Question 1.
Which statement is true about RSTP topology changes?

A. Any change in the state of the port generates a TC BPDU.
B. Only nonedge ports moving to the forwarding state generate a TC BPDU.
C. If either an edge port or a nonedge port moves to a block state, then a TC BPDU is generated.
D. Only edge ports moving to the blocking state generate a TC BPDU.
E. Any loss of connectivity generates a TC BPDU.

Answer: B

Explanation:
The IEEE 802.1D Spanning Tree Protocol was designed to keep a switched or bridged network loop free, with adjustments made to the network topology dynamically. A topology change typically takes 30 seconds, where a port moves from the Blocking state to the Forwarding state after two intervals of the Forward Delay timer. As technology has improved, 30 seconds has become an unbearable length of time to wait for a production network to failover or "heal" itself during a problem.
Topology Changes and RSTP
Recall that when an 802.1D switch detects a port state change (either up or down), it signals the Root Bridge by sending topology change notification (TCN) BPDUs. The Root Bridge must then signal a topology change by sending out a TCN message that is relayed to all switches in the STP domain. RSTP detects a topology change only when a nonedge port transitions to the Forwarding state. This might seem odd because a link failure is not used as a trigger. RSTP uses all of its rapid convergence mechanisms to prevent bridging loops from forming. Therefore, topology changes are detected only so that bridging tables can be updated and corrected as hosts appear first on a failed port and then on a different functioning port. When a topology change is detected, a switch must propagate news of the change to other switches in the network so they can correct their bridging tables, too. This process is similar to the convergence and synchronization mechanism-topology change (TC) messages propagate through the network in an everexpanding wave.

Question 2.
Refer to the exhibit.

Which four statements about this GLBP topology are true? (Choose four.)

A. Router A is responsible for answering ARP requests sent to the virtual IP address.
B. If router A becomes unavailable, router B forwards packets sent to the virtual MAC address of router A.
C. If another router is added to this GLBP group, there would be two backup AVGs.
D. Router B is in GLBP listen state.
E. Router A alternately responds to ARP requests with different virtual MAC addresses.
F. Router B transitions from blocking state to forwarding state when it becomes the AVG.

Answer: A, B, D, E

Explanation:
With GLBP the following is true:
With GLB, there is 1 AVG and 1 standby VG. In this case Company1 is the AVG and Company2 is the standby. Company2 would act as a VRF and would already be forwarding and routing packets. Any additional routers would be in a listen state. As the role of the Active VG and load balancing, Company1 responds to ARP requests with different virtual MAC addresses. In this scenario, Company2 is the Standby VF for the VMAC 0008.b400.0101 and would become the Active VF if Company1 were down. As the role of the Active VG, the primary responsibility is to answer ARP requests to the virtual IP address. As an AVF router Company2 is already forwarding/routing packets

Question 3.
Refer to the exhibit.

Which VRRP statement about the roles of the master virtual router and the backup virtual router is true?

A. Router A is the master virtual router, and router B is the backup virtual router. When router A fails, router B becomes the master virtual router. When router A recovers, router B maintains the role of master virtual router.
B. Router A is the master virtual router, and router B is the backup virtual router. When router A fails, router B becomes the master virtual router. When router A recovers, it regains the master virtual router role.
C. Router B is the master virtual router, and router A is the backup virtual router. When router B fails, router A becomes the master virtual router. When router B recovers, router A maintains the role of master virtual router.
D. Router B is the master virtual router, and router A is the backup virtual router. When router B fails, router A becomes the master virtual router. When router B recovers, it regains the master virtual router role.

Answer: B

Explanation:

Question 4.
Which description correctly describes a MAC address flooding attack?

A. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device then becomes the destination address found in the Layer 2 frames sent by the valid network device.
B. The attacking device crafts ARP replies intended for valid hosts. The MAC address of the attacking device then becomes the source address found in the Layer 2 frames sent by the valid network device.
C. The attacking device spoofs a destination MAC address of a valid host currently in the CAM table. The switch then forwards frames destined for the valid host to the attacking device.
D. The attacking device spoofs a source MAC address of a valid host currently in the CAM table. The switch then forwards frames destined for the valid host to the attacking device.
E. Frames with unique, invalid destination MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted because of the exhausted CAM table space, and traffic is subsequently flooded out all ports.
F. Frames with unique, invalid source MAC addresses flood the switch and exhaust CAM table space. The result is that new entries cannot be inserted because of the exhausted CAM table space, and traffic is subsequently flooded out all ports.

Answer: F

Explanation:

Question 5.
Refer to the exhibit.
An attacker is connected to interface Fa0/11 on switch A-SW2 and attempts to establish a DHCP server for a man-in-middle attack. 

Which recommendation, if followed, would mitigate this type of attack?

A. All switch ports in the Building Access block should be configured as DHCP trusted ports.
B. All switch ports in the Building Access block should be configured as DHCP untrusted ports.
C. All switch ports connecting to hosts in the Building Access block should be configured as DHCP trusted ports.
D. All switch ports connecting to hosts in the Building Access block should be configured as DHCP untrusted ports.
E. All switch ports in the Server Farm block should be configured as DHCP untrusted ports.
F. All switch ports connecting to servers in the Server Farm block should be configured as DHCP untrusted ports.

Answer: D

Explanation:
One of the ways that an attacker can gain access to network traffic is to spoof responses that would be sent by a valid DHCP server. The DHCP spoofing device replies to client DHCP requests. The legitimate server may reply also, but if the spoofing device is on the same segment as the client, its reply to the client may arrive first. The intruder’s DHCP reply offers an IP address and supporting information that designates the intruder as the default gateway or Domain Name System (DNS) server. In the case of a gateway, the clients will then forward packets to the attacking device, which will in turn send them to the desired destination. This is referred to as a “man-in-the-middle” attack, and it may go entirely undetected as the intruder intercepts the data flow through the network. Untrusted ports are those that are not explicitly configured as trusted. A DHCP binding table is built for untrusted ports. Each entry contains the client MAC address, IP address, lease time, binding type, VLAN number, and port ID recorded as clients make DHCP requests. The table is then used to filter subsequent DHCP traffic. From a DHCP snooping perspective, untrusted access ports should not send any DHCP server responses, such as DHCPOFFER, DHCPACK, DHCPNAK.

Question 6.
Refer to the exhibit. 
The web servers WS_1 and WS_2 need to be accessed by external and internal users. For security reasons, the servers should not communicate with each other, although they are located on the same subnet. However, the servers do need to communicate with a database server located in the inside network. 

Which configuration isolates the servers from each other?

A. The switch ports 3/1 and 3/2 are defined as secondary VLAN isolated ports. The ports connecting to the two firewalls are defined as primary VLAN promiscuous ports.
B. The switch ports 3/1 and 3/2 are defined as secondary VLAN community ports. The ports connecting to the two firewalls are defined as primary VLAN promiscuous ports.
C. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls are defined as primary VLAN promiscuous ports.
D. The switch ports 3/1 and 3/2 and the ports connecting to the two firewalls are defined as primary VLAN community ports.

Answer: A

Explanation:
Service providers often have devices from multiple clients, in addition to their own servers, on a single Demilitarized Zone (DMZ) segment or VLAN. As security issues proliferate, it becomes necessary to provide traffic isolation between devices, even though they may exist on the same Layer 3 segment and VLAN. Catalyst 6500/4500 switches implement PVLANs to keep some switch ports shared and some switch ports isolated, although all ports exist on the same VLAN. The 2950 and 3550 support “protected ports,” which are functionality similar to PVLANs on a perswitch basis. 
A port in a PVLAN can be one of three types:
Isolated: An isolated port has complete Layer 2 separation from other ports within the same PVLAN, except for the promiscuous port. PVLANs block all traffic to isolated ports, except the traffic from promiscuous ports. Traffic received from an isolated port is forwarded to only promiscuous ports.
Promiscuous: A promiscuous port can communicate with all ports within the PVLAN, including the community and isolated ports. The default gateway for the segment would likely be hosted on a promiscuous port, given that all devices in the PVLAN will need to communicate with that port.
Community: Community ports communicate among themselves and with their promiscuous ports. These interfaces are isolated at Layer 2 from all other interfaces in other communities, or in isolated ports within their PVLAN.

