Question 1

Which statement regarding user exemptions is true?

Accepted Answer

A)  Non-administrators can be made exempt on an individual basis. 
B)  Exempt users have a browser session timeout restriction of 24 hours. 
C)  Administrators can be exempt from any browser session timeout value. 
D)  By default, all users cannot be exempt from any browser session timeout value. 
A)  Non-administrators can be made exempt on an individual basis. 
B)  Exempt users have a browser session timeout restriction of 24 hours. 
C)  Administrators can be exempt from any browser session timeout value. 
D)  By default, all users cannot be exempt from any browser session timeout value.

Question 2

File information is sent to the Sourcefire Collective Security Intelligence Cloud using which format?

Accepted Answer

A)  MD5 
B)  SHA-1 
C)  filenames 
D)  SHA-256 
A)  MD5 
B)  SHA-1 
C)  filenames 
D)  SHA-256

Question 3

When you instruct Snort to place ASCII-formatted log data in a specific directory, what does Snort use to organize the alert data?

Accepted Answer

A)  IP address 
B)  port number 
C)  packet 
D)  interface 
A)  IP address 
B)  port number 
C)  packet 
D)  interface

Question 4

What is the minimum action that you should take when configuring a new Snort installation?

Accepted Answer

A)  Turn on all the rules. 
B)  Inform your users that you have deployed an IDS/IPS. 
C)  Provision more network bandwidth in case your installation causes latency. 
D)  Configure your HOME_NET to include the networks that you want the sensor to protect. 
A)  Turn on all the rules. 
B)  Inform your users that you have deployed an IDS/IPS. 
C)  Provision more network bandwidth in case your installation causes latency. 
D)  Configure your HOME_NET to include the networks that you want the sensor to protect.

Question 5

Which statement describes the meaning of a red health status icon?

Accepted Answer

A)  A critical threshold has been exceeded. 
B)  At least one health module has failed. 
C)  A health policy has been disabled on a monitored device. 
D)  A warning threshold has been exceeded. 
A)  A critical threshold has been exceeded. 
B)  At least one health module has failed. 
C)  A health policy has been disabled on a monitored device. 
D)  A warning threshold has been exceeded.

Question 6

Which option can you enter in the Search text box to look for the trajectory of a particular file?

Accepted Answer

A)  the MD5 hash value of the file 
B)  the SHA-256 hash value of the file 
C)  the URL of the file 
D)  the SHA-512 hash value of the file 
A)  the MD5 hash value of the file 
B)  the SHA-256 hash value of the file 
C)  the URL of the file 
D)  the SHA-512 hash value of the file

Question 7

How does application blocking enhance security?

Accepted Answer

A)  It identifies and logs usage. 
B)  It tracks application abuse. 
C)  It deletes identified applications. 
D)  It blocks vulnerable applications from running, until they are patched. 
A)  It identifies and logs usage. 
B)  It tracks application abuse. 
C)  It deletes identified applications. 
D)  It blocks vulnerable applications from running, until they are patched.

Question 8

Which configuration is optimal for the frag3 engine?

Accepted Answer

A)  Bind target IP addresses to policies that represent operating systems, so that the IPS engine can process traffic the same way that target hosts do. 
B)  Bind client IP addresses to policies that represent operating systems, so that clients can process traffic the same way that the IPS engine does. 
C)  Keep the configuration as simple as possible, for better performance. 
D)  Deploy the engine only in passive mode, for better performance. 
A)  Bind target IP addresses to policies that represent operating systems, so that the IPS engine can process traffic the same way that target hosts do. 
B)  Bind client IP addresses to policies that represent operating systems, so that clients can process traffic the same way that the IPS engine does. 
C)  Keep the configuration as simple as possible, for better performance. 
D)  Deploy the engine only in passive mode, for better performance.

Question 9

Reputation filtering performs which two functions? (Choose two.)

Accepted Answer

A)  rates each site based on a reputation score 
B)  automatically updates devices based on threats 
C)  tunes itself according to relevance to the network 
D)  communicates with Cisco SenderBase, which is a common security database 
E)  analyzes in-depth parameters for anything that requests network access 
A)  rates each site based on a reputation score 
B)  automatically updates devices based on threats 
C)  tunes itself according to relevance to the network 
D)  communicates with Cisco SenderBase, which is a common security database 
E)  analyzes in-depth parameters for anything that requests network access

Question 10

Which option best describes granular app control using application visibility and control?

Accepted Answer

A)  blocking harmful sites based on content, such as pokerstars.com 
B)  blocking World of Warcraft but allowing Google+ 
C)  blocking Facebook games but allowing Facebook posts 
D)  blocking Twitter to increase employee productivity 
A)  blocking harmful sites based on content, such as pokerstars.com 
B)  blocking World of Warcraft but allowing Google+ 
C)  blocking Facebook games but allowing Facebook posts 
D)  blocking Twitter to increase employee productivity

Question 11

Which two features of AMP are available in Cisco AMP for Networks that are not available in Cisco AMP for Content alone? (Choose two.)

Accepted Answer

A)  trajectory 
B)  retrospective security 
C)  dynamic analytics 
D)  behavioral indications of compromise 
E)  fuzzy fingerprinting
F) one-to-one signature 
A)  trajectory 
B)  retrospective security 
C)  dynamic analytics 
D)  behavioral indications of compromise 
E)  fuzzy fingerprinting
F) one-to-one signature

Question 12

Which option describes the two basic components of Sourcefire Snort rules?

