Cisco Securing Cisco Networks with Sourcefire Intrusion Prevention System

QUESTION NO: 1
Which mechanism should be used to write an IPS rule that focuses on the client or server side of a TCP communication?

A. the "flow" rule option B. the directional operator in the rule header C. The detection engine evaluates all sides of a TCP communication regardless of the rule options. D. specification of the source and destination ports in the rule header

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Which option describes the two basic components of Sourcefire Snort rules?

A. a rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol B. a rule body that contains packet-matching criteria or options to define where to look for content in a packet, and a rule header to define matching criteria based on where a packet originates, where it is going, and over which protocol C. a rule header to define source, destination, and protocol, and the output configuration to determine which form of output to produce if the rule triggers D. preprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place

Correct Answer: B

QUESTION NO: 3
Alert priority is established in which way?

A. through Context Explorer B. event classification C. priority.conf file D. host criticality selection

Correct Answer: B

QUESTION NO: 4
A context box opens when you click on an event icon in the Network File Trajectory map for a file. Which option is an element of the box?

A. Threat Name B. Application Protocol C. Scan D. File Name

Correct Answer: B

QUESTION NO: 5
Which option is true when configuring an access control rule?

A. You can use geolocation criteria to specify source and destination IP addresses by continent but not by country. B. You can use geolocation criteria to specify destination IP addresses by country but not source IP addresses. C. You can use geolocation criteria to specify source IP addresses by country and continent, as well as destination IP addresses by country and continent. D. You can use geolocation criteria to specify source and destination IP addresses by country but not by continent.

Correct Answer: C

QUESTION NO: 6
Which option is a remediation module that comes with the Sourcefire System?

A. Syslog Route B. Response Group C. Cisco IOS Null Route D. Nmap Route Scan

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Cisco Securing Cisco Networks with Sourcefire Intrusion Prevention System - 500-285 Exam Questions