While we can’t provide 642-825 audio exams, you will find that each 642-825 study guide is a veritable 642-825 boot camp waiting to explode in your mind, bringing you the 642-825 exams questions and answers at a pace you can work with. Learn at your own pace and develop your very own 642-825 simulations knowing that all of the 642-825 test questions are real, and the 642-825 practice exam questions are 100% accurate. No other Cisco 642-825 course can provide the results ActualCerts does and has for thousands of professionals world wide.

With each Cisco 642-825 test, you also get unlimited access to all of our other PDF downloads for all the other vendors’ exams. This is lifetime unlimited access, including future exams not yet released, as well as their updates. You are buying more than the 642-825 dumps of your dreams. And these are more than mere Cisco 642-825 brain dumps! Each and every 642-825 exam is a complete work of art guaranteeing you test success. If you fail to pass, at your request we will refund your money and cancel your account. We are committed to your 642-825 course and your 642-825 certification.
http://www.sendspace.com/file/uinud2
http://uploading.com/files/cfd7fce2/free%2BPassGuide%2Bccnp%2B642-825%2BV3.31.zip/
http://www.2shared.com/file/10128271/d2ba58fe/free_PassGuide_ccnp_642-825_V3.html

http://www.4shared.com/file/177826820/83213e2f/free_PassGuide_ccnp_642-825_V3.html
http://rapidshare.com/files/323787081/free_PassGuide_ccnp_642-825_V3.31.zip.html

http://www.4shared.com/file/177826820/83213e2f/free_PassGuide_ccnp_642-825_V3.html

The Cisco certificates give you possibility to work in any country of the world because they are acknowledged in all countries equally. This 642-825 torrent certificate helps not only to improve your knowledge and skills, but it also helps your career, gives a possibility for qualified usage of 642-825 exams products under different conditions. The majority of companies in the sphere of information technologies require the presence of Cisco exam for the work in the company, and that makes obtaining this Cisco certificate necessary. Many IT specialists were not able to obtain the Cisco certificate from the first attempt, which was the result of poor preparation for the examination, using preparatory 642-825 study guide of poor quality.
642-825 Braindumps with Complete Answers, Purchase now!!!

Free Sample Printable PDF VCE Download: Click Me Free download:
The Cisco Certification leader among the providers of Cisco Braindumps preparatory materials is 642-825 products such as Cisco Braindumps, 642-825 Study Guides, 642-825 Tutorial, 642-825 pdf Exam Questions with Answers, 642-825 Trainings, 642-825 Online Course and free PDF. It obtained its leadership and trust of the users from the very beginning of its work on the 642-825 vce training materials market. All the 642-825 Cisco aids have been created by people who are personally familiar with 642-825 exams and who know all the difficulties and popular mistakes made by those who take a Cisco test. The entire material is logically composed in such a way that everything becomes easy to understand for anyone. Many Cisco 642-825 Braindumps guides include audio and video material. It is really easy to acquire 642-825 Cisco exams becausy of great variety of methods of payment.

Search Help For Free 642-825 dumps
Pass4sure p4s 642-825 Torrent
testking tk 642-825 test Questons and Answers(Q & As with Expert Explanations)
actualtest 642-825 real exams

Exam Number: 642-825
Associated Certifications: CCNP
Duration: 90 minutes
Available Languages: English
Click Here to Register: Pearson VUE
Exam Policies: Read current policies and requirements
Exam Tutorial: Review type of exam questions

Exam Description Exam Topics Recommended Training Additional Resources
Exam Description
The Implementing Secure Converged Wide Area Networks (ISCW 642-825) is a qualifying exam for the Cisco Certified Network Professional CCNP®. The ISCW 642-825 exam will certify that the successful candidate has important knowledge and skills necessary to secure and expand the reach of an enterprise network to teleworkers and remote sites with focus on securing remote access and VPN client configuration. The exam covers topics on Cisco hierarchical network model as it pertains to the WAN, teleworker configuration and access, frame mode MPLS, site-to-site IPSEC VPN, Cisco EZVPN, strategies used to mitigate network attacks, Cisco device hardening and IOS firewall features.

Exam Topics
The following information provides general guidelines for the content likely to be included on the exam. However, other related topics may also appear on any specific delivery of the exam. In order to better reflect the contents of the exam and for clarity purposes the guidelines below may change at any time without notice.

Implement basic teleworker services.
Describe Cable (HFC) technologies.
Describe xDSL technologies.
Configure ADSL (i.e., PPPoE or PPPoA).
Verify basic teleworker configurations.

Implement Frame-Mode MPLS.
Describe the components and operation of Frame-Mode MPLS (e.g., packet-based MPLS VPNs).
Configure and verify Frame-Mode MPLS.

Implement a site-to-site IPSec VPN
Describe the components and operations of IPSec VPNs and GRE Tunnels.
Configure a site-to-site IPSec VPN/GRE Tunnel with SDM (i.e., preshared key).
Verify IPSec/GRE Tunnel configurations (i.e., IOS CLI configurations).
Describe, configure, and verify VPN backup interfaces.
Describe and configure Cisco Easy VPN solutions using SDM.

Describe network security strategies.
Describe and mitigate common network attacks (i.e., Reconnaissance, Access, and Denial of Service).
Describe and mitigate Worm, Virus, and Trojan Horse attacks.
Describe and mitigate application-layer attacks (e.g., management protocols).

Implement Cisco Device Hardening
Describe, Configure, and verify AutoSecure/One-Step Lockdown implementations (i.e., CLI and SDM).
Describe, configure, and verify AAA for Cisco Routers.
Describe and configure threat and attack mitigation using ACLs.
Describe and configure IOS secure management features (e.g., SSH, SNMP, SYSLOG, NTP, Role-Based CLI, etc.)

Implement Cisco IOS firewall.
Describe the functions and operations of Cisco IOS Firewall (e.g., Stateful Firewall, CBAC, etc.).
Configure Cisco IOS Firewall with SDM.
Verify Cisco IOS Firewall configurations (i.e., IOS CLI configurations, SDM Monitor).

Describe and configure Cisco IOS IPS.
Describe the functions and operations of IDS and IPS systems (e.g., IDS/IPS signatures, IPS Alarms, etc.)
Configure Cisco IOS IPS using SDM.

CISCO ccnp 642-825 Pass4sure
CISCO ccnp 642-825 Pdf
CISCO ccnp 642-825 Study Guide
CISCO ccnp 642-825 Exam
CISCO ccnp 642-825 Torrent
CISCO ccnp 642-825 Braindumps
CISCO ccnp 642-825 Actual Tests
CISCO ccnp 642-825 Real Exams
CISCO ccnp 642-825 Exams
CISCO ccnp 642-825 P4S
cisco ccnp 642-825 testking

642-825 Practice engine

642-825 question and answers

ISCW – Implementing Secure Converged Wide Area Networks
Exam Number: 642-825 Exam
Associated Certifications: ISCW – Implementing Secure Converged Wide Area Networks
Duration: 310 Q&As
Available Language(s): English
Exam Details
The Implementing Secure Converged Wide Area Networks (ISCW 642-825) is a qualifying exam for the Cisco Certified Network Professional CCNP®. The ISCW 642-825 exam will certify that the successful candidate has important knowledge and skills necessary to secure and expand the reach of an enterprise network to teleworkers and remote sites with focus on securing remote access and VPN client configuration. The exam covers topics on Cisco hierarchical network model as it pertains to the WAN, teleworker configuration and access, frame mode MPLS, site-to-site IPSEC VPN, Cisco EZVPN, strategies used to mitigate network attacks, Cisco device hardening and IOS firewall features.

Free 642-825 Exams’s PDF Download
Free Actualtests offers free demo for 642-825 PDF(ISCW – Implementing Secure Converged Wide Area Networks). You can check out the interface, question quality and usability of our practice exams . We are the only one site can offer demo for almost all ISCW – Implementing Secure Converged Wide Area Networks.

Recommended Training about 642-825 exam PDF
The following courses are the recommended training for 642-825 exam PDF.
642-825 Q & A with Explanations
642-825 Audio Exam
642-825 Study Guide
642-825 Preparation Lab
642-825 Exam Preparation from Actualtests with FULL explanations include:
Comprehensive questions with complete details
Detailed explanations of all the questions
Questions accompanied by exhibits
Verified Answers Researched by Industry Experts
Drag and Drop questions as experienced in the Actual Exams
Questions updated on regular basis
These questions and answers are backed by our GUARANTEE.
Like actual certification exams our product is in multiple-choice questions (MCQs).
642-825 Exam: Actualtests’s ISCW – Implementing Secure Converged Wide Area Networks PDF
The ISCW – Implementing Secure Converged Wide Area Networks PDF for preparing for the 642-825 exam – Actualtests’s ISCW – Implementing Secure Converged Wide Area Networks. Actualtests is your premier source for practice tests, and true testing environment. Nothing will prepare you for your next exam like a Actualtests. You find it all here at ciscoexams.org.

