Implementing Cisco Network Security (IINS)

 

QUESTION 61

A specific URL has been identified as containing malware. What action can you take to block users from accidentally visiting the URL and becoming infected with malware.

 

A.

Enable URL filtering on the perimeterrouter and add the URLs you want to block to the router’s local URL list.

B.

Enable URL filtering on the perimeter firewall and add the URLs you want to allow to the router’s local URL list.

C.

Enable URL filtering on the perimeterrouter and add the URLs you want to allow to thefirewall’s local URL list.

D.

Create a blacklist that contains the URL you want toblock and activate the blacklist on theperimeter router.

E.

Create a whitelist that contains the URLs you want to allow and activate the whitelist on the perimeter router.

 

Correct Answer: A

 

 

QUESTION 62

When is the best time to perform an anti-virus signature update?

 

A.

Every time a new update is available.

B.

When the local scanner has detected a new virus.

C.

When a new virus is discovered in the wild.

D.

When the system detects a browser hook.

 

Correct Answer: A

 

 

QUESTION 63

Which statement about application blocking is true?

 

A.

It blocks access to specific programs.

B.

It blocks access to files with specific extensions.

C.

It blocks access to specific network addresses.

D.

It blocks access to specific network services.

 

Correct Answer: A

 

 

QUESTION 64

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image002

clip_image004

clip_image006

clip_image008

clip_image010

clip_image012

clip_image014

clip_image016

clip_image018

clip_image020

clip_image022

clip_image024

clip_image026

clip_image028

clip_image030

clip_image032

clip_image034

clip_image036

clip_image038

clip_image040

clip_image042

clip_image044

clip_image046

clip_image048

clip_image050

clip_image052

clip_image054

clip_image056

clip_image058

clip_image060

clip_image062

clip_image064

clip_image066

clip_image068

clip_image070

clip_image072

clip_image074

clip_image076

clip_image078

clip_image080

clip_image082

clip_image084

clip_image086

clip_image088

clip_image090

clip_image092

clip_image094

clip_image096

clip_image098

clip_image100

clip_image102

clip_image104

clip_image106

clip_image108

 

Which four tunneling protocols are enabled in the DfltGrpPolicy group policy? (Choose four)

 

A.

Clientless SSL VPN

B.

SSL VPN Client

C.

PPTP

D.

L2TP/IPsec

E.

IPsec IKEv1

F.

IPsec IKEv2

 

Correct Answer: ADEF

Explanation:

By clicking one the Configuration-> Remote Access -> Clientless CCL VPN Access-> Group Policies tab you can view the DfltGrpPolicy protocols as shown below:

 

clip_image110

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

QUESTION 65

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image112

clip_image114

clip_image116

clip_image118

clip_image120

clip_image122

clip_image124

clip_image126

clip_image128

clip_image130

clip_image132

clip_image134

clip_image136

clip_image138

clip_image140

clip_image142

clip_image144

clip_image146

clip_image148

clip_image150

clip_image152

clip_image154

clip_image156

clip_image158

clip_image160

clip_image162

clip_image164

clip_image166

clip_image168

clip_image170

clip_image172

clip_image174

clip_image176

clip_image178

clip_image180

clip_image182

clip_image184

clip_image186

clip_image188

clip_image190

clip_image192

clip_image194

clip_image196

clip_image198

clip_image200

clip_image202

clip_image204

clip_image206

clip_image208

clip_image210

clip_image212

clip_image214

clip_image216

clip_image218

 

Which user authentication method is used when users login to the Clientless SSLVPN portal using https://209.165.201.2/test?

 

A.

AAA with LOCAL database

B.

AAA with RADIUS server

C.

Certificate

D.

Both Certificate and AAA with LOCAL database

E.

Both Certificate and AAA with RADIUS server

 

Correct Answer: A

Explanation:

This can be seen from the Connection Profiles Tab of the Remote Access VPN configuration, where the alias of test is being used.

 

clip_image220

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

QUESTION 66

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image222

clip_image224

clip_image226

clip_image228

clip_image230

clip_image232

clip_image234

clip_image236

clip_image238

clip_image240

clip_image242

clip_image244

clip_image246

clip_image248

clip_image250

clip_image252

clip_image254

clip_image256

clip_image258

clip_image260

clip_image262

clip_image264

clip_image265

clip_image267

clip_image269

clip_image271

clip_image273

clip_image275

clip_image277

clip_image279

clip_image281

clip_image283

clip_image285

clip_image287

clip_image289

clip_image291

clip_image293

clip_image295

clip_image297

clip_image299

clip_image301

clip_image303

clip_image305

clip_image307

clip_image309

clip_image311

clip_image313

clip_image315

clip_image317

clip_image319

clip_image321

clip_image322

clip_image324

clip_image326

 

Which two statements regarding the ASA VPN configurations are correct? (Choose two)

 

A.

The ASA has a certificate issued by an external Certificate Authority associated to the ASDM_TrustPoint1.

B.

The DefaultWEBVPNGroup Connection Profile is using the AAA with RADIUS server method.

C.

The Inside-SRV bookmark references the https://192.168.1.2 URL.

D.

Only Clientless SSL VPN access is allowed with the Sales group policy.

E.

AnyConnect, IPSec IKEv1, and IPSec IKEv2 VPN access is enabled on the outside interface.

F.

The Inside-SRV bookmark has not been applied to the Sales group policy.

 

Correct Answer: BC

Explanation:

For B:

clip_image328

 

For C, Navigate to the Bookmarks tab:

clip_image330

 

Then hit “edit” and you will see this:

clip_image332

 

Not A, as this is listed under the Identity Certificates, not the CA certificates:

clip_image334

 

Note E:

clip_image336

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

QUESTION 67

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image338

clip_image340

clip_image342

clip_image344

clip_image346

clip_image348

clip_image350

clip_image352

clip_image354

clip_image356

clip_image358

clip_image360

clip_image362

clip_image364

clip_image366

clip_image368

clip_image370

clip_image372

clip_image374

clip_image376

clip_image378

clip_image380

clip_image382

clip_image384

clip_image386

clip_image388

clip_image390

clip_image392

clip_image394

clip_image396

clip_image398

clip_image400

clip_image402

clip_image404

clip_image406

clip_image408

clip_image410

clip_image412

clip_image414

clip_image416

clip_image418

clip_image420

clip_image422

clip_image424

clip_image426

clip_image311[1]

clip_image429

clip_image431

clip_image433

clip_image435

clip_image437

clip_image322[1]

clip_image439

clip_image326[1]

 

When users login to the Clientless SSLVPN using https://209.165.201.2/test, which group policy will be applied?

 

A.

test

B.

clientless

C.

Sales

D.

DfltGrpPolicy

E.

DefaultRAGroup

F.

DefaultWEBVPNGroup

 

Correct Answer: C

Explanation:

First navigate to the Connection Profiles tab as shown below, highlight the one with the test alias:

 

clip_image441

 

Then hit the “edit” button and you can clearly see the Sales Group Policy being applied.

 

clip_image443

 

 

 

 

 

 

 

 

 

 

QUESTION 68

Scenario

Given the new additional connectivity requirements and the topology diagram, use ASDM to accomplish the required ASA configurations to meet the requirements.

 

New additional connectivity requirements:

Currently, the ASA configurations only allow on the Inside and DMZ networks to access any hosts on the Outside. Your task is to use ASDM to configure the ASA to also allow any host only on the Outside to HTTP to the DMZ server. The hosts on the Outside will need to use the 209.165.201.30 public IP address when HTTPing to the DMZ server.

Currently, hosts on the ASA higher security level interfaces are not able to ping any hosts on the lower security level interfaces. Your task in this simulation is to use ASDM to enable the ASA to dynamically allow the echo-reply responses back through the ASA.

 

Once the correct ASA configurations have been configured:

You can test the connectivity tohttp://209.165.201.30from the Outside PC browser.

You can test the pings to the Outside (www.cisco.com) by opening the inside PC command prompt window. In this simulation, only testing pings towww.cisco.comwill work.

 

To access ASDM, click the ASA icon in the topology diagram.

 

To access the Firefox Browser on the Outside PC, click the Outside PC icon in the topology diagram.

 

To access the Command prompt on the Inside PC, click the Inside PC icon in the topology diagram.

 

Note:

After you make the configuration changes in ASDM, remember to click Apply to apply the configuration changes.

 

Not all ASDM screens are enabled in this simulation, if some screen is not enabled, try to use different methods to configure the ASA to meet the requirements.

 

In this simulation, some of the ASDM screens may not look and function exactly like the real ASDM.

 

clip_image445

clip_image447

clip_image449

clip_image451

clip_image453

clip_image455

clip_image348[1]

clip_image458

clip_image460

clip_image354[1]

clip_image356[1]

clip_image463

clip_image465

clip_image467

clip_image469

clip_image471

clip_image473

clip_image475

clip_image477

clip_image479

clip_image481

clip_image483

clip_image485

clip_image487

clip_image489

clip_image491

clip_image493

clip_image495

clip_image497

clip_image499

clip_image501

clip_image503

clip_image505

clip_image507

clip_image509

clip_image511

clip_image513

clip_image515

clip_image517

clip_image519

clip_image521

clip_image523

clip_image525

clip_image527

clip_image529

clip_image531

clip_image533

clip_image535

clip_image537

clip_image539

clip_image541

clip_image543

clip_image545

clip_image547

clip_image549

clip_image551

clip_image553

clip_image555

clip_image557

clip_image559

clip_image561

clip_image563

 

Correct Answer:

Follow the explanation part to get answer on this sim question.

First, for the HTTP access we need to creat a NAT object. Here I called it HTTP but it can be given any name.

 

clip_image565

 

Then, create the firewall rules to allow the HTTP access:

 

clip_image567

clip_image569

 

You can verify using the outside PCto HTTP into209.165.201.30.

 

For step two, to be able to ping hosts on the outside, we edit the last service policy shown below:

 

clip_image571

 

And then check the ICMP box only as shown below, then hit Apply.

 

clip_image573

 

After that is done, we can pingwww.cisco.comagain to verify:

 

clip_image575

 

 

QUESTION 69

Which command will configure a Cisco ASA firewall to authenticate users when they enter the enable syntax using the local database with no fallback method?

 

A.

aaa authentication enable console LOCAL SERVER_GROUP

B.

aaa authentication enable console SERVER_GROUP LOCAL

C.

aaa authentication enable console local

D.

aaa authentication enable console LOCAL

 

Correct Answer: D

 

 

QUESTION 70

Which of the following statements about access lists are true? (Choose three.)

 

A.

Extended access lists should be placed as near as possible to the destination

B.

Extended access lists should be placed as near as possible to the source

C.

Standard access lists should be placed as near as possible to the destination

D.

Standard access lists should be placed as near as possible to the source

E.

Standard access lists filter on the source address

F.

Standard access lists filter on the destination address

 

Correct Answer: BCE

 

Free VCE & PDF File for Cisco 210-260 Practice Test

Instant Access to Free VCE Files: CCNA | CCNP | CCIE …
Instant Access to Free PDF Files: CCNA | CCNP | CCIE …