Cisco 210-255 Online Practice Questions and Exam Preparation

Cisco 210-255 Online Questions & Answers

• Question 81:

  According to NIST what option is unnecessary for containment strategy?

  A. The delayed containment
  B. Monitoring with methods other than sandboxing
  A. The delayed containment
  B. Monitoring with methods other than sandboxing

• Question 82:

  What can be addressed when using retrospective security techniques?

  A. if the affected host needs a software update
  B. what system are affected
  C. if the affected system needs replacement
  D. why the malware is still in our network
  D. why the malware is still in our network

• Question 83:

  What is the process of remediation the network and systems and/or reconstructing so the responsible threat actor can be revealed?

  A. Data analysis
  B. Assets distribution
  C. Evidence collection
  D. Threat actor distribution
  D. Threat actor distribution

• Question 84:

  Which example of a precursor is true?

  A. A notification that a host is infected with malware.
  B. An admin finds their password has been changed.
  C. A log indicating a port scan was run against a host
  D. A device configuration changed from the baseline without an audit log entry.
  C. A log indicating a port scan was run against a host

• Question 85:

  A CMS plugin creates two files that are accessible from the Internet myplugin.html and exploitable.php. A newly discovered exploit takes advantage of an injection vulnerability in exploitable.php. To exploit the vulnerability, one must send an HTTP POST with specific variables to exploitable.php. You see traffic to your webserver that consists of only HTTP GET requests to myplugin.html. Which category best describes this activity?

  A. weaponization
  B. exploitation
  C. installation
  D. reconnaissance
  B. exploitation

• Question 86:

  Which evidence is considered to be the most volatile?

  A. disk
  B. registers and cache
  C. removable media
  D. logging
  D. logging

• Question 87:

  Which data type is protected under the PCI compliance framework?

  A. credit card type
  B. primary account number
  C. health conditions
  D. provision of individual care
  B. primary account number

• Question 88:

  Which source provides reports of vulnerabilities in software and hardware to a Security Operations Center?

  A. Analysis Center
  B. National CSIRT
  C. Internal CSIRT
  D. Physical Security
  C. Internal CSIRT

• Question 89:

  Which option filters a LibPCAP capture that used a host as a gateway?

  A. tcp|udp] [src|dst] port
  B. [src|dst] net [{mask }|{len }]
  C. ether [src|dst] host
  D. gateway host
  D. gateway host

• Question 90:

  What do the Security Intelligence Events within the FMC allow an administrator to do?

  A. See if a host is connecting to a known-bad domain.
  B. Check for host-to-server traffic within your network.
  C. View any malicious files that a host has downloaded.
  D. Verify host-to-host traffic within your network.
  A. See if a host is connecting to a known-bad domain.