Cisco Exactexams 642-737 Questions & Answers · Cisco Exactexams 642-737 Questions & Answers Number...

Cisco Exactexams 642-737 Questions & Answers

Number: 642-737Passing Score: 800Time Limit: 120 minFile Version: 23.4

http://www.gratisexam.com/

Cisco 642-737 Questions & Answers

Exam Name: Implementing Advanced Cisco Unified Wireless Security (IAUWS) v2.0

For Full Set of Questions please visit: http://www.actualtests.com/exam-642-737.htm

Actualtests

QUESTION 1Which statement describes the major difference between PEAP and EAP-FAST client authentication?

A. EAP-FAST requires a backend AAA server, and PEAP does not.B. EAP-FAST is a Cisco-only proprietary protocol, whereas PEAP is an industry-standard protocol.C. PEAP requires a server-side certificate, while EAP-FAST does not require certificates.D. PEAP authentication protocol requires a client certificate, and EAP-FAST requires a secure password.

Correct Answer: CSection: (none)Explanation

Explanation/Reference:Explanation:

QUESTION 2What are the four packet types that are used by EAP? (Choose four.)

A. EAP TypeB. EAP RequestC. EAP IdentityD. EAP ResponseE. EAP SuccessF. EAP FailureG. EAP Authentication

Correct Answer: BDEFSection: (none)Explanation


QUESTION 3When a supplicant and AAA server are configured to use PEAP, which mechanism is used by the client toauthenticate the AAA server in Phase One?

A. PMKB. shared secret keysC. digital certificateD. PAC



QUESTION 4What are two of the benefits that the Cisco AnyConnect v3.0 provides to the administrator for client WLANsecurity configuration? (Choose two.)

A. Provides a reporting mechanism for rouge APsB. Prevents a user from adding any WLANsC. Hides the complexity of 802.1X and EAP configurationD. Supports centralized or distributed client architecturesE. Provides concurrent wired and wireless connectivityF. Allows users to modify but not delete admin-created profiles

Correct Answer: CDSection: (none)Explanation


QUESTION 5When using the Standalone Profile Editor in the Cisco AnyConnect v3.0 to create a new NAM profile, which twostatements describe the profile becoming active? (Choose two.)

A. selects the new profile from NAMB. selects "Network Repair" from NAMC. becomes active after a save of the profile nameD. ensures use of "configuration.xml" as the profile nameE. ensures use of "config.xml" as the profile nameF. ensures use of "nam.xml" as the profile name

Correct Answer: BDSection: (none)Explanation


QUESTION 6Which three parameters can be communicated between a Cisco WLC v7.0 and Cisco Compatible Extensionsv4-enabled client to improve a secure roaming connection? (Choose three.)


A. minimum SNRB. transition timeC. scan thresholdD. hysteresisE. PERF. MIC errors

Correct Answer: BCDSection: (none)Explanation


QUESTION 7Employees are allowed to start bringing their own wireless devices to work for use on the 802.11a/b/g/n WLANwhen using their existing credentials. However, they are experiencing issues. Which two items are the mostprobable cause of these issues? (Choose two.)

A. incorrect IP addressB. supplicant or driverC. incorrect user nameD. wrong wireless bandE. application issues

Correct Answer: BESection: (none)Explanation


QUESTION 8Wireless NAC single sign-on uses which type of RADIUS records to notify the Cisco NAC Appliance Managerabout the authenticated wireless clients?

A. accounting recordsB. authentication recordsC. authentication and accounting recordsD. preauthentication records

Correct Answer: ASection: (none)Explanation

Explanation/Reference:

QUESTION 9When configuring the WLC for single sign-on for the NAC, which device is used for the RADIUS accounting IPaddress?

A. Cisco NAC Appliance ManagerB. Cisco NAC Appliance ServerC. Cisco NAC Guest ServerD. Cisco ACSE. Cisco WCS



QUESTION 10Which option verifies that a wireless client has authenticated to a WLAN when performing NAC using the CiscoNAC Appliance Manager and Server?

A. Cisco CAM OOB Management > Devices > Discovered ClientsB. Cisco CAS OOB Management > Devices > Discovered ClientsC. Cisco CAM Monitor > View Online UsersD. Cisco CAS Monitor > View Online Users



QUESTION 11

Which attribute on the Cisco WLC v7.0 does RADIUS IETF attribute "Tunnel-Private-Group ID" assign?

