Online Access Free 600-199 Exam Questions

Which step should be taken first when a server on a network is compromised?

• A.Determine which server has been compromised.
• B.Find the serial number of the server.
• C.Email all server administrators.
• D.Refer to the company security policy.

The IHL is a 4-bit field containing what measurement?

• A.the size of the IP header, in bytes
• B.the number of 32-bit words in the entire IP datagram
• C.the size of the entire IP datagram, in bytes
• D.the number of 32-bit words in the IP header
• E.the number of bytes in the IP header

When investigating potential network security issues, which two pieces of useful information would be found in a syslog message? (Choose two.)

• A.MAC address
• B.broadcast address
• C.IP address
• D.product model number
• E.product serial number

Which event is actionable?

• A.reverse shell detected
• B.traffic flow started
• C.Telnet login failed
• D.SSH login failed

After an attack has occurred, which two options should be collected to help remediate the problem? (Choose two.)

• A.NAT translation table
• B.connection table information
• C.syslogs from affected devices
• D.packet captures
• E.NetFlow data