Cisco Cisco Certifications 210-250 Questions & Answers

• Question 661:

  When attempting to reconstruct an incident from a packet capture, which three things should an analyst pay special attention to? (Choose three.)

  A. IP addresses of hosts that may have been affected

  B. the path that was used in the attack

  C. the timeline of the attack

  D. the tool used to produce the packet capture

  E. the geo-location information in the IP header

  Correct Answer: ABC

• Question 662:

  Which statement is true about NetFlow?

  A. NetFlow data contains actual packet data and metadata of network conversations.

  B. NetFlow detects traffic anomalies by using NetFlow signatures.

  C. NetFlow provides a complete audit trail of all network communications.

  D. NetFlow alone can provide a security analyst with context for the communication that triggered an IPS signature.

  Correct Answer: C

• Question 663:

  What are three pieces of information that NetFlow captures? (Choose three.)

  A. the time of IP conversations

  B. the amount of data that are transferred during IP conversations

  C. the content of IP conversations

  D. identities of systems that are involved in IP conversations

  Correct Answer: ABD

• Question 664:

  Which two of the following statements best describe the ways in which AAA server logs can be useful in protecting the network and users? (Choose two.)

  A. Due to the nature of AAA logging, AAA server logs always indicate actual attack attempts.

  B. Most AAA servers log authentication failures, an excessive number of which may point the security analyst to a brute force attack.

  C. Authentication logs track the success and failure of legitimate users with a time stamp record.

  D. AAA server logs are very minimal and actually do not yield much information.

  Correct Answer: BC

• Question 665:

  Which three are true about the Cisco FirePower NGFW logging? (Choose three.)

  A. can log packet-level information about IPS events

  B. can identify indications of compromise

  C. can identify traffic anomalies by examining NetFlow records

  D. can collect and correlate logs from other network security devices

  E. can log the NGFW connections events

  Correct Answer: ABE

• Question 666:

  On a Linux system, where are application logs usually stored?

  A. Event Viewer

  B. /var/log folder

  C. /proc/log folder

  D. Log Viewer

  Correct Answer: B

• Question 667:

  Which two statements are true about application logs? (Choose two.)

  A. The application log file contains events that are logged by the network applications.

  B. Events that are written to the application log are determined by the operating system.

  C. Application logs can be used along with the network usage logs to verify that network resources are being used appropriately.

  D. An application uses the same location for storing log messages regardless of the operating system on which it is running.

  Correct Answer: AC

• Question 668:

  URL Redirect status codes all start with which digit?

  A. 1xx

  B. 2xx

  C. 3xx

  D. 4xx

  Correct Answer: C

• Question 669:

  What is the purpose of a DLP policy?

  A. to prevent end users from abusing corporate email services

  B. to prevent end users from participating in internal phishing attacks

  C. to prevent end users from sending sensitive or critical information outside the corporate network

  D. to prevent end users from inadvertently disrupting corporate email services

  Correct Answer: C

• Question 670:

  Which two types of logs can you see on most typical email proxies? (Choose two.)

  A. logs regarding incoming spam emails

  B. logs regarding protocol violations

  C. logs regarding email that is sent outside the corporate network

  D. logs regarding incoming emails containing viruses

  Correct Answer: AD