500-280 by Cisco Actual Free Exam Q&As

Question 1

What is a GID?

A. Gigabit interface definition B. Generator ID C. gradual interrupt detection D. general intrusion domain

Discussion 0

Correct Answer: B Vote an answer

Question 2

Which statement about implementing DAQ is true?

A. You must obtain it from Sourceforge. B. It is a shell script that works on any Linux platform. C. It is not open source. D. It must be compiled separately.

Discussion 0

Correct Answer: D Vote an answer

Question 3

If Snort is installed and the sensor, database, and web server all reside on the same machine, to which ports should remote access of the sensor be restricted?

A. 80 and 443 B. 22 and 443 C. 23 and 80 D. 443 and 3306

Discussion 0

Correct Answer: B Vote an answer

Question 4

Which statement about the FTPTelnet preprocessor is true?

A. It can normalize FTP network traffic. B. It can check for correctness of Telnet commands. C. It can reassemble FTP fragments. D. It can limit how much server-side traffic to process.

Discussion 0

Correct Answer: A Vote an answer

Question 5

Which configuration is optimal for the frag3 engine?

A. Keep the configuration as simple as possible, for better performance. B. Deploy the engine only in passive mode, for better performance. C. Bind client IP addresses to policies that represent operating systems, so that clients can process traffic the same way that the IPS engine does. D. Bind target IP addresses to policies that represent operating systems, so that the IPS engine can process traffic the same way that target hosts do.

Discussion 0

Correct Answer: D Vote an answer

Question 6

Which technique can an intruder use to try to evade detection by a Snort sensor?

A. exceed the maximum number of fragments that a sensor can evaluate B. split the malicious payload over several fragments to mask the attack signature C. send more packet fragments than the destination host can reassemble, to disable the host without regard to any intrusion-detection devices that might be on the network D. disable a sensor by exceeding the number of packets that it can fragment before forwarding

Discussion 0

Correct Answer: B Vote an answer

Cisco Securing Cisco Networks with Open Source Snort - 500-280 Exam Practice Test