Welcome to download the newest Dumpsoon 648-385 dumps:

Moreover, the Cisco 642-384 exam sample questions are worked out by I.T. experts who enable you to Cisco 642-384 practice test questions in order to achieve your goal. Pass4itsure provide high quality Cisco 642-384 Certified Solutions Associate. It is the best and the latest Cisco 642-384 exam questions. Furthermore, we are constantly updating Pass4itsure Cisco 642-384 Exam. These Cisco 642-384 test updates are supplied free of charge to Pass4itsure customers. After you purchase Pass4itsure Cisco 642-384 exam sample questions, you can enjoy one year free update.

QUESTION 101
You enter the command show ip ospf neighbor and see “two-way/DROTHER” listed as the state for neighbor 10.1.1.1. What does this status indicate?
A. The neighbor 10.1 1 1 is not a DR or BDR
B. The neighbor relationship with 10.1.1.1 has not yet completed.
C. DR and BDR election is in progress.
D. The neighbor 10.1.1.1 is the BDR.

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 102
Which design phase service component includes the development and documentation of the test case or cases used to verify that a deployed infrastructure meets operational, functional, and interface requirements?
A. Implementation Plan.
B. Business Plan
C. Staging Plan
D. Detailed Design Development
E. Systems Acceptance Test Plan Development

Correct Answer: E Section: (none) Explanation
Explanation/Reference:
QUESTION 103
Which implement phase service component consists of explaining the benefits and limitations of purchased support options to a customer and ensuring that the customer understands operational processes and responsibilities?
A. Staging and System Migration
B. Post Implementation Support Handoff Meeting
C. Detailed Design Development
D. Staff Training
Correct Answer: B Section: (none) Explanation

Explanation/Reference:
QUESTION 104
In which of these phases is a customer’s network assessed to determine its system readiness?
A. plan
B. design
C. operate
D. implement

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 105
How many voice expansion slots are provided by the Cisco UC520?
A. One
B. two
C. three
D. four

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 106
A concern has been expressed that the switched infrastructure in an integrated network is vulnerable to VLAN hopping attacks. Which two configuration statements can be used to mitigate VLAN hopping? (Choose two.)
A. switch port port-security
B. switch port port-security tagging
C. switch port accessvlan
D. switch port doublE.tag snooping
E. switch port mode access

Correct Answer: CE Section: (none) Explanation
Explanation/Reference:
QUESTION 107
Which network management tool is designed to allow businesses to manage up to 40 devices?
A. Cisco Works Unrestricted
B. Cisco Works SNMS
C. Campus Manager D. Resource Management Essentials

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 108
You are troubleshooting OSPF neighbor establishment problems, which are occurring over Frame Relay interfaces that use the default OSPF network type. What should you verify in the router configuration?
A. theip ospf network point-to-point statement under the Frame Relay interface
B. The ip ospf priority 0 statement on the Frame Relay interface on the designated router
C. The neighbor statements on the Frame Relay interface
D. The framE.relay map statement on the Frame Relay interface

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 109
You are configuring a VLAN and the switch you are using requires that you do so within the VLAN database. Which command allows you to enter the VLAN database?
A. Switch#vlan database
B. Switch (config)# vlan database
C. Switch (config-if)# vlan database
D. Switch (vlan)# vlan database

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 110
Which two statements best describe the wireless core feature set using autonomous access points when implementing repeater topology? (Choose two.)
A. RF overlap between access points should be 10 to 15 percent with unique channels configured.
B. RF overlap between primary and repeater access points should be 10 to 15 percent with the same channel configured.
C. RF overlap between primary and repeater access points should be 50 percent with the same channel configured
D. RF overlap between primary and repeater access points should be 50 percent with unique channels configured.
E. Clients that are associated with the repeater access point will have 10 to 15 percent less data throughput than clients that are associated with the primary root access point.
F. Clients that are associated with the repeater access point will have 50 percent less data throughput than clients that are associated with the primary root access point
Correct Answer: CF Section: (none) Explanation

Explanation/Reference:
QUESTION 111
:Refer to the exhibit. The Cisco Aironet 802.1 la/b/g Wireless LAN Client Adapter has two LEDs. Which two LED states indicate that the card is associated to an access point and is working properly? (Choose two.)

A. green LED off; amber LED solid
B. green LED off; amber LED blinking sporadically
C. green LED blinking quickly: amber LED blinking quickly
D. green LED blinking slowly, amber LED blinking slowly
E. green LED blinking slowly; amber LED blinking quickly

Correct Answer: CD Section: (none) Explanation
Explanation/Reference:
QUESTION 112
Refer to the exhibit. The tables contain information from the Cisco Router and Security Device Manager configuration of Router A and Router B. Traffic between Host 1 and Host 2 is not successfully establishing the sitE.to-site VPN between Router A and Router B. What is the mostly likely cause of this fault?

