of NAT is used where you translate multiple internal IP addresses to a single global, routable IP address?

A.    policy NAT
B.    dynamic PAT
C.    static NAT
D.    dynamic NAT
E.    policy PAT

Answer: B

QUESTION 35
Which Cisco IPS product offers an inline, deep-packet inspection feature that is available in integrated services routers?

A.    Cisco iSDM
B.    Cisco AIM
C.    Cisco IOS IPS
D.    Cisco AIP-SSM

Answer: C

QUESTION 36
Which three modes of access can be delivered by SSL VPN? (Choose three.)

A.    full tunnel client
B.    IPsec SSL
C.    TLS transport mode
D.    thin client
E.    clientless
F.    TLS tunnel mode

Answer: ADE

QUESTION 37
During role-based CLI configuration, what must be enabled before any user views can be created?

A.    multiple privilege levels
B.    usernames and passwords
C.    aaa new-model command
D.    secret password for the root user
E.    HTTP and/or HTTPS server
F.    TACACS server group

Answer: C

QUESTION 38
Which three statements about applying access control lists to a Cisco router are true? (Choose three.)

A.    Place more specific ACL entries at the top of the ACL.
B.    Place generic ACL entries at the top of the ACL to filter general traffic and thereby reduce “noise” on
the network.
C.    ACLs always search for the most specific entry before taking any filtering action.
D.    Router-generated packets cannot be filtered by ACLs on the router.
E.    If an access list is applied but it is not configured, all traffic passes.

Answer: ADE

QUESTION 39
When port security is enabled on a Cisco Catalyst switch, what is the default action when the configured maximum number of allowed MAC addresses value is exceeded?

A.    The port remains enabled, but bandwidth is throttled until old MAC addresses are aged out.
B.    The port is shut down.
C.    The MAC address table is cleared and the new MAC address is entered into the table.
D.    The violation mode of the port is set to restrict.

Answer: B

QUESTION 40
Which three statements about the Cisco ASA appliance are true? (Choose three.)

A.    The DMZ interface(s) on the Cisco ASA appliance most typically use a security level between 1 and 99.
B.    The Cisco ASA appliance supports Active/Active or Active/Standby failover.
C.    The Cisco ASA appliance has no default MPF configurations.
D.    The Cisco ASA appliance uses security contexts to virtually partition the ASA into multiple virtual firewalls.
E.    The Cisco ASA appliance supports user-based access control using 802.1x.
F.    An SSM is required on the Cisco ASA appliance to support Botnet Traffic Filtering.

Answer: ABD

If you want to pass the Cisco 640-554 Exam sucessfully, recommend to read latest Cisco 640-554 Dump full version.

clip_image001

Official 2014 Latest Cisco 640-554 Dump Free Download(21-30)!

QUESTION 21
Which option can be used to authenticate the IPsec peers during IKE Phase 1?

A.    Diffie-Hellman Nonce
B.    pre-shared key
C.    XAUTH
D.    integrity check value
E.    ACS
F.    AH

Answer: B

QUESTION 22
Which single Cisco IOS ACL entry permits IP addresses from 172.16.80.0 to 172.16.87.255?

A.    permit 172.16.80.0 0.0.3.255
B.    permit 172.16.80.0 0.0.7.255
C.    permit 172.16.80.0 0.0.248.255
D.    permit 176.16.80.0 255.255.252.0
E.    permit 172.16.80.0 255.255.248.0
F.    permit 172.16.80.0 255.255.240.0

Answer: B

QUESTION 23
You want to use the Cisco Configuration Professional site-to-site VPN wizard to implement a site- to-site IPsec VPN using pre-shared key.
Which four configurations are required (with no defaults)? (Choose four.)

A.    the interface for the VPN connection
B.    the VPN peer IP address
C.    the IPsec transform-set
D.    the IKE policy
E.    the interesting traffic (the traffic to be protected)
F.    the pre-shared key

Answer: ABEF

QUESTION 24
Which two options represent a threat to the physical installation of an enterprise network? (Choose two.)

A.    surveillance camera
B.    security guards
C.    electrical power
D.    computer room access
E.    change control

Answer: CD

QUESTION 25
Which option represents a step that should be taken when a security policy is developed?

