Online Access Free 600-199 Exam Questions

Which is considered to be anomalous activity?

• A.an alert describing an anonymous login attempt to an FTP server
• B.an alert context buffer containing traffic to amazon.com
• C.an alert context buffer containing SSH traffic
• D.an alert context buffer containing an FTP server SYN scanning your network

Which data is the most useful to determine if a network attack was occurring from inbound Internet traffic?

• A.DNS request logs
• B.Apache server logs
• C.VPN connection logs
• D.syslogs from all core switches
• E.NetfFow data from border firewall(s)

What is the most important reason for documenting an incident?

• A.It could be used as evidence for a criminal case.
• B.It could be used to identify the person responsible for allowing it into the network.
• C.To use it for future incident response handling.
• D.To train others on what they should not do.

Which attack exploits incorrect boundary checking in network software?

• A.buffer overflow
• B.Slowloris
• C.man-in-the-middle
• D.Smurf

Which two tools are used to help with traffic identification? (Choose two.)

• A.ping
• B.NetFlow
• C.DHCP
• D.route table
• E.traceroute
• F.network sniffer