Cisco Cisco Certifications 210-250 Questions & Answers

• Question 861:

  Which tool provides universal query access to text-based data such as event logs and file system?

  A. log parser

  B. Windows Management Instrumentation

  C. handles

  D. service viewer

  Correct Answer: A

• Question 862:

  Which option is true when using the traffic mirror feature in a switch?

  A. Packets are automatically decrypted.

  B. Ethernet headers are modified before capture.

  C. Packet payloads are lost.

  D. Full packet captures are possible.

  Correct Answer: D

• Question 863:

  Endpoint logs indicate that a machine has obtained an unusual gateway address and unusual DNS servers via DHCP. Which option is this situation most likely an example of?

  A. command injection

  B. man in the middle attack

  C. evasion methods

  D. phishing

  Correct Answer: B

• Question 864:

  After a large influx of network traffic to externally facing devices, you begin investigating what appears to be a denial of service attack. When you review packet capture data, you notice that the traffic is a single SYN packet to each port. Which kind of attack is this?

  A. SYN flood

  B. port scanning

  C. traffic fragmentation

  D. host profiling

  Correct Answer: A

• Question 865:

  Which data type is the most beneficial to recreate a binary file for malware analysis?

  A. session data

  B. statistical data

  C. extracted content data

  D. alert data

  Correct Answer: A

• Question 866:

  Which NTP service is a best practice to ensure that all network devices are synchronized with a reliable and trusted time source?

  A. redundant authenticated NTP

  B. local NTP within each network device

  C. redundant unauthenticated NTP

  D. authenticated NTP services from one of the local AD domain controllers

  Correct Answer: A

• Question 867:

  Which benefit does the Antivirus Engine within AMP for Endpoints provide?

  A. It displays all files that have been executed across your organization, ordered by prevalence from lowest to highest.

  B. It continuously tracks file propagation over time throughout your environment.

  C. It performs offline and system-based detections, including rootkit scanning.

  D. It provides visibility into which command-line arguments are used to launch executables.

  Correct Answer: B

• Question 868:

  

  Refer to the exhibit. Which description of what happened on the system is true?

  A. A user connected to the system using SSH using source port 55796.

  B. A user created a new HTTP session using the SHA256 hashing algorithm.

  C. A user connected to the system after 450 attempts.

  D. A user connected to the system using remote access VPN.

  Correct Answer: A

• Question 869:

  What does the sum of the risks presented by an application represent for that application?

  A. application attack surface

  B. HIPPA violation

  C. vulnerability

  D. security violation

  Correct Answer: A

• Question 870:

  Which two characteristics of a secure hashing algorithm are true? (Choose two.)

  A. produces a variable-length output

  B. not reversible

  C. produces a fixed-length output

  D. susceptible to collisions

  E. reversible

  Correct Answer: BC