Cisco Cisco Certifications 210-255 Questions & Answers

• Question 161:

  Refer to the exhibit. You notice that the email volume history has been abnormally high. Which potential result is true?

  

  A. Email sent from your domain might be filtered by the recipient.

  B. Messages sent to your domain may be queued up until traffic dies down.

  C. Several hosts in your network may be compromised.

  D. Packets may be dropped due to network congestion.

  Correct Answer: C

• Question 162:

  Which element can be used by a threat actor to discover a possible opening into a target network and can also be used by an analyst to determine the protocol of the malicious traffic?

  A. TTLs

  B. ports

  C. SMTP replies

  D. IP addresses

  Correct Answer: B

• Question 163:

  Refer to the exhibit. Which type of log is this an example of?

  

  A. syslog

  B. NetFlow log

  C. proxy log

  D. IDS log

  Correct Answer: D

• Question 164:

  Refer to the exhibit. Which type of log is this an example of?

  

  A. IDS log

  B. proxy log

  C. NetFlow log

  D. syslog

  Correct Answer: C

  A typical output of a NetFlow command line tool (nfdump in this case) when printing the stored flows may look as follows:

  Date flow start Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows 2010-09-01 00:00:00.459 0.000 UDP 127.0.0.1:24920 -> 192.168.0.1:22126 1 46 1 2010-09-01 00:00:00.363 0.000 UDP 192.168.0.1:22126 -> 127.0.0.1:24920 1 80 1

  Reference: http://nfdump.sourceforge.net/

• Question 165:

  Which option allows a file to be extracted from a TCP stream within Wireshark?

  A. File > Export Objects

  B. Analyze > Extract

  C. Tools > Export > TCP

  D. View > Extract

  Correct Answer: A

• Question 166:

  During which phase of the forensic process are tools and techniques used to extract the relevant information from the collective data?

  A. examination

  B. reporting

  C. collection

  D. investigation

  Correct Answer: A

  Examinations involve forensically processing large amounts of collected data using a combination of automated and manual methods to assess and extract data of particular interest, while preserving the integrity of the data. Forensic tools and techniques appropriate to the types of data that were collected are executed to identify and extract the relevant information from the collected data while protecting its integrity. Examination may use a combination of automated tools and manual processes.

• Question 167:

  Which element is included in an incident response plan?

  A. organization mission

  B. junior analyst approval

  C. day-to-day firefighting

  D. siloed approach to communications

  Correct Answer: A

• Question 168:

  In Microsoft Windows, as files are deleted the space they were allocated eventually is considered available for use by other files. This creates alternating used and unused areas of various sizes. What is this called?

  A. network file storing

  B. free space fragmentation

  C. alternate data streaming

  D. defragmentation

  Correct Answer: B

• Question 169:

  Which process is being utilized when IPS events are removed to improve data integrity?

  A. data normalization

  B. data availability

  C. data protection

  D. data signature

  Correct Answer: A

• Question 170:

  Which goal of data normalization is true?

  A. Reduce data redundancy.

  B. Increase data redundancy.

  C. Reduce data availability.

  D. Increase data availability

  Correct Answer: A