Latest CCNP Security 642-627 Real Exam Download 11-20



Which statement about inline VLAN pair deployment with the Cisco IPS 4200 Series appliance is true?


A.      The sensing interface acts as an 802.1q trunk port, and the Cisco IPS appliance performs VLAN translation between pairs of VLANs.

B.      The Cisco IPS appliance connects to two physically distinct switches using two paired physical interfaces.

C.      Two sensing interfaces connect to the same switch that forwards traffic between two VLANs.

D.      The pair of sensing interfaces can be selectively divided (virtualized) into multiple logical “wires” by VLANs that can be analyzed separately


Answer: A




Which four statements about Cisco IPS appliance anomaly detection histograms are true? (Choose four.)


A.      Histograms are learned or configured manually.

B.      Destination IP address row is the same for all histograms.

C.      Source IP address row can be learned or configured.

D.      Anomaly detection only builds a single histogram for all services in a zone.

E.       You can enable a separate histogram and scanner threshold for specific services, or use the default one for all other services

F.       Anomaly detection histograms only track source (attacker) IP addresses.


Answer: A,B,C,E




You are working with Cisco TAC to troubleshoot a software problem on the Cisco IPS appliance. TAC suspects a fault with the NotificationApp software module in the Cisco IPS appliance. In this case, which Cisco IPS appliance operations may be most affected by the NotificationApp software

module fault?


A          SNMP

B          IDM or IME

C          global correlation

D          remote blocking

E           anomaly detection

F           SDEE


Answer: A




Which two switching-based mechanisms are used to deploy high availability IPS using multiple Cisco IPS appliances? (Choose two.)


A.      Spanning Tree-based HA

B.      HSRP-basedHA

C.      EtherChannel-based HA

D.      VRRP-basedHA


Answer: A,C




Which statement about the 4-port GigabitEthernet card with hardware bypass is true?


A.      Hardware bypass only works with inline interface pairs.

B.      Hardware bypass is only supported on the Cisco IPS 4270 appliance.

C.      Hardware bypass is independent from software bypass.

D.      Hardware bypass is enabled if software bypass is configured to “OFF”.

E.       Hardware bypass is supported between any of the four GigabitEthernet ports


Answer: A










What is the correct regular expression to match a URI request equal to /test.exe?


A.      /test.exe

B.      Vtest.exe

C.      /test.exe

D.      */test.exe

E.       */test.exe

F.       */test.exe


Answer: C




Which four types of interface modes are available on the Cisco IPS 4200 Series appliance? (Choose four.)


A.      promiscuous

B.      inline TAP

C.      inline interface

D.      inline VLAN pair

E.       VLAN groups

F.       bypass


Answer: A,C,D,E




Which option is best to use to capture only a subset of traffic (capturing traffic per-IP-address, per-protocol, or per-application) off the switch backplane and copy it to the Cisco IPS appliance?


A.      SPAN

B.      PBR

C.      VACL

D.      MPF

E.       STP


Answer: C




Refer to the exhibit. Which statement is true?


A.      A summary alert is sent once during each interval for each unique Summary Key entry.

B.      An alert is generated each time the signature triggers.

C.      This signature does not fire until three events are seen during 60 seconds with the same attacker and victim IP addresses and ports

D.      This signature is disabled by default.

E.       When this signature triggers, the Cisco IPS appliance sends an SNMP trap for this event.


Answer: C


Download Latest CCNP 642-627 Real Free Tests , help you to pass exam 100%.


Leave a Reply