Cisco Cisco Certifications 210-255 Questions & Answers

• Question 141:

  Which of the following is an example of a managed security offering where incident response experts monitor and respond to security alerts in a security operations center (SOC)?

  A. Cisco CloudLock

  B. Cisco's Active Threat Analytics (ATA)

  C. Cisco Managed Firepower Service

  D. Cisco Jasper

  Correct Answer: B

• Question 142:

  Which of the following is not a metadata feature of the Diamond Model?

  A. Direction

  B. Result

  C. Devices

  D. Resources

  Correct Answer: C

• Question 143:

  Which of the following is typically a responsibility of a PSIRT?

  A. Configure the organization's firewall

  B. Monitor security logs

  C. Investigate security incidents in a security operations center (SOC)

  D. Disclose vulnerabilities in the organization's products and services

  Correct Answer: D

• Question 144:

  Which of the following are the three metrics, or "scores," of the Common Vulnerability Scoring System (CVSS)? (Select all that apply.)

  A. Baseline score

  B. Base score

  C. Environmental score

  D. Temporal score

  Correct Answer: BCD

• Question 145:

  Which of the following are not components of the 5-tuple of a flow in NetFlow? (Select all that apply.)

  A. Source IP address

  B. Flow record ID

  C. Gateway

  D. Source port

  E. Destination port

  Correct Answer: BC

• Question 146:

  Which of the following steps in the kill chain would come before the others?

  A. C2

  B. Delivery

  C. Installation

  D. Exploitation

  Correct Answer: B

• Question 147:

  Refer to the following packet capture. Which of the following statements is true about this packet capture?

  00:00:04.549138 IP omar.cisco.com.34548 > 93.184.216.34.telnet: Flags [S], seq 3152949738, win 29200,

  options [mss 1460,sackOK,TS val 1193148797 ecr 0,nop,wscale 7], length 0 00:00:05.547084 IP omar.cisco.com.34548 > 93.184.216.34.telnet: Flags [S], seq 3152949738, win 29200,

  options [mss 1460,sackOK,TS val 1193149047 ecr 0,nop,wscale 7], length 0 00:00:07.551078 IP omar.cisco.com.34548 > 93.184.216.34.telnet: Flags [S], seq 3152949738, win 29200,

  options [mss 1460,sackOK,TS val 1193149548 ecr 0,nop,wscale 7], length 0 00:00:11.559081 IP omar.cisco.com.34548 > 93.184.216.34.telnet: Flags [S], seq 3152949738, win 29200,

  options [mss 1460,sackOK,TS val 1193150550 ecr 0,nop,wscale 7], length 0

  A. The host with the IP address 93.184.216.34 is the source.

  B. The host omar.cisco.com is the destination.

  C. This is a Telnet transaction that is timing out and the server is not responding.

  D. The server omar.cisco.com is responding to 93.184.216.34 with four data packets.

  Correct Answer: D

• Question 148:

  Which of the following is one of the main goals of data normalization?

  A. To save duplicate logs for redundancy

  B. To purge redundant data while maintaining data integrity

  C. To correlate IPS and IDS logs with DNS

  D. To correlate IPS/IDS logs with firewall logs

  Correct Answer: B

• Question 149:

  Which of the following is an example of a coordination center?

  A. Cisco PSIRT

  B. Microsoft MSRC

  C. CERT division of the Software Engineering Institute (SEI)

  D. FIRST

  Correct Answer: C

• Question 150:

  Which of the following are examples of some of the responsibilities of a corporate CSIRT and the policies it helps create? (Select all that apply.)

  A. Scanning vendor customer networks

  B. Incident classification and handling

  C. Information classification and protection

  D. Information dissemination

  E. Record retentions and destruction

  Correct Answer: BCD