CISCO cyberops whole Flashcards
Which two statements are characteristics of a virus? (Choose two.)
A virus typically requires end-user activation.
A virus can be dormant and then activate at a specific time or date.
A virus replicates itself by independently exploiting vulnerabilities in networks.
A virus has an enabling vulnerability, a propagation mechanism, and a payload.
A virus provides the attacker with sensitive data, such as passwords.
A virus typically requires end-user activation.
A virus can be dormant and then activate at a specific time or date.
The type of end user interaction required to launch a virus is typically opening an application, opening a web page, or powering on the computer. Once activated, a virus may infect other files located on the computer or other computers on the same network.
What is a characteristic of a Trojan horse as it relates to network security?
Too much information is destined for a particular memory block, causing additional memory areas to be affected.
Extreme quantities of data are sent to a particular network device interface.
An electronic dictionary is used to obtain a password to be used to infiltrate a key network device.
Malware is contained in a seemingly legitimate executable program.
Malware is contained in a seemingly legitimate executable program.
A Trojan horse carries out malicious operations under the guise of a legitimate program. Denial of service attacks send extreme quantities of data to a particular host or network device interface. Password attacks use electronic dictionaries in an attempt to learn passwords. Buffer overflow attacks exploit memory buffers by sending too much information to a host to render the system inoperable.
What technique is used in social engineering attacks?
sending junk email
buffer overflow
phishing
man-in-the-middle
phishing
A threat actor sends fraudulent email which is disguised as being from a legitimate, trusted source to trick the recipient into installing malware on their device, or to share personal or financial information.
What is a purpose of implementing VLANs on a network?
They can separate user traffic.
They prevent Layer 2 loops.
They eliminate network collisions.
They allow switches to forward Layer 3 packets without a router.
They can separate user traffic.
VLANs are used on a network to separate user traffic based on factors such as function, project team, or application, without regard for the physical location of the user or device.
A cybersecurity analyst needs to collect alert data. What are three detection tools to perform this task in the Security Onion architecture? (Choose three.)
CapME Wazuh Kibana Zeek Sguil Wireshark
CapME
Wazuh
Zeek
Match the Security Onion tool with the description.
Snort OSSEC Squil Wireshark ------------------------- network-based intrusion detection system packet capture application host-based intrusion detection system high-level cybersecurity analysis console
Snort — network-based intrusion detection system
OSSEC — host-based intrusion detection system
Squil — high-level cybersecurity analysis console
Wireshark — packet capture application
In network security assessments, which type of test is used to evaluate the risk posed by vulnerabilities to a specific organization including assessment of the likelihood of attacks and the impact of successful exploits on the organization?
port scanning
risk analysis
penetration testing
vulnerability assessment
risk analysis
Match the server profile element to the description. (Not all options are used.)
user accounts
listening ports
service accounts
software enviroment
———————————
the parameters defininf user access and behavior
the number of times the server is powered on and off
the TCP and UDP daemons and ports that are allowed to be open on the server
the tasks, processes, and applications that are permitted to run on the server
the definitions of the type of service that an application is allowed to run on a given host
user accounts — the parameters defininf user access and behavior
listening ports — the TCP and UDP daemons and ports that are allowed to be open on the server
software enviroment — the tasks, processes, and applications that are permitted to run on the server
service accounts — the definitions of the type of service that an application is allowed to run on a given host
The elements of a server profile include the following:Listening ports – the TCP and UDP daemons and ports that are allowed to be open on the server
User accounts – the parameters defining user access and behavior
Service accounts – the definitions of the type of service that an application is allowed to run on a given host
Software environment – the tasks, processes, and applications that are permitted to run on the server
In addressing an identified risk, which strategy aims to shift some of the risk to other parties?
risk avoidance
risk sharing
risk retention
risk reduction
risk sharing
What is a network tap?
a technology used to provide real-time reporting and long-term analysis of security events
a Cisco technology that provides statistics on packets flowing through a router or multilayer switch
a feature supported on Cisco switches that enables the switch to copy frames and forward them to an analysis device
a passive device that forwards all traffic and physical layer errors to an analysis device
a passive device that forwards all traffic and physical layer errors to an analysis device
Match the monitoring tool to the definition.