QUESTION 1:
A few small Certkiller locations use HFC cable to connect to the Certkiller WAN.
Which HFC cable network statement is true about the downstream data channel to
the customer and the upstream data channel to the service provider?
A. The upstream data path is assigned a channel in a higher frequency range than the
downstream path has.
B. The downstream data path is assigned a 30 MHz channel and the upstream data path is
assigned a 1 MHz channel.
C. The downstream data path is assigned a fixed bandwidth channel and the upstream
data path uses a variable bandwidth channel.
D. Both upstream and downstream data paths are assigned in 6 MHz channels.
E. None of the above.
Answer: D
Explanation:
Hybrid fiber-coaxial (HFC): A mixed optical-coaxial network in which optical fiber
replaces some or all of the traditional trunk portion of the cable network.
The HFC architecture is the evolution of an initial cable system and signifies a network
that incorporates both optical fiber along with coaxial cable to create a broadband
network. By upgrading a cable plant to an HFC architecture, you can deploy a data
network over an HFC system to offer high-speed Internet services and you can serve
more subscribers. The cable network is segmented into smaller service areas in which
fewer amplifiers are cascaded after each optical node-typically five or fewer. The
tree-and-branch network architecture for HFC can be a fiber backbone, cable area
network, superdistribution, fiber to the feeder, or a ring.
Downstream: An RF signal transmission (TV channels, data) from source (headend) to
the destination (subscribers). Downstream is also called a forward path.
Upstream: An RF signal transmission opposite to downstream-from subscribers to the
headend. Upstream is also called a return or reverse path.
Delivering services over a cable network requires different RF frequencies-the outgoing
frequencies are in the 50-to-860 MHz range, the incoming are in the 5-to-42 MHz range.
To deliver data services over a cable network TV channels which usually operate at 6
MHz range for the downstream, and 6 MHz or less (for asymmetric cable connections)
for upstream traffic from the corresponding frequency range are usually used.
QUESTION 2:
Many small Certkiller branch offices use broadband cable for data connection
access. Which three modulation signaling standards are used in broadband cable
technology? (Select three)
642-825
Actualtests.com – The Power of Knowing
A. S-Video
B. NTSC
C. SECAM
D. PAL
E. FEC
F. FDM
G. MLP
Answer: B, C, D
Explanation:
Broadband: Data transmission where multiple pieces of data are sent simultaneously to
increase the effective rate of transmission. In cable systems, the term broadband refers to
the frequency-division multiplexing (FDM) of many signals in a wide radio frequency
(RF) bandwidth over an HFC network, and the capability to handle vast amounts of
information.
NTSC is a North American TV technical standard for analog TV systems. The standard
was created in 1941 and is named after the National Television System Committee
formed in 1940. The standard uses a 6-MHz modulated signal. PAL is a color encoding
system used in broadcast television systems in most of Europe, Asia, Africa, Australia,
Brazil, and Argentina, and uses a 6-MHz, 7-MHz, or 8-MHz modulated signal. The color
difference signals an alternate phase at the horizontal line rate. SECAM is an analog
color TV system used in France and certain Eastern European countries that uses an
8-MHz modulated signal.
QUESTION 3:
Some of the smaller Certkiller locations use HFC cable to connect to the Certkiller
WAN. Which two statements are true about broadband cable (HFC) systems?
(Select two)
A. Cable modems operate at Layers 1, 2, and 3 of the OSI model.
B. Cable modems operate at Layers 1 and 2 of the OSI model.
C. A function of the cable modem termination system is to convert the digital data stream
from the end user host into a modulated RF signal for transmission onto the cable system.
D. Cable modems only operate at Layer 1 of the OSI model.
E. A function of the cable modem termination system (CMTS) is to convert the
modulated signal from the cable modem into a digital signal.
Answer: B, E
Explanation:
Hybrid fiber-coaxial (HFC): A mixed optical-coaxial network in which optical fiber
replaces some or all of the traditional trunk portion of the cable network.
642-825
Actualtests.com – The Power of Knowing
The HFC architecture is the evolution of an initial cable system and signifies a network
that incorporates both optical fiber along with coaxial cable to create a broadband
network. By upgrading a cable plant to an HFC architecture, you can deploy a data
network over an HFC system to offer high-speed Internet services and you can serve
more subscribers. The cable network is segmented into smaller service areas in which
fewer amplifiers are cascaded after each optical node-typically five or fewer. The
tree-and-branch network architecture for HFC can be a fiber backbone, cable area
network, superdistribution, fiber to the feeder, or a ring.
QUESTION 4:
A Certkiller remote user is getting Internet access from the local cable provider.
When an individual is connected to the Internet by way of a CATV cable service,
what kind of traffic is considered upstream traffic?
A. Traffic going from the user’s home traveling to the headend.
B. Broadcast traffic, including the cable TV signals.
C. Traffic between the headend and the TV signal.
D. Traffic between the headend and the supplier antenna.
E. Traffic from outside the local cable segment serving the user’s home.
F. All of the above can be considered upstream
Answer: A
Explanation:
In the CATV space, the downstream channels in a cable plant (cable head-end to
subscribers) is a point-to-multipoint channel. This does have very similar characteristics
to transmitting over an Ethernet segment where one transmitter is being listened to by
many receivers. The major difference is that base-band modulation has been replaced by
a more densely modulated RF carrier with very sophisticated adaptive signal processing
and forward error correction (FEC).
In the upstream direction (subscriber cable modems transmitting towards the head-end)
the environment is many transmitters and one receiver. This introduces the need for
precise scheduling of packet transmissions to achieve high utilization and precise power
control so as to not overdrive the receiver or other amplifier electronics in the cable
system. Since the upstream direction is like a single receiver with many antennas, the
channels are much more susceptible to interfering noise products. In the cable industry,
we generally call this ingress noise. As ingress noise is an inherent part of CATV plants,
the observable impact is an unfortunate rise in the average noise floor in the upstream
channel. To overcome this noise jungle, upstream modulation is not as dense as in the
downstream and we have to use more effective FEC as used in the downstream.
Reference: http://www.cisco.com/warp/public/759/ipj_1-3/ipj_1-3_catv.html
QUESTION 5:
642-825
Actualtests.com – The Power of Knowing
A new cable modem was shipped to the home of a Certkiller user, where it is being
installed for the first time. When a DOCSIS 1.1 compliant cable modem first
initializes, (boots up) what does it do?
A. Establishes IP connectivity (DHCP).
B. Determines the time of day.
C. Requests a DOCSIS configuration file from a TFTP server.
D. Scan for a downstream channel and the establishment of timing synchronization with
the CMTS.
E. None of the above.
Answer: D
Explanation:
According to the DOCSIS (Data-over-Cable Service Interface Specifications) when you
first power up a cable modem it starts scanning (starting at a low frequency) for a cable
signal. When it ‘hears’ a cable modem stream it listens for a broadcast (from the service
provider) which contains information (ie. frequency) needed to talk back with the head
end. It then ‘talks back’ and if it communicates the right authentication information, it is
allowed to proceed.
References: Page 225 of the CCNP Self-Study BCRAN (642-821) ISBN: 1-58720-084-8
http://www.cisco.com/en/US/products/hw/cable/ps2217/products_feature_guide_chapter09186a008019b57f.ht
m
QUESTION 6:
You are building a small network at your home and you intend on connecting your
cable modem to a Cisco router. Which router interface would you connect the
modem to?
A. Synchronous serial
B. Asynchronous serial
C. Ethernet
D. auxiliary
E. BRI
Answer: C
Explanation:
In certain environments where a non Cisco Cable Modem (CM) is used, and the CM is
only capable of bridging, a Cisco router such as the Cisco 806 can be connected to the
Cable Modem via the Ethernet interface. The routing can then be performed by the Cisco
router behind the Cable Modem and the Client PC or Customer Premises Equipment
(CPE) will be connected to the Cisco router. Network Address Translation (NAT) can
642-825
Actualtests.com – The Power of Knowing
then be configured on the Cisco router.
When the Cisco router is connected behind the Cable Modem the first problem that might
be encountered is not obtaining an IP address dynamically on the Cisco router’s Ethernet
interface. Most Internet Service Providers (ISPs) allow only one host or PC behind the
Cable Modem. Some ISPs assign an IP address to the PC based on the host name.
Therefore, if you have a Cisco router behind the Cable Modem, then the host name for
the router configured using the hostname command should be the same host name given
by the ISP.
Example:
QUESTION 7:
When a cable modem is being provisioned to operate with a host system for Internet
services, which two options must occur before Layer 1 and 2 connectivity can
occur? (Choose two)
A. The cable modem must request an IP address and core configuration information from
a Dynamic Host Configuration Protocol (DHCP) server.
B. The cable modem powering up must scan and lock on the RF data channel in the
downstream path.
C. The modem must request a DOCSIS configuration file from a TFTP server.
D. The cable modem must register with the CMTS.
E. The modem must read specific maintenance messages in the downstream path.
Answer: B, E
Explanation:
According to the DOCSIS (Data-over-Cable Service Interface Specifications) when you
first power up a cable modem it starts scanning (starting at a low frequency) for a cable
signal. When it ‘hears’ a cable modem stream it listens for a broadcast (from the service
provider) which contains information (ie. frequency) needed to talk back with the head
end. It then ‘talks back’ and if it communicates the right authentication information, it is
allowed to proceed. Once these steps are completed, layers 1 and 2 will be operational.
QUESTION 8:
How is cable broadband technology able to transmit downstream and upstream
data while at the same time delivering television content?
A. The cable operator uses the VHF hyperband to transmit and receive data signals.
642-825
Actualtests.com – The Power of Knowing
B. The cable operator assigns any available spectrum to data, depending on how its own
television spectrum is being used.
C. The cable operator uses specific bandwidths for data signals specified by DOCSIS.
D. The cable operator places its data signals into clean areas where there is no
interference from noise or other signals.
Answer: C
Explanation:
Developed by CableLabs and approved by the ITU in March 1998, Data Over
Cable Service Interface Specification (DOCSIS) defines interface standards for
cable modems and supporting equipment. In a cable TV system, signals from the
various channels are each given a 6-MHz slice of the cable’s available bandwidth and
then sent down the cable to your house. In some systems, coaxial cable is the only
medium used for distributing signals.
When a cable company offers Internet access over the cable, Internet information can use
the same cables because the cable modem system puts downstream data — data sent from
the Internet to an individual computer — into a 6-MHz channel. On the cable, the data
looks just like a TV channel. So Internet downstream data takes up the same amount of
cable space as any single channel of programming. Upstream data — information sent
from an individual back to the Internet — requires even less of the cable’s bandwidth, just
2 MHz, since the assumption is that most people download far more information than
they upload.
QUESTION 9:
Certkiller operates a DSL network. What does the “dsl operating-mode auto”
command configure on a Cisco router?
A. It configures a Cisco router to automatically detect the proper modulation method to
use when connecting an ATM interface.
B. It configures a Cisco router to automatically detect the proper DSL type (ADSL,
IDSL, HDSL, VDSL) to use when connecting an ATM interface.
C. It configures a Cisco router to automatically detect the proper encapsulation method to
use when connecting an ATM interface.
D. It configures a Cisco router to automatically detect the proper authentication method
to use when connecting an ATM interface.
642-825
Actualtests.com – The Power of Knowing
E. None of the above
Answer: A
Explanation:
dsloperating-mode auto interface configuration command to specify that the router
automatically detect the DSL modulation that the service provider is using and set the
DSL modulation to match. An incompatible DSL modulation configuration can result in
failure to establish a DSL connection to the DSLAM of the service provider
Example:
QUESTION 10:
Certkiller is a DSL service provider using providing xDSL to its customers. Which
statement about xDSL implementations is true?
A. All xDSL standards operate in lower frequencies than the POTS system and can
therefore coexist on the same media.
B. Other than providing higher data rates, HDSL is identical to ADSL.
C. The ADSL standard operates in higher frequencies than the POTS system and can
therefore coexist on the same media.
D. The HDSL standard operates in higher frequencies than the POTS system and can
therefore coexist on the same media.
E. All xDSL standards operate in higher frequencies than the POTS system and therefore
can coexist on the same media.
F. None of the above.