A.    Perform penetration testing.
B.    Determine device risk scores.
C.    Implement a security monitoring system.
D.    Perform quantitative risk analysis.

Answer: D

QUESTION 26
Which type of network masking is used when Cisco IOS access control lists are configured?

A.    extended subnet masking
B.    standard subnet masking
C.    priority masking
D.    wildcard masking

Answer: D

QUESTION 27
How are Cisco IOS access control lists processed?

A.    Standard ACLs are processed first.
B.    The best match ACL is matched first.
C.    Permit ACL entries are matched first before the deny ACL entries.
D.    ACLs are matched from top down.
E.    The global ACL is matched first before the interface ACL.

Answer: D

QUESTION 28
Which type of management reporting is defined by separating management traffic from production traffic?

A.    IPsec encrypted
B.    in-band
C.    out-of-band
D.    SSH

Answer: C

QUESTION 29
Which syslog level is associated with LOG_WARNING?

A.    1
B.    2
C.    3
D.    4
E.    5
F.    6

Answer: D

QUESTION 30
In which type of Layer 2 attack does an attacker broadcast BDPUs with a lower switch priority?

A.    MAC spoofing attack
B.    CAM overflow attack
C.    VLAN hopping attack
D.    STP attack

Answer: D

If you want to pass the Cisco 640-554 Exam sucessfully, recommend to read latest Cisco 640-554 Dump full version.

clip_image001

Official 2014 Latest Cisco 640-554 Dump Free Download(11-20)!

QUESTION 11
Which four tasks are required when you configure Cisco IOS IPS using the Cisco Configuration Professional IPS wizard? (Choose four.)

A.    Select the interface(s) to apply the IPS rule.
B.    Select the traffic flow direction that should be applied by the IPS rule.
C.    Add or remove IPS alerts actions based on the risk rating.
D.    Specify the signature file and the Cisco public key.
E.    Select the IPS bypass mode (fail-open or fail-close).
F.    Specify the configuration location and select the category of signatures to be applied to the selected
interface(s).

Answer: ABDF

QUESTION 12
Which statement is a benefit of using Cisco IOS IPS?

A.    It uses the underlying routing infrastructure to provide an additional layer of security.
B.    It works in passive mode so as not to impact traffic flow.
C.    It supports the complete signature database as a Cisco IPS sensor appliance.
D.    The signature database is tied closely with the Cisco IOS image.

Answer: A

QUESTION 13
Which description of the Diffie-Hellman protocol is true?

A.    It uses symmetrical encryption to provide data confidentiality over an unsecured communications channel.
B.    It uses asymmetrical encryption to provide authentication over an unsecured communications channel.
C.    It is used within the IKE Phase 1 exchange to provide peer authentication.
D.    It provides a way for two peers to establish a shared-secret key, which only they will know, even though
they are communicating over an unsecured channel.
E.    It is a data integrity algorithm that is used within the IKE exchanges to guarantee the integrity of the
message of the IKE exchanges.

Answer: D

QUESTION 14
Which IPsec transform set provides the strongest protection?

A.    crypto ipsec transform-set 1 esp-3des esp-sha-hmac
B.    crypto ipsec transform-set 2 esp-3des esp-md5-hmac
C.    crypto ipsec transform-set 3 esp-aes 256 esp-sha-hmac
D.    crypto ipsec transform-set 4 esp-aes esp-md5-hmac
E.    crypto ipsec transform-set 5 esp-des esp-sha-hmac
F.    crypto ipsec transform-set 6 esp-des esp-md5-hmac

Answer: C

QUESTION 15
Which two options are characteristics of the Cisco Configuration Professional Security Audit wizard? (Choose two.)

A.    displays a screen with fix-it check boxes to let you choose which potential security-related configuration
changes to implement
B.    has two modes of operation: interactive and non-interactive
C.    automatically enables Cisco IOS firewall and Cisco IOS IPS to secure the router
D.    uses interactive dialogs and prompts to implement role-based CLI
E.    requires users to first identify which router interfaces connect to the inside network and which connect to
the outside network

Answer: AE

QUESTION 16
Which statement describes a result of securing the Cisco IOS image using the Cisco IOS image resilience feature?

