Cisco 210-250 Online Practice Questions and Exam Preparation

Cisco 210-250 Online Questions & Answers

• Question 821:

  Which two of the following statements are true about host-based anti-virus software? (Choose two.)

  A. User identity detection is embedded in most antivirus software code.
  B. Most antivirus software uses signature-based malware detection.
  C. Antivirus software is wholly dependent on running scans to find malware that has already obtained a foothold on a system.
  D. Antivirus software may use heuristics with other methods to detect malware.
  B. Most antivirus software uses signature-based malware detection.
  D. Antivirus software may use heuristics with other methods to detect malware.

• Question 822:

  Which one of the following options must a host on an Ethernet network know about a destination in order to send an Ethernet frame to that destination?

  A. receiving port number
  B. IP address
  C. MAC address
  D. window size
  C. MAC address

• Question 823:

  Which term describes reasonable efforts that must be made to obtain relevant information to facilitate appropriate courses of action?

  A. decision making
  B. due diligence
  C. data mining
  D. ethical behavior
  B. due diligence

• Question 824:

  What SQL command is used by attackers to exfiltrate sensitive data?

  A. alter
  B. drop
  C. select
  D. get
  E. post
  C. select

• Question 825:

  Which of the following is not a true statement about TACACS+?

  A. It offers command-level authorization.
  B. It is proprietary to Cisco.
  C. It encrypts the TACACS+ header.
  D. It works over TCP.
  C. It encrypts the TACACS+ header.

• Question 826:

  Which is the best definition of a Windows process?

  A. A program that is running within Windows
  B. The basic unit an operating system allocates process time to
  C. A group of worker threads that efficiently execute asynchronous callbacks for the application
  D. A unit of execution that is manually scheduled by an application
  A. A program that is running within Windows

• Question 827:

  When are "point-in-time detection technologies" considered useless?

  A. after the attacker has compromised the Internet-facing firewall appliance
  B. when a malicious file is not caught, or is self-morphing after entering the environment
  C. when the IPS appliance detects an anomaly.
  D. when forensics are performed on the malicious payload to ascertain its origin and attack behaviors
  B. when a malicious file is not caught, or is self-morphing after entering the environment

• Question 828:

  A system administrator installs an IDS to protect users on 10.2.3.0/24. After the installation, users can see only other machines on their /24 consistently and cannot reach external sites. Which possible explanation is true?

  A. The IDS is working properly and providing the users on 10.2.3.0/24 with the security they need
  B. The IDS was configured to fail open and has not yet been fully configured
  C. The IDS was installed inline and is dropping traffic that must be allowed
  D. The system administrator mirrored the traffic for that network segment and did not tune the IDS properly
  C. The IDS was installed inline and is dropping traffic that must be allowed

• Question 829:

  Regarding outbound email security policies, which one of the following steps is omitted from the outbound mail pipeline, but is available in the inbound mail pipeline?

  A. reputation filters
  B. RSA DLP
  C. advanced malware protection
  D. anti-virus
  E. anti-spam
  A. reputation filters

• Question 830:

  Which statement is true about TCP reset attacks?

  A. A TCP reset attack is designed to disrupt the TCP 3-way handshake.
  B. A TCP reset attack terminates TCP communications between two hosts.
  C. An malicious attack is always indicated when the RST bit is set to 1 in a TCP packet header.
  D. In a TCP reset attack, the RST bit in the TCP packet header must be set to 1; settings for other fields in the TCP header are irrelevant.
  B. A TCP reset attack terminates TCP communications between two hosts.