600-199 Exam Questions

Which describes the best method for preserving the chain of evidence?

Which will be provided as output when issuing the show processes cpu command on a Cisco IOS router?

Refer to the exhibit. Which protocol is used in this network traffic flow?

Which two types of data are relevant to investigating network security issues? (Choose two.)

In the context of a network security device like an IPS, which event would qualify as having the highest severity?

Which event is likely to be a false positive?

Given a Linux machine running only an SSH server, which chain of alarms would be most concerning?

If a company has a strict policy to limit potential confidential information leakage, which three alerts would be of concern? (Choose three.)

Which event is actionable?

Which would be classified as a remote code execution attempt?

Given the signature "SQL Table Manipulation Detected", which site may trigger a false positive?

Which is considered to be anomalous activity?

If an alert that pertains to a remote code execution attempt is seen on your network, which step is unlikely to help?

Refer to the exhibit. In the tcpdump output, what is the sequence number that is represented by XXXXX?

Refer to the exhibit. Based on the traffic captured in the tcpdump, what is occurring?

Which three statements are true about the IP fragment offset? (Choose three.)

Which two tools are used to help with traffic identification? (Choose two.)

Refer to the exhibit. Based on the tcpdump capture, which three statements are true? (Choose three.)

Refer to the exhibit. Based on the tcpdump output, which two statements are true? (Choose two.)

Refer to the exhibit. Which two options does the following tcpdump command do? (Choose two.)

What is the maximum size of an IP datagram?

The IHL is a 4-bit field containing what measurement?

What is the purpose of the TCP SYN flag?

Refer to the exhibit. What does the tcpdump command do?

What is the most effective way to save the data on a system for later forensic use?

In a network security policy, which procedure should be documented ahead of time to speed the communication of a network attack?

Which data is the most useful to determine if a network attack was occurring from inbound Internet traffic?

Which step should be taken first when a server on a network is compromised?

After an attack has occurred, which two options should be collected to help remediate the problem? (Choose two.)

Which source should be used to recommend preventative measures against security vulnerabilities regardless of operating system or platform?

Which data from previous network attacks should be used to recommend architectural changes based on potential future impact?

Which three post-mortem steps are critical to help prevent a network attack from reoccurring? (Choose three.)

Refer to the exhibit. Which two personal administrators should be involved to investigate further? (Choose two.)

Which network management protocol relies on multiple connections between a managed device and the management station where such connections can be independently initiated by either...

When an IDS generates an alert for a correctly detected network attack, what is this event called?

When is it recommended to establish a traffic profile baseline for your network?

Which two activities would you typically be expected to perform as a Network Security Analyst? (Choose two.)

Which protocol is typically considered critical for LAN operation?

Which two measures would you recommend to reduce the likelihood of a successfully executed network attack from the Internet? (Choose two.)

Which attack exploits incorrect boundary checking in network software?

Where should you report suspected security vulnerability in Cisco router software?

When investigating potential network security issues, which two pieces of useful information would be found in a syslog message? (Choose two.)

Which command would provide you with interface status information on a Cisco IOS router?

Refer to the exhibit. Which DNS Query Types pertains to email?

A server administrator tells you that the server network is potentially under attack. Which piece of information is critical to begin your network investigation?

Refer to the exhibit. In the packet captured from tcpdump, which fields match up with the lettered parameters?

For TCP and UDP, what is the correct range of well-known port numbers?

Which three symptoms are best used to detect a TCP SYN flood attack? (Choose three.)

Which two statements about the IPv4 TTL field are true? (Choose two.)

What are four steps to manage incident response handling? (Choose four.)