Cisco 600-199 Online Practice Questions and Exam Preparation

Cisco 600-199 Online Questions & Answers

• Question 41:

  Which publication from the ISO covers security incident response?

  A. 1918
  B. 2865
  C. 27035
  D. 25012
  C. 27035

• Question 42:

  Which network management protocol relies on multiple connections between a managed device and the management station where such connections can be independently initiated by either side?

  A. SSH
  B. SNMP
  C. Telnet
  D. NetFlow
  B. SNMP

• Question 43:

  Which event is actionable?

  A. SSH login failed
  B. Telnet login failed
  C. traffic flow started
  D. reverse shell detected
  D. reverse shell detected

• Question 44:

  What is the maximum size of an IP datagram?

  A. There is no maximum size.
  B. It is limited only by the memory on the host computers at either end of the connection and the intermediate routers.
  C. 1024 bytes
  D. 65535 bytes
  E. 32768 bytes
  D. 65535 bytes

• Question 45:

  Given the signature "SQL Table Manipulation Detected", which site may trigger a false positive?

  A. a company selling discount dining-room table inserts
  B. a large computer hardware company
  C. a small networking company
  D. a biotech company
  A. a company selling discount dining-room table inserts

• Question 46:

  Which two statements about the IPv4 TTL field are true? (Choose two.)

  A. If the TTL is 0, the datagram is automatically retransmitted.
  B. Each router that forwards an IP datagram reduces the TTL value by one.
  C. It is used to limit the lifetime of an IP datagram on the Internet.
  D. It is used to track IP datagrams on the Internet.
  B. Each router that forwards an IP datagram reduces the TTL value by one.
  C. It is used to limit the lifetime of an IP datagram on the Internet.

• Question 47:

  Refer to the exhibit.

  

  Based on the tcpdump output, which two statements are true? (Choose two.)

  A. The reply is sent via unicast.
  B. All devices in the same subnet on a switched network will see the reply because it was broadcast.
  C. The device is coming up for the first time and is requesting an IP address.
  D. The ARP request is being sent as a broadcast.
  E. The device is requesting an ARP.
  F. Host 192.168.10.7 is requesting the operational status of host 192.168.10.8.
  A. The reply is sent via unicast.
  D. The ARP request is being sent as a broadcast.

• Question 48:

  In what sequence do the proper eradicate/recovery steps take place? 1) Re-image2) Restore3) Patch4) Backup

  A. 1, 2, 3, 4
  B. 4, 3, 2, 1
  C. 1, 3, 4, 2
  D. 4, 1, 3, 2
  D. 4, 1, 3, 2

• Question 49:

  Which two tools are used to help with traffic identification? (Choose two.)

  A. network sniffer
  B. ping
  C. traceroute
  D. route table
  E. NetFlow
  F. DHCP
  A. network sniffer
  E. NetFlow

• Question 50:

  Refer to the exhibit.

  

  Which two options does the following tcpdump command do? (Choose two.)

  A. Read from nvram (non-volatile) and parse the stream.
  B. Capture traffic based on host 10.10.10.10 and HTTP traffic.
  C. Capture traffic based on host 10.10.10.10 and everything but HTTP traffic.
  D. Capture ARP traffic only.
  E. Write the capture as a file.
  F. Read the capture from a file.
  C. Capture traffic based on host 10.10.10.10 and everything but HTTP traffic.
  E. Write the capture as a file.