A.    The show version command does not show the Cisco IOS image file location.
B.    The Cisco IOS image file is not visible in the output from the show flash command.
C.    When the router boots up, the Cisco IOS image is loaded from a secured FTP location.
D.    The running Cisco IOS image is encrypted and then automatically backed up to the NVRAM.
E.    The running Cisco IOS image is encrypted and then automatically backed up to a TFTP server.

Answer: B

QUESTION 17
Which aaa accounting command is used to enable logging of the start and stop records for user terminal sessions on the router?

A.    aaa accounting network start-stop tacacs+
B.    aaa accounting system start-stop tacacs+
C.    aaa accounting exec start-stop tacacs+
D.    aaa accounting connection start-stop tacacs+
E.    aaa accounting commands 15 start-stop tacacs+

Answer: C

QUESTION 18
Which access list permits HTTP traffic sourced from host 10.1.129.100 port 3030 destined to host 192.168.1.10?

A.    access-list 101 permit tcp any eq 3030
B.    access-list 101 permit tcp 10.1.128.0 0.0.1.255 eq 3030 192.168.1.0 0.0.0.15 eq www
C.    access-list 101 permit tcp 10.1.129.0 0.0.0.255 eq www 192.168.1.10 0.0.0.0 eq www
D.    access-list 101 permit tcp host 192.168.1.10 eq 80 10.1.0.0 0.0.255.255 eq 3030
E.    access-list 101 permit tcp 192.168.1.10 0.0.0.0 eq 80 10.1.0.0 0.0.255.255
F.    access-list 101 permit ip host 10.1.129.100 eq 3030 host 192.168.1.100 eq 80

Answer: B

QUESTION 19
Which location is recommended for extended or extended named ACLs?

A.    an intermediate location to filter as much traffic as possible
B.    a location as close to the destination traffic as possible
C.    when using the established keyword, a location close to the destination point to ensure that return traffic
is allowed
D.    a location as close to the source traffic as possible

Answer: D

QUESTION 20
Which statement about asymmetric encryption algorithms is true?

A.    They use the same key for encryption and decryption of data.
B.    They use the same key for decryption but different keys for encryption of data.
C.    They use different keys for encryption and decryption of data.
D.    They use different keys for decryption but the same key for encryption of data.

Answer: C

If you want to pass the Cisco 640-554 Exam sucessfully, recommend to read latest Cisco 640-554 Dump full version.

clip_image001

Official 2014 Latest Cisco 640-554 Dump Free Download(1-10)!

QUESTION 1
Which statement describes a best practice when configuring trunking on a switch port?

A.    Disable double tagging by enabling DTP on the trunk port.
B.    Enable encryption on the trunk port.
C.    Enable authentication and encryption on the trunk port.
D.    Limit the allowed VLAN(s) on the trunk to the native VLAN only.
E.    Configure an unused VLAN as the native VLAN.

Answer: E

QUESTION 2
Which type of Layer 2 attack causes a switch to flood all incoming traffic to all ports?

A.    MAC spoofing attack
B.    CAM overflow attack
C.    VLAN hopping attack
D.    STP attack

Answer: B

QUESTION 3
What is the best way to prevent a VLAN hopping attack?

A.    Encapsulate trunk ports with IEEE 802.1Q.
B.    Physically secure data closets.
C.    Disable DTP negotiations.
D.    Enable BDPU guard.

Answer: C

QUESTION 4
Which statement about PVLAN Edge is true?

A.    PVLAN Edge can be configured to restrict the number of MAC addresses that appear on a single port.
B.    The switch does not forward any traffic from one protected port to any other protected port.
C.    By default, when a port policy error occurs, the switchport shuts down.
D.    The switch only forwards traffic to ports within the same VLAN Edge.

Answer: B

QUESTION 5
If you are implementing VLAN trunking, which additional configuration parameter should be added to the trunking configuration?

A.    no switchport mode access
B.    no switchport trunk native VLAN 1
C.    switchport mode DTP
D.    switchport nonnegotiate

Answer: D

QUESTION 6
When Cisco IOS zone-based policy firewall is configured, which three actions can be applied to a traffic class? (Choose three.)

