Free Cisco 642-648 Exam Dumps Questions & Answers

When initiating a new SSL or TLS session, the client receives the server SSL certificate and validates it. After validating the server certificate, what does the client use the certificate for?

• A.  The server creates a separate session key and sends it to the client. The client decrypts the session key by using the server public key.
• B.  The client and server use the server public key to encrypt the SSL session data.
• C.  The client generates a random session key, encrypts it with the server public key, and then sends it to the server.
• D.  The client and server switch to a DH key exchange to establish a session key.

When troubleshooting a site-to-site IPsec VPN deployment, you see a QM FSM message.
What is the most likely cause of this message?

• A.  IKE Phase 1 has failed authentication due to mismatched DH groups.
• B.  There are mismatched proxy identities.
• C.  The Quick Mode timers have expired.
• D.  Forward Secrecy Mode has failed.

With SCEP enabled in a Cisco AnyConnect Connection Profile, what additional configuration step must you do when using Cisco ASA 8.4 software?

• A.  Configure the client to poll the CA for a response to the certificate request.
• B.  Configure local authentication prior to the enrollment process.
• C.  Configure the location of the CA server.
• D.  Configure the profile to inherit the SCEP forwarding URL.

Upon receiving a digital certificate, what are three steps that a Cisco ASA performs to authenticate the digital certificate? (Choose three.)

• A.  The identity certificate thumbprint is validated using the private key of the stored CA.
• B.  The identity certificate signature is validated by using the stored root certificate.
• C.  If enabled, the Cisco ASA locates the CRL and validates the identity certificate.
• D.  The signature is validated by using the stored identity certificate.
• E.  The identity certificate validity period is verified against the system clock of the Cisco ASA.

What are three methods for VPN address assignment? (Choose three.)

• A.  Kerberos server
• B.  RSA SecureID authentication server
• C.  LDAP server
• D.  RADIUS authentication server
• E.  internal address pool