Question 7.
What does the command udld reset accomplish?

A. allows a UDLD port to automatically reset when it has been shut down
B. resets all UDLD enabled ports that have been shut down
C. removes all UDLD configurations from interfaces that were globally enabled
D. removes all UDLD configurations from interfaces that were enabled per-port

Answer: B

Explanation:

Question 8.
Refer to the exhibit.
Dynamic ARP Inspection is enabled only on switch SW_A. Host_A and Host_B acquire their IP addresses from the DHCP server connected to switch SW_A. 

What would the outcome be if Host_B initiated an ARP spoof attack toward Host_A ?

A. The spoof packets are inspected at the ingress port of switch SW_A and are permitted.
B. The spoof packets are inspected at the ingress port of switch SW_A and are dropped.
C. The spoof packets are not inspected at the ingress port of switch SW_A and are permitted.
D. The spoof packets are not inspected at the ingress port of switch SW_A and are dropped.

Answer: C

Explanation:
When configuring DAI, follow these guidelines and restrictions:
• DAI is an ingress security feature; it does not perform any egress checking.
• DAI is not effective for hosts connected to routers that do not support DAI or that do not have this feature enabled. Because man-in-the-middle attacks are limited to a single Layer 2 broadcast domain, separate the domain with DAI checks from the one with no checking. This action secures the ARP caches of hosts in the domain enabled for DAI.
• DAI depends on the entries in the DHCP snooping binding database to verify IP-to-MAC address bindings in incoming ARP requests and ARP responses. Make sure to enable DHCP snooping to permit ARP packets that have dynamically assigned IP addresses.
• When DHCP snooping is disabled or in non-DHCP environments, use ARP ACLs to permit or to deny packets.
• DAI is supported on access ports, trunk ports, EtherChannel ports, and private VLAN ports.
In our example, since Company2 does not have DAI enabled (bullet point 2 above) packets will not be inspected and they will be permitted.

Reference:
http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SXF/configuration/guide/dynarp.html

Question 9.
Which statement is true about Layer 2 security threats?

A. MAC spoofing, in conjunction with ARP snooping, is the most effective counter-measure against reconnaissance attacks that use Dynamic ARP Inspection to determine vulnerable attack points.
B. DHCP snooping sends unauthorized replies to DHCP queries.
C. ARP spoofing can be used to redirect traffic to counter Dynamic ARP Inspection.
D. Dynamic ARP Inspection in conjunction with ARP spoofing can be used to counter DHCP snooping attacks.
E. MAC spoofing attacks allow an attacking device to receive frames intended for a different network host.
F. Port scanners are the most effective defense against Dynamic ARP Inspection.

Answer: E

Explanation:
First of all, MAC spoofing is not an effective counter-measure against any reconnaissance attack; it IS an attack! Furthermore, reconnaissance attacks don't use dynamic ARP inspection (DAI); DAI is a switch feature used to prevent attacks.

Question 10.
What does the global configuration command ip arp inspection vlan 10-12,15 accomplish?

A. validates outgoing ARP requests for interfaces configured on VLAN 10, 11, 12, or 15
B. intercepts all ARP requests and responses on trusted ports
C. intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings
D. discards ARP packets with invalid IP-to-MAC address bindings on trusted ports

Answer: C

Explanation:
The “ip arp inspection” command enables Dynamic ARP Inspection (DAI) for the specified VLANs. DAI is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address to IP address bindings. This capability protects the network from certain "man-in-themiddle" attacks.

Reference:
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/dynarp.html

	Web www.certsbraindumps.com

Home

Search

Latest Brain Dumps

BrainDump List

Certifications Dumps

Microsoft

CompTIA

Oracle

Cisco

CIW

Novell

Linux

Sun

Certs Notes

How-Tos & Practices

Free Online Demos

Free Online Quizzes

Free Study Guides

Free Online Sims

Material Submission

Test Vouchers

Users Submissions

Site Links

Submit Site

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Braindumps for "642-785" Exam

Maintaining Cisco Service Provider Quality of Service

 Question 1.
Within a QoS policy-map configuration, one of the traffic classes is configured with the randomdetect dscp-based configuration command. What will that command accomplish?

A. provides congestion management by queueing the traffic using CBWFQ
B. provides congestion management by queueing the traffic using LLQ
C. decreases the probability of congestion by selectively dropping TCP packets before the queue is full
D. provides congestion avoidance by selectively delaying the delivery of packets with lower DSCP priority
E. decreases congestion by avoiding global UDP synchronization

Answer:  C

Explanation:

Question 2.
What are three benefits of IntServ and RSVP? (Choose three.)

A. RSVP helps network devices identify dynamic port numbers.
B. IntServ networks will reject or downgrade new RSVP sessions if all reservable bandwidth is booked somewhere in a path.
C. RSVP signaling is a scalable way to ensure all devices maintain an accurate picture of the network state.
D. They enable the network to guarantee necessary QoS to individual data flows.
E. The IntServ class-based approach is easy to design and implement.

Answer:  A, B, D

Explanation:

Question 3.
Which statement about the rates and statistics (such as match, transmit, drop, and police) shown in the show policy-map interface output is true?

A. The rates are computed as a moving average of instantaneous rates.
B. The rates are displayed in real time, which matches the actual traffic rate.
C. The matched statistics of the packet can be cleared only when the router reboots.
D. The matched statistics of the packet are displayed in real time.
E. The traffic policing statistics are displayed in real time.

Answer:  A

Explanation:

Question 4.
Which four factors can be used for packet classification in a QoS-aware network device? (Choose four.)

A. source address
B. destination address
C. DSCP
D. TTL
E. MQC
F. IP precedence

Answer:  A, B, C, F

Explanation:

Question 5.
What are the three primary types of faults associated with QoS fault management? (Choose three.)

A. classification faults
B. buffer faults
C. queue faults
D. marking faults
E. assurance faults
F. physical faults

Answer:  A, D, E

Explanation:

Question 6.
Which are the two locations where the SP network device always trusts the QoS markings from its upstream neighbor? (Choose two.)

A. at the ingress PE
B. at the egress PE
C. in the SP core
D. at the ingress CE
E. at the egress CE

Answer:  B, C 

Explanation:

Question 7.
Which of these correctly describes traffic classification using qos-group?

A. qos-group marking is automatically mapped to MPLS EXP marking.
B. qos-group is only applicable to an MPLS-enabled router.
C. qos-group marking value ranges from 0 to 7.
D. qos-group is local to the router.

Answer:  D

Explanation:

Question 8.
Which two IP SLA Probe types can be used to measure voice quality? (Choose two.)

A. HTTP
B. ICMP Path Jitter
C. UDP Echo
D. UDP Jitter
E. UDP Delay
F. UDP MOS

Answer:  B, D

Explanation:

Question 9.
Refer to the exhibit.
Traffic in CLASS-B is not getting a minimum bandwidth of 192 kb/s in this policy map. 

What can be done to correct this?

A. No changes are needed, the site is already correct.
B. The shape peak command should be used instead of the shape average command.
C. Set the shape rate to a CIR higher than 192 kb/s.
D. Decrease the maximum queue size.

Answer:  C

Explanation:

Question 10.
Which of these describes Short Pipe mode in QoS for MPLS VPN service providers?

A. Service provider can remark customer DSCP values.
B. Service provider does not remark customer DSCP values. (Service provider uses independent MPLS EXP markings.) Final PE-to-CE policies are based on service provider markings.
C. The customer and service provider share the same DiffServ domain.
D. Service provider does not remark customer DSCP values. (Service provider uses independent MPLS EXP markings.) Final PE-to-CE policies are based on customer markings.

