Cisco 300-210 Online Practice Questions and Exam Preparation

Cisco 300-210 Online Questions & Answers

• Question 51:

  

  What is the status of OS Identification?

  A. It is only enabled to identify "Cisco IOS" OS using statically mapped OS fingerprinting
  B. OS mapping information will not be used for Risk Rating calculations.
  C. It is configured to enable OS mapping and ARR only for the 10.0.0.0/24 network.
  D. It is enabled for passive OS fingerprinting for all networks.
  D. It is enabled for passive OS fingerprinting for all networks.

  ---

  Understanding Passive OS Fingerprinting

  Passive OS fingerprinting lets the sensor determine the OS that hosts are running. The sensor analyzes network traffic between hosts and stores the OS of these hosts with their IP addresses. The sensor inspects TCP SYN and SYNACK

  packets exchanged on the network to determine the OS type.

  The sensor then uses the OS of the target host OS to determine the relevance of the attack to the victim by computing the attack relevance rating component of the risk rating. Based on the relevance of the attack, the sensor may alter the risk

  rating of the alert for the attack and/or the sensor may filter the alert for the attack. You can then use the risk rating to reduce the number of false positive alerts (a benefit in IDS mode) or definitively drop suspicious packets (a benefit in IPS

  mode). Passive OS fingerprinting also enhances the alert output by reporting the victim OS, the source of the OS identification, and the relevance to the victim OS in the alert.

  Passive OS fingerprinting consists of three components:

  稰assive OS learning

  Passive OS learning occurs as the sensor observes traffic on the network. Based on the characteristics of TCP SYN and SYNACK packets, the sensor makes a determination of the OS running on the host of the source IP address.

  稶ser-configurable OS identification

  You can configure OS host mappings, which take precedence over learned OS mappings.

  稢omputation of attack relevance rating and risk rating.

• Question 52:

  Which information does whoami command display in a WSA?

  A. Full name, group and location
  B. Username, fullname and groups
  C. Username only
  D. Username and groups
  B. Username, fullname and groups

• Question 53:

  An enginner manages a Cisco Intrusion Prevention System via IME. A new user must be able to tune signatures, but must not be able to create new users. Which role for the new user is correct?

  A. viewer
  B. service
  C. operator
  D. administrator
  C. operator

• Question 54:

  A user wants to conire high availability with their Cisco Firepoer deployment . Which platform allow for clustering?

  A. Virtual NGIPS
  B. All platform support clustering
  C. Cisco Firepower appliance
  D. FirePOWERE Threat Defense for ISR
  C. Cisco Firepower appliance

• Question 55:

  A Cisco Web Security Appliance's policy can provide visibility and control of which two elements? (Choose two.)

  A. Voice and Video Applications
  B. Websites with a reputation between -100 and -60
  C. Secure websites with certificates signed under an unknown CA
  D. High bandwidth websites during business hours
  C. Secure websites with certificates signed under an unknown CA
  D. High bandwidth websites during business hours

• Question 56:

  An engineer wants to configure a method to verify the authenticity of emails on cisco ESA and noticed the sender policy framework. How can the SPF help in that task?

  A. SPF allows the sender to sign the email using preshared key
  B. SPF allows the sender to sign the email using public key
  C. SPF allows the owner of an internet domain to use DNS TXT records to specify which machines are authorized to transmit email for that domain.
  D. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in the form of a specially formatted TXT record
  B. SPF allows the sender to sign the email using public key

• Question 57:

  Which Cisco Advanced Malware Protection event is generated when a file disposition changes because more information is gathered and evaluated about the file?

  A. quarantine event
  B. threat detected event
  C. policy update event D. retrospective event
  D

• Question 58:

  Which two statements about devices within a Cisco ESA cluster are true? (Choose two.)

  A. Clustered systems must consist of devices in the same hardware series.
  B. Clustered devices can communicate via either SSH or Cluster Communication Service.
  C. Clustered devices can communicate only with Cluster Communication Service.
  D. In-the-cloud devices must be in a separate cluster from on-premise devices.
  E. Clustered devices can run different versions of AsyncOS.
  A. Clustered systems must consist of devices in the same hardware series.
  B. Clustered devices can communicate via either SSH or Cluster Communication Service.

• Question 59:

  Which option lists the minimum requirements to deploy a managed device inline?

  A. passive interface, security zone, MTU, and link mode.
  B. passive interface, MTU, MDI/MDIX, and link mode.
  C. inline interfaces, MTU, MDI/MDIX, and link mode.
  D. inline interfaces, security zones, MTU, and link mode.
  A. passive interface, security zone, MTU, and link mode.

• Question 60:

  Which two features of Cisco Email Security can protect your organization against email threats? (Choose two.)

  A. Time-based one-time passwords
  B. Data loss prevention
  C. NetFlow
  D. Geolocation-based filtering
  E. Heunstic-based filtering
  A. Time-based one-time passwords
  B. Data loss prevention