A. The IPSec and IKE encryption methods do not match. They all have to be either 3DES or AES.
B. Router A is using a standard IP ACL (100-149) while Router B is using a turbo ACL (150-199).
C. The D.H Group settings on the two routers are set to group 2. They must be set to group 1 for SHA. 1.
D. The IPSec policy map names on the two routers do not match. They must be the same on both routers.
E. The IPSec rules on the two routers are not permitting the correct interesting traffic

Correct Answer: E Section: (none) Explanation
Explanation/Reference:
QUESTION 113
OSPF routes are being redistributed into EIGRP but they are not showing up in the routing table. What are two possible causes? (Choose two.)
A. CEF has not been enabled.
B. Synchronization has been turned off.
C. incorrect distribute lists have been configured
D. No default metric has been configured for EIGRP
E. Theip classless command is missing.
F. There are mismatched autonomous system numbers.

Correct Answer: CD Section: (none) Explanation
Explanation/Reference:
QUESTION 114
Which two statements best describe the wireless implementation of Cisco Aironet root and non- root bridging? (Choose two.)
A. Point-to-point access points can be used if one is root and the other is non-root.
B. WGB can be used with an access point if the distance is less than one mile
C. Root mode must be enabled only on one side in a point-to-point link to intemperate with other vendors and comply with 802.11
D. Up to 17 non-root bridges can associate to a root bridge
E. Point-to-point WGB can be used if total number of PCs is fewer than eight. The neighbor 10.1.1.1 is the BDR

Correct Answer: BD Section: (none) Explanation
Explanation/Reference:
QUESTION 115
The customer wants to implement wireless security through implementation of WPAv2. Which component of WPAv2 would limit the rollout because of the continued use of old access points?
A. 48-bit IV
B. AES
C. TKIP
D. MIC

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 116
A company needs to provide sitE.to-site VPN, remote access VPN, and firewall protection. Which device best supports all three functions?
A. Cisco PIX
B. Cisco ASA
C. Cisco Concentrator
D. Cisco Router and Security Device Manager

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 117
Refer to the exhibit. R2 is always in the init state. Which two statements are correct? (Choose two.)

A. R2 is seeing hello packets from R1.
B. R2 is not seeing hello packets from R1.
C. The exchanging of data between R1 and R2 is occurring because each is sending hello packets.
D. Two-way communication has not been established between R1 and R2 because R2 is not seeing its router ID in the hello packets that it is receiving from R1
E. R2 has an access list defined for SO that is blocking an OSPF multicast IP address of 224.0.0.5.

Correct Answer: AD Section: (none) Explanation
Explanation/Reference:
QUESTION 118
Which two features are only supported when using the Cisco Router and Security Device Manager (SDM) Advanced Firewall wizard and not supported when using the Cisco SDM Basic Firewall wizard? (Choose two.)
A. deep-packet inspections
B. IP unicast Reverse Path Forwarding on the outside (untrusted) interface
C. DMZ services
D. Custom inspection rules
E. proxy authentication

Correct Answer: CD Section: (none) Explanation
Explanation/Reference:
QUESTION 119
:When troubleshooting poor network performance, which two symptoms would typically be associated with a network layer problem? (Choose two.)
A. Packet loss is more than 30 percent
B. There is excessive broadcast traffic.
C. There are excessive CRC errors.
D. Pings succeed only part of the time
E. Slips are detected on WAN interfaces.
F. ARP requests are timing out.

Correct Answer: AD Section: (none) Explanation Explanation/Reference:
QUESTION 120
Which command can be used to verify that RIPv2 is running on a router?
A. show startup-config
B. show ip route
C. showip route rip
D. Show ip protocols

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 121
Which two statements best describe the wireless core feature set using autonomous access points when implementing Wireless Domain Services? (Choose two.)
A. Layer 2 and Layer 3 services can be configured in a CiscoAironet autonomous AP or a Cisco Integrated Services Router.
B. Layer 2 services can be configured in a Cisco Aironet autonomous AP or a Cisco Integrated Services Router
C. Layer 2 and Layer 3 services can be configured in a CiscoAironet autonomous AP or controllers.
D. Layer 3 services can be configured in WLSM.
E. Layer 3 services can be configured in WLSE.

Correct Answer: BD Section: (none) Explanation
Explanation/Reference:
QUESTION 122
You have just configured and enabled the Cisco IOS Firewall feature set from a remote location using the Cisco Router and Security Device Manager (SDM) Firewall wizard. You later want to doublE. check your configuration using Cisco SDM. However, you find that you can no longer connect to the Cisco IOS Firewall using Cisco SDM.
What is the probable cause of this failure?
A. You must additionally specify the Cisco SDM management port number to gain access when the configuration has been applied.
B. You have not generated an RSA key pair between the host and device to allow secure access via Cisco SDM.
C. You have been locked out via access lists mat nave been applied to the router as a result of your Cisco SDM configuration.
D. You must specify the host IP address of Cisco SDM in the Configuration panel for allowed management connections.

