Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) (642-618) Free Practice Test

Question 1

Which two statements about traffic shaping capability on the Cisco ASA appliance are true? (Choose two.)

A. Traffic shaping can be applied in the input or output direction.

B. You can configure traffic shaping and priority queuing on the same interface.

C. Traffic shaping can cause jitter and delay.

D. Traffic shaping can be applied to all outgoing traffic on a physical interface or, in the case of the Cisco ASA 5505 appliance, on a VLAN.

E. With traffic shaping, when traffic exceeds the maximum rate, the security appliance drops the excess traffic.

Correct Answer: C,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

DRAG DROP
Click and drag the supported ASA QoS option on the left to the correct description on the right. (Some of the options on the left are not used)

Correct Answer:

Explanation:

Question 3

Refer to the exhibit.

A Cisco ASA in transparent firewall mode generates the log messages seen in the exhibit. What should be configured on the Cisco ASA to allow the denied traffic?

A. static ARP mapping

B. extended ACL on the outside and inside interface to permit the multicast traffic

C. EtherType ACL on the outside and inside interface to permit the multicast traffic

D. static MAC address mapping

E. stateful packet inspection

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Refer to the exhibit.

The Cisco ASA is dropping all the traffic that is sourced from the internet and is destined to any security context inside interface. Which configuration should be verified on the Cisco ASA to solve this problem?

A. The Cisco ASA has NAT control disabled on each security context.

B. The Cisco ASA is using inside dynamic NAT on each security context.

C. The Cisco ASA is using a unique MAC address on each security context outside interface.

D. The Cisco ASA packet classifier is configured to use the outside physical interface to assign the packets to each security context.

E. The Cisco ASA is using a unique dynamic routing protocol process on each security context.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Which statement about the Cisco ASA 5585-X appliance is true?

A. The ASA 5585-X appliance with the firewall/VPN SSP-60 has a maximum firewall throughput of 10 Gb/s.

B. All IPS traffic (except the IPS management interface traffic) must flow through the firewall/VPN SSP first before it can be redirected to the IPS SSP.

C. The IPS SSP must be installed in slot 0 (bottom slot) and the firewall/VPN SSP must be installed in slot 1 (top slot).

D. The IPS SSP operates independently. The firewall/VPN SSP is not necessary to support the IPS SSP.

E. The ASA 5585-X appliance supports three types of SSP (the firewall/VPN SSP, the IPS SSP, and the CSC SSP).

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Which statement about SNMP support on the Cisco ASA appliance is true?

A. The Cisco ASA appliance can send SNMP traps to the network management station only using SNMPv2.

B. The Cisco ASA appliance supports read-only and read-write access.

C. The Cisco ASA appliance supports three built-in SNMPv3 groups in Cisco ASDM: Authentication and Encryption, Authentication Only, and No Authentication, No Encryption.

D. The Cisco ASA appliance supports only SNMPv1 or SNMPv2c.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

With Cisco ASA active/active or active/standby stateful failover, which state information or table is not passed between the active and standby Cisco ASA by default?

A. NAT translation table

B. TCP connection states

C. HTTP connection table

D. UDP connection states

E. ARP table

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Which Cisco ASA CLI command is used to enable HTTPS (Cisco ASDM) access from any inside host on the 10.1.16.0/20 subnet?

A. http 10.1.16.0 255.255.240.0 inside

B. http 10.1.16.0 0.0.0.0 inside

C. http 10.1.16.0 255.255.255.255

D. http 10.1.16.0 0.0.15.255 inside

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

Refer to the exhibit.

Which option completes the CLI NAT configuration command to match the Cisco ASDM NAT configuration?
object network insidenatted range 10.1.2.10 10.1.2.20 ! object network insidenet range 172.16.1.10 172.16.1.100 ! object network outnatted range 192.168.3.100 192.168.3.150 ! nat (inside,outside) after-auto 1 _______________?________________

A. source dynamic insidenet insidenatted destination static Partner-internal-subnets outnatted

B. source dynamic insidenet interface destination static Partner-internal-subnets outnatted

C. source dynamic insidenet insidenatted destination static Partner-internal-subnets outnatted interface

D. source dynamic insidenatted interface destination static Partner-internal-subnets outnatted

E. source dynamic insidenatted insidenet destination static Partner-internal-subnets outnatted

F. source dynamic insidenet insidenatted interface destination static Partner-internal-subnets outnatted

Correct Answer: F

Welcome to TestSimulate

Cisco Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) (642-618) Free Practice Test