Cisco 210-250 Online Practice Questions and Exam Preparation

Cisco 210-250 Online Questions & Answers

• Question 481:

  When attempting to reconstruct an incident from a packet capture, which three things should an analyst pay special attention to? (Choose three.)

  A. IP addresses of hosts that may have been affected
  B. the path that was used in the attack
  C. the timeline of the attack
  D. the tool used to produce the packet capture
  E. the geo-location information in the IP header
  A. IP addresses of hosts that may have been affected
  B. the path that was used in the attack
  C. the timeline of the attack

• Question 482:

  What are two goals of compliance regulations? (Choose two.)

  A. punish organizations that do not comply
  B. reduce an organization's security risk
  C. create worldwide standards for all organizations to follow
  D. protect the interests of an organization's clients
  B. reduce an organization's security risk
  D. protect the interests of an organization's clients

• Question 483:

  Which two of the following options are other common names for SPAN? (Choose two.)

  A. port multiplexing
  B. port mirroring
  C. port channeling
  D. port monitoring
  E. port failover
  B. port mirroring
  D. port monitoring

• Question 484:

  Which two of the following options are potential problems with a large single broadcast domain? (Choose two.)

  A. Large amounts of broadcast traffic consume resources.
  B. All PCs share the same collision domain.
  C. Layer 3 routing overhead is high.
  D. It is difficult to apply security policies because there are no boundaries between devices.
  A. Large amounts of broadcast traffic consume resources.
  D. It is difficult to apply security policies because there are no boundaries between devices.

• Question 485:

  Which Cisco AMP for endpoints feature is used during post-incident investigations to determine the source (patient zero) of the malware?

  A. file security intelligence feeds
  B. file capture
  C. file sandboxing
  D. file trajectory
  D. file trajectory

• Question 486:

  Which two of the following statements are true regarding the hub? (Choose two.)

  A. All ports on the hub are in the same single collision domain.
  B. Hubs use the MAC address table to make its switching decisions.
  C. Hubs function at the data link layer.
  D. Hubs can run only in half-duplex mode.
  A. All ports on the hub are in the same single collision domain.
  D. Hubs can run only in half-duplex mode.

• Question 487:

  In which type of penetration assessment is all information about the systems and network known?

  A. White box approach
  B. Black box approach
  C. Gray box approach
  D. Silver box approach
  A. White box approach

• Question 488:

  The FMC can share HTML, PDF, and CSV data types that relate to a specific event type. Which event type?

  A. connection
  B. host
  C. intrustion
  D. NetFlow
  C. intrustion

• Question 489:

  Which of the following is an example of a data loss prevention solution?

  A. Cisco Advanced DLP
  B. Cisco CloudLock
  C. Cisco Advanced Malware Protection (AMP)
  D. Cisco Firepower 4100 appliances
  B. Cisco CloudLock

• Question 490:

  You suspect that a Windows host has been infected with malware, and the malware is creating many TCP connections. Which Windows command would you use to display all the active TCP connections on the host?

  A. net view
  B. systeminfo
  C. route print
  D. netstat
  D. netstat