Correct Answer: C Section: (none) Explanation
Explanation/Reference: QUESTION 123
An 802.11 b telephone is receiving an audio signal from an access point, but cannot send audio. What is a possible cause?
A. the RSSI value on the telephone is greater than 35.
B. The access point is set to receive only at 802.11g data rates.
C. The security settings in the telephone do not match the settings in the access point.
D. The transmit power in the telephone is significantly lower than the transmit power in the access point.

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 124
Refer to the exhibit. A host on the Sales subnet (10.0.2.0/24) is not able to initiate a web connection to an outside website. According to the network diagram and partial Cisco Adaptive Security Device Manager configuration shown in the exhibit, what is the cause of the problem?

A. The dynamic NAT global pool is not configured correctly.
B. The source networks for static NAT are not configured correctly.
C. The administrator has not added an access list to allow the connection.
D. The source network for dynamic NAT is not configured correctly

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 125
Users logging into Cisco Router and Security Device Manager should be authenticated using the Cisco ISR local user database. Currently, none of the users can access Cisco Router and Security Device Manager via HTTP. You should check the configuration of which command or commands when attempting to resolve this problem?
A. There is no ip http secure-server
B. There is ip http authentication local
C. There is linevty 0 5 login local
D. There isaaa new-model

Correct Answer: B Section: (none) Explanation
Explanation/Reference:

Flydumps.com Cisco 642-384 study guides are patterned into Questions and Answers pdf format and test engine and it will sharpen your skills and expand your knowledge to obtain a definite success. Everything you need to prepare and quickly pass the Cisco 642-384 certification exams the first time, Cisco 642-384 can be found in Flydumps.com study guides.

Welcome to download the newest Dumpsoon 648-385 dumps: http://www.dumpsoon.com/648-385.html

Fortinet 925-201B Real Exam, Pass the Fortinet 925-201B Dumps PDF On Store

Welcome to download the newest Flydumps 642-832 VCE dumps: http://www.flydumps.com/642-832.html

While FLYDUMPS ahead, the reason people choose FLYDUMPS IIA IIA-CFSA exam sample questions is that it can really bring benefits to them, and to help you come true your dreams as soon as possible. If you think you can face unique challenges in your career, you should pass the IIA IIA-CFSA exam. FLYDUMPS is a site that comprehensively understands the IIA IIA-CFSA exam. Using the exclusive online IIA IIA-CFSA certification exam, will become very easy to pass the IIA IIA-CFSA exam. FLYDUMPS guarantee 100% success. FLYDUMPS is recognized as the leader of a professional certification exam, it provides the most comprehensive Cisco certification standard IIA IIA-CFSA exam sample questions.

QUESTION 1
Which two factors should be considered when calculating the cost of downtime?
(Choose two.)

A. Number of compromised Servers
B. Server downtime (in Hours)
C. Time (in hours ) to rebuild servers
D. Average Revenue per hour
Answer: B,D
QUESTION 2 Once you have concluded the discovery process, you will set up a meeting with the final decision maker and present the value proposition,. Which two items would you include in your value proposition? (Choose Two.)
A. Qualitative information about how Cisco can help to increase revenue and reduce costs
B. A high-level review of the Cisco Security portfolio and how it differs from competitive offerings
C. A detailed review of the proposed technological enhancements that are provided in the security solution design
D. An analysis of the security-market business trends and related Cisco Solution offerings
E. A review of customer security pain points and business needs that you learned about during the discovery process
Answer: A,E
QUESTION 3 In which two ways does a Cisco solution directly reduce the cost of operation?( Choose two.)
A. By Minimizing the number of vendors that supply security
B. By reducing overall management complexity
C. by improving competitive advantage
D. By avoiding information theft
E. By addressing security pain points
Answer: A,B
QUESTION 4 Which government regulation opens up an opportunity to sell a Cisco Security Solution to companies that collect financial information?
A. AS/NZS 4360
B. BS 7799/ISO 17799
C. SOX
D. GLB Act
E. HIPAA
Answer: D
QUESTION 5 When building a security policy for an organization, which of these steps should you take first?
A. Risk Management
B. Risk Assessment
C. Threat Avoidance
D. End-user Training
E. Threat Identification
Answer: E
QUESTION 6 You are meeting with a customer who is concerned about remote employees connecting to the network with infected systems and spreading infection across the corporate network. How should you position the Cisco SDN with this computer?
A. The Cisco Self-defending Network Includes NAC, which evaluates devices that may not have the latest antivirus software or operating system patch and either denies access to those devices or quarantines them
B. The Cisco Self-defending Network Includes integration, which enables a more proactive response to threats with grater operational efficiency through the consolidation of multiple security services on the devices
C. The Cisco Self-Defending Network is adaptive, distributing security technologies throughout every segment of the network to enable every network element as a point of defense
D. The Cisco Self-Defending Network provides technologies that have intelligent insight into what is running on computers, so there is no possible way for remote employees to connect to the network with infected systems
Answer: A
QUESTION 7 What are three benefits of the Cisco SDN that will be recognized by business decision makers? (Choose three.)
A. Lowers TCO by using the existing infrastructure
B. Helps to meet regulatory requirements
C. Protects against insecure or contaminated devices
D. Helps to manage IT and operational risk
E. Effectively enforces security and confidential policies company-wide
F. Provides network availability and reliability
Answer: A,B,D
QUESTION 8
You are meeting with an enterprise customer that has a multivendor network.
Which Cisco Security product should you position with this customer?