A.    pass
B.    police
C.    inspect
D.    drop
E.    queue
F.    shape

Answer: ACD

QUESTION 7
With Cisco IOS zone-based policy firewall, by default, which three types of traffic are permitted by the router when some of the router interfaces are assigned to a zone? (Choose three.)

A.    traffic flowing between a zone member interface and any interface that is not a zone member
B.    traffic flowing to and from the router interfaces (the self zone)
C.    traffic flowing among the interfaces that are members of the same zone
D.    traffic flowing among the interfaces that are not assigned to any zone
E.    traffic flowing between a zone member interface and another interface that belongs in a different zone
F.    traffic flowing to the zone member interface that is returned traffic

Answer: BCD

QUESTION 8
Which option is a key difference between Cisco IOS interface ACL configurations and Cisco ASA appliance interface ACL configurations?

A.    The Cisco IOS interface ACL has an implicit permit-all rule at the end of each interface ACL.
B.    Cisco IOS supports interface ACL and also global ACL. Global ACL is applied to all interfaces.
C.    The Cisco ASA appliance interface ACL configurations use netmasks instead of wildcard masks.
D.    The Cisco ASA appliance interface ACL also applies to traffic directed to the IP addresses of the Cisco
ASA appliance interfaces.
E.    The Cisco ASA appliance does not support standard ACL. The Cisco ASA appliance only support
extended ACL.

Answer: C

QUESTION 9
Which two options are advantages of an application layer firewall? (Choose two.)

A.    provides high-performance filtering
B.    makes DoS attacks difficult
C.    supports a large number of applications
D.    authenticates devices
E.    authenticates individuals

Answer: BE

QUESTION 10
On Cisco ISR routers, for what purpose is the realm-cisco.pub public encryption key used?

A.    used for SSH server/client authentication and encryption
B.    used to verify the digital signature of the IPS signature file
C.    used to generate a persistent self-signed identity certificate for the ISR so administrators can authenticate
the ISR when accessing it using Cisco Configuration Professional
D.    used to enable asymmetric encryption on IPsec and SSL VPNs
E.    used during the DH exchanges on IPsec VPNs

Answer: B

If you want to pass the Cisco 640-554 Exam sucessfully, recommend to read latest Cisco 640-554 Dump full version.

clip_image001

Free 2014 Latest Cisco 200-120 Dump (191-204) Download!

QUESTION 191
Which statement describes the process ID that is used to run OSPF on a router?

A.    It is globally significant and is used to represent the AS number.
B.    It is locally significant and is used to identify an instance of the OSPF database.
C.    It is globally significant and is used to identify OSPF stub areas.
D.    It is locally significant and must be the same throughout an area.

Answer: B

QUESTION 192
Which three are the components of SNMP? (Choose three)

A.    MIB
B.    SNMP Manager
C.    SysLog Server
D.    SNMP Agent
E.    Set

Answer: ABD

QUESTION 193
What are the Popular destinations for syslog messages to be saved?

A.    Flash
B.    The logging buffer .RAM
C.    The console terminal
D.    Other terminals
E.    Syslog server

Answer: BCE

QUESTION 194
Syslog was configured with a level 3 trap. Which 3 types of logs would be generated (choose three)

A.    Emergencies
B.    Alerts
C.    Critical
D.    Errors
E.    Warnings

Answer: ABC

QUESTION 195
What are the benefit of using Netflow? (Choose three.)

A.    Network, Application & User Monitoring
B.    Network Planning
C.    Security Analysis
D.    Accounting/Billing

Answer: ACD

QUESTION 196
Which protocol can cause overload on a CPU of a managed device?

A.    Netflow
B.    WCCP
C.    IP SLA
D.    SNMP

Answer: D

QUESTION 197
What are the three things that the Netflow uses to consider the traffic to be in a same flow?

A.    IP address
B.    Interface name
C.    Port numbers
D.    L3 protocol type
E.    MAC address

Answer: ACD

QUESTION 198
What is the alert message generated by SNMP agents called ?