Free download?pass4sure ccnp 642-825
Free download?testking ccnp 642-825

“Implementing Secure Converged Wide Area Networks”, also known as 642-825 exam, is a Cisco certification.
Preparing for the 642-825 exam? Searching 642-825 Test Questions, 642-825 Practice Exam, 642-825 Dumps?

Free 642-825 Demo Download
TestInside offers free demo for 642-825 exam ( Implementing Secure Converged Wide Area Networks). You can check out the interface, question quality and usability of our practice exams before you decide to buy it. We are the only one site can offer demo for almost all products.

1. When configuring the Cisco VPN Client with transparent tunneling, what is true about the IPSec over TCP

option?

A. The port number is negotiated automatically.

B. Clients will have access to the secured tunnel and local resources.

C. The port number must match the configuration on the secure gateway.

D. Packets are encapsulated using Protocol 50 (Encapsulating Security Payload, or ESP). Answer:C

2. Refer to the exhibit.

MPLS must be enabled on all routers in the MPLS domain that consists of Cisco routers and equipment of other

vendors. What MPLS distribution protocol(s) should be used on router R2 FastEthernet interface Fa0/0 so that the

Label Information Base (LIB) table is populated across the MPLS domain? A. Only LDP should be enabled on Fa0/0 interface.
B. Only TDP should be enabled on Fa0/0 interface.

C. Both distribution protocols LDP and TDP should be enabled on the Fa0/0 interface.

D. MPLS cannot be enabled in a domain consisting of Cisco and non-Cisco devices. Answer:C

3. Which two statements about common network attacks are true? (Choose two.)

A. Access attacks can consist of password attacks, trust exploitation, port redirection, and man-in-the-middle attacks.
B. Access attacks can consist of password attacks, ping sweeps, port scans, and man-in-the-middle attacks.

C. Access attacks can consist of packet sniffers, ping sweeps, port scans, and man-in-the-middle attacks.

D. Reconnaissance attacks can consist of password attacks, trust exploitation, port redirection and Internet information queries.
E. Reconnaissance attacks can consist of packet sniffers, port scans, ping sweeps, and Internet information queries.
F. Reconnaissance attacks can consist of ping sweeps, port scans, man-in-middle attacks and Internet information queries.
Answer:AE

4. Which two statements about worms, viruses, or Trojan horses are true? (Choose two.)

A. A Trojan horse has three components: an enabling vulnerability, a propagation mechanism, and a payload.

B. A Trojan horse virus propagates itself by infecting other programs on the same computer. C. A virus cannot spread to a new computer without human assistance.
D. A virus has three components: an enabling vulnerability, a propagation mechanism, and a payload.

E. A worm can spread itself automatically from one computer to the next over an unprotected network.

F. A worm is a program that appears desirable but actually contains something harmful. Answer:CE

5. Which two statements about management protocols are true? (Choose two.)

A. Syslog version 2 or above should be used because it provides encryption of the syslog messages.

B. NTP version 3 or above should be used because these versions support a cryptographic authentication mechanism between peers.
C. SNMP version 3 is recommended since it provides authentication and encryption services for management

packets.

D. SSH, SSL and Telnet are recommended protocols to remotely manage infrastructure devices.

E. TFTP authentication (username and password) is sent in an encrypted format, and no additional encryption is required.
Answer:BC

6. Which two statements about the Cisco AutoSecure feature are true? (Choose two.)

A. All passwords entered during the AutoSecure configuration must be a minimum of 8 characters in length.

B. Cisco123 would be a valid password for both the enable password and the enable secret commands.

C. The auto secure command can be used to secure the router login as well as the NTP and SSH protocols.

D. For an interactive full session of AutoSecure, the auto secure login command should be used.

E. If the SSH server was configured, the 1024 bit RSA keys are generated after the auto secure command is enabled.
Answer:CE

7. Which three statements are correct about MPLS-based VPNs? (Choose three.)

A. Route Targets (RTs) are attributes attached to a VPNv4 BGP route to indicate its VPN membership.

B. Scalability becomes challenging for a very large, fully meshed deployment. C. Authentication is done using a digital certificate or pre-shared key.
D. A VPN client is required for client-initiated deployments.

E. A VPN client is not required for users to interact with the network.

F. An MPLS-based VPN is highly scalable because no site-to-site peering is required. Answer:AEF

8. Which IPsec mode will encrypt a GRE tunnel to provide multiprotocol support and reduced overhead?

A. 3DES

B. multipoint GRE C. tunnel
D. transport

Answer:D

9. Which two statements are true about broadband cable (HFC) systems? (Choose two.)

A. Cable modems only operate at Layer 1 of the OSI model.

B. Cable modems operate at Layers 1 and 2 of the OSI model.

C. Cable modems operate at Layers 1, 2, and 3 of the OSI model.

D. A function of the cable modem termination system (CMTS) is to convert the modulated signal from the cable modem into a digital signal.
E. A function of the cable modem termination system is to convert the digital data stream from the end user host into a modulated RF signal for transmission onto the cable system.
Answer:BD

10. Refer to the exhibit.

Which two statements about the AAA configuration are true? (Choose two.)

A. A good security practice is to have the none parameter configured as the final method used to ensure that no other authentication method will be used.
B. If a TACACS+ server is not available, then a user connecting via the console port would not be able to gain access since no other authentication method has been defined.
C. If a TACACS+ server is not available, then the user Bob could be able to enter privileged mode as long as the proper enable password is entered.
D. The aaa new-model command forces the router to override every other authentication method previously configured for the router lines.
E. To increase security, group radius should be used instead of group tacacs+.