A. CiscoWorks VPN/Security Management Solution Basic
B. Cisco Security MARS
C. Cisco Router and Security Device Manager
D. Cisco PIX Device Manager
Answer: B
QUESTION 9 In which two ways does application security protect against threats being introduced from within web-enabled applications (Choose two.)
A. Application Security examines message-level information to ascertain the “intent” of the applications
B. Application security provides controls that limit the transmission of confidential data or policies
C. Application Security Intelligently Analyzes network payload
D. Application security stops attacks as far as possible from their intended destination and the core of the network
Answer: A,C
QUESTION 10
What is one way that Cisco Security can decrease customer implementation costs?

A. through better security management products
B. Through dedicated security appliances
C. By using the existing infrastructure
D. By reducing the number of people to train
Answer: C
QUESTION 11 How does the Cisco Security Agent work in conjunction with third-part antivirus software?
A. Cisco Security Agent checks the status of third-party antivirus software and makes a decision about compliance
B. Cisco Security Agent Checks the status of third-party antivirus software and forward it to the third-party antivirus policy server
C. Cisco Security Agent checks the status of third-part antivirus software and forwards it to the policy server (ACS)
D. Cisco Security Agent enhances the security by sandboxing the applications and the system in addition to the antivirus protection offered by the antivirus software
Answer: D
QUESTION 12 Which government regulation specifies which patient information must be kept private, how companies must secure the information and the standards for electronic communication between medical providers and insurance companies?
A. Basel II
B. GLB Act

C. HIPAA
D. USA PATRIOT Act
Answer: C
QUESTION 13 The Cisco SDN is a strategy to protect the business processes and the network of an organization by identifying, preventing and adapting to security threats. What are three principal characteristics of the SDN? (Choose three.)
A. Application Security
B. Adaptation
C. Intelligence
D. Collaboration
E. Protection
F. Integration
Answer: B,D,F
QUESTION 14
.com suffered from a critical security breach and experienced considerable downtime. They decided to reassess the security policy and rebuild the network infrastructure. Which three business problems does the self-defending Network Initiative address? (Choose three.)
A. Asset Exposure
B. Legal liability
C. Suboptimal Product positioning
D. Damage to customer confidence
E. Inadequate time-to-market
F. Lack of robustness
Answer: A,B,D
QUESTION 15 Your Customer wants to ensure business continuity by allowing legitimate transactions to the website while redirecting illegitimate transactions. Which Cisco SDN solution offering would satisfy this requirement?
A. Cisco NAC framework
B. Cisco Secure ACS
C. Cisco Guard DDOS Mitigation Appliances
D. Cisco Security MARS
Answer: C
QUESTION 16
Which three technologies allow the Cisco SDN to adapt to new threats as they arise?
(Choose three.)

A. Antivirus
B. Application awareness
C. Behavior Recognition
D. Firewalling
E. Network Control
F. VPN
Answer: B,C,E
QUESTION 17 You are meeting with a financial customer who is concerned about Internet worms, viruses and other threats. A worm or virus would cost millions of dollors in lost productivity and malware or spyware could result in information theft. How should you position Anti-X defenses with this customer?
A. Anti-X defenses intelligently analyze network payload so that application security tools can control port 80 misuse by rogue applications
B. Anit-X defense provide broad attack-mitifation capabilities and distribute defenses throughout the network, including to critical system endpoints
C. Anti-X defense enable proactive response to threats by aggregating and correlating security information
D. Anti-X defenses render malware and spyware harmless by managing patches more proactively Answer: B
QUESTION 18 Which security Management offering helps customers to readily and accurately identify, manage and mitigate network attacks and to maintain network security compliance?
A. Cisco Security Manager
B. Cisco Network Assistant
C. Cisco NAC
D. Cisco Security MARS
E. Cisco Security Agent
F. Cisco Trust Agent
Answer: D
QUESTION 19 Which government regulation was implemented to promote world financial stability by coordinating definitions of capital and risk management across countries?
A. BS 7799/IOS 17799
B. SOX
C. HIPPA
D. Basel II
E. USA PATRIOT Act
Answer: D
QUESTION 20 A Cisco Outbreak Prevention Solution provides customers with many benefits. Within this solution, which type of Cisco network security offering acts as the first line of defense to proactively isolate infections by preventing worms or viruses from infiltrating endpoints?
A. NIPS

