Cisco Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0)

QUESTION NO: 1
Refer to the exhibit.

Which command enables the stateful failover option?

A. failover lan unit primary B. failover link MYFAILOVER GigabitEthernet0/2 C. preempt D. failover group 1 primary E. failover lan interface MYFAILOVER GigabitEthernet0/2 F. failover interface ip MYFAILOVER 172.16.5.1255.255.0 standby 172.16.5.10

Correct Answer: B

QUESTION NO: 2
Which Cisco ASA feature enables the ASA to do these two things? 1) Act as a proxy for the server and generate a SYN-ACK response to the client SYN request. 2) When the Cisco
ASA receives an ACK back from the client, the Cisco ASA authenticates the client and allows the connection to the server.

A. basic threat detection B. TCP intercept C. TCP normalizer D. botnet traffic filter E. TCP state bypass F. advanced threat detection

Correct Answer: B

QUESTION NO: 3
With active/standby failover, what happens if the standby Cisco ASA does not receive three consecutive hello messages from the active Cisco ASA on the LAN failover interface?

A. The standby ASA eventually becomes the active ASA after three times the hold-down times interval expires. B. The standby ASA immediately becomes the active AS C. The standby ASA sends additional hellos packets on all monitored interfaces, including the LAN failover interface, to determine if the active ASA has failed. D. The standby ASA runs network activity tests, including ARP and ping, to determine if the active ASA has expired. E. Both ASAs go to the "unknown" state until the LAN interface becomes operational again.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
With Cisco ASA active/active or active/standby stateful failover, which state information or table is not passed between the active and standby Cisco ASA by default?

A. TCP connection states B. HTTP connection table C. NAT translation table D. UDP connection states E. ARP table

Correct Answer: B

QUESTION NO: 5
Which three statements about traffic shaping capability on the Cisco ASA are true?
(Choose three.)

A. Traffic shaping can be applied in the input or output direction. B. Traffic shaping is not supported on the Cisco ASA 5580. C. Traffic shaping can be applied to all outgoing traffic on a physical interface or in the case of the Cisco ASA 5505, on a VLAN D. Traffic shaping can cause jitter and delay. E. You can configure both traffic shaping and priority queueing on the same interface.

Correct Answer: B,C,D

QUESTION NO: 6
What is the default interval for how often the dynamic database of the Cisco ASA botnet traffic filter is updated from Cisco/lronPort?

A. every 5 minutes B. every 24 hours C. every 15 minutes D. every 1 hour E. every 30 minutes F. every 12 hours

Correct Answer: D

QUESTION NO: 7

Which two statements about the Cisco ASA configuration is true? (Choose two.)

A. The ASA is using a persistent self-signed certificated so users can authenticate the
Cisco ASA when accessing it via Cisco ASDM B. The Cisco ASA is setup as the DHCP server for hosts on the inside and outside interfaces C. NAT Control is enabled D. All IP traffic is permitted from the inside host to the outside E. Access to the CLI in privileged mode will be authenticated using the LOCAL database on the Cisco ASA F. All hosts on the inside and on the outside can access Cisco ASDM

Correct Answer: B,C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8

Refer to the exhibit. What is the resulting CLI command?

A. class _default_GoToMyPC-tunnel
drop-connection log B. match request uri regex _default_GoToMyPC-tunnel
drop-connection log C. match class-map _default_GoToMyPC-tunnel
drop-connection log D. match regex _default_GoToMyPC-tunnel
drop-connection log

Correct Answer: A

QUESTION NO: 9
Which feature is not supported on the Cisco ASA 5505 with the Security Plus license?

A. traffic shaping B. transparent firewall C. security contexts D. threat detection E. stateless active/standby failover

Correct Answer: C

Cisco Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0) - 642-617 Exam Questions