F. Two authentication options are prescribed by the displayed aaa authentication command. Answer:DF

11. Refer to the exhibit.

When you are using the Quick Setup option of the Site-to-Site VPN wizard on the SDM to configure an IPsec

VPN, which three settings can you configure? (Choose three.) A. peer identity
B. crypto map

C. pre-shared key

D. transform set priority

E. source interface and destination IP address F. encapsulation security payload Answer:ACE

12. Refer to the exhibit.

SDM has been used to configure the locations from which the signature definition file (SDF) will be loaded. What

will happen if the SDF files in flash are not available at startup? A. All traffic will flow uninspected or will be dropped.
B. All traffic will be marked as uninspected and will be checked after the signature file is loaded.

C. All traffic will be inspected by the built-in signatures bundled with Cisco IOS Software.

D. All traffic will be inspected by the pre-built signatures bundled in the attack-drop.sdf file. Answer:A

13. Drag each Cisco Easy VPN connection process on the left to its step on the right.

Free download?pass4sure ccnp 642-825
Free download?testking ccnp 642-825

Exam Number: 642-825
Associated Certifications: CCNP
Duration: 90 minutes
Available Languages: English
Click Here to Register: Pearson VUE
Exam Policies: Read current policies and requirements
Exam Tutorial: Review type of exam questions
QUESTION 1:

A few small Certkiller locations use HFC cable to connect to the Certkiller WAN. Which HFC cable network statement is true about the downstream data channel to the customer and the upstream data channel to the service provider?

A. The upstream data path is assigned a channel in a higher frequency range than the downstream path has.
B. The downstream data path is assigned a 30 MHz channel and the upstream data path is assigned a 1 MHz channel.
C. The downstream data path is assigned a fixed bandwidth channel and the upstream data path uses a variable bandwidth channel.
D. Both upstream and downstream data paths are assigned in 6 MHz channels.
E. None of the above. Answer: D
Explanation:
Hybrid fiber-coaxial (HFC): A mixed optical-coaxial network in which optical fiber replaces some or all of the traditional trunk portion of the cable network.
The HFC architecture is the evolution of an initial cable system and signifies a network that incorporates both optical fiber along with coaxial cable to create a broadband network. By upgrading a cable plant to an HFC architecture, you can deploy a data network over an HFC system to offer high-speed Internet services and you can serve
more subscribers. The cable network is segmented into smaller service areas in which fewer amplifiers are cascaded after each optical node-typically five or fewer. The
tree-and-branch network architecture for HFC can be a fiber backbone, cable area network, superdistribution, fiber to the feeder, or a ring.
Downstream: An RF signal transmission (TV channels, data) from source (headend) to the destination (subscribers). Downstream is also called a forward path.
Upstream: An RF signal transmission opposite to downstream-from subscribers to the headend. Upstream is also called a return or reverse path.
Delivering services over a cable network requires different RF frequencies-the outgoing frequencies are in the 50-to-860 MHz range, the incoming are in the 5-to-42 MHz range.
To deliver data services over a cable network TV channels which usually operate at 6
MHz range for the downstream, and 6 MHz or less (for asymmetric cable connections)
for upstream traffic from the corresponding frequency range are usually used.

QUESTION 2:

Many small Certkiller branch offices use broadband cable for data connection access. Which three modulation signaling standards are used in broadband cable technology? (Select three)

A. S-Video

TK

642-825

B. NTSC
C. SECAM D. PAL
E. FEC F. FDM G. MLP
Answer: B, C, D Explanation:
Broadband: Data transmission where multiple pieces of data are sent simultaneously to increase the effective rate of transmission. In cable systems, the term broadband refers to the frequency-division multiplexing (FDM) of many signals in a wide radio frequency
(RF) bandwidth over an HFC network, and the capability to handle vast amounts of information.
NTSC is a North American TV technical standard for analog TV systems. The standard was created in 1941 and is named after the National Television System Committee
formed in 1940. The standard uses a 6-MHz modulated signal. PAL is a color encoding system used in broadcast television systems in most of Europe, Asia, Africa, Australia, Brazil, and Argentina, and uses a 6-MHz, 7-MHz, or 8-MHz modulated signal. The color difference signals an alternate phase at the horizontal line rate. SECAM is an analog
color TV system used in France and certain Eastern European countries that uses an
8-MHz modulated signal.

QUESTION 3:

Some of the smaller Certkiller locations use HFC cable to connect to the Certkiller
WAN. Which two statements are true about broadband cable (HFC) systems?
(Select two)

A. Cable modems operate at Layers 1, 2, and 3 of the OSI model. B. Cable modems operate at Layers 1 and 2 of the OSI model.
C. A function of the cable modem termination system is to convert the digital data stream from the end user host into a modulated RF signal for transmission onto the cable system.
D. Cable modems only operate at Layer 1 of the OSI model.
E. A function of the cable modem termination system (CMTS) is to convert the modulated signal from the cable modem into a digital signal.
Answer: B, E Explanation:
Hybrid fiber-coaxial (HFC): A mixed optical-coaxial network in which optical fiber replaces some or all of the traditional trunk portion of the cable network.
The HFC architecture is the evolution of an initial cable system and signifies a network that incorporates both optical fiber along with coaxial cable to create a broadband network. By upgrading a cable plant to an HFC architecture, you can deploy a data

TK

642-825

network over an HFC system to offer high-speed Internet services and you can serve
more subscribers. The cable network is segmented into smaller service areas in which fewer amplifiers are cascaded after each optical node-typically five or fewer. The
tree-and-branch network architecture for HFC can be a fiber backbone, cable area network, superdistribution, fiber to the feeder, or a ring.

QUESTION 4:

A Certkiller remote user is getting Internet access from the local cable provider. When an individual is connected to the Internet by way of a CATV cable service, what kind of traffic is considered upstream traffic?

A. Traffic going from the user’s home traveling to the headend. B. Broadcast traffic, including the cable TV signals.
C. Traffic between the headend and the TV signal.
D. Traffic between the headend and the supplier antenna.
E. Traffic from outside the local cable segment serving the user’s home. F. All of the above can be considered upstream
Answer: A Explanation:
In the CATV space, the downstream channels in a cable plant (cable head-end to subscribers) is a point-to-multipoint channel. This does have very similar characteristics
to transmitting over an Ethernet segment where one transmitter is being listened to by
many receivers. The major difference is that base-band modulation has been replaced by
a more densely modulated RF carrier with very sophisticated adaptive signal processing and forward error correction (FEC).
In the upstream direction (subscriber cable modems transmitting towards the head-end)
the environment is many transmitters and one receiver. This introduces the need for
precise scheduling of packet transmissions to achieve high utilization and precise power control so as to not overdrive the receiver or other amplifier electronics in the cable system. Since the upstream direction is like a single receiver with many antennas, the channels are much more susceptible to interfering noise products. In the cable industry,
we generally call this ingress noise. As ingress noise is an inherent part of CATV plants, the observable impact is an unfortunate rise in the average noise floor in the upstream channel. To overcome this noise jungle, upstream modulation is not as dense as in the downstream and we have to use more effective FEC as used in the downstream.
Reference: http://www.cisco.com/warp/public/759/ipj_1-3/ipj_1-3_catv.html

QUESTION 5:

A new cable modem was shipped to the home of a Certkiller user, where it is being installed for the first time. When a DOCSIS 1.1 compliant cable modem first initializes, (boots up) what does it do?

TK

642-825

A. Establishes IP connectivity (DHCP).
B. Determines the time of day.
C. Requests a DOCSIS configuration file from a TFTP server.
D. Scan for a downstream channel and the establishment of timing synchronization with the CMTS.
E. None of the above. Answer: D
Explanation:
According to the DOCSIS (Data-over-Cable Service Interface Specifications) when you first power up a cable modem it starts scanning (starting at a low frequency) for a cable signal. When it ‘hears’ a cable modem stream it listens for a broadcast (from the service provider) which contains information (ie. frequency) needed to talk back with the head end. It then ‘talks back’ and if it communicates the right authentication information, it is allowed to proceed.
References: Page 225 of the CCNP Self-Study BCRAN (642-821) ISBN: 1-58720-084-8
http://www.cisco.com/en/US/products/hw/cable/ps2217/products_feature_guide_chapter09186a008019b57f.ht
m

QUESTION 6:

You are building a small network at your home and you intend on connecting your cable modem to a Cisco router. Which router interface would you connect the modem to?

