Cisco 600-199 Online Practice Questions and Exam Preparation

Cisco 600-199 Online Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  In the tcpdump output, what is the sequence number that is represented by XXXXX?

  A. 82080
  B. 82081
  C. 83448
  D. 83449
  E. 98496
  F. 98497
  C. 83448

• Question 32:

  Which event is likely to be a false positive?

  A. Internet Relay Chat signature with an alert context buffer containing #IPS_ROCS Yay
  B. a signature addressing an ActiveX vulnerability alert on a Microsoft developer network documentation page
  C. an alert for a long HTTP request with an alert context buffer containing a large HTTP GET request
  D. BitTorrent activity detected on ephemeral ports
  B. a signature addressing an ActiveX vulnerability alert on a Microsoft developer network documentation page

• Question 33:

  Which will be provided as output when issuing the show processes cpu command on a Cisco IOS router?

  A. router configuration
  B. CPU utilization of device
  C. memory used by device processes
  D. interface processing statistics
  B. CPU utilization of device

• Question 34:

  Which is considered to be anomalous activity?

  A. an alert context buffer containing traffic to amazon.com
  B. an alert context buffer containing SSH traffic
  C. an alert context buffer containing an FTP server SYN scanning your network
  D. an alert describing an anonymous login attempt to an FTP server
  C. an alert context buffer containing an FTP server SYN scanning your network

• Question 35:

  When investigating potential network security issues, which two pieces of useful information would be found in a syslog message? (Choose two.)

  A. product serial number
  B. MAC address
  C. IP address
  D. product model number
  E. broadcast address
  B. MAC address
  C. IP address

• Question 36:

  Refer to the exhibit.

  

  What does the tcpdump command do?

  A. Capture all packets sourced from TCP port 1514, resolve DNS names, print all TCP packets with the SYN flag not equaling 0, and print the Ethernet header and all version information.
  B. Capture all packets sourced from TCP port 1514, resolve DNS names, print all TCP packets except those containing the SYN flag, and print the Ethernet header and all version information.
  C. Capture up to 1514 bytes, do not resolve DNS names, print all TCP packets except for those containing the SYN flag, and print the Ethernet header and be very verbose.
  D. Capture up to 1514 bytes, do not resolve DNS names, print only TCP packets containing the SYN flag, and print the Ethernet header and be very verbose.
  D. Capture up to 1514 bytes, do not resolve DNS names, print only TCP packets containing the SYN flag, and print the Ethernet header and be very verbose.

• Question 37:

  When an IDS generates an alert for a correctly detected network attack, what is this event called?

  A. false positive
  B. true negative
  C. true positive
  D. false negative
  C. true positive

• Question 38:

  Refer to the exhibit.

  

  Based on the tcpdump capture, which three statements are true? (Choose three.)

  A. Host 10.10.10.20 is requesting the MAC address of host 10.10.10.10 using ARP.
  B. Host 10.10.10.10 is requesting the MAC address of host 10.10.10.20.
  C. The ARP request is unicast.
  D. The ARP response is unicast.
  E. The ARP request is broadcast.
  F. Host 10.10.10.20 is using the MAC address of ffff.ffff.ffff.
  B. Host 10.10.10.10 is requesting the MAC address of host 10.10.10.20.
  D. The ARP response is unicast.
  E. The ARP request is broadcast.

• Question 39:

  Which two activities would you typically be expected to perform as a Network Security Analyst? (Choose two.)

  A. Verify user login credentials.
  B. Troubleshoot firewall performance.
  C. Monitor database applications.
  D. Create security policies on routers.
  B. Troubleshoot firewall performance.
  D. Create security policies on routers.

• Question 40:

  If an alert that pertains to a remote code execution attempt is seen on your network, which step is unlikely to help?

  A. looking for anomalous traffic
  B. looking for reconnaissance activity
  C. restoring the machine to a known good backup
  D. clearing the event store to see if future events indicate malicious activity
  D. clearing the event store to see if future events indicate malicious activity