Cisco 500-290 Online Practice Questions and Exam Preparation

Cisco 500-290 Online Questions & Answers

• Question 31:

  What are the two categories of variables that you can configure in Object Management?

  A. System Default Variables and FireSIGHT-Specific Variables
  B. System Default Variables and Procedural Variables
  C. Default Variables and Custom Variables
  D. Policy-Specific Variables and Procedural Variables
  C. Default Variables and Custom Variables

• Question 32:

  Which option describes Spero file analysis?

  A. a method of analyzing the SHA-256 hash of a file to determine whether a file is malicious or not
  B. a method of analyzing the entire contents of a file to determine whether it is malicious or not
  C. a method of analyzing certain file characteristics, such as metadata and header information, to determine whether a file is malicious or not
  D. a method of analyzing a file by executing it in a sandbox environment and observing its behaviors to determine if it is malicious or not
  C. a method of analyzing certain file characteristics, such as metadata and header information, to determine whether a file is malicious or not

• Question 33:

  Other than navigating to the Network File Trajectory page for a file, which option is an alternative way of accessing the network trajectory of a file?

  A. from Context Explorer
  B. from the Analysis menu
  C. from the cloud
  D. from the Defense Center
  A. from Context Explorer

• Question 34:

  Context Explorer can be accessed by a subset of user roles. Which predefined user role is valid for FireSIGHT event access?

  A. Administrator
  B. Intrusion Administrator
  C. Maintenance User
  D. Database Administrator
  A. Administrator

• Question 35:

  Which option is a valid whitelist evaluation value?

  A. pending
  B. violation
  C. semi-compliant
  D. not-evaluated
  D. not-evaluated

• Question 36:

  When adding source and destination ports in the Ports tab of the access control policy rule editor, which restriction is in place?

  A. The protocol is restricted to TCP only.
  B. The protocol is restricted to UDP only.
  C. The protocol is restricted to TCP or UDP.
  D. The protocol is restricted to TCP and UDP.
  C. The protocol is restricted to TCP or UDP.

• Question 37:

  The collection of health modules and their settings is known as which option?

  A. appliance policy
  B. system policy
  C. correlation policy
  D. health policy
  D. health policy

• Question 38:

  Which statement describes the meaning of a red health status icon?

  A. A critical threshold has been exceeded.
  B. At least one health module has failed.
  C. A health policy has been disabled on a monitored device.
  D. A warning threshold has been exceeded.
  A. A critical threshold has been exceeded.

• Question 39:

  Which feature in the Cisco AMP solution provides the ability to track malware activity over time?

  A. malware detection
  B. sandboxing
  C. blacklisting
  D. trajectory
  D. trajectory

• Question 40:

  Which option is a remediation module that comes with the Sourcefire System?

  A. Cisco IOS Null Route
  B. Syslog Route
  C. Nmap Route Scan
  D. Response Group
  A. Cisco IOS Null Route