A. Synchronous serial B. Asynchronous serial C. Ethernet
D. auxiliary
E. BRI Answer: C
Explanation:
In certain environments where a non Cisco Cable Modem (CM) is used, and the CM is only capable of bridging, a Cisco router such as the Cisco 806 can be connected to the
Cable Modem via the Ethernet interface. The routing can then be performed by the Cisco router behind the Cable Modem and the Client PC or Customer Premises Equipment
(CPE) will be connected to the Cisco router. Network Address Translation (NAT) can then be configured on the Cisco router.
When the Cisco router is connected behind the Cable Modem the first problem that might
be encountered is not obtaining an IP address dynamically on the Cisco router’s Ethernet interface. Most Internet Service Providers (ISPs) allow only one host or PC behind the Cable Modem. Some ISPs assign an IP address to the PC based on the host name. Therefore, if you have a Cisco router behind the Cable Modem, then the host name for

Interactive Testing Engine Included!
277 Questions
Updated : 09/01/2008
Price : $87.99 $79.99

Free download?testking CCNP 642-825

Free download?pass4sure CCNP 642-825

Free download?pass4sure CCNP 642-825

A new cable modem was shipped to the home of a certifyme.comuser, where it is being
installed for the first time. When a DOCSIS 1.1 compliant cable modem first
initializes, (boots up) what does it do?
A. Establishes IP connectivity (DHCP).
B. Determines the time of day.
C. Requests a DOCSIS configuration file from a TFTP server.
D. Scan for a downstream channel and the establishment of timing synchronization with
the CMTS.
E. None of the above.
Answer: D
Explanation:
According to the DOCSIS (Data-over-Cable Service Interface Specifications) when you
first power up a cable modem it starts scanning (starting at a low frequency) for a cable
signal. When it ‘hears’ a cable modem stream it listens for a broadcast (from the service
provider) which contains information (ie. frequency) needed to talk back with the head
end. It then ‘talks back’ and if it communicates the right authentication information, it is
allowed to proceed.

References: Page 225 of the CCNP Self-Study BCRAN (642-821) ISBN: 1-58720-084-8
http://www.cisco.com/en/US/products/hw/cable/ps2217/products_feature_guide_chapter09186a008019b57f.htm
QUESTION NO: 6
You are building a small network at your home and you intend on connecting your
cable modem to a Cisco router. Which router interface would you connect the
modem to?
A. Synchronous serial
B. Asynchronous serial
C. Ethernet
D. auxiliary
E. BRI
Answer: C
Explanation:
In certain environments where a non Cisco Cable Modem (CM) is used, and the CM is
only capable of bridging, a Cisco router such as the Cisco 806 can be connected to the
Cable Modem via the Ethernet interface. The routing can then be performed by the Cisco
router behind the Cable Modem and the Client PC or Customer Premises Equipment
(CPE) will be connected to the Cisco router. Network Address Translation (NAT) can
then be configured on the Cisco router.
When the Cisco router is connected behind the Cable Modem the first problem that might
be encountered is not obtaining an IP address dynamically on the Cisco router’s Ethernet
interface. Most Internet Service Providers (ISPs) allow only one host or PC behind the
Cable Modem. Some ISPs assign an IP address to the PC based on the host name.
Therefore, if you have a Cisco router behind the Cable Modem, then the host name for
the router configured using the hostname command should be the same host name given
by the ISP.
QUESTION NO: 7
When a cable modem is being provisioned to operate with a host system for Internet
services, which two options must occur before Layer 1 and 2 connectivity can
occur? (Choose two)
A. The cable modem must request an IP address and core configuration information from
a Dynamic Host Configuration Protocol (DHCP) server.
B. The cable modem powering up must scan and lock on the RF data channel in the
downstream path.
C. The modem must request a DOCSIS configuration file from a TFTP server.
D. The cable modem must register with the CMTS.
E. The modem must read specific maintenance messages in the downstream path.
Answer: B, E
Explanation:
According to the DOCSIS (Data-over-Cable Service Interface Specifications) when you
first power up a cable modem it starts scanning (starting at a low frequency) for a cable
signal. When it ‘hears’ a cable modem stream it listens for a broadcast (from the service
provider) which contains information (ie. frequency) needed to talk back with the head
end. It then ‘talks back’ and if it communicates the right authentication information, it is
allowed to proceed. Once these steps are completed, layers 1 and 2 will be operational.
QUESTION NO: 8
How is cable broadband technology able to transmit downstream and upstream
data while at the same time delivering television content?
A. The cable operator uses the VHF hyperband to transmit and receive data signals.
B. The cable operator assigns any available spectrum to data, depending on how its own
television spectrum is being used.
C. The cable operator uses specific bandwidths for data signals specified by DOCSIS.
D. The cable operator places its data signals into clean areas where there is no
interference from noise or other signals.
Answer: C

QUESTION NO: 9
certifyme.comoperates a DSL network. What does the “dsl operating-mode auto”
command configure on a Cisco router?
A. It configures a Cisco router to automatically detect the proper modulation method to
use when connecting an ATM interface.
B. It configures a Cisco router to automatically detect the proper DSL type (ADSL,
IDSL, HDSL, VDSL) to use when connecting an ATM interface.
C. It configures a Cisco router to automatically detect the proper encapsulation method to
use when connecting an ATM interface
D. It configures a Cisco router to automatically detect the proper authentication method
to use when connecting an ATM interface.
E. None of the above
Answer: A
Explanation:
dsloperating-mode auto interface configuration command to specify that the router
automatically detect the DSL modulation that the service provider is using and set the
DSL modulation to match. An incompatible DSL modulation configuration can result in
failure to establish a DSL connection to the DSLAM of the service provider
Example:

Free Down:pass4sure CCNP ISCW 642-825 V3.10
Testking iscw 642-825

password:www.ccnp.cc

Questions and Answers : 310 Q&As
Updated: 2008-09-02
Market Price: $129.99
Member Price: $89.99

Exam Number/Code: 642-825
Exam Name: ISCW – Implementing Secure Converged Wide Area Networks
VUE Code: 642-825
Questions Type: Single choice,

Exam : Cisco 642­825

Title :

Implementing Secure Converged

Wide Area Networks (ISCW)

Update : Demo

1. Refer to the exhibit, which shows a PPPoA diagram and partial SOHO77 configuration.

Which command needs to be applied to the SOHO77 to complete the configuration?

A. encapsulation aal5snap applied to the PVC.

B. encapsulation aal5ciscoppp applied to the PVC

C. encapsulation aal5ciscoppp applied to the ATM0 interface

D. encapsulation aal5mux ppp dialer applied to the ATM0 interface

E. encapsulation aal5mux ppp dialer applied to the PVC Answer: E

2. Which three techniques should be used to secure management protocols? (Choose three.)

A. Configure SNMP with only read­only community strings.

B. Encrypt TFTP and syslog traffic in an IPSec tunnel.

C. Implement RFC 3704 filtering at the perimeter router when allowing syslog access from devices on the outside of a firewall.
D. Synchronize the NTP master clock with an Internet atomic clock.

E. Use SNMP version 2.

F. Use TFTP version 3 or above because these versions support a cryptographic authentication mechanism between peers.
Answer: ABC

3. What are two steps that must be taken when mitigating a worm attack? (Choose two.)

A. Inoculate systems by applying update patches. B. Limit traffic rate.
C. Apply authentication.

D. Quarantine infected machines. E. Enable anti­spoof measures Answer: AD

4. What is a reason for implementing MPLS in a network? A. MPLS eliminates the need of an IGP in the core.
B. MPLS reduces the required number of BGP­enabled devices in the core.

C. Reduces routing table lookup since only the MPLS core routers perform routing table lookups.

D. MPLS eliminates the need for fully meshed connections between BGP enabled devices. Answer: B

5. Which three statements about IOS Firewall configurations are true? (Choose three.)

A. The IP inspection rule can be applied in the inbound direction on the secured interface.

B. The IP inspection rule can be applied in the outbound direction on the unsecured interface.

C. The ACL applied in the outbound direction on the unsecured interface should be an extended ACL.

D. The ACL applied in the inbound direction on the unsecured interface should be an extended ACL.

E. For temporary openings to be created dynamically by Cisco IOS Firewall, the access­list for the returning traffic must be a standard ACL.
F. For temporary openings to be created dynamically by Cisco IOS Firewall, the IP inspection rule must be applied to the secured interface.
Answer: ABD

6. Which three IPsec VPN statements are true? (Choose three.) A. IKE keepalives are unidirectional and sent every ten seconds.
B. IKE uses the Diffie­Hellman algorithm to generate symmetrical keys to be used by IPsec peers.

C. IPsec uses the Encapsulating Security Protocol (ESP) or the Authentication Header (AH) protocol for exchanging keys.
D. Main mode is the method used for the IKE phase two security association negotiations.

E. Quick mode is the method used for the IKE phase one security association negotiations.

F. To establish IKE SA, main mode utilizes six packets while aggressive mode utilizes only three packets. Answer: ABF

7. Which three MPLS statements are true? (Choose three.)

A. Cisco Express Forwarding (CEF) must be enabled as a prerequisite to running MPLS on a Cisco router.
B. Frame­mode MPLS inserts a 32­bit label between the Layer 3 and Layer 4 headers.

C. MPLS is designed for use with frame­based Layer 2 encapsulation protocols such as Frame Relay, but

is not supported by ATM because of ATM fixed­length cells.

D. OSPF, EIGRP, IS­IS, RIP, and BGP can be used in the control plane. E. The control plane is responsible for forwarding packets.
F. The two major components of MPLS include the control plane and the data plane. Answer: ADF

8. Refer to the exhibit.

What are the two options that are used to provide High Availability IPsec? (Choose two.)

