Cisco 500-290 Online Practice Questions and Exam Preparation

Cisco 500-290 Online Questions & Answers

• Question 41:

  Correlation policy rules allow you to construct criteria for alerting on very specific conditions. Which option is an example of such a rule?

  A. testing password strength when accessing an application
  B. limiting general user access to administrative file shares
  C. enforcing two-factor authentication for access to critical servers
  D. issuing an alert if a noncompliant operating system is detected or if a host operating system changes to a noncompliant operating system when it was previously profiled as a compliant one
  D. issuing an alert if a noncompliant operating system is detected or if a host operating system changes to a noncompliant operating system when it was previously profiled as a compliant one

• Question 42:

  Which policy controls malware blocking configuration?

  A. file policy
  B. malware policy
  C. access control policy
  D. IPS policy
  A. file policy

• Question 43:

  Which statement represents detection capabilities of the HTTP preprocessor?

  A. You can configure it to blacklist known bad web servers.
  B. You can configure it to normalize cookies in HTTP headers.
  C. You can configure it to normalize image content types.
  D. You can configure it to whitelist specific servers.
  B. You can configure it to normalize cookies in HTTP headers.

• Question 44:

  The IP address::/0 is equivalent to which IPv4 address and netmask?

  A. 0.0.0.0
  B. 0.0.0.0/0
  C. 0.0.0.0/24
  D. The IP address::/0 is not valid IPv6 syntax.
  B. 0.0.0.0/0

• Question 45:

  FireSIGHT uses three primary types of detection to understand the environment in which it is deployed. Which option is one of the detection types?

  A. protocol layer
  B. application
  C. objects
  D. devices
  B. application

• Question 46:

  FireSIGHT recommendations appear in which layer of the Policy Layers page?

  A. Layer Summary
  B. User Layers
  C. Built-In Layers
  D. FireSIGHT recommendations do not show up as a layer.
  C. Built-In Layers

• Question 47:

  What does the whitelist attribute value "not evaluated" indicate?

  A. The host is not a target of the whitelist.
  B. The host could not be evaluated because no profile exists for it.
  C. The whitelist status could not be updated because the correlation policy it belongs to is not enabled.
  D. The host is not on a monitored network segment.
  A. The host is not a target of the whitelist.

• Question 48:

  Which option transmits policy-based alerts such as SNMP and syslog?

  A. the Defense Center
  B. FireSIGHT
  C. the managed device
  D. the host
  C. the managed device

• Question 49:

  How do you configure URL filtering?

  A. Add blocked URLs to the global blacklist.
  B. Create a Security Intelligence object that contains the blocked URLs and add the object to the access control policy.
  C. Create an access control rule and, on the URLs tab, select the URLs or URL categories that are to be blocked or allowed.
  D. Create a variable.
  C. Create an access control rule and, on the URLs tab, select the URLs or URL categories that are to be blocked or allowed.

• Question 50:

  Which Sourcefire feature allows you to send traffic directly through the device without inspecting it?

  A. fast-path rules
  B. thresholds or suppressions
  C. blacklist
  D. automatic application bypass
  A. fast-path rules