NetFlow
Wireshark
SNMP
SIEM
——————–
presents real-time reporting and long-term analysis of security events
provides statistics on packets flowing through a Cisco router or multilayer switch
captures packets and saves them as PCAP file
retrieves information on the operation of network devices
SIEM — presents real-time reporting and long-term analysis of security events
NetFlow — provides statistics on packets flowing through a Cisco router or multilayer switch
Wireshark — captures packets and saves them as PCAP file
SNMP — retrieves information on the operation of network devices
If a SOC has a goal of 99.999% uptime, how many minutes of downtime a year would be considered within its goal?
Approximately 5 minutes per year.
Approximately 10 minutes per year
Approximately 20 minutes per year.
Approximately 30 minutes per year.
Approximately 5 minutes per year.
Within a year, there are 365 days x 24 hours a day x 60 minutes per hour = 525,600 minutes. With the goal of uptime 99.999% of time, the downtime needs to be controlled under 525,600 x (1-0.99999) = 5.256 minutes a year.
The HTTP server has responded to a client request with a 200 status code. What does this status code indicate?
The request is understood by the server, but the resource will not be fulfilled.
The request was completed successfully.
The server could not find the requested resource, possibly because of an incorrect URL.
The request has been accepted for processing, but processing is not completed.
The request was completed successfully.
What is an advantage for small organizations of adopting IMAP instead of POP?
POP only allows the client to store messages in a centralized way, while IMAP allows distributed storage.
IMAP sends and retrieves email, but POP only retrieves email.
When the user connects to a POP server, copies of the messages are kept in the mail server for a short time, but IMAP keeps them for a long time.
Messages are kept in the mail servers until they are manually deleted from the email client.
Messages are kept in the mail servers until they are manually deleted from the email client.
IMAP and POP are protocols that are used to retrieve email messages. The advantage of using IMAP instead of POP is that when the user connects to an IMAP-capable server, copies of the messages are downloaded to the client application. IMAP then stores the email messages on the server until the user manually deletes those messages.
What debugging security tool can be used by black hats to reverse engineer binary files when writing exploits?
WinDbg
Firesheep
Skipfish
AIDE
WinDbg
question 17 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
What are two features of ARP? (Choose two.)
When a host is encapsulating a packet into a frame, it refers to the MAC address table to determine the mapping of IP addresses to MAC addresses.
If a host is ready to send a packet to a local destination device and it has the IP address but not the MAC address of the destination, it generates an ARP broadcast.
If a device receiving an ARP request has the destination IPv4 address, it responds with an ARP reply.
If no device responds to the ARP request, then the originating node will broadcast the data packet to all devices on the network segment.
An ARP request is sent to all devices on the Ethernet LAN and contains the IP address of the destination host and the multicast MAC address.
If a host is ready to send a packet to a local destination device and it has the IP address but not the MAC address of the destination, it generates an ARP broadcast.
If a device receiving an ARP request has the destination IPv4 address, it responds with an ARP reply.
When a node encapsulates a data packet into a frame, it needs the destination MAC address. First it determines if the destination device is on the local network or on a remote network. Then it checks the ARP table (not the MAC table) to see if a pair of IP address and MAC address exists for either the destination IP address (if the destination host is on the local network) or the default gateway IP address (if the destination host is on a remote network). If the match does not exist, it generates an ARP broadcast to seek the IP address to MAC address resolution. Because the destination MAC address is unknown, the ARP request is broadcast with the MAC address FFFF.FFFF.FFFF. Either the destination device or the default gateway will respond with its MAC address, which enables the sending node to assemble the frame. If no device responds to the ARP request, then the originating node will discard the packet because a frame cannot be created.
What is a property of the ARP table on a device?
Entries in an ARP table are time-stamped and are purged after the timeout expires.
Every operating system uses the same timer to remove old entries from the ARP cache.
Static IP-to-MAC address entries are removed dynamically from the ARP table.
Windows operating systems store ARP cache entries for 3 minutes.
Entries in an ARP table are time-stamped and are purged after the timeout expires.
What is the purpose of Tor?
to allow users to browse the Internet anonymously
to securely connect to a remote network over an unsecure link such as an Internet connection
to donate processor cycles to distributed computational tasks in a processor sharing P2P network
to inspect incoming traffic and look for any that violates a rule or matches the signature of a known exploit
to allow users to browse the Internet anonymously
Tor is a software platform and network of peer-to-peer (P2P) hosts that function as routers. Users access the Tor network by using a special browserthat allows them to browse anonymously
Which two network protocols can be used by a threat actor to exfiltrate data in traffic that is disguised as normal network traffic? (Choose two.)
NTP DNS HTTP syslog SMTP
DNS
HTTP
What is a key difference between the data captured by NetFlow and data captured by Wireshark?
NetFlow data shows network flow contents whereas Wireshark data shows network flow statistics.
NetFlow data is analyzed by tcpdump whereas Wireshark data is analyzed by nfdump.
NetFlow provides transaction data whereas Wireshark provides session data.
NetFlow collects metadata from a network flow whereas Wireshark captures full data packets.
NetFlow collects metadata from a network flow whereas Wireshark captures full data packets.
Wireshark captures the entire contents of a packet. NetFlow does not. Instead, NetFlow collects metadata, or data about the flow.
Which tool captures full data packets with a command-line interface only?
nfdump
Wireshark
NBAR2
tcpdump
tcpdump
The command-line tool tcpdump is a packet analyzer. Wireshark is a packet analyzer with a GUI interface.
Which method can be used to harden a device?
maintain use of the same passwords
allow default services to remain enabled
allow USB auto-detection
use SSH and disable the root account access over SSH
use SSH and disable the root account access over SSH
The basic best practices for device hardening are as follows: Ensure physical security. Minimize installed packages. Disable unused services. Use SSH and disable the root account login over SSH. Keep the system updated. Disable USB auto-detection. Enforce strong passwords. Force periodic password changes. Keep users from re-using old passwords. Review logs regularly.
In a Linux operating system, which component interprets user commands and attempts to execute them?
GUI
daemon
kernel
shell
shell
A network administrator is configuring an AAA server to manage RADIUS authentication. Which two features are included in RADIUS authentication? (Choose two.)
encryption for all communication
encryption for only the data
single process for authentication and authorization
separate processes for authentication and authorization
hidden passwords during transmission
single process for authentication and authorization
hidden passwords during transmission
RADIUS authentication supports the following features:
RADIUS authentication and authorization as one process
Encrypts only the password
Utilizes UDP
Supports remote-access technologies, 802.1X, and Session Initiation Protocol (SIP)
What is privilege escalation?
Vulnerabilities in systems are exploited to grant higher levels of privilege than someone or some process should have.
Everyone is given full rights by default to everything and rights are taken away only when someone abuses privileges.
Someone is given rights because she or he has received a promotion.
A security problem occurs when high ranking corporate officials demand rights to systems or files that they should not have.
Vulnerabilities in systems are exploited to grant higher levels of privilege than someone or some process should have.
With privilege escalation, vulnerabilities are exploited to grant higher levels of privilege. After the privilege is granted, the threat actor can access sensitive information or take control of the system.
What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)
The code contains no viruses.
The code has not been modified since it left the software publisher.
The code is authentic and is actually sourced by the publisher.
The code contains no errors.
The code was encrypted with both a private and public key.
The code has not been modified since it left the software publisher.
The code is authentic and is actually sourced by the publisher.
Digitally signing code provides several assurances about the code:
The code is authentic and is actually sourced by the publisher.
The code has not been modified since it left the software publisher.
The publisher undeniably published the code. This provides nonrepudiation of the act of publishing.
An IT enterprise is recommending the use of PKI applications to securely exchange information between the employees. In which two cases might an organization use PKI applications to securely exchange information between users? (Choose two.)
HTTPS web service 802.1x authentication local NTP server FTP transfers file and directory access permission
HTTPS web service
802.1x authentication
The Public Key Infrastructure (PKI) is a third party-system referred to as a certificate authority or CA. The PKI is the framework used to securely exchange information between parties. Common PKI applications are as follows:
SSL/TLS certificate-based peer authentication
Secure network traffic using IPsec VPNs
HTTPS Web traffic
Control access to the network using 802.1x authentication
Secure email using the S/MIME protocol
Secure instant messaging
Approve and authorize applications with Code Signing
Protect user data with the Encryption File System (EFS)
Implement two-factor authentication with smart cards
Securing USB storage devices
Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?
Use a Syslog server to capture network traffic.
Deploy a Cisco SSL Appliance.
Require remote access connections through IPsec VPN.
Deploy a Cisco ASA.
Require remote access connections through IPsec VPN.
An administrator is trying to develop a BYOD security policy for employees that are bringing a wide range of devices to connect to the company network. Which three objectives must the BYOD security policy address? (Choose three.)
All devices must be insured against liability if used to compromise the corporate network.
All devices must have open authentication with the corporate network.
Rights and activities permitted on the corporate network must be defined.
Safeguards must be put in place for any personal device being compromised.
The level of access of employees when connecting to the corporate network must be defined.
All devices should be allowed to attach to the corporate network flawlessly.
Rights and activities permitted on the corporate network must be defined.
Safeguards must be put in place for any personal device being compromised.
The level of access of employees when connecting to the corporate network must be defined.
question 32 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
question 33 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
What type of attack targets an SQL database using the input field of a user?
XML injection
buffer overflow
Cross-site scripting
SQL injection
SQL injection
A criminal can insert a malicious SQL statement in an entry field on a website where the system does not filter the user input correctly.
What are two characteristics of Ethernet MAC addresses? (Choose two.)
MAC addresses use a flexible hierarchical structure.
They are expressed as 12 hexadecimal digits.
They are globally unique.
They are routable on the Internet.
MAC addresses must be unique for both Ethernet and serial interfaces on a device.
They are expressed as 12 hexadecimal digits.
They are globally unique.
A user calls to report that a PC cannot access the internet. The network technician asks the user to issue the command ping 127.0.0.1 in a command prompt window. The user reports that the result is four positive replies. What conclusion can be drawn based on this connectivity test?
The IP address obtained from the DHCP server is correct.
The PC can access the network. The problem exists beyond the local network.
The PC can access the Internet. However, the web browser may not work.
The TCP/IP implementation is functional.
The TCP/IP implementation is functional.
What characterizes a threat actor?
They are all highly-skilled individuals.
They always use advanced tools to launch attacks.
They always try to cause some harm to an individual or organization.
They all belong to organized crime.
They always try to cause some harm to an individual or organization.
A computer is presenting a user with a screen requesting payment before the user data is allowed to be accessed by the same user. What type of malware is this?
a type of logic bomb
a type of virus
a type of worm
a type of ransomware
a type of ransomware
Ransomware commonly encrypts data on a computer and makes the data unavailable until the computer user pays a specific sum of money
Which ICMPv6 message type provides network addressing information to hosts that use SLAAC?
router solicitation
neighbor advertisement
neighbor solicitation
router advertisement
router advertisement
Which ICMPv6 message type provides network addressing information to hosts that use SLAAC?
router solicitation
neighbor advertisement
neighbor solicitation
router advertisement
router advertisement
Which tol included in the Security Onion is a series of software plugins that send different types of data to the Elasticsearch data stores?
Curator
Beats
OSSEC
ElastAlert
Beats
Which two types of unreadable network traffic could be eliminated from data collected by NSM? (Choose two.)
STP traffic IPsec traffic routing updates traffic SSL traffic broadcast traffic
IPsec traffic
SSL traffic
To reduce the huge amount of data collected so that cybersecurity analysts can focus on critical threats, some less important or unusable data could be eliminated from the datasets. For example, encrypted data, such as IPsec and SSL traffic, could be eliminated because it is unreadable in a reasonable time frame.
Which core open source component of the Elastic-stack is responsible for accepting the data in its native format and making elements of the data consistent across all sources?
Logstash
Kibana
Beats
Elasticsearch
Logstash
question 43 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
In the NIST incident response process life cycle, which type of attack vector involves the use of brute force against devices, networks, or services?
media
impersonation
attrition
loss or theft
attrition
Common attack vectors include media, attrition, impersonation, and loss or theft. Attrition attacks are any attacks that use brute force. Media attacks are those initiated from storage devices. Impersonation attacks occur when something or someone is replaced for the purpose of the attack, and loss or theft attacks are initiated by equipment inside the organization.
question 45 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
What is a characteristic of CybOX?
It is a set of standardized schemata for specifying, capturing, characterizing, and communicating events and properties of network operations.
It enables the real-time exchange of cyberthreat indicators between the U.S. Federal Government and the private sector.
It is a set of specifications for exchanging cyberthreat information between organizations.
It is the specification for an application layer protocol that allows the communication of CTI over HTTPS.
It is a set of standardized schemata for specifying, capturing, characterizing, and communicating events and properties of network operations.
question 47 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
What are two ways that ICMP can be a security threat to a company? (Choose two.)
by collecting information about a network
by corrupting data between email servers and email recipients
by the infiltration of web pages
by corrupting network IP data packets
by providing a conduit for DoS attacks
by collecting information about a network
by providing a conduit for DoS attacks
ICMP can be used as a conduit for DoS attacks. It can be used to collect information about a network such as the identification of hosts and network structure, and by determining the operating systems being used on the network.
Which three IPv4 header fields have no equivalent in an IPv6 header? (Choose three.)
fragment offset protocol flag TTL identification version
fragment offset
flag
identification
Unlike IPv4, IPv6 routers do not perform fragmentation. Therefore, all three fields supporting fragmentation in the IPv4 header are removed and have no equivalent in the IPv6 header. These three fields are fragment offset, flag, and identification. IPv6 does support host packet fragmentation through the use of extension headers, which are not part of the IPv6 header.
Which two net commands are associated with network resource sharing? (Choose two.)
net start net accounts net share net use net stop
net share
net use
The net command is a very important command. Some common net commands include these:
net accounts – sets password and logon requirements for users
net session – lists or disconnects sessions between a computer and other computers on the network
net share – creates, removes, or manages shared resources
net start – starts a network service or lists running network services
net stop – stops a network service
net use – connects, disconnects, and displays information about shared network resources
net view – shows a list of computers and network devices on the network
question 51 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
Which PDU format is used when bits are received from the network medium by the NIC of a host?
segment
file
packet
frame
frame
When received at the physical layer of a host, the bits are formatted into a frame at the data link layer. A packet is the PDU at the network layer. A segment is the PDU at the transport layer. A file is a data structure that may be used at the application layer.
A user is executing a tracert to a remote device. At what point would a router, which is in the path to the destination device, stop forwarding the packet?
when the router receives an ICMP Time Exceeded message
when the values of both the Echo Request and Echo Reply messages reach zero
when the RTT value reaches zero
when the value in the TTL field reaches zero
when the host responds with an ICMP Echo Reply message
when the value in the TTL field reaches zero
When a router receives a traceroute packet, the value in the TTL field is decremented by 1. When the value in the field reaches zero, the receiving router will not forward the packet, and will send an ICMP Time Exceeded message back to the source
Q 54 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
For what purpose would a network administrator use the Nmap tool?
protection of the private IP addresses of internal hosts
identification of specific network anomalies
collection and analysis of security alerts and logs
detection and identification of open ports
detection and identification of open ports
Q 56 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
Q 57 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
Q 58 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
Q 59 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
What network attack seeks to create a DoS for clients by preventing them from being able to obtain a DHCP lease?
DHCP starvation
IP address spoofing
DHCP spoofing
CAM table attack
DHCP starvation
DCHP starvation attacks are launched by an attacker with the intent to create a DoS for DHCP clients. To accomplish this goal, the attacker uses a tool that sends many DHCPDISCOVER messages in order to lease the entire pool of available IP addresses, thus denying them to legitimate hosts.
Q 61 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
A company has a file server that shares a folder named Public. The network security policy specifies that the Public folder is assigned Read-Only rights to anyone who can log into the server while the Edit rights are assigned only to the network admin group. Which component is addressed in the AAA network service framework?
automation
authentication
authorization
accounting
authorization
After a user is successfully authenticated (logged into the server), the authorization is the process of determining what network resources the user can access and what operations (such as read or edit) the user can perform.
Q 63 https://itexamanswers.net/cyberops-associate-version-1-0-final-exam-answers.html
A person coming to a cafe for the first time wants to gain wireless access to the Internet using a laptop. What is the first step the wireless client will do in order to communicate over the network using a wireless management frame?
associate with the AP
authenticate to the AP
discover the AP
agree with the AP on the payload
discover the AP
In order for wireless devices to communicate on a wireless network, management frames are used to complete a three-stage process:
Discover the AP
Authenticate with the AP
Associate with the AP
A device has been assigned the IPv6 address of 2001:0db8:cafe:4500:1000:00d8:0058:00ab/64. Which is the network identifier of the device?
2001:0db8:cafe:4500:1000
2001:0db8:cafe:4500:1000:00d8:0058:00ab
1000:00d8:0058:00ab
2001:0db8:cafe:4500
2001
2001:0db8:cafe:4500
The address has a prefix length of /64. Thus the first 64 bits represent the network portion, whereas the last 64 bits represent the host portion of the IPv6 address.
An administrator wants to create four subnetworks from the network address 192.168.1.0/24. What is the network address and subnet mask of the second useable subnet?
subnetwork 192.168.1.64
subnet mask 255.255.255.192
subnetwork 192.168.1.64
subnet mask 255.255.255.240
subnetwork 192.168.1.32
subnet mask 255.255.255.240
subnetwork 192.168.1.128
subnet mask 255.255.255.192
subnetwork 192.168.1.8
subnet mask 255.255.255.224
subnetwork 192.168.1.64
subnet mask 255.255.255.192
What term describes a set of software tools designed to increase the privileges of a user or to grant access to the user to portions of the operating system that should not normally be allowed?
compiler
rootkit
package manager
penetration testing
rootkit
A rootkit is used by an attacker to secure a backdoor to a compromised computer, grant access to portions of the operating system normally not permitted, or increase the privileges of a user.
The IT security personnel of an organization notice that the web server deployed in the DMZ is frequently targeted by threat actors. The decision is made to implement a patch management system to manage the server. Which risk management strategy method is being used to respond to the identified risk?
risk sharing
risk avoidance
risk reduction
risk retention
risk reduction
There are four potential strategies for responding to risks that have been identified:
Risk avoidance – Stop performing the activities that create risk.
Risk reduction – Decrease the risk by taking measures to reduce vulnerability.
Risk sharing – Shift some of the risk to other parties.
Risk retention – Accept the risk and its consequences.
What are three characteristics of an information security management system? (Choose three.)
It involves the implementation of systems that track the location and configuration of networked devices and software across an enterprise.
It is a systematic and multilayered approach to cybersecurity.
It addresses the inventory and control of hardware and software configurations of systems.
It consists of a set of practices that are systematically applied to ensure continuous improvement in information security.
It consists of a management framework through which an organization identifies, analyzes, and addresses information security risks.
It is based on the application of servers and security devices.
It is a systematic and multilayered approach to cybersecurity.
It consists of a set of practices that are systematically applied to ensure continuous improvement in information security.
It consists of a management framework through which an organization identifies, analyzes, and addresses information security risks.
An Information Security Management System (ISMS) consists of a management framework through which an organization identifies, analyzes, and addresses information security risks. ISMSs are not based in servers or security devices. Instead, an ISMS consists of a set of practices that are systematically applied by an organization to ensure continuous improvement in information security. ISMSs provide conceptual models that guide organizations in planning, implementing, governing, and evaluating information security programs.
ISMSs are a natural extension of the use of popular business models, such as Total Quality Management (TQM) and Control Objectives for Information and Related Technologies (COBIT), into the realm of cybersecurity.
An ISMS is a systematic, multi-layered approach to cybersecurity. The approach includes people, processes, technologies, and the cultures in which they interact in a process of risk management.
Which three technologies should be included in a SOC security information and event management system? (Choose three.)
event collection, correlation, and analysis security monitoring user authentication proxy service intrusion prevention threat intelligence
event collection, correlation, and analysis
security monitoring
threat intelligence
Technologies in a SOC should include the following:
• Event collection, correlation, and analysis
• Security monitoring
• Security control
• Log management
• Vulnerability assessment
• Vulnerability tracking
• Threat intelligence
Proxy server, VPN, and IPS are security devices deployed in the network infrastructure.
What part of the URL, http://www.cisco.com/index.html, represents the top-level DNS domain?
http
www
.com
index
.com
The components of the URL http://www.cisco.com/index.htm are as follows: http = protocol www = part of the server name cisco = part of the domain name index = file name com = the top-level domain
What best describes the security threat of spoofing?
sending bulk email to individuals, lists, or domains with the intention to prevent users from accessing email
sending abnormally large amounts of data to a remote server to prevent user access to the server services
intercepting traffic between two hosts or inserting false information into traffic between two hosts
making data appear to come from a source that is not the actual source
making data appear to come from a source that is not the actual source
A newly created company has fifteen Windows 10 computers that need to be installed before the company can open for business. What is a best practice that the technician should implement when configuring the Windows Firewall?
The technician should remove all default firewall rules and selectively deny traffic from reaching the company network.
After implementing third party security software for the company, the technician should verify that the Windows Firewall is disabled.
The technician should create instructions for corporate users on how to allow an app through the WIndows Firewall using the Administrator account.
The technician should enable the Windows Firewall for inbound traffic and install other firewall software for outbound traffic control.
After implementing third party security software for the company, the technician should verify that the Windows Firewall is disabled.
Only disable Windows Firewall if other firewall software is installed. Use the Windows Firewall (Windows 7 or 8) or the Windows Defender Firewall (Windows 10) Control Panel to enable or disable the Windows Firewall.
Which statement defines the difference between session data and transaction data in logs?
Session data analyzes network traffic and predicts network behavior, whereas transaction data records network sessions.
Session data is used to make predictions on network behaviors, whereas transaction data is used to detect network anomalies.
Session data records a conversation between hosts, whereas transaction data focuses on the result of network sessions.
Session data shows the result of a network session, whereas transaction data is in response to network threat traffic.
Session data records a conversation between hosts, whereas transaction data focuses on the result of network sessions.
Q 75
Which device supports the use of SPAN to enable monitoring of malicious activity?
Cisco Catalyst switch
Cisco IronPort
Cisco NAC
Cisco Security Agent
Cisco Catalyst switch
SPAN is a Cisco technology that allows all of the traffic from one port to be redirected to another port.
