Which security monitoring data type requires the most storage space? transaction data session data statistical data full packet capture QUESTION 2
Which security principle states that more than one person is required to perform a critical task? due diligence least privilege need to know separation of duties
Which definition of a fork in Linux is true? parent directory name of a file pathname macros for manipulating CPU sets daemon to execute scheduled commands new process created by a parent process QUESTION 4
Which two protocols are used for email (Choose two ) IMAP SMTP HTTP NTP DNS
Cisco 210-250 Exam
Which statement about digitally signing a document is true? The document is hashed and then the document is encrypted with the private key. The document is encrypted and then the document is hashed with the public key The document is hashed and then the document is encrypted with the public key. The document is hashed and then the hash is encrypted with the private key.
Which two actions are valid uses of public key infrastructure? (Choose two ) ensuring the privacy of a certificate revoking the validation of a certificate creating duplicate copies of a certificate changing ownership of a certificate validating the authenticity of a certificate
While viewing packet capture data, you notice that one IP is sending and receiving traffic for multiple devices by modifying the IP header, Which option is making this behavior possible? TOR encapsulation tunneling NAT
Cisco 210-250 Exam QUESTION 8
Which term represents a weakness in a system that could lead to the system being compromised? risk exploit threat vulnerability
Which definition of a process in Windows is true? running program database that stores low-level settings for the OS and for certain applications basic unit to which the operating system allocates processor time unit of execution that must be manually scheduled by the application
Which two options are recognized forms of phishing? (Choose two ) whaling mailbomb hooking mailnet spear
Cisco 210-250 Exam QUESTION 11
Which protocol is primarily supported by the third layer of the Open Systems Interconnection reference model? TCP/UDP ATM/ MPLS MPLS IPv4/IPv6 HTTP/TLS
An intrusion detection detection system begins begins receiving receiving an abnormally high volume of scanning scanning from numerous numerous sources. sources. Which evasion technique does this attempt indicate? timing attack tunneling traffic fragmentation fragmentation resource exhaustion QUESTION 13
Which identifier is used to describe the application or process that submitted a log message? selector priority facility action
A firewall requires requires deep packet inspection inspection to to evaluate evaluate which layer? layer? link application Internet transport
Cisco 210-250 Exam QUESTION 15
Which option is a purpose of port scanning? Determine if the network is up or down Identify legitimate users of a system. Identify the Internet Protocol of the target system. Identify which ports and services are open on the target host.
For which reason can HTTPS traffic make security monitoring difficult? large packet headers Signature detection takes longer. encryption SSL interception
Which protocol maps IP network addresses to MAC hardware addresses so that IP packets can be sent across networks? Internet Control Message Protocol Session Initiation Protocol Transmission Control Protocol/Internet Protocol Address Resolution Resolution Protocol Protocol
Which evasion method involves performing actions slower than normal to prevent detection? tunneling traffic fragmentation resource exhaustion timing attack www.lead2pass.com
Cisco 210-250 Exam QUESTION 19
Which network device is used to separate broadcast domains? repeater bridge router switch
Which term represents the practice of giving employees only those permissions necessary to perform their specific role within an organization? due diligence need to know least privilege integrity validation
Which definition of the virtual address space for a Windows process is true? system-level memory protection feature that is built into the operating system set of pages that are currently resident in physical memory actual physical location of an object in memory set of virtual memory addresses that it can use
Cisco 210-250 Exam QUESTION 22
Which definition of permissions in Linux is true? table maintenance program attributes of ownership and control of an object rules that allow network traffic to go in and out written affidavit that you have to sign before using the system
Which term represents the chronological record of how evidence was collected- analyzed, preserved, and transferred? chain of custody chain of evidence evidence chronology record of safekeeping
hich security monitoring data type is associated with application server logs? statistical data session data alert data transaction data
Cisco 210-250 Exam QUESTION 25
Which data can be obtained using NetFlow? session data report full packet capture network downtime application logs
Which encryption algorithm is the strongest? DES 3DES CES AES
Which definition of the IIS Log Parser tool is true? a powerful versatile tool that verifies the integrity of the log files a powerful, versatile tool that makes it possible to run SQL-like queries against log flies a data source control to connect to your data source a logging module for IIS that allows you to log to a database
Which information security property is supported by encryption? availability sustainability confidentiality integrity www.lead2pass.com
Cisco 210-250 Exam QUESTION 29
If a web server accepts input from the user and passes it to a bash shell, to which attack method is it vulnerable? input validation command injection hash collision integer overflow
Which hash algorithm is the weakest? SHA-256 SHA-1 SHA-512 RSA 4096
Based on which statement does the discretionary access control security model grant or restrict access ? role of a user within an organization security policy defined by the owner of an object discretion of the system administrator administrator security policy defined by the system administrator
Which definition of Windows Registry is true? database that stores low-level settings for the operating system set of virtual memory addresses set of pages that are currently resident m physical memory basic unit to which the operating system allocates processor time www.lead2pass.com
Cisco 210-250 Exam
Which option is an advantage to using network-based anti-virus versus host-based anti-virus? There are no advantages compared to host-based antivirus. Network-based can protect against infection from malicious files at rest. Network-based has the ability to protect unmanaged devices and unsupported operating systems. Host-based antivirus does not have the ability to collect newly created signatures.
Which directory is commonly used on Linux systems to store log files, including syslog and apache access logs? /lib/log /var/log /etc/log /root/log
A user reports reports difficulties accessing certain external external web web pages, When examining examining traffic to and from the external external domain in full packet captures, you notice many SYNs that have the same sequence number, source, and destination IP address, but have different payloads. Which problem is a possible explanation of this situation? misconfiguration of web filter failure of full packet capture solution TCP injection insufficient network resources
Cisco 210-250 Exam QUESTION 36
Which definition of a daemon on Linux is true? set of basic CPU instructions new process created by duplicating the calling process error check right after the call to fork a process program that runs unobtrusively in the background
Which definition of an antivirus program is true? program that scans a running application for vulnerabilities program used to detect and remove unwanted malicious software from the system rules that allow network traffic to go in and out program that provides real time analysis of security alerts generated by network hardware and application
Which event occurs when a signature-based IDS encounters network traffic that triggers an alert? endpoint event intrusion event NetFlow event connection event
Cisco 210-250 Exam QUESTION 39
Which two terms are types of cross site scripting attacks? (Choose two ) encoded directed cascaded stored reflected
Drag the data source on the left to the left to the correct data type on the right.
Wireshark - full packet capture Netflow - session data Server log - Transaction data IPS - alert data
Cisco 210-250 Exam QUESTION 41
In NetFlow records, which flags indicate that an HTTP connection was stopped by a security appliance, like a firewall, before it could be built fully? RST PSH, ACK ACK SYN ACK
Which concern is important when monitoring NTP servers for abnormal levels of traffic? Being the cause of a distributed reflection denial of service attack. Users changing the time settings on their systems. Watching for rogue devices that have been added to the network. A critical server server may not not have the correct time synchronized. synchronized.
Refer to the exhibit. During an analysis this list of email attachments is found. Which files contain the same content?
1 and 3 3 and 4 1 and 2 1 and 4
Cisco 210-250 Exam QUESTION 44
Which term represents a potential danger that could take advantage of a weakness in a system? vulnerability exploit threat risk
Drag the technology on the left to the data type the technology provides on the right.
Tcpdump - full packet capture netflow - session data Traditional stateful firewall - connection event Web content content filtering - transaction data
One of the objectives of information security is to protect the CIA of information and systems. What does CIA mean in this context? Confidentiality, Integrity, and Availability Confidentiality, Identity, and Authorization Confidentiality, Integrity, and Authorization Confidentiality, Confidentiality, Identity, and Availability
Cisco 210-250 Exam QUESTION 47
Which definition of vulnerability is true? software that does not have the most current patch applied software that was not approved for installation an exploitable unpatched and unmitigated weakness in software an incompatible piece of software
Which hashing algorithm is the least secure? SHA-3 MD5 SHA-2 RC4
According to RFC 1035 which transport transport protocol protocol is recommended recommended for use with with DNS queries? queries? Hypertext Transfer Protocol Transmission Control Protocol User Datagram Protocol Reliable Data Protocol
Where is a host-based intrusion detection system located? on a particular end-point as an agent or a desktop application on a tap switch port on a span switch port on a dedicated proxy server monitoring egress traffic
Cisco 210-250 Exam QUESTION 51
In computer security, which information is the term PHI used to describe? private host information protected health information personal health information protected host information
You must create a vulnerability management framework. Which main purpose of this framework is true? Identify remove and mitigate system vulnerabilities. Detect and remove vulnerabilities in source code. Conduct vulnerability scans on the network. Manage a list of reported vulnerabilities.
Which cryptographic key is contained in an X.509 certificate? public symmetric private asymmetric
Which protocol is expected to have NTP a user agent, host, and referrer headers in a packet capture? HTTP SSH DNS NTP
Cisco 210-250 Exam QUESTION 55
Which situation indicates application-level white listing? Allow specific specific executable executable files and and deny specific executable executable files. Writing current application attacks on a whiteboard daily. Allow specific specific files and deny everything everything else. else. Allow everything everything and deny specific specific executable executable files. files.
Which two activities are examples of social engineering? (Choose two) sending a verbal request to an administrator to change the password to the account of a user the administrator does know receiving an unexpected email from an unknown person with an uncharacteristic attachment from someone in the same company receiving an invite to your department's weekly WebEx meeting receiving an email from MR requesting that you visit the secure HR website and update your contract information receiving call from the IT department asking you to verify your username/password to maintain the account
Which term describes the act of a user, without authority or permission, obtaining rights on a system, beyond what were assigned? administrative abuse rights exploitation exploitation authentication tunneling privilege escalation
Cisco 210-250 Exam QUESTION 58
Which two features must a next generation firewall include? (Choose two.) Security Information and Event Management host-based antivirus application visibility and control data mining intrusion detection system
Which type of exploit normally requires the culprit to have prior access to the target system? denial of service local exploit remote exploit system vulnerability vulnerability
Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IPS phones? man-in-the-middle dictionary replay known-plaintext
Cisco 210-250 Exam QUESTION 61
Which two tasks can be performed by analyzing the logs of a traditional stateful firewall? (Choose two.) Map internal private IP addresses to dynamically translated external public IP addresses Determine the user IDs involved in an instant messaging exchange. Confirm the timing of network connections differentiated by the TCP 5-tuple Audit the applications applications used within within a social social networking networking web site. site. Identify the malware variant carried by ^n SMTP connection
Which type of attack occurs when an attacker utilizes a botnet to reflect requests off an NTP server to overwhelm their target? distributed denial of service man in the middle replay denial of service
Cisco 210-250 Exam QUESTION 63
Refer to the exhibit. A TFTP server has recently been installed in the Atlanpero ta office. The network administrator is located in the NY office and has attempted to make a connection to the TFTP server. They are unable to backup the configuration file and Cisco IOS of the NY router to the TFTP server Which cause of this problem is true?
The TFTP server cannot obtain an address from a DHCP Server. The network administrator computer has an incorrect IP address The TFTP server has an incorrect IP address. The TFTP server has an incorrect subnet mask.
Which definition describes the main purpose of a Security Information and Event Management solution ? a monitoring interface that manages firewall access control lists for duplicate firewall filtering a security product that collects, normalizes, and correlates event log data to provide holistic views of the security posture a database that collects and categorizes indicators of compromise to evaluate and search for potential security threats a relay server or device that collects then forwards event logs to another log collection device
Cisco 210-250 Exam QUESTION 65
Which tool is commonly used by threat actors on a webpage to take advantage of the software vulnerabilities of a system to spread malware? vulnerability vulnerability kit exploit kit root kit script kiddie kit