A. ACLB. DSCPC. QoSD. VLAN

Correct Answer: DSection: (none)Explanation


QUESTION 12The Cisco WLC v7.0 is configured for external authentication of the management access to the WLC itselfusing the Cisco Secure ACS v4.2. The management user is limited to read access for all menu options exceptfor full read/write access to the WLAN menu options.

Which two items are required in the Cisco Secure ACS network configuration to enable correct AAA? (Choosetwo.)

A. AP IP addressB. WLC virtual IP addressC. WLC management IP addressD. WLC AP management IP addressE. hostname matching the WLC case-sensitive nameF. authentication using RADIUSG. authentication using TACACS+

Correct Answer: CGSection: (none)Explanation


Explanation:

QUESTION 13Configuring the Cisco Secure ACS with a self-signed certificate supports which requirement?

A. when no user certificate is requiredB. when a CA-signed certificate is required for the userC. when a self-signed certificate Class 4 is required for the userD. when a self-signed certificate Class 0 is required for the user



QUESTION 14Which two statements about the sponsor accounts on the Cisco NAC Guest Server are true? (Choose two.)

A. The sponsor login to the Cisco NAC Guest Server is at https://NGS-IP-Address/admin to create, view, andedit guest accounts.

B. The Cisco NAC Guest Server can authenticate the sponsors using the local database or via MicrosoftActive Directory or LDAP or RADIUS servers.

C. Sponsoring user groups is the method by which to assign permissions to the sponsors.D. Guest roles provide a way to give different levels of access to different sponsor accounts.E. Sponsor accounts require admin privileges to generate reports.

Correct Answer: BCSection: (none)Explanation


QUESTION 15Which two statements are true about configuring a wired guest LAN feature? (Choose two.)

A. Create a WLAN on the anchor controller onlyB. Select the management interface as the egress interface to reach the anchor controllerC. Require an anchor controller to implementD. Select the interface that you created as the guest LAN interface in the ingress interface menuE. Configure on any controller from version 5.2 forward



QUESTION 16Which statement correctly describes the relationship between the foreign and anchor controllers when used forguest access?

A. The foreign controller will load balance in round-robin fashion starting with the highest IP address anchorcontroller to the lowest IP address anchor controller.

B. The foreign controller will load balance in round-robin fashion starting with the lowest IP address anchorcontroller to the highest IP address anchor controller.

C. The foreign controller will load balance in round-robin fashion starting with the highest MAC "Pass AnyExam. Any Time." - www.actualtests.com 17 Cisco 642-737 Examaddress anchor controller to the lowest MAC address anchor controller.

D. The foreign controller will load balance in round-robin fashion starting with the lowest MAC address anchorcontroller to the highest MAC address anchor controller.

Correct Answer: BSection: (none)Explanation


QUESTION 17Which two firewall ports must be opened for the anchor controller to operate properly with a foreign controllerfor guest access? (Choose two.)

A. ports 16666 and 16667 for controller trafficB. port 97 for EoIP trafficC. port 80 for HTTP trafficD. port 69 for TFTP traffic

Correct Answer: ABSection: (none)Explanation


QUESTION 18Which one of the options is responsible for multiple requirements for account data protection such as withcredit cards?

A. ISOB. IEEEC. IETFD. Wi-Fi AllianceE. PCIF. HIPAAG. GLBA

Correct Answer: ESection: (none)Explanation


QUESTION 19A Cisco WLC v7.0 has been only initially configured through the console setup CLI wizard. A new AP has justfinished association with the controller. What is the default mode of remote access to the AP?

A. HTTPSB. HTTPC. SSHD. TelnetE. access is disabled



QUESTION 20Which two tools help to provide PCI compliance reports? (Choose two.)

A. WLCB. WCSC. MSED. Ekahau Site SurveyE. AirMagnet WiFi Analyzer

Correct Answer: BESection: (none)Explanation


QUESTION 21The Cisco Unified Wireless Network solution, which is based on version 7.0, provides which three wired-sidetracing techniques? (Choose three.)

A. switch port tracingB. adaptive wIPSC. RLDPD. autocontainmentE. rogue detectorF. H-REAP

Correct Answer: ACESection: (none)Explanation


QUESTION 22Refer to the exhibit.

What is the effect of setting Client Exclusion to Enabled and set to a Timeout Value of 0 seconds in a CiscoWLC v7.0?

A. Excluded clients must be manually removed from the excluded list.B. Client exclusion will not occur.C. Client exclusion timeout will be determined by the IDS module.D. Clients will only be disconnected and not excluded.



"Pass Any Exam. Any Time." - www.actualtests.com 21 Cisco 642-737 Exam

QUESTION 23The NetStumbler tool is an example of which wireless attack type?

A. denial of serviceB. information gatheringC. hijackingD. eavesdropping

Correct Answer: BSection: (none)

Explanation


QUESTION 24Which device performs the definition of rules and requirements for posture assessment of a wireless clientwhen implementing a NAC appliance solution?

A. Cisco NAC Guest ServerB. Cisco Secure Access Control SystemC. Cisco 802.1X supplicantD. Cisco NAC Appliance AgentE. Cisco NAC Appliance ManagerF. Cisco NAC Appliance ServerG. Cisco IPS Appliance



QUESTION 25Which two firewall protocol port(s) need open access for secure management access to an anchorWLC for guest access? (Choose two.)

A. TCP 22B. TCP 23C. TCP 80D. TCP 8080E. TCP 443F. UDP 123

Correct Answer: AESection: (none)Explanation


QUESTION 26An IPS appliance is being integrated into the Cisco Unified Wireless Network solution in promiscuous mode.Which two parameters are required when configuring a Cisco WLC v7.0 for the addition of the IPS applianceservices? (Choose two.)

A. WLAN > AAA Override is enabledB. WLAN > P2P Blocking is enabledC. WLAN > Client Exclusion is enabledD. WLAN > NAC State is enabledE. Security > RADIUS accounting IP addressF. Security > Sensors IP address

Correct Answer: CFSection: (none)Explanation


QUESTION 27A wireless client has finished 802.1X and EAP using WPA2 with a controller-based AP network using a centralAAA server. How is unicast encryption implemented on the client?

A. The client uses the PMK that is sent from the AAA server that is derived from EAP authentication.B. The client uses the PTK that is sent from the WLC, which was derived from the PMK that is sent from the

AAA server.C. The client uses the PTK that is derived from EAP authentication.D. The client uses the PMK that is derived from a four-way handshake with the AP.E. The client uses the PTK that is derived from a four-way handshake with the AP.



QUESTION 28What does the Cisco WLC v7.0 use to encrypt broadcast and multicast frames that are sent to a wirelessclient?

A. PMKB. GTKC. PTKD. OKCE. PSK



QUESTION 29Many employees are bringing their own devices to work such as those running Apple iOS for iPhones andiPads. Which three statements correctly describe authentication for these devices? (Choose three.)

A. supports only broadcast networksB. supports broadcast and hidden networksC. supports only pre-shared key (pass phrase)D. supports most EAP types such as EAP-FAST, EAP-TLS, and PEAPE. supports WPA onlyF. supports WEP, WPA, and WPA2

Correct Answer: BDFSection: (none)

Explanation


QUESTION 30Which two statements describe the use of NAM by the Cisco AnyConnect v3.0? (Choose two.)

A. removes Cisco Secure Services Client v5.X but retains the configuration for NAMB. removes Cisco Secure Services Client v5.X software and configuration for a clean installC. installs on Windows, Mac, and LinuxD. installs on Windows onlyE. requires a licenseF. requires a profile editor to allow a user to add WLANs

Correct Answer: ADSection: (none)Explanation


QUESTION 31Which two fast roaming algorithms will allow a WLAN client to roam to a new AP and re-establish a newsession key without a full reauthentication of the WLAN client? (Choose two.)

A. PMKB. PTKC. MICD. GTKE. CKMF. PKC

Correct Answer: EFSection: (none)Explanation


QUESTION 32Employees are allowed to starting bringing their own laptops to work. Which option can help provide a temporaluser device vulnerability check when using the Java applet or ActiveX?

A. Cisco NAC ServerB. Cisco NAC Guest ServerC. Cisco NAC ManagerD. Cisco NAC Windows AgentE. Cisco NAC Web AgentF. Cisco ACS



QUESTION 33When deploying wireless Cisco NAC OOB operations, which device signals the WLC to switch a user from aquarantine VLAN to an access VLAN?

A. Cisco NAC Appliance ManagerB. Cisco NAC Appliance ServerC. Cisco NAC Guest ServerD. Cisco ACSE. Cisco WCS



QUESTION 34For wireless NAC out-of-band operations, which protocol is used between the Cisco NACAppliance Manager and the wireless controller to switch the wireless client from the quarantine VLAN to theaccess VLAN after the client has passed the NAC authentication and posture assessment process?

A. RADIUSB. TACACS+C. SNMPD. SSLE. EAP



QUESTION 35Which option verifies that a wireless client has associated but is not yet authenticated to a WLAN whenperforming NAC using the Cisco NAC Appliance Manager and Server?

A. Cisco CAM OOB Management > Devices > Discovered ClientsB. Cisco CAS OOB Management > Devices > Discovered ClientsC. Cisco CAM Monitor > View Online UsersD. Cisco CAS Monitor > View Online Users



QUESTION 36Which two statements best describe the local authentication configuration options for a H-REAP using H-REAPgroups in the Cisco WLC v7.0? (Choose two.)

A. LEAP and EAP-FAST onlyB. LEAP, EAP-FAST, EAP-PEAP, and EAP-TLS onlyC. LEAP, EAP-FAST, EAP-PEAP, EAP-TLS, and EAP-MD5D. EAP-FAST with PAC provision onlyE. EAP-FAST with PAC or certificate provision

Correct Answer: ADSection: (none)Explanation


QUESTION 37Cisco Client MFP is supported on which modes of LWAPP and CAPWAP APs?

A. Local, H-REAP, and BridgeB. Local, H-REAP, and MonitorC. Local, H-REAP, and Rogue DetectorD. Sniffer, H-REAP, and Bridge



QUESTION 38Which answer best describes the implementation of IBN using the Cisco WLC v7.0 and Cisco Secure ACSv4.2?

A. Configure the ACS for AAA override and attributes. Configure the WLC for RADIUS server.B. Configure the ACS for AAA override and attributes. Configure the WLC for RADIUS server and attributes.C. Configure the ACS for attributes. Configure the WLC for RADIUS server and AAA override.D. Configure the ACS for attributes. Configure the WLC for RADIUS server, AAA override, and attributes.



QUESTION 39When using a controller-based AP network, which type of entry is configured in the Cisco Secure ACS?

A. AAA client using the AP IP addressB. AAA server using the AP IP addressC. AAA client using the WLC IP addressD. AAA server using the WLC IP address



QUESTION 40Which two entries can be used in the Cisco Secure ACS AAA network configuration setup for IP address192.168.1.1 to provide RADIUS authentication for the network node? (Choose two.)

A. 192.168.1.1-10B. 192.168.1.0C. 192.168.1.0 0.0.0.255D. 192.168.1.255E. 192.168.1.*

Correct Answer: AESection: (none)Explanation


QUESTION 41Which two EAP type(s) require a client certificate? (Choose two.)

A. LEAPB. PEAPC. EAP-FASTD. EAP-TLSE. EAP-MD5

Correct Answer: CDSection: (none)Explanation


QUESTION 42What is the maximum number of ACLs that can be applied to a Cisco WLC v7.0 interface?

A. 1B. 16C. 32D. 64



QUESTION 43"Pass Any Exam. Any Time." - www.actualtests.com 37 Cisco 642-737 ExamRefer to the exhibit.

Why is the client failing to authenticate with the AAA server?

A. excessive number of authentication attempts for usernameB. incorrect read/write credentials for usernameC. incorrect IP address being sent by clientD. incorrect authentication for username



QUESTION 44Which statement about the Cisco NAC Guest Server that is deployed in wireless guest access implementationsis true?

A. The Cisco NAC Guest Server integrates with the Cisco WCS through the RADIUS protocol.B. The Cisco NAC Guest Server can be used in place of Cisco WCS Lobby Ambassador functionality for guest

provisioning and reporting. The Cisco WCS is still needed for WLAN management.

C. The Cisco WLC acts as the guest accounts provisioning portal, and the Cisco NAC Guest Server acts asthe captive portal capturing web requests from preassigned "guest ports" and requesting authentication.

D. Guest accounts on the Cisco NAC Guest Server can be created using the Cisco WCS Lobby Ambassadorfeature.



QUESTION 45What is the default authentication protocol that is used for web authentication?

A. MD5-CHAPB. CHAPC. PAPD. LEAP



QUESTION 46How many tunnels can a Cisco WLC v7.0 anchor?

A. 63B. 64C. 71D. 72E. 253F. 254



QUESTION 47What does the eping mobility_peer_IP_address command do?

A. It tests EoIP connectivity via port 97 though the management interface.B. It tests EoIP connectivity via port 97 though the AP manager interface.C. It tests UDP connectivity via port 16666 through the management interface.D. It tests UDP connectivity via port 16666 through the AP manager interface.



QUESTION 48Which one of the options is related to U.S. Federal Trade Commission safeguard rules for financial institutionsto protect customer information?

A. ISOB. IEEEC. IETFD. Wi-Fi AllianceE. PCIF. HIPAAG. GLBA

Correct Answer: GSection: (none)Explanation


QUESTION 49A network administrator is assigning a one-to-one association for VLAN to wireless WLAN or SSID. Given theimplementation of a Cisco 2500 Series controller using v7.0, how many WLANs can be created?

A. 8B. 16C. 32D. 64E. 128F. 254G. 512



QUESTION 50Given a proper configuration of the Cisco WLC v7.0, what is the default username, password, and enablepassword to remotely access an associated AP?

A. admin, admin, and CiscoB. admin, cisco, and CiscoC. none, cisco, and CiscoD. none, Cisco, and CiscoE. Cisco, Cisco, and CiscoF. lightweight APs do not allow remote access

Correct Answer: E

Section: (none)Explanation


QUESTION 51Refer to the exhibit.

"Pass Any Exam. Any Time." - www.actualtests.com 44 Cisco 642-737 ExamA WLAN with the SSID "Enterprise" is configured. Which rogue will be marked as malicious?

A. a rogue with no clients, broadcasting the SSID "Enterprise" heard at -50dBmB. a rogue with two clients, broadcasting the SSID "Employee" heard at -50dBmC. a rogue with two clients, broadcasting the SSID "Enterprise" heard at -50dBmD. a rouge with two clients, broadcasting the SSID "Enterprise" heard at -80dBm



QUESTION 52Which two situations permit the Cisco WCS v7.0 to successfully trace a rogue to a switch port? (Choose two.)

A. The rogue is broadcasting an infrastructure SSID.B. The rogue has a client that is associated.C. The wired MAC address of the rogue is equal to or +1/-1 of the wireless MAC address of the rogue.D. The rogue is on the same switch as a CAPWAP AP.E. The rogue has been identified using RLDP.

Correct Answer: BCSection: (none)Explanation


QUESTION 53Which two attacks represent a social engineering attack? (Choose two.)

A. using AirMagnet Wi-Fi Analyzer to search for hidden SSIDsB. calling the IT helpdesk and asking for network informationC. spoofing the MAC address of an employee deviceD. entering a business and posing as IT support staff



QUESTION 54Which type of attack is a result of a WLAN being overwhelmed by 802.1X authentication requests?

A. NetStumbler attackB. EAPOL flood signatureC. management flood signaturesD. broadcast deauthentication frame signaturesE. NULL probe response signatures



QUESTION 55Which device performs the enforcement of posture assessment for a wireless client when implementing a NACappliance solution?

A. Cisco NAC Guest ServerB. Cisco Secure Access Control SystemC. Cisco 802.1X supplicantD. Cisco NAC Appliance AgentE. Cisco NAC Appliance ManagerF. Cisco NAC Appliance ServerG. Cisco IPS Appliance

Correct Answer: FSection: (none)Explanation


Explanation:

QUESTION 56Which device provides IDS and IPS protection in a Cisco Unified Wireless Network against wireless clients withviruses and worms?

A. Cisco NAC Guest ServerB. Cisco Secure Access Control SystemC. Cisco WLCD. Cisco WCSE. Cisco NAC Appliance ManagerF. Cisco NAC Appliance ServerG. Cisco IPS Appliance

Correct Answer: GSection: (none)Explanation


QUESTION 57Which protocol port(s) need open access for communication between the MSE and WLC?

A. UDP 16666 and 16667B. UDP 5247 and 5264C. UDP 161 and 162D. UDP 16113E. TCP 16113



QUESTION 58Which protocol port needs open access for the Cisco WLC v7.0 using an external AAA server for checkingadministrative privileges for menu access?

A. UDP 1812B. UDP 1813C. UDP 1645D. UDP 1646E. TCP 49F. TCP 443



QUESTION 59When deploying wIPS, which protocol is used to communicate between the Cisco WLC v7.0 and the MSE?

A. SNMPB. HTTPSC. CAPWAPD. SOAP and XMLE. NMSP



QUESTION 60DRAG DROP

A.B.C.D.

Correct Answer: Section: (none)Explanation


Explanation:


"Pass Any Exam. Any Time." - www.actualtests.com 49 Cisco 642-737 Exam

A.B.C.D.



Explanation:


A.B.C.D.



Explanation:


A.B.C.D.



Explanation:


A.B.C.D.



Explanation:

Cisco Exactexams 642-737 Questions & Answers · Cisco Exactexams 642-737 Questions & Answers Number...

Documents

Transcript of Cisco Exactexams 642-737 Questions & Answers · Cisco Exactexams 642-737 Questions & Answers Number...