ActualTests.Cisco.640-802.Exam.Q.and.A.08.15.08-DDU (1130589), страница 72
Текст из файла (страница 72)
In thisexample there is no permit statement, so it will deny all traffic exiting E0 Interface.Incorrect Answers:A. It will deny everything, including FTP and telnet traffic.B, C, E. It will deny all traffic in addition to the condition mentioned in these answers,because there is no permit statement at the end.QUESTION 635:On a newly installed Certkiller router, the following access list is added to serialinterface for incoming traffic:Access-list 101 permit tcp any 10.18.10.0 0.0.0.255 eq 23What is the effect of the "any" keyword in the above access list?A. check any of the bits in the source addressB. permit any wildcard mask for the addressC. accept any source addressD.
check any bit in the destination addressE. permit 255.255.255.255 0.0.0.0F. accept any destinationG. None of the aboveAnswer: CExplanation:The "any" in this list is the source address to filter. If it is set to any or "0.0.0.0255.255.255.255", then any source address will be filtered. In the example above, theaccess list is stating that any TCP traffic from any source going to the 10.18.10.0/24network will be allowed.QUESTION 636:Which one of the following commands will display the placement and direction of anIP access control list on the interfaces of a router?A.
show interface listB. show ip routeC. show ip interfaceD. show ip interface briefE. show interfaceActualtests.com - The Power of Knowing640-802F. None of the aboveAnswer: CExplanation:The command "show ip interface" will include a reference to the access lists enabled onthe interface.QUESTION 637:You are a technician at Certkiller . Your assistant applied an IP access control list toRouter CK1 . You want to check the placement and direction of the access controllist.Which command should you use?A.
show access-listB. show ip access-listC. show ip interfaceD. show interfaceE. show interface listF. None of the aboveAnswer: CExplanation:The show ip interface [name] command can be used to see if the access-list is on theinterface. Output will vary depending on how the access-list command was applied butcan include:* Outgoing access list is not set* Inbound access list is 101* Outgoing access list is not set* Inbound access list is 101, default is not setIncorrect Answers:A, B.
This would simply show you the contents of the ACL, as well as the countersassuming the "log" keyword was configured on the access list. Example:Show access list 101 or show IP access list 101* Extended IP access list 101* deny tcp any any (1649 matches)* deny udp any any (35 matches)* deny icmp any any (36 matches)D. This will display the statistics pertaining to the interface, but not any configuredaccess lists that are applied.QUESTION 638:Actualtests.com - The Power of Knowing640-802Which of the following statements regarding the use of multiple access lists are validwhen configuring a single interface on a Cisco router?A. Application of up to three access lists per protocol to a single interface.B. No more than two access lists per interface.C.
One access list may be configured per direction for each Layer 3 protocol configuredon an interface.D. The maximum number allowed varies due to RAM availability in the router.E. An infinite number of access lists that can be applied to an interface, from mostspecific to most general.F. Cisco IOS allows only one access list to an interface.G. None of the aboveAnswer: CExplanation:For each interface, one access list for each protocol (IP, IPX, etc) can be applied in theinbound direction, and one for the outbound direction.Incorrect Answers:B. It is true that no more than two access lists can be applied per interface (inbound andoutbound).
However, this applies per layer 3 protocol, so it is possible to configure morethan 2 access lists per interface.QUESTION 639:The following configuration line was added to router CK1 :Access-list 101 permit ip 10.25.30.0 0.0.0.255 anyWhat is the effect of this access list configuration?A. It will permit all packets matching the host bits in the source address to alldestinationsB.
It will permit all packets to destinations matching the first three octets in thedestination addressC. It will permit all packets from the third subnet of the network address to alldestinationsD. It will permit all packets matching the first three octets of the source address to alldestinationsE. It will permit all packets matching the last octet of the destination address and acceptall source addressesF. None of the aboveAnswer: DActualtests.com - The Power of Knowing640-802QUESTION 640:The Certkiller network is shown below:The CK network administrator needs to troubleshoot an ACL issue. He would liketo permit only hosts on the 172.30.16.0/24 network to access the Internet. Whichwild card mask and address combination will only match addresses on thisnetwork?A.
172.30.0.0 0.0.0.0B. 172.30.16.0 0.0.0.255C. 172.30.0.0 0.0.15.255D. 172.30.16.0 0.0.31.255E. 172.30.16.0 0.0.255.255Answer: BExplanation:According to question, only the hosts from 172.30.16.30/24 network allow to access theInternet, for that we should use the wildcard masking. 172.168.16.0 0.0.0.255 where 0means exact and 255 means 1-255 range.For any particular host: 192.168.0.1 0.0.0.0For Range: 192.168.0.1 0.0.0.3 means 1-4 total 4 hosts.QUESTION 641:In the Certkiller network shown below, a network technician enters the followingline into the router:Tidmore1(config)# access-list 106 deny tcp 192.168.254.0 0.0.0.255 any eq www.What is the effect of this configuration, given that the router was already configuredas shown below?Actualtests.com - The Power of Knowing640-802A.
Web pages from the Internet cannot be accessed by hosts in the 192.168.254.0 LAN.B. No hosts in the 192.168.254.0 LAN except 192.168.254.7 can access web pages fromthe Internet.C. The change has no effect on the packets being filtered.D. All traffic from the 192.168.254.0 LAN to the Internet is permitted.Answer: CExplanation:Traffic that comes into the router is compared to ACL entries based on the order that theentries occur in the router. New statements are added to the end of the list. The routercontinues to look until it has a match. If no matches are found when the router reachesthe end of the list, the traffic is denied.
For this reason, you should have the frequently hitentries at the top of the list. There is an "implied deny" for traffic that is not permitted. Asingle-entry ACL with only one "deny" entry has the effect of denying all traffic. Youmust have at least one "permit" statement in an ACL or all traffic is blocked. In thisexample, since the statement will be added to the end of the access list, and since there isalready an entry that permits all IP traffic, the www traffic will be allowed, all traffic willnever reach this access list entry.QUESTION 642:For security reasons, the network administrator needs to prevent pings into thecorporate networks from hosts outside the internetwork. Which protocol should beblocked with access control lists?A.
UDPB. ICMPC. IPD. TCPActualtests.com - The Power of Knowing640-802E. None of the aboveAnswer: BExplanation:ICMP is used for error and control messages within the IP world and is very muchintegrated with IP. Ping is a computer network tool used to test whether a particular hostis reachable across an IP network. Ping works by sending ICMP "echo request" packetsto the target host and listening for ICMP "echo response" replies.QUESTION 643:A Certkiller network associate creates the configuration shown in the exhibit below:Exhibit:What will be the results of this configuration?A.
The configuration creates an access list that allows all the hosts in the 172.16.232.0/24subnet to use Telnet but not to access web pages.B. The configuration creates an access list that allow all traffic from the hostActualtests.com - The Power of Knowing640-802172.16.232.253 except Telnet and ping traffic.C. The fourth line of the configuration creates an access list that allows only traffic fromthe host172.16.232.253 to anywhere in the network.D. The configuration creates four access lists.Answer: DExplanation:With all access list entries, the order of entries is important.
Normally, when a packet isevaluated against entries in an access list, the entries are evaluated in sequential order,and when a match occurs, no more entries are evaluated. However, this applies to accesslists with the same number, but has multiple lines. When a different number is specifiedfor each line, a different, separate, access list is actually created as is the case here.QUESTION 644:You need to configure NAT on a Certkiller router that is connected to the Internet.To do so, you must determine what the Inside Global IP addresses will be. Whatdoes the "Inside Global" address represent in the configuration of NAT?A.
The summarized address for all of the internal submitted addressesB. A registered address that represents that represents an inside host to an outsidenetworkC. A globally unique, private IP address assigned to a host on the inside networkD. The MAC address of the router used by inside hosts to connect to the InternetE. None of the aboveAnswer: BQUESTION 645:Which one of the following varieties of NAT utilizes different ports to map multipleIP addresses to a single globally registered IP address?A. Static NATB. Port loadingC. NAT OverloadingD.
Dynamic NATE. OverlappingF. None of the aboveAnswer: CExplanation:Actualtests.com - The Power of Knowing640-802Port address translation, or NAT overloading, uses transport layer port information todynamically create NAT entries. This is also known as one to many network addresstranslation.Incorrect Answers:A. Static NAT is known as one to one NAT, and is used to map a single IP address to asingle registered IP address.
It is often used for servers that need to be accessed via theInternet.B, D: This is the incorrect term, and is not used.QUESTION 646:Part of the Certkiller network is shown below:The Certkiller network administrator would like to implement NAT in the Certkillernetwork segment shown in the graphic to allow inside hosts to use a privateaddressing scheme. In this network segment, where should NAT be configured?A.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
