Question 1

Which statement is true in regard to the Sourcefire Security Intelligence lists?

Accepted Answer

A)  The global blacklist universally allows all traffic through the managed device. 
B)  The global whitelist cannot be edited. 
C)  IP addresses can be added to the global blacklist by clicking on interactive graphs in Context Explorer. 
D)  The Security Intelligence lists cannot be updated. 
A)  The global blacklist universally allows all traffic through the managed device. 
B)  The global whitelist cannot be edited. 
C)  IP addresses can be added to the global blacklist by clicking on interactive graphs in Context Explorer. 
D)  The Security Intelligence lists cannot be updated.

Question 2

To accept input from Snort and produce various forms of output, the Barnyard architecture consists of which components?

Accepted Answer

A)  preprocessors and reassemblers 
B)  preprocessors and detection engine 
C)  data processors and output plug-ins 
D)  data processors and reassemblers 
A)  preprocessors and reassemblers 
B)  preprocessors and detection engine 
C)  data processors and output plug-ins 
D)  data processors and reassemblers

Question 3

Which preprocessor maintains connection state so that attacks that manifest over multiple packets in a session can be detected?

Accepted Answer

A)  stream5 
B)  frag3 
C)  flow tracking module 
D)  detection engine 
A)  stream5 
B)  frag3 
C)  flow tracking module 
D)  detection engine

Question 4

A default FireAMP Private Cloud installation can accommodate how many connectors over which period of time?

Accepted Answer

A)  100 connectors over a 15-day period 
B)  1000 connectors over a 45-day period 
C)  5000 connectors over a 10-day period 
D)  500 connectors over a 30-day period 
A)  100 connectors over a 15-day period 
B)  1000 connectors over a 45-day period 
C)  5000 connectors over a 10-day period 
D)  500 connectors over a 30-day period

Question 5

Where does an administrator go to get a copy of a fetched file?

Accepted Answer

A)  the Business Defaults page 
B)  the File menu, followed by Downloads 
C)  the File Repository 
D)  the Search selection in the Analysis menu 
A)  the Business Defaults page 
B)  the File menu, followed by Downloads 
C)  the File Repository 
D)  the Search selection in the Analysis menu

Question 6

Which mechanism should be used to write an IPS rule that focuses on the client or server side of a TCP communication?

Accepted Answer

A)  the directional operator in the rule header 
B)  the "flow" rule option 
C)  specification of the source and destination ports in the rule header 
D)  The detection engine evaluates all sides of a TCP communication regardless of the rule options. 
A)  the directional operator in the rule header 
B)  the "flow" rule option 
C)  specification of the source and destination ports in the rule header 
D)  The detection engine evaluates all sides of a TCP communication regardless of the rule options.

Question 7

Which statement is true about the Device Trajectory feature?

Accepted Answer

A)  It shows where the endpoint devices have moved in your environment by displaying each IP address that a device has had over time. 
B)  A "plus" sign on the File Trajectory map indicates that you can execute the file inside FireAMP. 
C)  In the File Trajectory map, you can view the parent process for a file by selecting the infected system. 
D)  It shows hosts that display Indications of Compromise. 
A)  It shows where the endpoint devices have moved in your environment by displaying each IP address that a device has had over time. 
B)  A "plus" sign on the File Trajectory map indicates that you can execute the file inside FireAMP. 
C)  In the File Trajectory map, you can view the parent process for a file by selecting the infected system. 
D)  It shows hosts that display Indications of Compromise.

Question 8

Which technique can an intruder use to try to evade detection by a Snort sensor?

Accepted Answer

A)  exceed the maximum number of fragments that a sensor can evaluate 
B)  split the malicious payload over several fragments to mask the attack signature 
C)  disable a sensor by exceeding the number of packets that it can fragment before forwarding 
D)  send more packet fragments than the destination host can reassemble, to disable the host without regard to any intrusion-detection devices that might be on the network 
A)  exceed the maximum number of fragments that a sensor can evaluate 
B)  split the malicious payload over several fragments to mask the attack signature 
C)  disable a sensor by exceeding the number of packets that it can fragment before forwarding 
D)  send more packet fragments than the destination host can reassemble, to disable the host without regard to any intrusion-detection devices that might be on the network

Question 9

What do policies enable you to do? Real 6 Cisco 500-275 Exam

Accepted Answer

A)  specify a custom whitelist 
B)  specify group membership 
C)  specify hosts to include in reports 
D)  specify which events to view 
A)  specify a custom whitelist 
B)  specify group membership 
C)  specify hosts to include in reports 
D)  specify which events to view

Question 10

Remote access to the Defense Center database has which characteristic?

Accepted Answer

A)  read/write 
B)  read-only 
C)  Postgres 
D)  Estreamer 
A)  read/write 
B)  read-only 
C)  Postgres 
D)  Estreamer

Question 11

Which component of Cisco network security builds on basic firewall capabilities by adding web filtering, web email controls, and Cisco Application Visibility and Control?