A.    TRAP
B.    INFORM
C.    GET
D.    SET

Answer: AB

QUESTION 199
Which three features are added in SNMPv3 over SNMPv2?

A.    Message Integrity
B.    Compression
C.    Authentication
D.    Encryption
E.    Error Detection

Answer: ACD

QUESTION 200
In a GLBP network, who is responsible for the arp request?

A.    AVF
B.    AVG
C.    Active Router
D.    Standby Router

Answer: B

QUESTION 201
What is a valid HSRP virtual MAC address?

A.    0000.5E00.01A3
B.    0007.B400.AE01
C.    0000.0C07.AC15
D.    0007.5E00.B301

Answer: C

QUESTION 202
In GLBP, which router will respond to client ARP requests?

A.    The active virtual gateway will reply with one of four possible virtual MAC addresses.
B.    All GLBP member routers will reply in round-robin fashion.
C.    The active virtual gateway will reply with its own hardware MAC address.
D.    The GLBP member routers will reply with one of four possible burned in hardware addresses.

Answer: A

QUESTION 203
Which statement describes VRRP object tracking?

A.    It monitors traffic flow and link utilization.
B.    It ensures the best VRRP router is the virtual router master for the group.
C.    It causes traffic to dynamically move to higher bandwidth links.
D.    It thwarts man-in-the-middle attacks.

Answer: B

QUESTION 204
What is a global command?

A.    a command that is set once and affects the entire router
B.    a command that is implemented in all foreign and domestic IOS versions
C.    a command that is universal in application and supports all protocols
D.    a command that is available in every release of IOS, regardless of the version or deployment status
E.    a command that can be entered in any configuration mode

Answer: A
Explanation:
When you enter global configuration mode and enter a command, it is applied to the running configuration file that is currently running in ram. The configuration of a global command affects the entire router. An example of a global command is one used for the hostname of the router.

If you want to pass the Cisco 200-120 Exam sucessfully, recommend to read latest Cisco 200-120 Dump full version.

clip_image001

Free 2014 Latest Cisco 200-120 Dump (181-190) Download!

QUESTION 181
What are three values that must be the same within a sequence of packets for Netflow to consider them a network flow? (Choose three.)

A.    source IP address
B.    source MAC address
C.    egress interface
D.    ingress interface
E.    destination IP address
F.    IP next-hop

Answer: ADE

QUESTION 182
What are three factors a network administrator must consider before implementing Netflow in the network? (Choose three.)

A.    CPU utilization
B.    where Netflow data will be sent
C.    number of devices exporting Netflow data
D.    port availability
E.    SNMP version
F.    WAN encapsulation

Answer: ABC

QUESTION 183
Which two statements about the OSPF Router ID are true? (Choose two.)

A.    It identifies the source of a Type 1 LSA.
B.    It should be the same on all routers in an OSPF routing instance.
C.    By default, the lowest IP address on the router becomes the OSPF Router ID.
D.    The router automatically chooses the IP address of a loopback as the OSPF Router ID.
E.    It is created using the MAC Address of the loopback interface.

Answer: AD

QUESTION 184
What parameter can be different on ports within an EtherChannel?

A.    speed
B.    DTP negotiation settings
C.    trunk encapsulation
D.    duplex

Answer: B

QUESTION 185
What are two benefits of using a single OSPF area network design? (Choose two.)

A.    It is less CPU intensive for routers in the single area.
B.    It reduces the types of LSAs that are generated.
C.    It removes the need for virtual links.
D.    It increases LSA response times.
E.    It reduces the number of required OSPF neighbor adjacencies.

Answer: BC

QUESTION 186
What are two enhancements that OSPFv3 supports over OSPFv2? (Choose two.)

A.    It requires the use of ARP.
B.    It can support multiple IPv6 subnets on a single link.
C.    It supports up to 2 instances of OSPFv3 over a common link.
D.    It routes over links rather than over networks.

Answer: BD

QUESTION 187
When a router undergoes the exchange protocol within OSPF, in what order does it pass through each state?

A.    exstart state > loading state > exchange state > full state
B.    exstart state > exchange state > loading state > full state
C.    exstart state > full state > loading state > exchange state
D.    loading state > exchange state > full state > exstart state

Answer: B

QUESTION 188
A network administrator creates a layer 3 EtherChannel, bundling four interfaces into channel group 1. On what interface is the IP address configured?