B. HIPS
C. Cisco IOS infrastructure security
D. Cisco Antivirus Software
Answer: B
QUESTION 21 Which three of these are key elements of the Adaptive Threat Defense? (Choose three.)
A. Multilayer intelligence
B. A blend of IP and security technologies
C. Active Management and mitigation
D. Dynamic adjustment of risk ratings
E. Feature consistency
F. Intrusion Detection System
Answer: A,C,D
QUESTION 22 Which two threat-defense features allow a network to correlate events, mitigate events and audit policies? (Choose two.)
A. Proactive threat response
B. Control of data transmission
C. Application Security
D. Network Containment and Control
E. Anti-X denfeses
Answer: A,D
QUESTION 23 Which business enables provides a defense against damages and losses (Such as financial, legal, commercial, image, branding, property and people), which directly affect the ability of .com to do business?
A. Government Regulations
B. Protection
C. Ubiquitous access
D. Contribution to profitability
Answer: B
QUESTION 24 In terms of the network life-cycle, what should you consider when evaluating the TCO of a security solution?
A. Planning and design phase
B. Implementation and operation phases
C. The Entire network life-cycle
D. Operation Phase
E. Planning Phase
Answer: C
QUESTION 25
Which statement best describes the functionality of the Cisco Security Agent?

A. It enforces authorization policies and privileges
B. It isolates noncompliant machines
C. It prevents malicious behavior before damage can occur
D. It performs vulnerability testing and threat remediation
Answer: C
QUESTION 26
Which feature of Cisco Security MARS uses NetFlow Data?

A. Hostpot identification
B. Anomaly detection
C. Automated mitigation capabilities
D. Context Correlation
Answer: B
QUESTION 27
Which three elements should an enterprise security policy specify? (Choose three.)

A. Risk and how to manage the risks
B. Network Inventory
C. User roles and responsibilities
D. Software versions of the security products
E. Contingency plan in case of compromise
F. Funds allocated to security projects
Answer: A,C,E
QUESTION 28
Why do end users need to be aware of the security policy?

A. Some security decision are usually in their hands
B. They should understand the probability of every risk
C. They need to be aware of every threat
D. They should avoid responsibility for their actions
Answer: A
QUESTION 29 Which principal Characteristic of the Cisco SDN incorporates technologies that re inherent in the secure operation of network devices, including control plane policing and CPU/Memory thresholding?

Flydumps.com will provide you with the most updates material to prepare for the tests all the Cisco 646-562 torrent are available at the site. Studying with dumps makes it much easier to pass the certification. Number of networking downloads including the Cisco 646-562 download are available on the website. Various websites offering such information have information in various formats you can easily download the format that is suitable for you it can be in Cisco 646-562 Testing Engine or in html.

Flydumps 642-832 dumps with PDF + Premium VCE + VCE Simulator: http://www.flydumps.com/642-832.html

IIA IIA-CFSA Exam Test Questions, Free Download Real IIA IIA-CFSA Exam Practice PDF Covers All Key Points

Flydumps Cisco 642-544 exam questions and answers in PDF are prepared by our expert, Moreover,they are based on the recommended syllabus covering all the Cisco 642-544 exam objectives.You will find them to be very helpful and precise in the subject matter since all the Microsoft Cisco 642-544  exam content is regularly updated and has been checked for accuracy by our team of Microsoft expert professionals.

Exam A
QUESTION 1
What will happen if you try to run a Cisco Security MARS query that will take a long time to complete?
A. After submitting the query, the Cisco Security MARS GUI screen will be locked up until the query is completed.
B. The query will be automatically saved as a rule.
C. The query will be automatically saved as a report.
D. You will be prompted to “Submit Batch” to run the query in batch mode.

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 2
The Cisco Security MARS appliance supports which protocol for data archiving and restoring?
A. NFS
B. TFTP
C. FTP
D. Secure FTP
E. SSH

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 3
What is a benefit of using the dollar variable (as in $TARGET01) when creating queries in Cisco Security MARS?
A. The dollar variable enables multiple queries to reference the same common 5-tuple information using a variable.
B. The dollar variable ensures that the probes and attacks that are reported are happening to the same host.
C. The dollar variable allows matching of any unknown reporting device.
D. The dollar variable allows matching of any event type groups.
E. The dollar variable enables the same query to be applied to different reports.
F. The dollar variable enables the same query to be applied to different cases.

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 4
A Cisco Security MARS appliance cannot access certain devices through the default gateway. Troubleshooting has determined that this is a Cisco Security MARS configuration issue.
Which additional Cisco Security MARS configuration will be required to correct this issue?
A. use the Cisco Security MARS GUI or CLI to enable a dynamic routing protocol
B. use the Cisco Security MARS CLI to add a static route
C. use the Cisco Security MARS GUI to configure multiple default gateways
D. use the Cisco Security MARS GUI or CLI to configure multiple default gateways

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 5
What are three ways to add devices to the Cisco Security MARS appliance? (Choose three.)
A. import the devices from CiscoWorks
B. import the devices from Cisco Security Manager
C. load the devices from seed files
D. use SNMP auto discovery
E. use CDP to automatically discover the neighboring devices
F. manually add the devices, one at a time

Correct Answer: CDF Section: (none) Explanation
Explanation/Reference:
QUESTION 6
Which action enables the Cisco Security MARS appliance to ignore false-positive events by either dropping the events completely, or by just logging them to the database?
A. creating system inspection rules using the drop operation
B. creating drop rules
C. inactivating the rules
D. inactivating the events
E. deleting the false-positive events from the Incidents page
F. deleting the false-positive events from the Event Management page

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 7
Drop A. Interface Setting

B. Access IP
C. Reporting IP
D. Access Type

Correct Answer: ABCD Section: (none) Explanation
Explanation/Reference:
QUESTION 8
Which three statements are true about Cisco Security MARS rules? (Choose three.)
A. There are three types of rules.
B. Rules can be saved as reports.
C. Rules can be deleted.
D. Rules trigger incidents.
E. Rules can be defined using a seed file.
F. Rules can be created using a query.
Correct Answer: ADF Section: (none) Explanation

Explanation/Reference:
QUESTION 9
Which of the following alert actions can be transmitted to a user as notification that a Cisco Security MARS rule has fired, and that an incident has been logged? (Choose two.)
A. Distributed Threat Mitigation
B. Short Message Service
C. SNMP trap
D. XML notification
E. syslog
F. OPSEC-LEA (clear and encrypted)

Correct Answer: BD Section: (none) Explanation
Explanation/Reference:
QUESTION 10
To configure a Microsoft Windows IIS server to publish logs to the Cisco Security MARS, which log agent is installed and configured on the Microsoft Windows IIS server?
A. pnLog agent
B. Cisco Security MARS agent
C. SNARE
D. None. Cisco Security MARS is an agentless device.

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 11
What three data points are used to correlate reports in the Cisco Security MARS? (Choose three.)
A. Maximum Rank Returned
B. Query Criteria
C. View Type
D. Order/Rank By
E. Incident Type
F. Period of Time

Correct Answer: BCF Section: (none) Explanation
Explanation/Reference:
QUESTION 12
Refer to the exhibit.
The Service variables defined are used for what purpose?

A. for Event Groups creation
B. for Query/Reports and Rules creation
C. for IP Management Groups creation
D. for NetFlow Events Management
E. for Data Reduction

Correct Answer: AB Section: (none) Explanation
Explanation/Reference:
QUESTION 13
Refer to the Cisco Security MARS Event Management partial screen shown above. Which two statements are correct? (Choose two) A. Event ID 1104001 is a low-severity event.

B. Event ID 1104001 is triggered if ALL of the syslog messages under the Device Event ID column are received by the Cisco Security MARS within a predefined time frame.
C. Event ID 1104001 belongs in an event group that includes generic informational events from firewalls.
D. PIX and FWSM syslog messages (104001) are normalized into a single event (Event ID 1104001).
E. Info/Misc/FW is a user-defined rule that normalizes events into a single event.

Correct Answer: CD Section: (none) Explanation
Explanation/Reference:
QUESTION 14
When adding a device to the Cisco Security MARS appliance, what is the reporting IP address of the device?
A. the source IP address that sends syslog information to the Cisco Security MARS appliance
B. the IP address that Cisco Security MARS uses to access the device via SNMP
C. the IP address that Cisco Security MARS uses to access the device via Telnet or SSH
D. the pre-NAT IP address of the device

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 15
Which statement is true about the case management feature of Cisco Security MARS?
A. Cases are created on a global controller, but they can be viewed and modified on a local controller.
B. The global controller has a Case bar and all cases are selected from the Query/Reports > Cases page.
C. Cases are created on a local controller, but they can be viewed and modified on a global controller.
D. The Cases page on a local controller has an additional drop-down filter to display cases per a global controller.

Correct Answer: C Section: (none) Explanation Explanation/Reference:
QUESTION 16
What is a zone?
A. A zone represents all the local controllers each global controller is monitoring.
B. A zone is a logical partition within a local controller. Configuring zones allows the local controller to scale to cover large networks.
C. A zone is an area of a customer network related to one local controller. Each local controller represents a specific zone.
D. Each zone within the global controller is configured and managed independently.
E. Each zone within the local controller is configured and managed independently.

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 17
What protocol does Juniper NetScreen IDP use to exchange IPS events with the Cisco Security MARS?
A. SDEE
B. SNMP
C. RDEP
D. syslog

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 18
In what two ways can the Cisco Security MARS present the incident data to the user graphically from the Summary Dashboard? (Select two)
A. event type group matrix
B. incident firing information
C. path information
D. compromised topology information
E. incident vector information
F. system-confirmed true positive information

Correct Answer: CE Section: (none) Explanation
Explanation/Reference:
QUESTION 19
Which attack can be detected by Cisco Security MARS using NetFlow data?
A. man-in-the middle attack
B. day-zero attack
C. spoof attack
D. Land attack
E. buffer overflow attack

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 20
Which two of the following statements are TRUE when you configure the pnreset command on the Cisco Security MARS? (Choose two.)
A. erases the license file
B. sends Cisco IOS data from the Cisco Security MARS database to a network file server
C. enables you to view the status of the Cisco Security MARS processes and how long the processes have been active
D. sets the debug level that is reported in the logs
E. lets you add or delete disks in the Cisco Security MARS devices that support RAID configurations without powering down the devices
F. clears, sets, and initializes database structures

Correct Answer: AF Section: (none) Explanation
Explanation/Reference:

Cisco 642-544 Questions & Answers with explanations is all what you surely want to have before taking Cisco 642-544 exam.Cisco 642-544  Interactive Testing Engine is ready to help you to get your Cisco 642-544  by saving your time by preparing you quickly for the Cisco exam. If you are worried about getting your Cisco 642-544  certification passed and are in search of some best and useful material,Cisco 642-544  Q&A will surely serve you to enhance your Interconnecting Cisco Networking Devices Part 1 stydy.

Preparing for Microsoft exams of Cisco 642-544 is really a tough task to accomplish.Flydumps delivers the most comprehensive preparation material,covering each and every aspect of Cisco 642-544 exam curriculum and all the brain is the latest.You can pass Cisco 642-544 exam without any problem

Exam A
QUESTION 1
Refering to the rule shown on the MARS GUI screen, which two of the following statements are correct? (Choose two.)

A. This rule will fire if the offset 1 condition occurs “OR” if the offset 2 condition occurs.
B. This rule will fire if the offset 3 condition occurs.
C. The expressions between cells are “AND’ while the expressions between items in the same cell are “OR”.
D. This is a user-defined rule.
E. This rule can be deleted after changing its status to “inactive.”

Correct Answer: BC Section: (none) Explanation
Explanation/Reference:
QUESTION 2
To configure a Microsoft Windows IIS server to publish logs to the Cisco Security MARS, which log agent is installed and configured on the Microsoft Windows IIS server?
A. pnLog agent
B. Cisco Security MARS agent
C. SNARE
D. None. Cisco Security MARS is an agentless device.

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 3
Drop A.

B.
C.
D.

Correct Answer: Section: (none) Explanation
Explanation/Reference:
QUESTION 4
A Cisco Security MARS appliance cannot access certain devices through the default gateway. Troubleshooting has determined that this is a Cisco Security MARS configuration issue.
Which additional Cisco Security MARS configuration will be required to correct this issue?
A. use the Cisco Security MARS GUI or CLI to enable a dynamic routing protocol
B. use the Cisco Security MARS CLI to add a static route
C. use the Cisco Security MARS GUI to configure multiple default gateways
D. use the Cisco Security MARS GUI or CLI to configure multiple default gateways
Correct Answer: B Section: (none) Explanation

Explanation/Reference:
QUESTION 5
Which action enables the Cisco Security MARS appliance to ignore false-positive events by either dropping the events completely, or by just logging them to the database?
A. creating system inspection rules using the drop operation
B. creating drop rules
C. inactivating the rules
D. inactivating the events
E. deleting the false-positive events from the Incidents page
F. deleting the false-positive events from the Event Management page

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 6
Which three of the following statements are correct regarding the Query shown on the MARS GUI screen? (Choose three.)
A. Query will match any source IP address.
B. Query will only match a source IP address of 10.10.10.10.
C. Query will only match a destination IP address range from 10.1.1.1 to 10.1.1.25.
D. Query will only match a destination IP address of 10.1.1.1 OR 10.1.1.25.
E. Query will only not match any services since both TCP-highPort and UDP-highPort service groups are specified in the Service field.
F. Query will only match any services using the TCP-highPort OR UDP-highPort service groups.

Correct Answer: ACF Section: (none) Explanation
Explanation/Reference:
QUESTION 7
Which three statements are true about Cisco Security MARS rules? (Choose three.)
A. There are three types of rules.
B. Rules can be saved as reports.
C. Rules can be deleted.
D. Rules trigger incidents.
E. Rules can be defined using a seed file.
F. Rules can be created using a query.

Correct Answer: ADF Section: (none) Explanation
Explanation/Reference: QUESTION 8
Which two are required to enable Cisco Security MARS Level 3 operations? (Choose two.)
A. global controller
B. vulnerability scanning
C. NetFlow
D. SNMP community string
E. administrative access to the device
F. Cisco Security Manager

Correct Answer: DE Section: (none) Explanation
Explanation/Reference:
QUESTION 9
What is a zone?
A. A zone represents all the local controllers each global controller is monitoring.
B. A zone is a logical partition within a local controller. Configuring zones allows the local controller to scale to cover large networks.
C. A zone is an area of a customer network related to one local controller. Each local controller represents a specific zone.
D. Each zone within the global controller is configured and managed independently.
E. Each zone within the local controller is configured and managed independently.

