SChapter 8

1.

1 point

Which three ports must be open to verify that an IPsec VPN tunnel is operating properly? (Choose three.)

169

500

50

51

168

501

2.

1 point

Which two statements accurately describe characteristics of IPsec? (Choose two.)

IPsec is a framework of standards developed by Cisco that relies on OSI algorithms.

IPsec is a framework of proprietary standards that depend on Cisco specific algorithms.

IPsec works at the transport layer and protects data at the network layer.

IPsec works at the application layer and protects all application data.

IPsec works at the network layer and operates over all Layer 2 protocols.

IPsec is a framework of open standards that relies on existing algorithms.

3.

1 point

Refer to the exhibit. How will traffic that does not match that defined by access list 101 be treated by the router?

It will be sent encrypted.

It will be discarded.

It will be sent unencrypted.

It will be blocked.

4.

1 point

Which statement describes the effect of key length in deterring an attacker from hacking through an encryption key?

The length of a key does not affect the degree of security.

The length of a key will not vary between encryption algorithms.

The shorter the key, the harder it is to break.

The longer the key, the more key possibilities exist.

5.

1 point

Consider the following configuration on a Cisco ASA:
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

What is the purpose of this command?

to define only the allowed encryption algorithms

to define what traffic is allowed through and protected by the tunnel

to define the ISAKMP parameters that are used to establish the tunnel

to define the encryption and integrity algorithms that are used to build the IPsec tunnel

6.

1 point

What is the purpose of configuring multiple crypto ACLs when building a VPN connection between remote sites?

Multiple crypto ACLs can be configured to deny specific network traffic from crossing a VPN.

Multiple crypto ACLs can define multiple remote peers for connecting with a VPN-enabled router across the Internet or network.

When multiple combinations of IPsec protection are being chosen, multiple crypto ACLs can define different traffic types.

By applying the ACL on a public interface, multiple crypto ACLs can be built to prevent public users from connecting to the VPN-enabled router.

7.

1 point

Which transform set provides the best protection?

crypto ipsec transform-set ESP-DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-SHA esp-aes esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-SHA esp-aes-256 esp-sha-hmac

8.

1 point

What three protocols must be permitted through the company firewall for establishment of IPsec site-to-site VPNs? (Choose three.)

ISAKMP

NTP

AH

HTTPS

ESP

SSH

9.

1 point

In which situation would the Cisco Discovery Protocol be disabled?

when a Cisco VoIP phone attaches to a Cisco switch

only during Pwhen a Cisco switch connects to a Cisco router hase 1

when a Cisco switch connects to another Cisco switch

when a PC with Cisco IP Communicator installed connects to a Cisco switch

10.

1 point

When is a security association (SA) created if an IPsec VPN tunnel is used to connect between two sites?

after the tunnel is created, but before traffic is sent

only during Phase 1

only during Phase 2

during both Phase 1 and 2