500-285 Exam Questions

Which option is true of the Packet Information portion of the Packet View screen?

Which option is used to implement suppression in the Rule Management user interface?

When you are editing an intrusion policy, how do you know that you have changes?

FireSIGHT recommendations appear in which layer of the Policy Layers page?

Host criticality is an example of which option?

FireSIGHT uses three primary types of detection to understand the environment in which it is deployed. Which option is one of the detection types?

When configuring FireSIGHT detection, an administrator would create a network discovery policy and set the action to "discover". Which option is a possible type of discovery?

Which option is derived from the discovery component of FireSIGHT technology?

The IP address ::/0 is equivalent to which IPv4 address and netmask?

In addition to the discovery of new hosts, FireSIGHT can also perform which function?

Which one of the following statements is true regarding tuned signatures?

Which TCP stream reassembly mode disables TCP window-evasion checking?

Which three values are used to calculate the risk rating for an event? (Choose three.)

A context box opens when you click on an event icon in the Network File Trajectory map for a file. Which option is an element of the box?

Which policy controls malware blocking configuration?

Which statement is true regarding malware blocking over HTTP?

Which option describes Spero file analysis?

Which event source can have a default workflow configured?

Where do you configure widget properties?

Which option describes the two basic components of Sourcefire Snort rules?

Which option is a valid whitelist evaluation value?

Which list identifies the possible types of alerts that the Sourcefire System can generate as notification of events or policy violations?

Correlation policy rules allow you to construct criteria for alerting on very specific conditions. Which option is an example of such a rule?

Which option is a remediation module that comes with the Sourcefire System?

What does the whitelist attribute value "not evaluated" indicate?

Controlling simultaneous connections is a feature of which type of preprocessor?

Which statement represents detection capabilities of the HTTP preprocessor?

A one-to-many type of scan, in which an attacker uses a single host to scan a single port on multiple target hosts, indicates which port scan type?

Which feature of the preprocessor configuration pages lets you quickly jump to a list of the rules associated with the preprocessor that you are configuring?

What does packet latency thresholding measure?

What are the two categories of variables that you can configure in Object Management?

Which option is true regarding the $HOME_NET variable?

Which option is one of the three methods of updating the IP addresses in Sourcefire Security Intelligence?

Which statement is true in regard to the Sourcefire Security Intelligence lists?

How do you configure URL filtering?

When adding source and destination ports in the Ports tab of the access control policy rule editor, which restriction is in place?

Access control policy rules can be configured to block based on the conditions that you specify in each rule. Which behavior block response do you use if you want to deny and reset...

Which option transmits policy-based alerts such as SNMP and syslog?

Which statement is true when adding a network to an access control rule?

Which option is true when configuring an access control rule?

One of the goals of geolocation is to identify which option?

Which option is not a characteristic of dashboard widgets or Context Explorer?

Which statement describes the meaning of a red health status icon?

What is the maximum timeout value for a browser session?

Which statement regarding user exemptions is true?

Remote access to the Defense Center database has which characteristic?

The collection of health modules and their settings is known as which option?

Context Explorer can be accessed by a subset of user roles. Which predefined user role is valid for FireSIGHT event access?

When configuring an LDAP authentication object, which server type is available?

Context Explorer can be accessed by a subset of user roles. Which predefined user role is not valid for FireSIGHT event access?