Answer:  D

Explanation:

	Web www.certsbraindumps.com

Advertise

Submit Braindumps

Forum

Tell A Friend

Contact Us

Home

Search

Latest Brain Dumps

BrainDump List

Certifications Dumps

Microsoft

CompTIA

Oracle

Cisco

CIW

Novell

Linux

Sun

Certs Notes

How-Tos & Practices

Free Online Demos

Free Online Quizzes

Free Study Guides

Free Online Sims

Material Submission

Test Vouchers

Users Submissions

Site Links

Submit Site

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Braindumps for "642-770" Exam

Operational Foundations for Cisco Service Provider Core Networks (OFCN)

 Question 1.
Which two-stage configuration process is correct in Cisco IOS XR Software?

A. Enter configuration mode, then make configuration changes.
B. Make configuration changes, then enter "commit" to make configuration changes persist.
C. Make configuration changes, then enter "copy run start" to make configuration changes persist.
D. Enter admin mode, then make configuration changes.

Answer:  B

Explanation:

Question 2.
Which command displays the target configuration in Cisco IOS XR Software?

A. show config
B. show running-config
C. show config running
D. show config merge

Answer:  A

Explanation:

Question 3.
What will happen if a new version of Cisco IOS XR Software is installed and activated, and then the router reloads?

A. When the router comes back, the new version is loaded and the old and new versions are on disk0.
B. When the router comes back, the new version is loaded and only the new version is on disk0.
C. When the router comes back, the old version is loaded and the old and new versions are on disk0.
D. When the router comes back, the old version is loaded and only the old version is on disk0.

Answer:  C

Explanation:

Question 4.
When is it appropriate to use the commit replace command?

A. When you want to replace the existing configuration for an ipv4 address on an interface.
B. When you want to replace all configurations under router ospf.
C. When you want to replace the entire running configuration with the target configuration.
D. The commit replace command does the same as the commit command.

Answer:  C

Explanation:

Question 5.
Refer to the exhibit.
If all else are good, where could the problem be if a user in the 192.168.0.0/16 subnet reports that they are not able to connect to the router using Telnet?

A. MPP should be configured as out-of-band.
B. Interface GigabitEthernet0/2/0/1 should allow 192.168.0.0/16 address space when using Telnet.
C. Telnet traffic is going through other interfaces that are not configured in MPP.
D. Interface GigabitEthernet0/2/0/0 should allow 192.168.0.0/16 address space.
E. SNMP peer is not configured to "allow" on interface GigabitEthernet0/2/0/1 which prohibits Telnet

Answer:  C

Explanation:

Question 6.
At which SONET layer would you expect to see B3 errors?

A. physical
B. segment
C. line
D. path

Answer:  D

Explanation:

Question 7.
What is a common cause of increasing NEWPTR errors on a POS interface?

A. dirty fiber
B. incorrect timing
C. Tx and Rx swapped
D. wrong fiber type

Answer:  B

Explanation:

Question 8.
What is the range of DLCIs that are available for subscribers to configure on a Cisco IOS Frame Relay subinterface?

A. 0-1024
B. 1-2048
C. 0-991
D. 16-1007

Answer:  D

Explanation:

Question 9.
What is the acronym commonly used to identify a prearranged agreement between a service team and an external service provider?

A. SLA
B. OLA
C. UC
D. SLM
E. CICS

Answer:  C

Explanation:

Question 10.
According to the ITIL® v3 framework, a change that has an "approved" status has met which criteria?

A. The lab testing and operational assessments have been completed, and the change has been approved and committed to the change scheduler.
B. The operational testing and technical assessments have been completed, and the change has been approved and committed to the change scheduler.
C. The business and technical assessments have been completed, and the change has been approved and committed to the change scheduler.
D. The lab testing and technical assessments have been completed, and the change has been approved but is not yet committed to the change scheduler.

