Cisco Cisco Certifications 210-250 Questions & Answers

• Question 621:

  Which one of these protocols requires a connection to be established before transmitting data?

  A. TCP

  B. UDP

  C. IP

  D. OSPF

  Correct Answer: A

• Question 622:

  What is the TCP window field used for?

  A. Error detection

  B. Flow control

  C. Fragmentation

  D. Multiplexing

  Correct Answer: B

• Question 623:

  What are the advantages of a full-duplex transmission mode compared to half duplex mode? (Select all that apply.)

  A. Each station can transmit and receive at the same time.

  B. It avoids collisions.

  C. It makes use of back off time.

  D. It uses a collision avoidance algorithm to transmit.

  Correct Answer: AB

• Question 624:

  Chain of custody, in legal contexts, refers to the chronological documentation or paper trail, showing the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence. What five of the following types of information are contained in chain of custody documentation? (Choose five.)

  A. Who was the attacker?

  B. What is the evidence?

  C. What attack method was used?

  D. What method was used to collect the evidence?

  E. When was the evidence collected?

  F. Who handled the evidence and why did that person need to handle the evidence?

  G. What software was used to commit the attack?

  H. Where is the evidence permanently stored?

  I. Why did the attack happen?

  Correct Answer: BDEFH

• Question 625:

  Related to the chain of custody of forensic evidence, what two critical elements are required? (Choose two.)

  A. where the evidence was collected

  B. the exact time that the evidence was collected

  C. a copy of the evidence in case the original is damaged during forensic analysis

  D. investigators that rely on their own evidence documentation

  E. who handled the evidence

  Correct Answer: BE

• Question 626:

  Which layer of the TCP/IP model is concerned with end-to-end communication and offers multiplexing service?

  A. Transport

  B. Internet

  C. Link layer

  D. Application

  Correct Answer: A

• Question 627:

  Which statement is true concerning a link working in Ethernet half-duplex mode?

  A. A collision cannot happen.

  B. When a collision happens, the two stations immediately retransmit.

  C. When a collision happens, the two stations wait for a random time before retransmitting.

  D. To avoid a collision, stations wait a random time before transmitting.

  Correct Answer: C

• Question 628:

  What is the main characteristic of a hub?

  A. It regenerates the signal and retransmits on all ports.

  B. It uses a MAC address table to switch frames.

  C. When a packet arrives, the hub looks up the routing table before forwarding the packet.

  D. It supports full-duplex mode of transmission.

  Correct Answer: A

• Question 629:

  How can SOC analysts use the cyber kill chain?

  A. to gain insight into an attacker's tactics and techniques

  B. to delete detected malware

  C. to prevent all types of cyber attacks

  D. to require attackers to follow all phases of the cyber kill chain in sequence

  E. to implement additional security controls at the network level

  Correct Answer: A

• Question 630:

  What are three characteristics of an advanced persistent threat (APT)? (Choose three.)

  A. one time or drive-by file dropper

  B. pursues its objectives repeatedly over an extended period

  C. easily identified by common antivirus tools

  D. adapts to defenders' efforts to detect it

  E. maintains a level of interactions with the attacker's command and control infrastructure to execute its objectives

  F. usually injected via email attachment

  G. does not exhibit any signs of polymorphic behavior

  Correct Answer: BDE