Cisco 640-554 Actual Free Exam Questions & Community Discussion

Exam Code/Number: 640-554
Exam Name/Title: Implementing Cisco IOS Network Security (IINS v2.0)
Certification Provider: Cisco
Corresponding Certification: CCNA Security

Exam Questions: 289
Updated On: May 29, 2026

Question #29

On which protocol number does Encapsulating Security Payload operate?

A. 51

B. 47

C. 06

D. 50

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #30

When a company puts a security policy in place, what is the effect on the company's business?

A. Minimizing liability

B. Minimizing risk

C. Minimizing total cost of ownership

D. Maximizing compliance

Discussion 0

Correct Answer: B Vote an answer

Question #31

What is the Cisco preferred countermeasure to mitigate CAM overflows?

A. dynamic port security

B. IP source guard

C. root guard

D. port security

Discussion 0

Correct Answer: A Vote an answer

Question #32

DRAG DROP
Drag the disaster recovery concepts from the left and drop them on their definitions on the right.

Discussion 0

Correct Answer:

Question #33

What are two primary attack methods of VLAN hopping? (Choose two.)

A. double tagging

B. VoIP hopping

C. switch spoofing

D. CAM-table overflow

Discussion 0

Correct Answer: A,C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #34

Which type of Cisco ASA access list entry can be configured to match multiple entries in a single statement?

A. class-map

B. extended wildcard matching

C. object groups

D. nested object-class

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #35

Which type of network masking is used when Cisco IOS access control lists are configured?

A. standard subnet masking

B. priority masking

C. extended subnet masking

D. wildcard masking

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #36

Refer to the exhibit and partial configuration.

Which statement is true?

A. All traffic from network 10.0.0.0 will be permitted.

B. This ACL will prevent any host on the Internet from spoofing the inside network address as the source address for packets coming into the router from the Internet.

C. This is a misconfigured ACL resulting in traffic not being allowed into the router in interface S0.

D. All traffic destined for network 172.16.150.0 will be denied due to the implicit deny all.

E. Access-list 101 will prevent address spoofing from interface E0.

Discussion 0

Correct Answer: E Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #37

What hash type does Cisco use to validate the integrity of downloaded images?

A. SHA-2

B. MD5

C. SHA-1

D. MD1

Discussion 0

Correct Answer: B Vote an answer

Question #38

On Cisco ISR routers, for what purpose is the realm-cisco.pub public encryption key used?

A. used during the DH exchanges on IPsec VPNs

B. used to generate a persistent self-signed identity certificate for the ISR so administrators can authenticate the ISR when accessing it using Cisco Configuration Professional

C. used to verify the digital signature of the IPS signature file

D. used for SSH server/client authentication and encryption

E. used to enable asymmetric encryption on IPsec and SSL VPNs

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #39

Which two countermeasures can mitigate ARP spoofing attacks? (Choose two.)

A. IP source guard

B. DHCP snooping

C. dynamic ARP inspection

D. port security

Discussion 0

Correct Answer: B,C Vote an answer

Question #40

Refer to the exhibit.

This Cisco IOS access list has been configured on the FA0/0 interface in the inbound direction.
Which four TCP packets sourced from 10.1.1.1 port 1030 and routed to the FA0/0 interface are permitted? (Choose four.)

A. destination ip address: 192.168.15.37 destination port: 22

B. destination ip address: 192.168.15.36 destination port: 80

C. destination ip address: 192.168.15.80 destination port: 23

D. destination ip address: 192.168.15.63 destination port: 80

E. destination ip address: 192.168.15.66 destination port: 8080

F. destination ip address: 192.168.15.40 destination port: 21

Discussion 0

Correct Answer: B,C,D,E Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #41

Which VTP mode allows you to change the VLAN configuration and will then propagate the change throughout the entire switched network?

A. VTP client

B. VTP off

C. VTP server

D. VTP transparent

Discussion 0

Correct Answer: C Vote an answer

Question #42

Which option is the correct representation of the IPv6 address 2001:0000:150C:0000:0000:41B1:45A3:041D?

A. 2001::150c::41b1:45a3:041d

B. 2001:0:150c:0::41b1:45a3:04d1

C. 2001:150c::41b1:45a3::41d

D. 2001:0:150c::41b1:45a3:41d

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Download Free Cisco 640-554 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 640-554 exam.