Answer:  C

Explanation:

	Web www.certsbraindumps.com

Advertise

Submit Braindumps

Forum

Tell A Friend

Contact Us

Home

Search

Latest Brain Dumps

BrainDump List

Certifications Dumps

Microsoft

CompTIA

Oracle

Cisco

CIW

Novell

Linux

Sun

Certs Notes

How-Tos & Practices

Free Online Demos

Free Online Quizzes

Free Study Guides

Free Online Sims

Material Submission

Test Vouchers

Users Submissions

Site Links

Submit Site

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Braindumps for "642-747" Exam

Implementing Cisco Unified Wireless Mobility Services (IUWMS v2.0)

 Question 1.
Which two issues may need to be considered when using DAS to support location-tracking services? (Choose two.)

A. Third-party antennas may reduce RF cell size but provide location accuracy.
B. Additional monitor-mode APs may be necessary to obtain desired location accuracy.
C. Wi-Fi RF channel selection is critical when using DAS if multiple wireless services are supported in the same antenna group.
D. Multiple connections are required into a common DAS for 802.11n support.
E. Linear DAS deployment can reduce your location accuracy.

Answer:  B, E

Explanation:

Question 2.
Which issue may lead to inconsistent wireless client locations being reported by Cisco WCS v7.0?

A. Roaming between APs is controlled by different controllers.
B. A mix of APs is configured for monitor and local mode.
C. The wireless client does not transmit a probe request to all channels.
D. The wireless client is not compliant with Cisco Compatible Extensions.
E. The wireless client does not associate.

Answer:  C

Explanation:

Question 3.
Which three options describe ways in which the Cisco Compatible Extensions S36 message is used in Cisco WLC v7.0? (Choose three.)

A. for WGB location
B. by Cisco WCS for calibration
C. for location tracking of wireless tags
D. only on 802.11b/g/n
E. on 802.11a/b/g/n
F. by Cisco Compatible Extensions v4 and above
G. by Cisco Compatible Extensions v2 and above

Answer:  B, E, G

Explanation:

Question 4.
You have a customer interested in adding RFID tags to track the movement of containers of work in process in their manufacturing facility. Which type of RFID tags and which Wi-Fi band are most appropriate using their existing Cisco Unified Wireless Network based on v7.0? (Choose two.)

A. passive RFID tags
B. semipassive RFID tags
C. active RFID tags
D. 900 MHz
E. 2.4 GHz
F. 5 GHz

Answer:  C, E

Explanation:

Question 5.
A calibration model has been created for a specific floor in Cisco WCS v7.0. 

Which two events are more likely to affect location accuracy and compel a new calibration? (Choose two.)

A. additional local mode APs installed
B. changes in office interior walls location and type
C. additional monitor mode APs installed
D. change in inventory type stocked in warehouse
E. compass direction change in omnidirectional antenna

Answer:  B, D

Explanation:

Question 6.
What are the two message formats that a Cisco WCS v7.0 can use to send a context-aware tracking event notification to an external destination? (Choose two.)

A. XML
B. plaintext
C. XLS
D. PDF
E. JPEG
F. CSV

Answer:  B, C

Explanation:

Question 7.
Which two descriptions are examples of how location services can be adjusted at the Cisco WLC v7.0? (Choose two.)

A. Disable RFID tag tracking if there are no tags in the respective locations of the controller APs.
B. Disable wireless client tracking if there are no requirements for the respective locations of the controller APs.
C. Increase RFID timeouts from defaults if tags are beaconing at 30 seconds.
D. Decrease RFID timeouts from defaults if tags are beaconing at 30 seconds.

Answer:  A, D

Explanation:

Question 8.
If the wired infrastructure network latency becomes an issue, which adjustments can be made for collection of location information using Cisco WCS v7.0?

A. Adjust SNMP timers on Cisco WCS.
B. Adjust SNMP timers on the Cisco 3300 Series MSE.
C. Adjust SNMP timers on Cisco WLC.
D. Adjust LOCP timers on Cisco WLC.
E. Adjust LOCP timers on Cisco MSE.
F. Adjust NMSP timers on Cisco WLC.
G. Adjust NMSP timers on Cisco MSE.