Accepted Answer

A)  preprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place 
B)  a rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol 
C)  a rule header to define source, destination, and protocol, and the output configuration to determine which form of output to produce if the rule triggers 
D)  a rule body that contains packet-matching criteria or options to define where to look for content in a packet, and a rule header to define matching criteria based on where a packet originates, where it is going, and over which protocol 
A)  preprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place 
B)  a rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol 
C)  a rule header to define source, destination, and protocol, and the output configuration to determine which form of output to produce if the rule triggers 
D)  a rule body that contains packet-matching criteria or options to define where to look for content in a packet, and a rule header to define matching criteria based on where a packet originates, where it is going, and over which protocol

Question 13

What is the purpose of using a span or monitor port on a switch?

Accepted Answer

A)  to aggregate traffic from multiple switch ports 
B)  to tap data off network media 
C)  to overcome problems that switches have in accurately reproducing desired traffic 
D)  to limit the amount of traffic that passes through the switch 
A)  to aggregate traffic from multiple switch ports 
B)  to tap data off network media 
C)  to overcome problems that switches have in accurately reproducing desired traffic 
D)  to limit the amount of traffic that passes through the switch

Question 14

Cisco network security offers unmatched visibility and control of network and application traffic. This statement describes which Cisco value?

Accepted Answer

A)  time-to-value 
B)  protection 
C)  control 
D)  scalability 
E)  flexibility
F) agility 
A)  time-to-value 
B)  protection 
C)  control 
D)  scalability 
E)  flexibility
F) agility

Question 15

Access control policy rules can be configured to block based on the conditions that you specify in each rule. Which behavior block response do you use if you want to deny and reset the connection of HTTP traffic that meets the conditions of the access control rule?

Accepted Answer

A)  interactive block with reset 
B)  interactive block 
C)  block 
D)  block with reset 
A)  interactive block with reset 
B)  interactive block 
C)  block 
D)  block with reset

Question 16

Which statement represents detection capabilities of the HTTP preprocessor?

Accepted Answer

A)  You can configure it to blacklist known bad web servers. 
B)  You can configure it to normalize cookies in HTTP headers. 
C)  You can configure it to normalize image content types. 
D)  You can configure it to whitelist specific servers. 
A)  You can configure it to blacklist known bad web servers. 
B)  You can configure it to normalize cookies in HTTP headers. 
C)  You can configure it to normalize image content types. 
D)  You can configure it to whitelist specific servers.

Question 17

The FireAMP connector supports which proxy type?

Accepted Answer

A)  SOCKS6 
B)  HTTP_proxy 
C)  SOCKS5_filename 
D)  SOCKS7 
A)  SOCKS6 
B)  HTTP_proxy 
C)  SOCKS5_filename 
D)  SOCKS7

Question 18

FireAMP reports can be distributed by which mechanism?

Accepted Answer

A)  email 
B)  cloud sync 
C)  Windows file share 
D)  a Crystal Reports subscription 
A)  email 
B)  cloud sync 
C)  Windows file share 
D)  a Crystal Reports subscription

Question 19

If a customer complains that employees access websites for work but then waste time with games and videos, which solution should you suggest, and why?

Accepted Answer

A)  Cisco AMP, for protection before, during, and after attacks 
B)  Cisco WSA, for its URL filtering ability 
C)  Cisco RSA, for its data loss prevention 
D)  Cisco WSA, for its application visibility and control 
E)  Cisco ESA, for its global threat operations
F) Cisco ESA, for its antivirus capabilities 
A)  Cisco AMP, for protection before, during, and after attacks 
B)  Cisco WSA, for its URL filtering ability 
C)  Cisco RSA, for its data loss prevention 
D)  Cisco WSA, for its application visibility and control 
E)  Cisco ESA, for its global threat operations
F) Cisco ESA, for its antivirus capabilities

Question 20

Which tool can you use to query the history.db file?

Accepted Answer

A)  Curl 
B)  FireAMP_Helper.vbs 
C)  cscript 
D)  SQLite 
A)  Curl 
B)  FireAMP_Helper.vbs 
C)  cscript 
D)  SQLite

Exam 47: Designing Cisco Unified Contact Center Enterprise (UCCED)

Which statement regarding user exemptions is true?

File information is sent to the Sourcefire Collective Security Intelligence Cloud using which format?

When you instruct Snort to place ASCII-formatted log data in a specific directory, what does Snort use to organize the alert data?

What is the minimum action that you should take when configuring a new Snort installation?

Which statement describes the meaning of a red health status icon?

Which option can you enter in the Search text box to look for the trajectory of a particular file?

How does application blocking enhance security?

Which configuration is optimal for the frag3 engine?

Reputation filtering performs which two functions? (Choose two.)

Which option best describes granular app control using application visibility and control?

Which two features of AMP are available in Cisco AMP for Networks that are not available in Cisco AMP for Content alone? (Choose two.)

Which option describes the two basic components of Sourcefire Snort rules?

What is the purpose of using a span or monitor port on a switch?

Cisco network security offers unmatched visibility and control of network and application traffic. This statement describes which Cisco value?

Access control policy rules can be configured to block based on the conditions that you specify in each rule. Which behavior block response do you use if you want to deny and reset the connection of HTTP traffic that meets the conditions of the access control rule?

Which statement represents detection capabilities of the HTTP preprocessor?

The FireAMP connector supports which proxy type?

FireAMP reports can be distributed by which mechanism?

If a customer complains that employees access websites for work but then waste time with games and videos, which solution should you suggest, and why?

Which tool can you use to query the history.db file?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters