Ensurepass

QUESTION 61

A specific URL has been identified as containing malware. What action can you take to block users from accidentally visiting the URL and becoming infected with malware.

 

A.

EnableURL filtering on the perimeterrouter and add the URLs you want to block to the router’s local URL list.

B.

Enable URL filtering on the perimeter firewall and add the URLs you want to allow to the router’s local URL list.

C.

EnableURL filtering on the perimeterrouter and add the URLs you want to allow to thefirewall’s local URL list.

D.

Create a blacklist that contains the URL you want toblock and activate the blacklist on theperimeter router.

E.

Create a whitelist that contains the URLs you want to allow and activate the whitelist on the perimeter router.

 

Correct Answer: A

 

 

QUESTION 62

When is the best time to perform an anti-virus signature update?

 

A.

Every time a new update is available.

B.

When the local scanner has detected a new virus.

C.

When a new virus is discovered in the wild.

D.

When the system detects a browser hook.

 

Correct Answer: A

 

 

QUESTION 63

Which statement about application blocking is true?

 

A.

It blocks access to specific programs.

B.

It blocks access to files with specific extensions.

C.

It blocks access to specific network addresses.

D.

It blocks access to specific network services.

 

Correct Answer: A

 

 

QUESTION 64

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image002

clip_image004

clip_image006

clip_image008

clip_image010

clip_image012

clip_image014

clip_image016

clip_image018

clip_image020

clip_image022

clip_image024

clip_image026

clip_image028

clip_image030

clip_image032

clip_image034

clip_image036

clip_image038

clip_image040

clip_image042

clip_image044

clip_image046

clip_image048

clip_image050

clip_image052

clip_image054

clip_image056

clip_image058

clip_image060

clip_image062

clip_image064

clip_image066

clip_image068

clip_image070

clip_image072

clip_image074

clip_image076

clip_image078

clip_image080

clip_image082

clip_image084

clip_image086

clip_image088

clip_image090

clip_image092

clip_image094

clip_image096

clip_image098

clip_image100

clip_image102

clip_image104

clip_image106

clip_image108

 

Which four tunneling protocols are enabled in the DfltGrpPolicy group policy? (Choose four)

 

A.

Clientless SSL VPN

B.

SSL VPN Client

C.

PPTP

D.

L2TP/IPsec

E.

IPsec IKEv1

F.

IPsec IKEv2

 

Correct Answer: ADEF

Explanation:

By clicking one the Configuration-> Remote Access -> Clientless CCL VPN Access-> Group Policies tab you can view the DfltGrpPolicy protocols as shown below:

 

clip_image110

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

QUESTION 65

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image112

clip_image114

clip_image116

clip_image118

clip_image120

clip_image122

clip_image124

clip_image126

clip_image128

clip_image130

clip_image132

clip_image134

clip_image136

clip_image138

clip_image140

clip_image142

clip_image144

clip_image146

clip_image148

clip_image150

clip_image152

clip_image154

clip_image156

clip_image158

clip_image160

clip_image162

clip_image164

clip_image166

clip_image168

clip_image170

clip_image172

clip_image174

clip_image176

clip_image178

clip_image180

clip_image182

clip_image184

clip_image186

clip_image188

clip_image190

clip_image192

clip_image194

clip_image196

clip_image198

clip_image200

clip_image202

clip_image204

clip_image206

clip_image208

clip_image210

clip_image212

clip_image214

clip_image216

clip_image218

 

Which user authentication method is used when users login to the Clientless SSLVPN portal using https://209.165.201.2/test?

 

A.

AAA with LOCAL database

B.

AAA with RADIUS server

C.

Certificate

D.

Both Certificate and AAA with LOCAL database

E.

Both Certificate and AAA with RADIUS server

 

Correct Answer: A

Explanation:

This can be seen from the Connection Profiles Tab of the Remote Access VPN configuration, where the alias of test is being used.

 

clip_image220

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

QUESTION 66

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image222

clip_image224

clip_image226

clip_image228

clip_image230

clip_image232

clip_image234

clip_image236

clip_image238

clip_image240

clip_image242

clip_image244

clip_image246

clip_image248

clip_image250

clip_image252

clip_image254

clip_image256

clip_image258

clip_image260

clip_image262

clip_image264

clip_image265

clip_image267

clip_image269

clip_image271

clip_image273

clip_image275

clip_image277

clip_image279

clip_image281

clip_image283

clip_image285

clip_image287

clip_image289

clip_image291

clip_image293

clip_image295

clip_image297

clip_image299

clip_image301

clip_image303

clip_image305

clip_image307

clip_image309

clip_image311

clip_image313

clip_image315

clip_image317

clip_image319

clip_image321

clip_image322

clip_image324

clip_image326

 

Which two statements regarding the ASA VPN configurations are correct? (Choose two)

 

A.

The ASA has a certificate issued by an external Certificate Authority associated to the ASDM_TrustPoint1.

B.

The DefaultWEBVPNGroup Connection Profile is using the AAA with RADIUS server method.

C.

The Inside-SRV bookmark references the https://192.168.1.2 URL.

D.

Only Clientless SSL VPN access is allowed with the Sales group policy.

E.

AnyConnect, IPSec IKEv1, and IPSec IKEv2 VPN access is enabled on the outside interface.

F.

The Inside-SRV bookmark has not been applied to the Sales group policy.

 

Correct Answer: BC

Explanation:

For B:

clip_image328

 

For C, Navigate to the Bookmarks tab:

clip_image330

 

Then hit “edit” and you will see this:

clip_image332

 

Not A, as this is listed under the Identity Certificates, not the CA certificates:

clip_image334

 

Note E:

clip_image336

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

QUESTION 67

Scenario

In this simulation, you have access to ASDM only. Review the various ASA configurations using ASDM then answer the five multiple choice questions about the ASA SSLVPN configurations.

 

To access ASDM, click the ASA icon in the topology diagram.

 

Note: Not all ASDM functionalities are enabled in this simulation.

 

To see all the menu options available on the left navigation pane, you may also need to un-expand the expanded menu first.

 

clip_image338

clip_image340

clip_image342

clip_image344

clip_image346

clip_image348

clip_image350

clip_image352

clip_image354

clip_image356

clip_image358

clip_image360

clip_image362

clip_image364

clip_image366

clip_image368

clip_image370

clip_image372

clip_image374

clip_image376

clip_image378

clip_image380

clip_image382

clip_image384

clip_image386

clip_image388


clip_image390

clip_image392

clip_image394

clip_image396

clip_image398

clip_image400

clip_image402

clip_image404

clip_image406

clip_image408

clip_image410

clip_image412

clip_image414

clip_image416

clip_image418

clip_image420

clip_image422

clip_image424

clip_image426

clip_image428

clip_image430

clip_image432

clip_image434

clip_image436

clip_image438

clip_image439

clip_image441

clip_image326[1]

 

When users login to the Clientless SSLVPN using https://209.165.201.2/test, which group policy will be applied?

 

A.

test

B.

clientless

C.

Sales

D.

DfltGrpPolicy

E.

DefaultRAGroup

F.

DefaultWEBVPNGroup

 

Correct Answer: C

Explanation:

First navigate to the Connection Profiles tab as shown below, highlight the one with the test alias:

 

clip_image443

 

Then hit the “edit” button and you can clearly see the Sales Group Policy being applied.

 

clip_image445

 

 

 

 

 

 

 

 

 

 

QUESTION 68

Scenario

Given the new additional connectivity requirements and the topology diagram, use ASDM to accomplish the required ASA configurations to meet the requirements.

 

New additional connectivity requirements:

Currently, the ASA configurations only allow on the Inside and DMZ networks to access any hosts on the Outside. Your task is to use ASDM to configure the ASA to also allow any host only on the Outside to HTTP to the DMZ server. The hosts on the Outside will need to use the 209.165.201.30 public IP address when HTTPing to the DMZ server.

Currently, hosts on the ASA higher security level interfaces are not able to ping any hosts on the lower security level interfaces. Your task in this simulation is to use ASDM to enable the ASA to dynamically allow the echo-reply responses back through the ASA.

 

Once the correct ASA configurations have been configured:

You can test the connectivity tohttp://209.165.201.30from the Outside PC browser.

You can test the pings to the Outside (www.cisco.com) by opening the inside PC command prompt window. In this simulation, only testing pings towww.cisco.comwill work.

 

To access ASDM, click the ASA icon in the topology diagram.

 

To access the Firefox Browser on the Outside PC, click the Outside PC icon in the topology diagram.

 

To access the Command prompt on the Inside PC, click the Inside PC icon in the topology diagram.

 

Note:

After you make the configuration changes in ASDM, remember to click Apply to apply the configuration changes.

 

Not all ASDM screens are enabled in this simulation, if some screen is not enabled, try to use different methods to configure the ASA to meet the requirements.

 

In this simulation, some of the ASDM screens may not look and function exactly like the real ASDM.

 

clip_image447

clip_image449

clip_image451

clip_image453

clip_image455

clip_image457

clip_image459

clip_image461

clip_image463

clip_image465

clip_image466

clip_image468

clip_image470

clip_image472

clip_image474

clip_image476

clip_image478

clip_image480

clip_image482

clip_image484

clip_image486

clip_image488

clip_image490

clip_image492

clip_image494

clip_image496

clip_image498

clip_image500

clip_image502

clip_image504

clip_image506

clip_image508

clip_image510

clip_image512

clip_image514

clip_image516

clip_image518

clip_image520

clip_image522

clip_image524

clip_image526

clip_image528

clip_i
mage530

clip_image532

clip_image534

clip_image536

clip_image538

clip_image540

clip_image542

clip_image544

clip_image546

clip_image548

clip_image550

clip_image552

clip_image554

clip_image556

clip_image558

clip_image560

clip_image562

clip_image564

clip_image566

clip_image568

 

Correct Answer:

Follow the explanation part to get answer on this sim question.

First, for the HTTP access we need to creat a NAT object. Here I called it HTTP but it can be given any name.

 

clip_image570

 

Then, create the firewall rules to allow the HTTP access:

 

clip_image572

clip_image574

 

You can verify using the outside PCto HTTP into209.165.201.30.

 

For step two, to be able to ping hosts on the outside, we edit the last service policy shown below:

 

clip_image576

 

And then check the ICMP box only as shown below, then hit Apply.

 

clip_image578

 

After that is done, we can pingwww.cisco.comagain to verify:

 

clip_image580

 

 

QUESTION 69

Which command will configure a Cisco ASA firewall to authenticate users when they enter the enable syntax using the local database with no fallback method?

 

A.

aaa authentication enable console LOCAL SERVER_GROUP

B.

aaa authentication enable console SERVER_GROUP LOCAL

C.

aaa authentication enable console local

D.

aaa authentication enable console LOCAL

 

Correct Answer: D

 

 

QUESTION 70

Which of the following statements about access lists are true? (Choose three.)

 

A.

Extended access lists should be placed as near as possible to the destination

B.

Extended access lists should be placed as near as possible to the source

C.

Standard access lists should be placed as near as possible to the destination

D.

Standard access lists should be placed as near as possible to the source

E.

Standard access lists filter on the source address

F.

Standard access lists filter on the destination address

 

Correct Answer: BCE

 

Free VCE & PDF File for Cisco 210-260 Real Exam

Instant Access to Free VCE Files: CCNA | CCNP | CCIE …
Instant Access to Free PDF Files: CCNA | CCNP | CCIE …

Comments are closed.