Cisco 642-627 New Questions:Updated Cisco 642-627 Exam with All New Questions from Flydumps

Need The Newest Cisco 642-627 Exam Dumps? Why not try Cisco 642-627 vce or pdf exam dumps? You can get all the new Cisco 642-627 exam questions and answers you need, we ensure high pass rate and money back guarantee.

QUESTION 1
What are four properties of an IPS signature? (Choose four.)
A. reputation rating
B. fidelity rating
C. summarization strategy
D. signature engine
E. global correlation mode
F. signature ID and signature status

Correct Answer: BCDF Section: (none) Explanation
Explanation/Reference:
QUESTION 2
The custom signature ID of a Cisco IPS appliance has which range of values?
A. 10000 to 19999
B. 20000 to 29999
C. 50000 to 59999
D. 60000 to 65000
E. 80000 to 90000
F. 1 to 20000

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 3
When upgrading a Cisco IPS AIM or IPS NME using manual upgrade, what must be performed before installing the upgrade?
A. Disable the heartbeat reset on the router.
B. Enable fail-open IPS mode.
C. Enable the Router Blade Configuration Protocol.
D. Gracefully halt the operating system on the Cisco IPS AIM or IPS NME.

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 4
Which Cisco IPS NME interface is visible to the NME module but not visible in the router configuration and acts as the sensing interface of the NME module?
A. ids-sensor 0/1 interface
B. ids-sensor 1/0 interface
C. gigabitEthernet 0/1
D. gigabitEthernet 1/0
E. management 0/1
F. management 1/0

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 5
In which CLI configuration mode is the Cisco IPS appliance management IP address configured?
A. global configuration ips(config)#
B. service network-access ips(config-net)#
C. service host network-settings ips(config-hos-net)#
D. service interface ips(config-int)#

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 6
Which four parameters are used to configure how often the Cisco IPS appliance generates alerts when a signature is firing? (Choose four.)
A. summary mode
B. summary interval
C. event count key
D. global summary threshold
E. summary key
F. event count
G. summary count
H. event alert mode

Correct Answer: ABDF Section: (none) Explanation
Explanation/Reference:
QUESTION 7
Which three Cisco IPS cross-launch capabilities do Cisco Security Manager and Cisco Security MARS support? (Choose three.)
A. Edit IPS signatures in Cisco Security Manager from a Cisco Security MARS query.
B. Create custom signatures in Cisco Security Manager from a Cisco Security MARS query.
C. Create event action filters in Cisco Security Manager from a Cisco Security MARS query.
D. Create a Cisco Security MARS drop rule from Cisco Security Manager policy.
E. Create a Cisco Security MARS user inspection rule from Cisco Security Manager policy.
F. Query Cisco Security MARS from Cisco Security Manager policy.

Correct Answer: CEF Section: (none) Explanation
Explanation/Reference:
QUESTION 8
Which statement about inline VLAN pair deployment with the Cisco IPS 4200 Series appliance is true?
A. The sensing interface acts as an 802.1q trunk port, and the Cisco IPS appliance performs VLAN translation between pairs of VLANs.
B. The Cisco IPS appliance connects to two physically distinct switches using two paired physical interfaces.
C. Two sensing interfaces connect to the same switch that forwards traffic between two VLANs.
D. The pair of sensing interfaces can be selectively divided (virtualized) into multiple logical “wires” by VLANs that can be analyzed separately.

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 9
Which four statements about Cisco IPS appliance anomaly detection histograms are true? (Choose four.)
A. Histograms are learned or configured manually.
B. Destination IP address row is the same for all histograms.
C. Source IP address row can be learned or configured.
D. Anomaly detection only builds a single histogram for all services in a zone.
E. You can enable a separate histogram and scanner threshold for specific services, or use the default one for all other services.
F. Anomaly detection histograms only track source (attacker) IP addresses.

Correct Answer: ABCE Section: (none) Explanation
Explanation/Reference:
QUESTION 10
Which two switching-based mechanisms are used to deploy high availability IPS using multiple Cisco IPS appliances? (Choose two.)
A. Spanning Tree-based HA
B. HSRP-based HA
C. EtherChannel-based HA
D. VRRP-based HA

Correct Answer: BC Section: (none) Explanation Explanation/Reference:
QUESTION 11
Which statement about the 4-port GigabitEthernet card with hardware bypass is true?
A. Hardware bypass only works with inline interface pairs.
B. Hardware bypass is only supported on the Cisco IPS 4270 appliance.
C. Hardware bypass is independent from software bypass.
D. Hardware bypass is enabled if software bypass is configured to “OFF”.
E. Hardware bypass is supported between any of the fourGigabitEthernet ports.

Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 12
What is the correct regular expression to match a URI request equal to /test.exe?
A. /test.exe
B. Vtest\.exe
C. /test\.exe
D. */test\.exe
E. \*/test\.exe
F. */test.exe

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 13
Which four types of interface modes are available on the Cisco IPS 4200 Series appliance? (Choose four.)
A. promiscuous
B. inline TAP
C. inline interface
D. inline VLAN pair
E. VLAN groups
F. bypass

Correct Answer: ACDE Section: (none) Explanation
Explanation/Reference:
QUESTION 14
Which option is best to use to capture only a subset of traffic (capturing traffic per-IP-address, per-protocol, or per-application) off the switch backplane and copy it to the Cisco IPS appliance?
A. SPAN
B. PBR
C. VACL
D. MPF
E. STP

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 15
Refer to the exhibit. Which statement is true?
Exhibit:

A. A summary alert is sent once during each interval for each unique Summary Key entry.
B. An alert is generated each time the signature triggers.
C. This signature does not fire until three events are seen during 60 seconds with the same attacker and victim IP addresses and ports.
D. This signature is disabled by default.
E. When this signature triggers, the Cisco IPS appliance sends an SNMP trap for this event.

Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 16
Which type of signature engine is best suited for creating custom signatures that inspect data at OSI Layer 5 and above?
A. Atomic
B. String
C. Sweep
D. Service
E. Meta
F. Flood

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
QUESTION 17
A Cisco Catalyst switch is experiencing packet drops on a SPAN destination port that is connected to an Cisco IPS appliance. Which three configurations should be considered to resolve the packet drops issue? (Choose three.)
A. Configure an additional SPAN session to a different Cisco IPS appliance interface connected to the same virtual sensor.
B. Configure an EtherChannel bundle as the SPAN destination port.
C. Configure RSPAN.
D. Configure VACL capture.
E. Configure the Cisco IPS appliance to inline mode.

Correct Answer: ABD Section: (none) Explanation
Explanation/Reference:
QUESTION 18
Which signature action should be selected to cause the attacker’s traffic flow to terminate when the Cisco IPS appliance is operating in promiscuous mode?
A. deny connection
B. deny attacker
C. reset TCP connection
D. deny packet, reset TCP connection E. deny connection, reset TCP connection

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
QUESTION 19
From which three sources does the Cisco IPS appliance obtain OS mapping information? (Choose three.)
A. from manually configured OS mappings
B. imported OS mappings from Management Center for Cisco Security Agent
C. imported OS mappings from Cisco Security Manager
D. learned OS mappings from passive OS fingerprinting
E. learned OS mappings from CiscoSensorBase input
F. from Cisco IPS signature updates

Correct Answer: ABD Section: (none) Explanation
Explanation/Reference:
QUESTION 20
Which IPS alert action is available only in inline mode?
A. produce verbose alert
B. request rate limit
C. reset TCP connection
D. log attacker/victim pair packets
E. deny-packet-inline
F. request block connection

Correct Answer: E Section: (none) Explanation
Explanation/Reference:

Flydumps Cisco 642-627 exam dumps are audited by our certified subject matter experts and published authors for development.Flydumps Cisco 642-627 exam dumps are one of the highest quality Cisco 642-627 Q&As in the world.It covers nearly 96% real questions and answers, including the entire testing scope.Flydumps guarantees you pass Cisco 642-627 exam at first attempt.