Online Access Free 600-199 Practice Test

If an alert that pertains to a remote code execution attempt is seen on your network, which step is unlikely to help?

• A.looking for anomalous traffic
• B.restoring the machine to a known good backup
• C.looking for reconnaissance activity
• D.clearing the event store to see if future events indicate malicious activity

Which data from previous network attacks should be used to recommend architectural changes based on potential future impact?

• A.known vulnerabilities
• B.security audit reports
• C.IPS signature logs
• D.STP topology changes
• E.SNMP statistics

Which two statements about the IPv4 TTL field are true? (Choose two.)

• A.It is used to track IP datagrams on the Internet.
• B.It is used to limit the lifetime of an IP datagram on the Internet.
• C.If the TTL is 0, the datagram is automatically retransmitted.
• D.Each router that forwards an IP datagram reduces the TTL value by one.

Which source should be used to recommend preventative measures against security vulnerabilities regardless of operating system or platform?

• A.Cisco PSIRT notices
• B.zero-day attack wiki
• C.Common Vulnerabilities and Exposure website
• D.Microsoft security bulletins
• E.Mozilla Foundation security advisories

Which four tools are used during an incident to collect data? (Choose four.)

• A.ASA
• B.EnCase
• C.Microsoft Windows 7
• D.TCPDump
• E.Sniffer
• F.FTK
• G.ABC