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 10
In what two ways can the Cisco Security MARS present the incident data to the user graphically from the Summary Dashboard? (Select two)
A. event type group matrix
B. incident firing information
C. path information
D. compromised topology information
E. incident vector information
F. system-confirmed true positive information

Correct Answer: CE Section: (none) Explanation
Explanation/Reference:
QUESTION 11
Which two of the following statements are TRUE when you configure the pnreset command on the Cisco Security MARS? (Choose two.)
A. erases the license file
B. sends Cisco IOS data from the Cisco Security MARS database to a network file server
C. enables you to view the status of the Cisco Security MARS processes and how long the processes have been active
D. sets the debug level that is reported in the logs
E. lets you add or delete disks in the Cisco Security MARS devices that support RAID configurations without powering down the devices
F. clears, sets, and initializes database structures

Correct Answer: AF Section: (none) Explanation
Explanation/Reference:
QUESTION 12
Refer to the exhibit. The Service variables defined are used for what purpose?

A. for Event Groups creation
B. for Query/Reports and Rules creation
C. for IP Management Groups creation
D. for NetFlow Events Management
E. for Data Reduction

Correct Answer: B Section: (none) Explanation Explanation/Reference:
QUESTION 13
Which three statements are correct about the Cisco Security MARS global and local controller architecture? (Choose three.)
A. The global controller can correlate events from different local controllers into a common session.
B. One global controller can support multiple local controllers.
C. Each zone can have one local controller.
D. All local controllers events are propagated to the global controller for correlations.
E. The global controller and the local controllers can be running different Cisco Security MARS OS versions.
F. Incidents can be viewed on the global controller based on a selected local controller.

Correct Answer: BCF Section: (none) Explanation
Explanation/Reference:
QUESTION 14
What protocol does Juniper NetScreen IDP use to exchange IPS events with the Cisco Security MARS?
A. SDEE
B. SNMP
C. RDEP
D. syslog

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 15
At what level of operation does the Cisco Security MARS appliance perform NAT and PAT resolution?
A. Local (Level 0)
B. Basic (Level 1)
C. Intermediate (Level 2)
D. Advanced (Level 3)
E. Global (Level 4)

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 16
When adding a device to the Cisco Security MARS appliance, what is the reporting IP address of the device?
A. the source IP address that sends syslog information to the Cisco Security MARS appliance
B. the IP address that Cisco Security MARS uses to access the device via SNMP
C. the IP address that Cisco Security MARS uses to access the device via Telnet or SSH
D. the pre-NAT IP address of the device

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 17
Which statement best describes the case management feature of Cisco Security MARS?
A. It is used to automatically collect and save information on incidents, sessions, queries, and reports dynamically without user interventions.
B. It is used to capture, combine, and preserve user-selected Cisco Security MARS data within a specialized report.
C. It is used to very quickly evaluate the state of the network.
D. It is used in conjunction with the Cisco Security MARS incident escalation feature for incident reporting.

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 18
Referring to the System Inspection Rule shown on the MARS GUI screen, which one of the following statements is correct?

A. Click on “Add” to activate the rule.
B. Click on “Activate” to activate the rule.
C. Click on “Change Status” to activate the rule.
D. Click on “Edit.” Then you can apply and activate the rule.
E. Click on “Duplicate” to archive the rule to a remote NAS.

Correct Answer: C Section: (none) Explanation
Explanation/Reference: QUESTION 19
What is a benefit of using the dollar variable (as in $TARGET01) when creating queries in Cisco Security MARS?
A. The dollar variable enables multiple queries to reference the same common 5-tuple information using a variable.
B. The dollar variable ensures that the probes and attacks that are reported are happening to the same host.
C. The dollar variable allows matching of any unknown reporting device.
D. The dollar variable allows matching of any event type groups.
E. The dollar variable enables the same query to be applied to different reports.
F. The dollar variable enables the same query to be applied to different cases.

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 20
Referring to the diagram shown on the MARS GUI screen, why is the Push function not enabled (grayed out)?

A. Because the HQ-FW-1 device is the alternate choke point for mitigating this attack.
B. Because MARS cannot push commands to Layer 3 devices.
C. Because the Incident has not been confirmed by the administrator.
D. Because the Incident is a false positive.
E. Because MARS is operating at level 2 and not at level 3.
F. Because the selected mitigation command is not supported on the HQ-FW-1 device.

Correct Answer: B Section: (none) Explanation
Explanation/Reference:

Worried about Cisco 642-544  pass results? Adopt most reliable way of exam preparation that is Cisco 642-544  Questions & Answers with explanations to get reliable Cisco 642-544 pass result. Certpaper definitely guarantees it!