Online Access Free 600-199 Practice Test

Refer to the exhibit.

Which protocol is used in this network traffic flow?

• A.SNMP
• B.Telnet
• C.SSH
• D.DNS

Which is considered to be anomalous activity?

• A.an alert describing an anonymous login attempt to an FTP server
• B.an alert context buffer containing traffic to amazon.com
• C.an alert context buffer containing SSH traffic
• D.an alert context buffer containing an FTP server SYN scanning your network

Refer to the exhibit.

Which two personal administrators should be involved to investigate further? (Choose two.)

• A.IPS administrator
• B.security administrator
• C.desktop administrator
• D.DNS administrator
• E.email administrator

Refer to the exhibit.

Which two options does the following tcpdump command do? (Choose two.)

• A.Read from nvram (non-volatile) and parse the stream.
• B.Write the capture as a file.
• C.Capture traffic based on host 10.10.10.10 and everything but HTTP traffic.
• D.Capture ARP traffic only.
• E.Capture traffic based on host 10.10.10.10 and HTTP traffic.
• F.Read the capture from a file.

Which three post-mortem steps are critical to help prevent a network attack from reoccurring? (Choose three.)

• A.Collect "show" outputs after the attack.
• B.Revise the network security policy.
• C.Create a "lessons learned" collection.
• D.Document the incident in a report.
• E.Update the security rules for edge devices.
• F.Involve law enforcement officials.