210-255 · Question #188
Which two elements are used for profiling a network? (Choose two.)
The correct answer is D. OS fingerprint E. listening ports. Network profiling uses OS fingerprinting and listening port enumeration to build a baseline understanding of what devices and services exist on a network.
Question
Which two elements are used for profiling a network? (Choose two.)
Options
- Atotal throughout
- Bsession duration
- Crunning processes
- DOS fingerprint
- Elistening ports
How the community answered
(24 responses)- A4% (1)
- C4% (1)
- D92% (22)
Why each option
Network profiling uses OS fingerprinting and listening port enumeration to build a baseline understanding of what devices and services exist on a network.
Total throughput is a performance and capacity metric used for traffic baselining and bandwidth analysis, not for identifying and profiling the devices and services on a network.
Session duration is a traffic-flow characteristic used in behavioral analysis and anomaly detection, not a primary element used to profile the composition of a network.
Running processes are a host-level profiling element captured via endpoint agents or system access, not a network-level profiling attribute gathered through network observation.
OS fingerprinting identifies the operating systems running on network hosts, which is a fundamental component of a network profile because it reveals the attack surface and expected behavior of each device.
Listening ports reveal which network services are actively accepting connections on each host, establishing a baseline of expected services that analysts use to detect unauthorized or anomalous activity.
Concept tested: Network profiling using OS fingerprint and listening ports
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/network_discovery_policies.html
Topics
Community Discussion
No community discussion yet for this question.