Answer:  F

Explanation:

Question 9.
Refer to the exhibit.
To provide the best coverage for location-tracking services, where should the APs be located?

A. Deploy the APs down the center of the corridor with omnidirectional antennas to maximize location-tracking coverage.
B. Stagger the APs in the offices using directional antennas so that each AP has a view of the sector of the floor that it is responsible to cover.
C. Deploy the APs along the edge of the building with directional antennas pointing into the building to cover sectors of the floor.
D. Deploy the APs in a staggered formation with omnidirectional antennas so that they have a surrounding view with minimal obstruction.
E. Deploy the APs on the sides of steel or concrete interior columns with directional antennas to eliminate the columns from the coverage area.

Answer:  D

Explanation:

Question 10.
The Cisco 3300 Series MSE v7.0 receives three RSSI measurements that are higher than -75 dBm for a given device and multiple measurements that are lower than -75 dBm. 

How does Cisco MSE perform the location calculation?

A. Cisco MSE uses all the RSSI values that are received.
B. Cisco MSE uses only the RSSI values that are higher than -75 dBm.
C. Cisco MSE uses the three RSSI values that are higher than -75 dBm and the best RSSI that is lower than -75 dBm.
D. Cisco MSE uses the three RSSI values that are higher than -75 dBm and the average of the RSSI values that are lower than -75 dBm.
E. Cisco MSE takes in all the RSSI values for a given device and averages all the values.

Answer:  C

Explanation:

	Web www.certsbraindumps.com

Advertise

Submit Braindumps

Forum

Tell A Friend

Contact Us

Home

Search

Latest Brain Dumps

BrainDump List

Certifications Dumps

Microsoft

CompTIA

Oracle

Cisco

CIW

Novell

Linux

Sun

Certs Notes

How-Tos & Practices

Free Online Demos

Free Online Quizzes

Free Study Guides

Free Online Sims

Material Submission

Test Vouchers

Users Submissions

Site Links

Submit Site

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Braindumps for "642-648" Exam

Deploying Cisco ASA VPN Solutions (VPN v2.0)

 Question 1.
Which statement is correct concerning the trusted network detection (TND) feature?

A. The Cisco AnyConnect 3.0 Client supports TND on Windows, Mac, and Linux platforms.
B. With TND, one result of a Cisco Secure Desktop basic scan on an endpoint is to determine whether a device is a member of a trusted or an untrusted network.
C. If enabled, and a CSD scan determines that a host is a member of an untrusted network, an administrator can configure the TND feature to prohibit an end user from launching the Cisco AnyConnect VPN Client.
D. When the user is inside the corporate network, TND can be configured to automatically disconnect a Cisco AnyConnect session.

Answer:  D

Explanation:

Question 2.
Refer to the exhibit.
You are configuring a laptop with the Cisco VPN Client, which uses digital certificates for authentication.

Which protocol does the Cisco VPN Client use to retrieve the digital certificate from the CA server?

A. FTP
B. LDAP
C. HTTPS
D. SCEP
E. OCSP

Answer:  D

Explanation:

Question 3.
When using clientless SSL VPN, you might not want some applications or web resources to go through the Cisco ASA appliance. For these application and web resources, as a Cisco ASA administrator, which configuration should you use?

A. Configure the Cisco ASA appliance for split tunneling.
B. Configure network access exceptions in the SSL VPN customization editor.
C. Configure the Cisco ASA appliance to disable content rewriting.
D. Configure the Cisco ASA appliance to enable URL Entry bypass.
E. Configure smart tunnel to bypass the Cisco ASA appliance proxy function.

Answer:  C

Explanation:

Question 4.
Refer to the exhibit.
The "level_2" digital certificate was installed on a laptop.

What can cause an "invaliD. not active" status message?

A. On first use, a CA server-supplied passphrase is entered to validate the certificate.
B. A "newly installed" digital certificate does not become active until it is validated by the peer device upon its first usage.
C. The user has not clicked the Verify button within the Cisco VPN Client.
D. The CA server and laptop PC clocks are out of sync.

Answer:  D

Explanation:

Question 5.
Refer to the exhibit.
A NOC engineer is in the process of entering information into the Create New VPN Connection Entry fields.

Which statement correctly describes how to do this?

A. In the Connection Entry field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.
B. In the Host field, enter the IP address of the remote client device.
C. In the Authentication tab, click the Group Authentication or Mutual Group Authentication radio button to enable symmetrical pre-shared key authentication.
D. In the Name field, enter the name of the connection profile as it is specified on the Cisco ASA appliance.

Answer:  D

Explanation:

Question 6.
Refer to the exhibit.
A new NOC engineer is troubleshooting a VPN connection.

Which statement about the fields within the Cisco VPN Client Statistics screen is correct?

A. The ISP-assigned IP address of 10.0.21.1 is assigned to the VPN adapter of the PC.
B. The IP address of the security appliance to which the Cisco VPN Client is connected is 192.168.1.2.
C. CorpNet is the name of the Cisco ASA group policy whose tunnel parameters the connection is using.
D. The ability of the client to send packets transparently and unencrypted through the tunnel for test purposes is turned off.
E. With split tunneling enabled, the Cisco VPN Client registers no decrypted packets.

Answer:  B

Explanation:

Question 7.
An XYZ Corporation systems engineer, while making a sales call on the ABC Corporation headquarters, tried to access the XYZ sales demonstration folder to transfer a demonstration via FTP from an ABC conference room behind the firewall. The engineer could not reach XYZ through the remote-access VPN tunnel. From home the previous day, however, the engineer did connect to the XYZ sales demonstration folder and transferred the demonstration via IPsec over DSL. 

To get the connection to work and transfer the demonstration, what should the engineer do?

A. Change the MTU size on the IPsec client to account for the change from DSL to cable transmission.
B. Enable the local LAN access option on the IPsec client.
C. Enable the IPsec over TCP option on the IPsec client.
D. Enable the clientless SSL VPN option on the PC.

Answer:  C

Explanation:

Question 8.
Refer to the exhibit.
While configuring a site-to-site VPN tunnel, a new NOC engineer encounters the Reverse Route Injection parameter. Assuming that static routes are redistributed by the Cisco ASA to the IGP, what effect does enabling Reverse Route Injection on the local Cisco ASA have on a configuration?

A. The local Cisco ASA advertises its default routes to the distant end of the site-to-site VPN tunnel.
B. The local Cisco ASA advertises routes from the dynamic routing protocol that is running on the local Cisco ASA to the distant end of the site-to-site VPN tunnel.
C. The local Cisco ASA advertises routes that are at the distant end of the site-to-site VPN tunnel.
D. The local Cisco ASA advertises routes that are on its side of the site-to-site VPN tunnel to the distant end of the site-to-site VPN tunnel.

Answer:  C

Explanation:

Question 9.
Refer to the exhibit.
A NOC engineer needs to tune some prelogin parameters on an SSL VPN tunnel. From the information that is shown, where should the engineer navigate to find the prelogin session attributes?

A. "engineering" Group Policy
B. "contractor" Connection Profile
C. "engineer1" AAA/Local Users
D. DfltGrpPolicy Group Policy

Answer:  B

Explanation:

Question 10.
Refer to the exhibit.
A NOC engineer needs to tune some postlogin parameters on an SSL VPN tunnel. From the information shown, where should the engineer navigate to, in order to find all the postlogin session parameters?

A. "engineering" Group Policy
B. "contractor" Connection Profile
C. DefaultWEBVPNGroup Group Policy
D. DefaultRAGroup Group Policy
E. "engineer1" AAA/Local Users

Answer:  A

Explanation:

	Web www.certsbraindumps.com

Privacy Policy                   Disclaimer                    Feedback                    Term & Conditions

ITCertKeys.com

Copyright © 2004 CertsBraindumps.com Inc. All rights reserved.