642-648 試験問題を無料オンラインアクセス

After adding a remote-access IPsec tunnel via the VPN wizard, an administrator needs to tune the IPsec policy parameters. Where is the correct place to tune the IPsec policy parameters in Cisco ASDM?

• A.IPsec Policy
• B.Group Policy
• C.IKE Policy
• D.IPsec user profile
• E.Crypto Map

Which option limits a clientless SSL VPN user to specific resources upon successful login?

• A.modify the Cisco ASA Modular Policy Framework access control
• B.RADIUS authorization
• C.user-defined bookmarks
• D.disable portal features

Refer to the exhibit.

In the CLI snippet that is shown, what is the function of the deny option in the access list?

• A.When set in conjunction with outbound connection-type answer-only, its function is to instruct the Cisco ASA to deny specific outbound traffic if it is not encrypted.
• B.When set in conjunction with connection-type originate-only, its function is to cause all IP traffic that matches the specified conditions to be protected by the crypto map.
• C.When set in conjunction with connection-type originate-only, its function is to instruct the Cisco ASA to deny specific inbound traffic if it is not encrypted.
• D.When set in conjunction with outbound connection-type bidirectional, its function is to prevent the specified traffic from being protected by the crypto map entry.

Upon receiving a digital certificate, what are three steps that a Cisco ASA performs to authenticate the digital certificate? (Choose three.)

• A.The identity certificate validity period is verified against the system clock of the Cisco ASA.
• B.The identity certificate thumbprint is validated using the private key of the stored CA.
• C.The identity certificate signature is validated by using the stored root certificate.
• D.If enabled, the Cisco ASA locates the CRL and validates the identity certificate.
• E.The signature is validated by using the stored identity certificate.

Refer to the exhibit.

The "level_2" digital certificate was installed on a laptop.
What can cause an "invalid not active" status message?

• A.A "newly installed" digital certificate does not become active until it is validated by the peer device upon its first usage.
• B.The CA server and laptop PC clocks are out of sync.
• C.The user has not clicked the Verify button within the Cisco VPN Client.
• D.On first use, a CA server-supplied passphrase is entered to validate the certificate.