A. RRI

B. IPsec Backup Peerings

C. Dynamic Crypto Map

D. HSRP

E. IPsec Stateful Switchover (SSO) F. Dual Router Mode (DRM) IPsec Answer: AD

9. Refer to the exhibit. What type of security solution will be provided for the inside network?

A. The TCP connection that matches the defined ACL will be reset by the router if the connection does not

complete the three­way handshake within the defined time period.

B. The router will reply to the TCP connection requests. If the three­way handshake completes successfully, the router will establish a TCP connection between itself and the server.
C. The TCP traffic that matches the ACL will be allowed to pass through the router and create a TCP

connection with the server.

D. The router will intercept the traceroute messages. It will validate the connection requests before forwarding the packets to the inside network.
Answer: B

10. Refer to the exhibit.

Which statement about the authentication process is true?

A. The LIST1 list will disable authentication on the console port.

B. Because no method list is specified, the LIST1 list will not authenticate anyone on the console port.

C. All login requests will be authenticated using the group tacacs+ method. D. All login requests will be authenticated using the local database method.
E. The default login authentication will automatically be applied to all login connections.

Answer: A

11. Which three statements about the Cisco Easy VPN feature are true? (Choose three.)

A. If the VPN server is configured for Xauth, the VPN client waits for a username / password challenge.

B. The Cisco Easy VPN feature only supports transform sets that provide authentication and encryption.

C. The VPN client initiates aggressive mode (AM) if a pre­shared key is used for authentication during the

IKE phase 1 process.

D. The VPN client verifies a server username/password challenge by using a AAA authentication server that supports TACACS+ or RADIUS.
E. The VPN server can only be enabled on Cisco PIX Firewalls and Cisco VPN 3000 series

concentrators.

F. When connecting with a VPN client, the VPN server must be configured for ISAKMP group 1, 2 or 5. Answer: ABC

12. What are three features of the Cisco IOS Firewall feature set? (Choose three.) A. network­based application recognition (NBAR)

B. authentication proxy

C. stateful packet filtering

D. AAA services E. proxy server F. IPS
Answer: BCF

13. Refer to the exhibit.

What does the “26″ in the first two hop outputs indicate?

A. the outer label used to determine the next hop

B. the IPv4 label for the destination network

C. the IPv4 label for the forwarding router D. the IPv4 label for the destination router Answer: B

14. Which two statements about the Cisco AutoSecure feature are true? (Choose two.)

A. All passwords entered during the AutoSecure configuration must be a minimum of 8 characters in length.
B. Cisco123 would be a valid password for both the enable password and the enable secret commands.

C. The auto secure command can be used to secure the router login as well as the NTP and SSH

protocols.

D. For an interactive full session of AutoSecure, the auto secure login command should be used.

E. If the SSH server was configured, the 1024 bit RSA keys are generated after the auto secure command

is enabled.

Answer: CE

15. Refer to the exhibit. Which statement is true about the configuration of split tunnels using SDM?

A. Any protected subnets that are entered represent subnets at the end user’s site that will be accessed

without going through the encrypted tunnel.

B. Any protected subnets that are entered represent subnets at the end user’s site that will be accessed through the encrypted tunnel.
C. Any protected subnets that are entered represent subnets at the VPN server site that will be accessed

without going through the encrypted tunnel.

D. Any protected subnets that are entered represent subnets at the VPN server site that will be accessed

through the encrypted tunnel. Answer: D

16. Refer to the exhibit. Which statement is true about the partial MPLS configuration that is shown?

A. The route­target both 100:2 command sets import and export route­targets for vrf2.

B. The route­target both 100:2 command changes a VPNv4 route to a IPv4 route.

C. The route­target import 100:1 command sets import route­targets routes specified by the route map.

D. The route­target import 100:1 command sets import route­targets for vrf2 that override the other route­target configuration.
Answer: A

17. Which two mechanisms can be used to detect IPsec GRE tunnel failures? (Choose two).

A. Dead Peer Detection (DPD) B. CDP
C. isakmp keepalives

D. GRE keepalive mechanism

E. The hello mechanism of the routing protocol across the IPsec tunnel

Answer: AE

18. Which two statements are true about broadband cable (HFC) systems? (Choose two.)

A. Cable modems only operate at Layer 1 of the OSI model.

B. Cable modems operate at Layers 1 and 2 of the OSI model.

C. Cable modems operate at Layers 1, 2, and 3 of the OSI model.

D. A function of the cable modem termination system (CMTS) is to convert the modulated signal from the

cable modem into a digital signal.

E. A function of the cable modem termination system is to convert the digital data stream from the end user host into a modulated RF signal for transmission onto the cable system.
Answer: BD

19. What are three configurable parameters when editing signatures in Security Device Manager (SDM)?

(Choose three.) A. AlarmSeverity
B. AlarmKeepalive

C. AlarmTraits D. EventMedia E. EventAlarm F. EventAction Answer: ACF

20. Which two statements about common network attacks are true? (Choose two.)

A. Access attacks can consist of password attacks, trust exploitation, port redirection, and man­in­the­middle attacks.
B. Access attacks can consist of password attacks, ping sweeps, port scans, and man­in­the­middle attacks.
C. Access attacks can consist of packet sniffers, ping sweeps, port scans, and man­in­the­middle attacks.

D. Reconnaissance attacks can consist of password attacks, trust exploitation, port redirection and

Internet information queries.

E. Reconnaissance attacks can consist of packet sniffers, port scans, ping sweeps, and Internet information queries.
F. Reconnaissance attacks can consist of ping sweeps, port scans, man­in­middle attacks and Internet

information queries. Answer: AE

21. Refer to the exhibit.

Which three statements describe the steps that are required to configure an IPsec site­to­site VPN using a

GRE tunnel? (Choose three.)

A. The command access­list 110 permit gre must be configured to specify which traffic will be encrypted.

B. The command access­list 110 permit ip must be configured to specify which hosts can use the tunnel.

C. The tunnel destination 172.17.63.18 command must be configured on the Tunnel0 interface.

D. The tunnel mode gre command must be configured on the Tunnel0 interface.

E. The tunnel source Ethernet1 command must be configured on the Tunnel0 interface.

F. The tunnel source Tunnel0 command must be configured on the Tunnel0 interface. Answer: ACE

22. Which form of DSL technology is typically used as a replacement for T1 lines?

A. VDSL B. HDSL C. ADSL D. SDSL
E. G.SHDSL

F. IDSL Answer: B

23. Which three statements are true when configuring Cisco IOS Firewall features using the SDM?

(Choose three.)

A. A custom application security policy can be configured in the Advanced Firewall Security Configuration dialog box.
B. An optional DMZ interface can be specified in the Advanced Firewall Interface Configuration dialog

box.

C. Custom application policies for e­mail, instant messaging, HTTP, and peer­to­peer services can be created using the Intermediate Firewall wizard.
D. Only the outside (untrusted) interface is specified in the Basic Firewall Interface Configuration dialog

box.

E. The outside interface that SDM can be launched from is configured in the Configuring Firewall for

Remote Access dialog box.

F. The SDM provides a basic, intermediate, and advanced firewall wizard. Answer: ABE

24. Refer to the exhibit. On the basis of the partial configuration, which two statements are true? (Choose two.)

A. A CBAC inspection rule is configured on router RTA.

B. A named ACL called SDM_LOW is configured on router RTA.

C. A QoS policy has been applied on interfaces Serial 0/0 and FastEthernet 0/1.

D. Interface Fa0/0 should be the inside interface and interface Fa0/1 should be the outside interface.

E. On interface Fa0/0, the ip inspect statement should be incoming.

F. The interface commands ip inspect SDM_LOW in allow CBAC to monitor multiple protocols.

Answer: AF

25. Which three statements about frame­mode MPLS are true? (Choose three.)

A. MPLS has three distinct components consisting of the data plane, the forwarding plane, and the control plane.
B. The control plane is a simple label­based forwarding engine that is independent of the type of routing

protocol or label exchange protocol.

C. The CEF FIB table contains information about outgoing interfaces and their corresponding Layer 2

header.

D. The MPLS data plane takes care of forwarding based on either destination addresses or labels.

E. To exchange labels, the control plane requires protocols such as Tag Distribution Protocol (TDP) or

MPLS Label Distribution Protocol (LDP).

F. Whenever a router receives a packet that should be CEF­switched, but the destination is not in the FIB, the packet is dropped.
Answer: DEF

26. What are the four fields in an MPLS label? (Choose four.) A. version
B. experimental

C. label

D. protocol

E. TTL

F. bottom­of­stack indicator

Answer: BCEF

27. Which statement is true when ICMP echo and echo­reply are disabled on edge devices?

A. Pings are allowed only to specific devices. B. CDP information is not exchanged.

C. Port scans can no longer be run.

D. Some network diagnostic data is lost.

E. Wireless devices need to be physically connected to the edge device.

F. OSPF routing needs the command ip ospf network non­broadcast enabled. Answer: D

28. Which statement is true about a worm attack?

A. Human interaction is required to facilitate the spread.

B. The worm executes arbitrary code and installs copies of itself in the memory of the infected computer.

C. Extremely large volumes of requests are sent over a network or over the Internet.

D. Data or commands are injected into an existing stream of data. That stream is passed between a client and server application.
Answer: B

29. Refer to the exhibit. Which order correctly identifies the steps to provision a cable modem to connect

to a headend as defined by the DOCSIS standard?

