Question 1

Which statement describes an advantage of cloud-based detection?

Accepted Answer

A)  Limited customization allows for faster detection. 
B)  Fewer resources are required on the endpoint. 
C)  Sandboxing reduces the overall management overhead of the system. 
D)  High-speed analytical engines on the endpoint limit the amount of work the cloud must perform. 
A)  Limited customization allows for faster detection. 
B)  Fewer resources are required on the endpoint. 
C)  Sandboxing reduces the overall management overhead of the system. 
D)  High-speed analytical engines on the endpoint limit the amount of work the cloud must perform.

Question 2

In the Cisco future solutions architecture framework, the security solutions are directly built upon which component?

Accepted Answer

A)  management and intelligence capabilities 
B)  Cisco security platforms 
C)  third-party applications 
D)  security intelligence operations 
A)  management and intelligence capabilities 
B)  Cisco security platforms 
C)  third-party applications 
D)  security intelligence operations

Question 3

When a user initiates a scan, which types of scan are available as options? Real 15 Cisco 500-275 Exam

Accepted Answer

A)  scheduled scan, thorough scan, quick scan, network scan 
B)  jiffy scan, overnight scan, scan when available, vulnerability scan 
C)  flash scan, custom scan, full scan 
D)  none, because user-initiated scans are not allowed 
A)  scheduled scan, thorough scan, quick scan, network scan 
B)  jiffy scan, overnight scan, scan when available, vulnerability scan 
C)  flash scan, custom scan, full scan 
D)  none, because user-initiated scans are not allowed

Question 4

For which application is Snort output suitable?

Accepted Answer

A)  tcpdump 
B)  Wireshark 
C)  any application that can read PCAP format 
D)  NMap 
A)  tcpdump 
B)  Wireshark 
C)  any application that can read PCAP format 
D)  NMap

Question 5

Which preprocessor plays a role in detecting the reconnaissance phase of an attack?

Accepted Answer

A)  sfPortscan 
B)  frag3 
C)  telnet_decode 
D)  rpc_decode 
A)  sfPortscan 
B)  frag3 
C)  telnet_decode 
D)  rpc_decode

Question 6

Given the regular expression /[^Cc]at/, where does the system look for the "C" or "c"?

Accepted Answer

A)  at the beginning of the line 
B)  at the end of the line 
C)  anywhere 
D)  nowhere, because the content is negated 
A)  at the beginning of the line 
B)  at the end of the line 
C)  anywhere 
D)  nowhere, because the content is negated

Question 7

Which option is used to implement suppression in the Rule Management user interface?

Accepted Answer

A)  Rule Category 
B)  Global 
C)  Source 
D)  Protocol 
A)  Rule Category 
B)  Global 
C)  Source 
D)  Protocol

Question 8

An IPS addresses evasion by implementing countermeasures. What is one such countermeasure?

Accepted Answer

A)  periodically reset statistical buckets to zero for memory utilization, maximization, and performance 
B)  send packets to the origination host of a given communication session, to confirm or eliminate spoofing 
C)  perform pattern and signature analysis against the entire packet, rather than against individual fragments 
D)  automate scans of suspicious source IP addresses 
A)  periodically reset statistical buckets to zero for memory utilization, maximization, and performance 
B)  send packets to the origination host of a given communication session, to confirm or eliminate spoofing 
C)  perform pattern and signature analysis against the entire packet, rather than against individual fragments 
D)  automate scans of suspicious source IP addresses

Question 9

Which set of actions would you take to create a simple custom detection?

Accepted Answer

A)  Add a SHA-256 value; upload a file to calculate a SHA-256 value; upload a text file that contains SHA-256 values. 
B)  Upload a packet capture; use a Snort rule; use a ClamAV rule. 
C)  Manually input the PE header data, the MD-5 hash, and a list of MD-5 hashes. 
D)  Input the file and file name. 
A)  Add a SHA-256 value; upload a file to calculate a SHA-256 value; upload a text file that contains SHA-256 values. 
B)  Upload a packet capture; use a Snort rule; use a ClamAV rule. 
C)  Manually input the PE header data, the MD-5 hash, and a list of MD-5 hashes. 
D)  Input the file and file name.

Question 10

Which action can you take from the Detections/Quarantine screen?

Accepted Answer

A)  Create a policy. 
B)  Restore the detected file. 
C)  Run a report. 
D)  Change computer group membership. 
A)  Create a policy. 
B)  Restore the detected file. 
C)  Run a report. 
D)  Change computer group membership.

