Cisco Cisco Certifications 210-250 Questions & Answers

• Question 331:

  Which two methods might be used by an analyst to detect SSL/TLS encrypted command-and-control communication? (Choose two.)

  A. perform decryption and inspection of SSL/TLS traffic

  B. perform firewall HTTP application inspection to detect for the command and control traffic

  C. perform IPS HTTP deep packets inspection to detect for the command and control traffic

  D. perform analysis of the NetFlow data to detect anomalous TLS/SSL flows

  Correct Answer: AD

  The correct answers are "perform decryption and inspection of SSL/TLS traffic" and "perform analysis of the Netflow data to detect anomalous TLS/SSL flows."

• Question 332:

  Which protocol or diagnostic tool helps you determine how many hops away a network is and can be exploited by an attacker?

  A. SSH

  B. traceroute

  C. ping

  D. TCP

  Correct Answer: B

• Question 333:

  Which part of the UDP header would attackers replace if they change the data payload to prevent the receiver from identifying the change?

  A. source port

  B. destination port

  C. UDP length

  D. UDP port

  E. UDP checksum

  Correct Answer: E

• Question 334:

  A ping attack that exploits the broadcast IP address in a subnet is referred to as what type of attack?

  A. red rat

  B. fraggle

  C. smurf

  D. SYN flood

  E. firewalk

  Correct Answer: C

• Question 335:

  Which two attacks can be caused by a rogue DHCP server? (Choose two.)

  A. Trojan virus

  B. Compromised-Key

  C. DoS

  D. TCP SYN flood

  E. MITM

  Correct Answer: CE

• Question 336:

  What type of spoofing attack uses fake source IP addresses that are different than their real IP addresses?

  A. MAC spoofing

  B. IP spoofing

  C. application spoofing

  D. name spoofing

  Correct Answer: B

• Question 337:

  What type of attack occurs when an attacker sends a flood of protocol request packets to various IP hosts and the attacker spoofs the source IP address of the packets, such that each packet has the IP address of the intended target rather than the IP address of the attacker as its source address?

  A. reflection attack

  B. amplification attack

  C. MITM attack

  D. Trojan virus ARP

  Correct Answer: A

• Question 338:

  What type of attack occurs when the attacker spoofs the IP address of the victim, sending a continuous stream of small requests, which produce a continuous stream of much larger replies that are to be sent to the victim's IP address?

  A. reflection attack

  B. amplification attack

  C. MITM attack

  D. Trojan virus

  Correct Answer: B

• Question 339:

  What best describes a DoS attack?

  A. attempts to consume all of a critical computer or network resource in order to make it unavailable for valid use

  B. poses as legitimate software or email attachment in order to launch a malicious attack when opened

  C. can steal data such as user names and passwords without the user realizing that they have been compromised

  D. rarely seen because DoS attacks are extremely difficult to engineer and almost impossible to deliver

  Correct Answer: A

• Question 340:

  What best describes an amplification attack?

  A. A low volume of bad music is played progressively louder to the point that it becomes unbearable for people to listen to it.

  B. A small forged packet elicits a large reply from the reflectors.

  C. A small radio signal is initially weak and eventually increases the signal strength so that wireless devices will attach to it instead of the legitimate AP.

  D. There is no such attack that is called an amplification attack.

  Correct Answer: B