A. A, D, C, G, E, F, B

B. A, D, E, G, C, F, B C. C, D, F, G, E, A, B D. C, D, F, G, A, E, B E. F, D, C, G, A, E, B F. F, D, C, G, E, A, B Answer: E

30. Refer to the exhibit.

On the basis of the information that is provided, which two statements are true? (Choose two.)

A. An IPS policy can be edited by choosing the Edit button.

B. Right­clicking on an interface will display a shortcut menu with options to edit an action or to set severity levels.
C. The Edit IPS window is currently in Global Settings view.

D. The Edit IPS window is currently in IPS Policies view. E. The Edit IPS window is currently in Signatures view.
F. To enable an IPS policy on an interface, click on the interface and deselect Disable. Answer: AD

KillTest.com was founded in 2006. The safer,easier way to help you pass any IT
Certification exams . We provide high quality IT Certification exams practice questions and answers(Q&A). Especially Adob e, Apple, Cit rix, Compt ia, EM C,
HP, Hu aW ei, LPI, No rtel, Oracle , SUN, Vmw are and so on. And help you pass any IT Certification exams at the first try.
You can reach us at any of the email addresses listed below. English Customer: Chinese Customer: Sales : sales@Killtest.com sales@Killtest.net
Support: support@Killtest.com support@Killtest.com

“ISCW – Implementing Secure Converged Wide Area Networks”, also known as 642-825 exam, is a Cisco certification.
Preparing for the 642-825 exam? Searching 642-825 Test Questions, 642-825 Practice Exam, 642-825 Dumps?

With the complete collection of questions and answers, Pass4sure has assembled to take you through 172 Q&As to your 642-825 Exam preparation. In the 642-825 exam resources, you will cover every field and category in CCNP helping to ready you for your successful Cisco Certification.
Questions and Answers : 172 Q&As
Updated: April 5th , 2008
Market Price: $129.99
Member Price: $89.99

Free down: pass4sure ccnp 642-825 v3.10

Free down: testking ccnp 642-825

password:www.ccnp.cc

The Implementing Secure Converged Wide Area Networks (ISCW 642-825) is a qualifying exam for the Cisco Certified Network Professional CCNP®. The ISCW 642-825 exam will certify that the successful candidate has important knowledge and skills necessary to secure and expand the reach of an enterprise network to teleworkers and remote sites with focus on securing remote access and VPN client configuration. The exam covers topics on Cisco hierarchical network model as it pertains to the WAN, teleworker configuration and access, frame mode MPLS, site-to-site IPSEC VPN, Cisco EZVPN, strategies used to mitigate network attacks, Cisco device hardening and IOS firewall features.

Exam : Cisco 642­-825

Title :

Implementing Secure Converged

Wide Area Networks (ISCW)

Update : Demo

1. Refer to the exhibit, which shows a PPPoA diagram and partial SOHO77 configuration.

Which command needs to be applied to the SOHO77 to complete the configuration?

A. encapsulation aal5snap applied to the PVC.

B. encapsulation aal5ciscoppp applied to the PVC

C. encapsulation aal5ciscoppp applied to the ATM0 interface

D. encapsulation aal5mux ppp dialer applied to the ATM0 interface

E. encapsulation aal5mux ppp dialer applied to the PVC Answer: E

2. Which three techniques should be used to secure management protocols? (Choose three.)

A. Configure SNMP with only read­only community strings.

B. Encrypt TFTP and syslog traffic in an IPSec tunnel.

C. Implement RFC 3704 filtering at the perimeter router when allowing syslog access from devices on the outside of a firewall.
D. Synchronize the NTP master clock with an Internet atomic clock.

E. Use SNMP version 2.

F. Use TFTP version 3 or above because these versions support a cryptographic authentication mechanism between peers.
Answer: ABC

3. What are two steps that must be taken when mitigating a worm attack? (Choose two.)

A. Inoculate systems by applying update patches. B. Limit traffic rate.
C. Apply authentication.

D. Quarantine infected machines. E. Enable anti­spoof measures Answer: AD

4. What is a reason for implementing MPLS in a network? A. MPLS eliminates the need of an IGP in the core.
B. MPLS reduces the required number of BGP­enabled devices in the core.

C. Reduces routing table lookup since only the MPLS core routers perform routing table lookups.

D. MPLS eliminates the need for fully meshed connections between BGP enabled devices. Answer: B

5. Which three statements about IOS Firewall configurations are true? (Choose three.)

A. The IP inspection rule can be applied in the inbound direction on the secured interface.

B. The IP inspection rule can be applied in the outbound direction on the unsecured interface.

C. The ACL applied in the outbound direction on the unsecured interface should be an extended ACL.

D. The ACL applied in the inbound direction on the unsecured interface should be an extended ACL.

E. For temporary openings to be created dynamically by Cisco IOS Firewall, the access­list for the returning traffic must be a standard ACL.
F. For temporary openings to be created dynamically by Cisco IOS Firewall, the IP inspection rule must be applied to the secured interface.
Answer: ABD

6. Which three IPsec VPN statements are true? (Choose three.) A. IKE keepalives are unidirectional and sent every ten seconds.
B. IKE uses the Diffie­Hellman algorithm to generate symmetrical keys to be used by IPsec peers.

C. IPsec uses the Encapsulating Security Protocol (ESP) or the Authentication Header (AH) protocol for exchanging keys.
D. Main mode is the method used for the IKE phase two security association negotiations.

E. Quick mode is the method used for the IKE phase one security association negotiations.

F. To establish IKE SA, main mode utilizes six packets while aggressive mode utilizes only three packets. Answer: ABF

7. Which three MPLS statements are true? (Choose three.)

A. Cisco Express Forwarding (CEF) must be enabled as a prerequisite to running MPLS on a Cisco router.
B. Frame­mode MPLS inserts a 32­bit label between the Layer 3 and Layer 4 headers.

C. MPLS is designed for use with frame­based Layer 2 encapsulation protocols such as Frame Relay, but

is not supported by ATM because of ATM fixed­length cells.

D. OSPF, EIGRP, IS­IS, RIP, and BGP can be used in the control plane. E. The control plane is responsible for forwarding packets.
F. The two major components of MPLS include the control plane and the data plane. Answer: ADF

8. Refer to the exhibit.

What are the two options that are used to provide High Availability IPsec? (Choose two.)

A. RRI

B. IPsec Backup Peerings

C. Dynamic Crypto Map

D. HSRP

E. IPsec Stateful Switchover (SSO) F. Dual Router Mode (DRM) IPsec Answer: AD

9. Refer to the exhibit. What type of security solution will be provided for the inside network?

A. The TCP connection that matches the defined ACL will be reset by the router if the connection does not

complete the three­way handshake within the defined time period.

B. The router will reply to the TCP connection requests. If the three­way handshake completes successfully, the router will establish a TCP connection between itself and the server.
C. The TCP traffic that matches the ACL will be allowed to pass through the router and create a TCP

connection with the server.

D. The router will intercept the traceroute messages. It will validate the connection requests before forwarding the packets to the inside network.
Answer: B

10. Refer to the exhibit.

Which statement about the authentication process is true?

A. The LIST1 list will disable authentication on the console port.

B. Because no method list is specified, the LIST1 list will not authenticate anyone on the console port.

C. All login requests will be authenticated using the group tacacs+ method. D. All login requests will be authenticated using the local database method.
E. The default login authentication will automatically be applied to all login connections.

Answer: A

11. Which three statements about the Cisco Easy VPN feature are true? (Choose three.)

A. If the VPN server is configured for Xauth, the VPN client waits for a username / password challenge.

B. The Cisco Easy VPN feature only supports transform sets that provide authentication and encryption.

C. The VPN client initiates aggressive mode (AM) if a pre­shared key is used for authentication during the

IKE phase 1 process.

D. The VPN client verifies a server username/password challenge by using a AAA authentication server that supports TACACS+ or RADIUS.
E. The VPN server can only be enabled on Cisco PIX Firewalls and Cisco VPN 3000 series

concentrators.

F. When connecting with a VPN client, the VPN server must be configured for ISAKMP group 1, 2 or 5. Answer: ABC

12. What are three features of the Cisco IOS Firewall feature set? (Choose three.) A. network­based application recognition (NBAR)

B. authentication proxy

C. stateful packet filtering

D. AAA services E. proxy server F. IPS
Answer: BCF

13. Refer to the exhibit.

What does the “26″ in the first two hop outputs indicate?