A.    the port-channel 1 interface
B.    the highest number member interface
C.    all member interfaces
D.    the lowest number member interface

Answer: A

QUESTION 189
What command sequence will configure a router to run OSPF and add network 10.1.1.0 /24 to area 0?

A.    router ospf area 0
network 10.1.1.0 255.255.255.0 area 0
B.    router ospf
network 10.1.1.0 0.0.0.255
C.    router ospf 1
network 10.1.1.0 0.0.0.255 area 0
D.    router ospf area 0
network 10.1.1.0 0.0.0.255 area 0
E.    router ospf
network 10.1.1.0 255.255.255.0 area 0
F.    router ospf 1
network 10.1.1.0 0.0.0.255

Answer: C

QUESTION 190
What OSPF command, when configured, will include all interfaces into area 0?

A.    network 0.0.0.0 255.255.255.255 area 0
B.    network 0.0.0.0 0.0.0.0 area 0
C.    network 255.255.255.255 0.0.0.0 area 0
D.    network all-interfaces area 0

Answer: A

If you want to pass the Cisco 200-120 Exam sucessfully, recommend to read latest Cisco 200-120 Dump full version.

clip_image001

Free 2014 Latest Cisco 200-120 Dump (171-180) Download!

QUESTION 171
What command instructs the device to timestamp Syslog debug messages in milliseconds?

A.    service timestamps log datetime localtime
B.    service timestamps debug datetime msec
C.    service timestamps debug datetime localtime
D.    service timestamps log datetime msec

Answer: B

QUESTION 172
What are three components that comprise the SNMP framework? (Choose three.)

A.    MIB
B.    agent
C.    set
D.    AES
E.    supervisor
F.    manager

Answer: ABF

QUESTION 173
What are three components that comprise the SNMP framework? (Choose three.)

A.    MIB
B.    agent
C.    set
D.    AES
E.    supervisor
F.    manager

Answer: ABF

QUESTION 174
What SNMP message alerts the manager to a condition on the network?

A.    response
B.    get
C.    trap
D.    capture

Answer: C

QUESTION 175
What authentication type is used by SNMPv2?

A.    HMAC-MD5
B.    HMAC-SHA
C.    CBC-DES
D.    community strings

Answer: D

QUESTION 176
Which three statements about the features of SNMPv2 and SNMPv3 are true? (Choose three.)

A.    SNMPv3 enhanced SNMPv2 security features.
B.    SNMPv3 added the Inform protocol message to SNMP.
C.    SNMPv2 added the Inform protocol message to SNMP.
D.    SNMPv3 added the GetBulk protocol messages to SNMP.
E.    SNMPv2 added the GetBulk protocol message to SNMP.
F.    SNMPv2 added the GetNext protocol message to SNMP.

Answer: ACE

QUESTION 177
What are three reasons to collect Netflow data on a company network? (Choose three.)

A.    To identify applications causing congestion.
B.    To authorize user network access.
C.    To report and alert link up / down instances.
D.    To diagnose slow network performance, bandwidth hogs, and bandwidth utilization.
E.    To detect suboptimal routing in the network.
F.    To confirm the appropriate amount of bandwidth that has been allocated to each Class of Service.

Answer: ADF

QUESTION 178
What Netflow component can be applied to an interface to track IPv4 traffic?

A.    flow monitor
B.    flow record
C.    flow sampler
D.    flow exporter

Answer: A

QUESTION 179
What Cisco IOS feature can be enabled to pinpoint an application that is causing slow network performance?

A.    SNMP
B.    Netflow
C.    WCCP
D.    IP SLA

Answer: B

QUESTION 180
What command visualizes the general NetFlow data on the command line?

A.    show ip flow export
B.    show ip flow top-talkers
C.    show ip cache flow
D.    show mls sampling
E.    show mls netflow ip

Answer: C

If you want to pass the Cisco 200-120 Exam sucessfully, recommend to read latest Cisco 200-120 Dump full version.

clip_image001

1 148 149 150 151 152 153