Cisco 642-617 Actual Free Exam Questions & Community Discussion

Exam Code/Number: 642-617
Exam Name/Title: Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0)
Certification Provider: Cisco
Corresponding Certification: CCNP

Exam Questions: 86
Updated On: Jul 22, 2026

Question #1

Which statement about the default ACL logging behavior of the Cisco ASA is true?

A. The Cisco ASA generates system message 106023 for each packet that matched an
ACE.

B. No ACL logging is enabled by default.

C. The Cisco ASA generates system message 106100 only for the first packet that matched an ACE.

D. The Cisco ASA generates system message 106023 for each denied packet when a deny ACE is configured

E. The Cisco ASA generates system message 106100 for each packet that matched an
ACE.

Discussion 0

Correct Answer: D Vote an answer

Question #2

Which three statements about traffic shaping capability on the Cisco ASA are true?
(Choose three.)

A. Traffic shaping is not supported on the Cisco ASA 5580.

B. Traffic shaping can cause jitter and delay.

C. Traffic shaping can be applied to all outgoing traffic on a physical interface or in the case of the Cisco ASA 5505, on a VLAN

D. Traffic shaping can be applied in the input or output direction.

E. You can configure both traffic shaping and priority queueing on the same interface.

Discussion 0

Correct Answer: A,B,C Vote an answer

Question #3

Refer to the exhibit. Which two options will result from the Cisco ASA configuration?
(Choose two.)

A. The Cisco ASA will translate the DNS A-Record reply from the DNS server to any inside client for the web server (web server IP =192.168.100.1).

B. The web server will be reachable only from the outside.

C. The global IP address of the web server is 209.165.200.230.

D. The web server will be reachable only from the inside.

E. The outside hosts can use the 192.168.100.1 IP address to reach the web server on the inside network.

F. The inside web client will use the 209.165.200.230 IP address to reach the web server and the Cisco ASA will translate the 209.165.200.230
IP address to the 192.168.100.1 IP address.

Discussion 0

Correct Answer: A,C Vote an answer

Question #4

What features are available by default with CSC-SSM base License? (Choose Three)

A. URL Blocking and Filtering

B. email content control

C. HTTP & FTP file Blocking

D. Antispyware

E. Antiphishing

F. Antivirus

G. Antispam

Discussion 0

Correct Answer: C,D,F Vote an answer

Question #5

By default, which access rule is applied inbound to the inside interface?

A. All IP traffic is permitted.

B. All IP traffic is denied.

C. All IP traffic sourced from any source to any less secure network destinations is permitted.

D. All IP traffic sourced from any source to any more secure network destinations is permitted

Discussion 0

Correct Answer: C Vote an answer

Question #6

When troubleshooting redundant interface operations on the Cisco ASA, which configuration should be verified?

A. The nameif configuration on the member physical interfaces are identical.

B. The active interface is sending periodic hellos to the standby interface.

C. The MAC address configuration on the member physical interfaces are identical.

D. The IP address configuration on the logical redundant interface is correct.

E. The duplex and speed configuration on the logical redundant interface are correct.

Discussion 0

Correct Answer: D Vote an answer

Question #7

When troubleshooting a Cisco ASA (running 8.2.2) that is operating in transparent firewall mode, what should you verify to ensure proper operation?

A. The Cisco ASA is configured for ARP inspection.

B. The Cisco ASA is using a dedicated management interface for management access.

C. The Cisco ASA global IP address belongs to the same subnet as the directly connected interfaces.

D. The outside and inside interface are connected to different Layer 3 subnets.

E. The Cisco ASA has not been configured for inside static or dynamic NAT.

Discussion 0

Correct Answer: C Vote an answer

Question #8

Which three configuration options are available when configuring static routes on the Cisco
ASA? (Choose three.)

A. Specify that the static route will not be removed, even if the interface shuts down.

B. Specify a tag value to the static route that can be used as a "match" value for controlling redistribution via route maps

C. Enable route tracking.

D. Specify the static route as the default tunnel gateway for VPN traffic.

E. Change the default metric (admin distance) from 1 to some other value.

Discussion 0

Correct Answer: C,D,E Vote an answer

Question #9

Refer to the exhibit. A Cisco ASA in transparent firewall mode generates the log messages seen in the exhibit. What should be configured on the Cisco ASA to allow the denied traffic?

A. static ARP mapping

B. stateful packet inspection

C. static MAC address mapping

D. EtherType ACL on the outside and inside interface to permit the multicast traffic

E. extended ACL on the outside and inside interface to permit the multicast traffic

Discussion 0

Correct Answer: E Vote an answer

Download Free Cisco 642-617 Demo

Simply submit your e-mail address below to get started with our free demo of your Cisco 642-617 exam.