A. the outer label used to determine the next hop

B. the IPv4 label for the destination network

C. the IPv4 label for the forwarding router D. the IPv4 label for the destination router Answer: B

14. Which two statements about the Cisco AutoSecure feature are true? (Choose two.)

A. All passwords entered during the AutoSecure configuration must be a minimum of 8 characters in length.
B. Cisco123 would be a valid password for both the enable password and the enable secret commands.

C. The auto secure command can be used to secure the router login as well as the NTP and SSH

protocols.

D. For an interactive full session of AutoSecure, the auto secure login command should be used.

E. If the SSH server was configured, the 1024 bit RSA keys are generated after the auto secure command

is enabled.

Answer: CE

15. Refer to the exhibit. Which statement is true about the configuration of split tunnels using SDM?

A. Any protected subnets that are entered represent subnets at the end user’s site that will be accessed

without going through the encrypted tunnel.

B. Any protected subnets that are entered represent subnets at the end user’s site that will be accessed through the encrypted tunnel.
C. Any protected subnets that are entered represent subnets at the VPN server site that will be accessed

without going through the encrypted tunnel.

D. Any protected subnets that are entered represent subnets at the VPN server site that will be accessed

through the encrypted tunnel. Answer: D

16. Refer to the exhibit. Which statement is true about the partial MPLS configuration that is shown?

A. The route­target both 100:2 command sets import and export route­targets for vrf2.

B. The route­target both 100:2 command changes a VPNv4 route to a IPv4 route.

C. The route­target import 100:1 command sets import route­targets routes specified by the route map.

D. The route­target import 100:1 command sets import route­targets for vrf2 that override the other route­target configuration.
Answer: A

17. Which two mechanisms can be used to detect IPsec GRE tunnel failures? (Choose two).

A. Dead Peer Detection (DPD) B. CDP
C. isakmp keepalives

D. GRE keepalive mechanism

E. The hello mechanism of the routing protocol across the IPsec tunnel

Answer: AE

18. Which two statements are true about broadband cable (HFC) systems? (Choose two.)

A. Cable modems only operate at Layer 1 of the OSI model.

B. Cable modems operate at Layers 1 and 2 of the OSI model.

C. Cable modems operate at Layers 1, 2, and 3 of the OSI model.

D. A function of the cable modem termination system (CMTS) is to convert the modulated signal from the

cable modem into a digital signal.

E. A function of the cable modem termination system is to convert the digital data stream from the end user host into a modulated RF signal for transmission onto the cable system.
Answer: BD

19. What are three configurable parameters when editing signatures in Security Device Manager (SDM)?

(Choose three.) A. AlarmSeverity
B. AlarmKeepalive

C. AlarmTraits D. EventMedia E. EventAlarm F. EventAction Answer: ACF

20. Which two statements about common network attacks are true? (Choose two.)

A. Access attacks can consist of password attacks, trust exploitation, port redirection, and man­in­the­middle attacks.
B. Access attacks can consist of password attacks, ping sweeps, port scans, and man­in­the­middle attacks.
C. Access attacks can consist of packet sniffers, ping sweeps, port scans, and man­in­the­middle attacks.

D. Reconnaissance attacks can consist of password attacks, trust exploitation, port redirection and

Internet information queries.

E. Reconnaissance attacks can consist of packet sniffers, port scans, ping sweeps, and Internet information queries.
F. Reconnaissance attacks can consist of ping sweeps, port scans, man­in­middle attacks and Internet

information queries. Answer: AE

21. Refer to the exhibit.

Which three statements describe the steps that are required to configure an IPsec site­to­site VPN using a

GRE tunnel? (Choose three.)

A. The command access­list 110 permit gre must be configured to specify which traffic will be encrypted.

B. The command access­list 110 permit ip must be configured to specify which hosts can use the tunnel.

C. The tunnel destination 172.17.63.18 command must be configured on the Tunnel0 interface.

D. The tunnel mode gre command must be configured on the Tunnel0 interface.

E. The tunnel source Ethernet1 command must be configured on the Tunnel0 interface.

F. The tunnel source Tunnel0 command must be configured on the Tunnel0 interface. Answer: ACE

22. Which form of DSL technology is typically used as a replacement for T1 lines?

A. VDSL B. HDSL C. ADSL D. SDSL
E. G.SHDSL

F. IDSL Answer: B

23. Which three statements are true when configuring Cisco IOS Firewall features using the SDM?

(Choose three.)

A. A custom application security policy can be configured in the Advanced Firewall Security Configuration dialog box.
B. An optional DMZ interface can be specified in the Advanced Firewall Interface Configuration dialog

box.

C. Custom application policies for e­mail, instant messaging, HTTP, and peer­to­peer services can be created using the Intermediate Firewall wizard.
D. Only the outside (untrusted) interface is specified in the Basic Firewall Interface Configuration dialog

box.

E. The outside interface that SDM can be launched from is configured in the Configuring Firewall for

Remote Access dialog box.

F. The SDM provides a basic, intermediate, and advanced firewall wizard. Answer: ABE

24. Refer to the exhibit. On the basis of the partial configuration, which two statements are true? (Choose two.)

A. A CBAC inspection rule is configured on router RTA.

B. A named ACL called SDM_LOW is configured on router RTA.

C. A QoS policy has been applied on interfaces Serial 0/0 and FastEthernet 0/1.

D. Interface Fa0/0 should be the inside interface and interface Fa0/1 should be the outside interface.

E. On interface Fa0/0, the ip inspect statement should be incoming.

F. The interface commands ip inspect SDM_LOW in allow CBAC to monitor multiple protocols.

Answer: AF

25. Which three statements about frame­mode MPLS are true? (Choose three.)

A. MPLS has three distinct components consisting of the data plane, the forwarding plane, and the control plane.
B. The control plane is a simple label­based forwarding engine that is independent of the type of routing

protocol or label exchange protocol.

C. The CEF FIB table contains information about outgoing interfaces and their corresponding Layer 2

header.

D. The MPLS data plane takes care of forwarding based on either destination addresses or labels.

E. To exchange labels, the control plane requires protocols such as Tag Distribution Protocol (TDP) or

MPLS Label Distribution Protocol (LDP).

F. Whenever a router receives a packet that should be CEF­switched, but the destination is not in the FIB, the packet is dropped.
Answer: DEF

26. What are the four fields in an MPLS label? (Choose four.) A. version
B. experimental

C. label

D. protocol

E. TTL

F. bottom­of­stack indicator

Answer: BCEF

27. Which statement is true when ICMP echo and echo­reply are disabled on edge devices?

A. Pings are allowed only to specific devices. B. CDP information is not exchanged.

C. Port scans can no longer be run.

D. Some network diagnostic data is lost.

E. Wireless devices need to be physically connected to the edge device.

F. OSPF routing needs the command ip ospf network non­broadcast enabled. Answer: D

28. Which statement is true about a worm attack?

A. Human interaction is required to facilitate the spread.

B. The worm executes arbitrary code and installs copies of itself in the memory of the infected computer.

C. Extremely large volumes of requests are sent over a network or over the Internet.

D. Data or commands are injected into an existing stream of data. That stream is passed between a client and server application.
Answer: B

29. Refer to the exhibit. Which order correctly identifies the steps to provision a cable modem to connect

to a headend as defined by the DOCSIS standard?

A. A, D, C, G, E, F, B

B. A, D, E, G, C, F, B C. C, D, F, G, E, A, B D. C, D, F, G, A, E, B E. F, D, C, G, A, E, B F. F, D, C, G, E, A, B Answer: E

30. Refer to the exhibit.

On the basis of the information that is provided, which two statements are true? (Choose two.)

A. An IPS policy can be edited by choosing the Edit button.

B. Right­clicking on an interface will display a shortcut menu with options to edit an action or to set severity levels.
C. The Edit IPS window is currently in Global Settings view.

D. The Edit IPS window is currently in IPS Policies view. E. The Edit IPS window is currently in Signatures view.
F. To enable an IPS policy on an interface, click on the interface and deselect Disable. Answer: AD

KillTest.com was founded in 2006. The safer,easier way to help you pass any IT
Certification exams . We provide high quality IT Certification exams practice questions and answers(Q&A). Especially Adob e, Apple, Cit rix, Compt ia, EM C,
HP, Hu aW ei, LPI, No rtel, Oracle , SUN, Vmw are and so on. And help you pass any IT Certification exams at the first try.
You can reach us at any of the email addresses listed below. English Customer: Chinese Customer: Sales : sales@Killtest.com sales@Killtest.net
Support: support@Killtest.com support@Killtest.com

“ISCW – Implementing Secure Converged Wide Area Networks”, also known as 642-825 exam, is a Cisco certification.
Preparing for the 642-825 exam? Searching 642-825 Test Questions, 642-825 Practice Exam, 642-825 Dumps?

With the complete collection of questions and answers, Pass4sure has assembled to take you through 172 Q&As to your 642-825 Exam preparation. In the 642-825 exam resources, you will cover every field and category in CCNP helping to ready you for your successful Cisco Certification.