Question 11

In a FireAMP Private Cloud installation, deployed connectors communicate with which server?

Accepted Answer

A) opadmin..com B) console..com C) cloud..com D) aws..com A) opadmin..com B) console..com C) cloud..com D) aws..com

Question 12

Which action is valid for decoder/preprocessor stub rules?

Accepted Answer

A)  file I/O 
B)  recurse 
C)  inspect 
D)  reject 
A)  file I/O 
B)  recurse 
C)  inspect 
D)  reject

Question 13

Which IPS placement option is the noisiest?

Accepted Answer

A)  inside the firewall 
B)  outside the firewall 
C)  inside the DMZ 
D)  inside general user segments 
A)  inside the firewall 
B)  outside the firewall 
C)  inside the DMZ 
D)  inside general user segments

Question 14

Which integrated technology solution deals with application-centric infrastructures?

Accepted Answer

A)  Cisco Unified Access 
B)  Cisco Security as a Service 
C)  Cisco Cyber Threat Defense 
D)  Cisco Secure Data Center 
E)  Cisco TrustSec 
A)  Cisco Unified Access 
B)  Cisco Security as a Service 
C)  Cisco Cyber Threat Defense 
D)  Cisco Secure Data Center 
E)  Cisco TrustSec

Question 15

Incident responders use which policy mode for outbreak control?

Accepted Answer

A)  Audit 
B)  Protect 
C)  Triage 
D)  Emergency 
A)  Audit 
B)  Protect 
C)  Triage 
D)  Emergency

Question 16

What does packet latency thresholding measure?

Accepted Answer

A)  the total elapsed time it takes to process a packet 
B)  the amount of time it takes for a rule to process 
C)  the amount of time it takes to process an event 
D)  the time span between a triggered event and when the packet is dropped 
A)  the total elapsed time it takes to process a packet 
B)  the amount of time it takes for a rule to process 
C)  the amount of time it takes to process an event 
D)  the time span between a triggered event and when the packet is dropped

Question 17

Which information does the File Trajectory feature show?

Accepted Answer

A)  the time that the scan was run 
B)  the name of the file 
C)  the hosts on which the file was seen and points in time where events occurred 
D)  the protocol 
A)  the time that the scan was run 
B)  the name of the file 
C)  the hosts on which the file was seen and points in time where events occurred 
D)  the protocol

Question 18

Which policy controls malware blocking configuration?

Accepted Answer

A)  file policy 
B)  malware policy 
C)  access control policy 
D)  IPS policy 
A)  file policy 
B)  malware policy 
C)  access control policy 
D)  IPS policy

Question 19

Which option is a detection technology that is used by FireAMP?

Accepted Answer

A)  fuzzy matching 
B)  Norton AntiVirus 
C)  network scans 
D)  Exterminator 
A)  fuzzy matching 
B)  Norton AntiVirus 
C)  network scans 
D)  Exterminator

Question 20

Alert priority is established in which way?

Accepted Answer

A)  event classification 
B)  priority.conf file 
C)  host criticality selection 
D)  through Context Explorer 
A)  event classification 
B)  priority.conf file 
C)  host criticality selection 
D)  through Context Explorer

Exam 47: Designing Cisco Unified Contact Center Enterprise (UCCED)

Which statement describes an advantage of cloud-based detection?

In the Cisco future solutions architecture framework, the security solutions are directly built upon which component?

When a user initiates a scan, which types of scan are available as options? Real 15 Cisco 500-275 Exam

For which application is Snort output suitable?

Which preprocessor plays a role in detecting the reconnaissance phase of an attack?

Given the regular expression /[^Cc]at/, where does the system look for the "C" or "c"?

Which option is used to implement suppression in the Rule Management user interface?

An IPS addresses evasion by implementing countermeasures. What is one such countermeasure?

Which set of actions would you take to create a simple custom detection?

Which action can you take from the Detections/Quarantine screen?

In a FireAMP Private Cloud installation, deployed connectors communicate with which server?

Which action is valid for decoder/preprocessor stub rules?

Which IPS placement option is the noisiest?

Which integrated technology solution deals with application-centric infrastructures?

Incident responders use which policy mode for outbreak control?

What does packet latency thresholding measure?

Which information does the File Trajectory feature show?

Which policy controls malware blocking configuration?

Which option is a detection technology that is used by FireAMP?

Alert priority is established in which way?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters