Online Access Free 642-648 Practice Test

Refer to the exhibit.

The "level_2" digital certificate was installed on a laptop.
What can cause an "invalid not active" status message?

• A.The CA server and laptop PC clocks are out of sync.
• B.On first use, a CA server-supplied passphrase is entered to validate the certificate.
• C.The user has not clicked the Verify button within the Cisco VPN Client.
• D.A "newly installed" digital certificate does not become active until it is validated by the peer device upon its first usage.

A network architect designed a redundant site-to-site IPsec VPN. In this site-to-site IPsec VPN solution are two standalone Cisco ASA appliances that are deployed at the headquarters office site. A site-to-site VPN tunnel is established between the remote office and online peer (192.168.4.1).
To enable the remote office devices to be advertised correctly at headquarters, select the three Cisco ASA parameters and the ends in which they should be applied. R=remote end; H=headquarters end. (Choose three)

• A.R-Configure Answer-Only
• B.H-Configure Originate-Only
• C.H-Enable RRI
• D.R-Enable RRI
• E.R-Configure Originate-Only
• F.H-Configure Answer-Only

Refer to the exhibit.

In the CLI snippet that is shown, what is the function of the deny option in the access list?

• A.When set in conjunction with connection-type originate-only, its function is to instruct the Cisco ASA to deny specific inbound traffic if it is not encrypted.
• B.When set in conjunction with connection-type originate-only, its function is to cause all IP traffic that matches the specified conditions to be protected by the crypto map.
• C.When set in conjunction with outbound connection-type answer-only, its function is to instruct the Cisco ASA to deny specific outbound traffic if it is not encrypted.
• D.When set in conjunction with outbound connection-type bidirectional, its function is to prevent the specified traffic from being protected by the crypto map entry.

An XYZ Corporation systems engineer, while making a sales call on the ABC Corporation headquarters, tried to access the XYZ sales demonstration folder to transfer a demonstration via FTP from an ABC conference room behind the firewall. The engineer could not reach XYZ through the remote-access VPN tunnel. From home the previous day, however, the engineer did connect to the XYZ sales demonstration folder and transferred the demonstration via IPsec over DSL.
To get the connection to work and transfer the demonstration, what should the engineer do?

• A.Change the MTU size on the IPsec client to account for the change from DSL to cable transmission.
• B.Enable the IPsec over TCP option on the IPsec client.
• C.Enable the clientless SSL VPN option on the PC.
• D.Enable the local LAN access option on the IPsec client.

Refer to the exhibit.

While troubleshooting on a remote-access VPN application, a new NOC engineer received the message that is shown.
What is the most likely cause of the problem?

• A.The IP address pool for contractors was not applied to their connection profile.
• B.The IP address that is assigned to the PC of the VPN user is in the wrong subnet. The remote user needs to select a different host number within the correct subnet.
• C.The IP address that is assigned to the PC of the VPN user is not within the range of addresses that are assigned to the SVC connection.
• D.The IP address that is assigned to the PC of the VPN user is in use. The remote user needs to select a different host address within the range.