Cisco 600-199 Online Practice Questions and Exam Preparation

Cisco 600-199 Online Questions & Answers

• Question 51:

  Which command would provide you with interface status information on a Cisco IOS router?

  A. show status interface
  B. show running-config
  C. show ip interface brief
  D. show interface snmp
  C. show ip interface brief

• Question 52:

  Which describes the best method for preserving the chain of evidence?

  A. Shut down the machine that is infected, remove the hard drive, and contact the local authorities.
  B. Back up the hard drive, use antivirus software to clean the infected machine, and contact the local authorities.
  C. Identify the infected machine, disconnect from the network, and contact the local authorities.
  D. Allow user(s) to perform any business-critical tasks while waiting for local authorities.
  C. Identify the infected machine, disconnect from the network, and contact the local authorities.

• Question 53:

  Which source should be used to recommend preventative measures against security vulnerabilities regardless of operating system or platform?

  A. Microsoft security bulletins
  B. Cisco PSIRT notices
  C. Common Vulnerabilities and Exposure website
  D. Mozilla Foundation security advisories
  E. zero-day attack wiki
  C. Common Vulnerabilities and Exposure website

• Question 54:

  When is it recommended to establish a traffic profile baseline for your network?

  A. outside of normal production hours
  B. during a DDoS attack
  C. during normal production hours
  D. during monthly file server backup
  C. during normal production hours

• Question 55:

  What are four steps to manage incident response handling? (Choose four.)

  A. preparation
  B. qualify
  C. identification
  D. who
  E. containment
  F. recovery
  G. eradication
  H. lessons learned
  A. preparation
  C. identification
  E. containment
  H. lessons learned

• Question 56:

  Which would be classified as a remote code execution attempt?

  A. OLE stack overflow detected
  B. null login attempt
  C. BitTorrent activity detected
  D. IE ActiveX DoS
  A. OLE stack overflow detected

• Question 57:

  Which data from previous network attacks should be used to recommend architectural changes based on potential future impact?

  A. SNMP statistics
  B. known vulnerabilities
  C. security audit reports
  D. IPS signature logs
  E. STP topology changes
  A. SNMP statistics

• Question 58:

  What is the most effective way to save the data on a system for later forensic use?

  A. Use a hard duplicator with write-block capabilities.
  B. Copy the files to another disk.
  C. Copy the disk file by file.
  D. Shut down the system.
  A. Use a hard duplicator with write-block capabilities.