Cisco Cisco Certifications 210-255 Questions & Answers

• Question 81:

  Which event artifact can be used to identify HTTP GET requests for a specific file?

  A. HTTP status code

  B. TCP ACK

  C. destination IP

  D. URI

  Correct Answer: D

• Question 82:

  Which file is allocated with 32 bits?

  A. NTFS

  B. FAT32

  C. FAT

  D. EXT4

  Correct Answer: B

• Question 83:

  What can be addressed when using retrospective security techniques?

  A. if the affected host needs a software update

  B. what system are affected

  C. if the affected system needs replacement

  D. why the malware is still in our network

  Correct Answer: D

• Question 84:

  Which option is the process of remediating the network and systems and/or reconstructing the attack so that the responsible threat actor can be revealed?

  A. data analytics

  B. asset attribution

  C. threat actor attribution

  D. evidence collection

  Correct Answer: A

• Question 85:

  Which of the following is typically a responsibility of a PSIRT (Product SIRT)?

  A. Configure the organization's firewall

  B. Monitor security logs

  C. Investigate security incidents in a SOC

  D. Disclosure vulnerabilities in the organization's products and services

  Correct Answer: D

• Question 86:

  When incident data is collected, it is important that evidentiary cross-contamination is prevented. How is this accomplished?

  A. by allowing unrestricted access to impacted devices

  B. by not allowing items of evidence to physically touch

  C. by ensuring power is removed to all devices involved

  D. by not permitting a device to store evidence if it is the evidence itself.

  Correct Answer: D

• Question 87:

  Which of the following is not an example of reconnaissance?

  A. Searching the robots.txt file

  B. Redirecting users to a source and scanning traffic to learn about the target

  C. Scanning without completing the three-way handshake

  D. Communicating over social media

  Correct Answer: B

• Question 88:

  What does the CSIRT incident response provider usually do?

  A. provide incident handling services to their parent organization.

  B. provide incident handling services to a country

  C. coordinate and facilitate the handling of incidents across various CSIRTs

  D. focus on synthesizing data from various sources to determine trends and patterns in incident activity

  E. handle reports of vulnerabilities in their software or hardware products

  F. offer incident handling services as a for-fee service to other organizations

  Correct Answer: D

• Question 89:

  Which CSIRT category provides incident handling services to their parent organization such as a bank, a manufacturing company, a university, or a federal agency?

  A. internal CSIRT

  B. national CSIRT

  C. coordination centers

  D. analysis centers

  E. vendor teams

  F. incident response providers

  Correct Answer: A

• Question 90:

  What define the roadmap for implementing the incident response plan?

  A. Incident response plan

  B. Incident response policy

  C. Incident response procedures

  Correct Answer: A