Accepted Answer

A)  Cisco Advanced Malware Protection for Networks 
B)  Cisco ASA Next-Generation Firewall 
C)  Sourcefire Next-Generation Intrusion Prevention System 
D)  Cisco Web Security Appliance 
A)  Cisco Advanced Malware Protection for Networks 
B)  Cisco ASA Next-Generation Firewall 
C)  Sourcefire Next-Generation Intrusion Prevention System 
D)  Cisco Web Security Appliance

Question 12

Real 3 Cisco 500-275 Exam Which option is a detection technology that is used by FireAMP?

Accepted Answer

A)  fuzzy matching 
B)  Norton AntiVirus 
C)  network scans 
D)  Exterminator 
A)  fuzzy matching 
B)  Norton AntiVirus 
C)  network scans 
D)  Exterminator

Question 13

Consider the process that begins with file retrospection, continues to interrogate the file and update its disposition over time, then records the pathway that the software and files take from device to device. This process is an example of which Cisco AMP feature?

Accepted Answer

A)  file reputation 
B)  attack chain weaving 
C)  breach hunting 
D)  file sandboxing 
E)  machine learning 
A)  file reputation 
B)  attack chain weaving 
C)  breach hunting 
D)  file sandboxing 
E)  machine learning

Question 14

Which statement is true when adding a network to an access control rule?

Accepted Answer

A)  You can select only source networks. 
B)  You must have preconfigured the network as an object. 
C)  You can select the source and destination networks or network groups. 
D)  You cannot include multiple networks or network groups as sources or destinations. 
A)  You can select only source networks. 
B)  You must have preconfigured the network as an object. 
C)  You can select the source and destination networks or network groups. 
D)  You cannot include multiple networks or network groups as sources or destinations.

Question 15

A context box opens when you click on an event icon in the Network File Trajectory map for a file. Which option is an element of the box?

Accepted Answer

A)  Scan 
B)  Application Protocol 
C)  Threat Name 
D)  File Name 
A)  Scan 
B)  Application Protocol 
C)  Threat Name 
D)  File Name

Question 16

Which option describes Spero file analysis?

Accepted Answer

A)  a method of analyzing the SHA-256 hash of a file to determine whether a file is malicious or not 
B)  a method of analyzing the entire contents of a file to determine whether it is malicious or not 
C)  a method of analyzing certain file characteristics, such as metadata and header information, to determine whether a file is malicious or not 
D)  a method of analyzing a file by executing it in a sandbox environment and observing its behaviors to determine if it is malicious or not 
A)  a method of analyzing the SHA-256 hash of a file to determine whether a file is malicious or not 
B)  a method of analyzing the entire contents of a file to determine whether it is malicious or not 
C)  a method of analyzing certain file characteristics, such as metadata and header information, to determine whether a file is malicious or not 
D)  a method of analyzing a file by executing it in a sandbox environment and observing its behaviors to determine if it is malicious or not

Question 17

Which command-line argument can you use with Snort to produce a binary output file?

Accepted Answer

A)  -B 
B)  -b 
C)  -u 
D)  -U 
A)  -B 
B)  -b 
C)  -u 
D)  -U

Question 18

Which option is a remediation module that comes with the Sourcefire System?

Accepted Answer

A)  Cisco IOS Null Route 
B)  Syslog Route 
C)  Nmap Route Scan 
D)  Response Group 
A)  Cisco IOS Null Route 
B)  Syslog Route 
C)  Nmap Route Scan 
D)  Response Group

Question 19

On average, how many pieces of new malware are created every second?

Accepted Answer

A)  one 
B)  four 
C)  20 
D)  100 
A)  one 
B)  four 
C)  20 
D)  100

Question 20

Given the rule option byte_test:1, ,64,2;, what is the offset?

Accepted Answer

A)  1 
B)  2 
C)  64 
D)  cannot be determined 
A)  1 
B)  2 
C)  64 
D)  cannot be determined

Exam 47: Designing Cisco Unified Contact Center Enterprise (UCCED)

Which statement is true in regard to the Sourcefire Security Intelligence lists?

To accept input from Snort and produce various forms of output, the Barnyard architecture consists of which components?

Which preprocessor maintains connection state so that attacks that manifest over multiple packets in a session can be detected?

A default FireAMP Private Cloud installation can accommodate how many connectors over which period of time?

Where does an administrator go to get a copy of a fetched file?

Which mechanism should be used to write an IPS rule that focuses on the client or server side of a TCP communication?

Which statement is true about the Device Trajectory feature?

Which technique can an intruder use to try to evade detection by a Snort sensor?

What do policies enable you to do? Real 6 Cisco 500-275 Exam

Remote access to the Defense Center database has which characteristic?

Which component of Cisco network security builds on basic firewall capabilities by adding web filtering, web email controls, and Cisco Application Visibility and Control?

Real 3 Cisco 500-275 Exam Which option is a detection technology that is used by FireAMP?

Consider the process that begins with file retrospection, continues to interrogate the file and update its disposition over time, then records the pathway that the software and files take from device to device. This process is an example of which Cisco AMP feature?

Which statement is true when adding a network to an access control rule?

A context box opens when you click on an event icon in the Network File Trajectory map for a file. Which option is an element of the box?

Which option describes Spero file analysis?

Which command-line argument can you use with Snort to produce a binary output file?

Which option is a remediation module that comes with the Sourcefire System?

On average, how many pieces of new malware are created every second?

Given the rule option byte_test:1, ,64,2;, what is the offset?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters