Introducing The New!
Surepassexam Collection
Get Unlimited Access to all
Surepassexam's PREMIUM files
Q1. Which three options are valid event actions for a Cisco IPS? (Choose three.)
A. deny-packet-inline
B. deny-attack-reset
C. produce-verbose-alert
D. log-attacker-packets
E. deny-packet-internal
F. request-block-drop-connection
Answer: A,C,D
Q2. During initial configuration, the Cisco ASA can be configured to drop all traffic if the ASA CX SSP fails by using which command in a policy-map?
A. cxsc fail
B. cxsc fail-close
C. cxsc fail-open
D. cxssp fail-close
Answer: B
Q3. What are two benefits of using SPAN with promiscuous mode deployment? (Choose two.)
A. SPAN does not introduce latency to network traffic.
B. SPAN can perform granular scanning on captures of per-IP-address or per-port monitoring.
C. Promiscuous Mode can silently block traffic flows on the IDS.
D. SPAN can analyze network traffic from multiple points.
Answer: A,D
Q4. If learning accept mode is set to "auto" and the knowledge base is loaded only when explicitly requested on the IPS, which statement about the knowledge base is true?
A. The knowledge base is set to load dynamically.
B. The knowledge base is set to "save only."
C. The knowledge base is set to "discarded."
D. The knowledge base is set to load statically.
Answer: B
Q5. Which five system management and reporting protocols are supported by the Cisco Intrusion Prevention System? (Choose five.)
A. SNMPv2c
B. SNMPv1
C. SNMPv2
D. SNMPv3
E. syslog
F. SDEE
G. SMTP
Answer: A,B,C,F,G
Q6. Which three search parameters are supported by the Email Security Monitor? (Choose three.)
A. Destination domain
B. Network owner
C. MAC address
D. Policy requirements
E. Internal sender IP address
F. Originating domain
Answer: A,B,E
Q7. What action will the sensor take regarding IP addresses listed as known bad hosts in the Cisco SensorBase network?
A. Global correlation is configured in Audit mode fortesting the feature without actually denying any hosts.
B. Global correlation is configured in Aggressive mode, which has a very aggressive effect on deny actions.
C. It will not adjust risk rating values based on the known bad hosts list.
D. Reputation filtering is disabled.
Answer: D
Explanation:
This can be seen on the Globabl Correlation – Inspection/Reputation tab show below:
Q8. Refer to the exhibit.
The system administrator of mydomain.com was informed that one of the users in his environment received spam from an Internet sender. Message tracking shows that the emails for this user were not scanned by antispam. Why did the Cisco Email Security gateway fail to do a spam scan on emails for user@mydomain.com?
A. The remote MTA activated the SUSPECTLIST sender group.
B. The Cisco Email Security gateway created duplicates of the message.
C. The user user@mydomain.com matched an inbound rule with antispam disabled.
D. The user bob@mydomain.com matched an inbound rule with antispam disabled.
Answer: C
Q9. Which command sets the number of packets to log on a Cisco IPS sensor?
A. ip-log-count number
B. ip-log-packets number
C. ip-log-bytes number
D. ip-log number
Answer: B
Q10. Which Cisco technology is a modular security service that combines a stateful inspection firewall with next-generation application awareness, providing near real-time threat protection?
A. Cisco ASA 5500 series appliances
B. Cisco ASA CX Context-Aware Security
C. WSA
D. Internet Edge Firewall / IPS
Answer: B
Q11. Which three user roles are partially defined by default in Prime Security Manager? (Choose three.)
A. networkoperator
B. admin
C. helpdesk
D. securityoperator
E. monitoringadmin
F. systemadmin
Answer: B,C,F
Q12. What CLI command configures IP-based access to restrict GUI and CLI access to a Cisco Email Security appliance's administrative interface?
A. adminaccessconfig
B. sshconfig
C. sslconfig
D. ipaccessconfig
Answer: A
Q13. Which Cisco technology prevents targeted malware attacks, provides data loss prevention and spam protection, and encrypts email?
A. SBA
B. secure mobile access
C. IPv6 DMZ web service
D. ESA
Answer: D
Q14. Which two conditions must you configure in an event action override to implement a risk rating of 70 or higher and terminate the connection on the IPS? (Choose two.)
A. Configure the event action override to send a TCP reset.
B. Set the risk rating range to 70 to 100.
C. Configure the event action override to send a block-connection request.
D. Set the risk rating range to 0 to 100.
E. Configure the event action override to send a block-host request.
Answer: A,B
Q15. Which two statements about Cisco Cloud Web Security functionality are true? (Choose two.)
A. It integrates with Cisco Integrated Service Routers.
B. It supports threat avoidance and threat remediation.
C. It extends web security to the desktop, laptop, and PDA.
D. It integrates with Cisco.ASA Firewalls.
Answer: A,D
Q16. When you create a new server profile on the Cisco ESA, which subcommand of the ldapconfig command configures spam quarantine end-user authentication?
A. isqauth
B. isqalias
C. test
D. server
Answer: A