Securing Cisco Networks with Open Source Snort (500-280) Free Practice Test

Question 1

Which configuration is optimal for the frag3 engine?

A. Bind client IP addresses to policies that represent operating systems, so that clients can process traffic the same way that the IPS engine does.

B. Keep the configuration as simple as possible, for better performance.

C. Deploy the engine only in passive mode, for better performance.

D. Bind target IP addresses to policies that represent operating systems, so that the IPS engine can process traffic the same way that target hosts do.

Correct Answer: D

Question 2

Which technique can an intruder use to try to evade detection by a Snort sensor?

A. exceed the maximum number of fragments that a sensor can evaluate

B. split the malicious payload over several fragments to mask the attack signature

C. disable a sensor by exceeding the number of packets that it can fragment before forwarding

D. send more packet fragments than the destination host can reassemble, to disable the host without regard to any intrusion-detection devices that might be on the network

Correct Answer: B

Question 3

Which statement about the FTPTelnet preprocessor is true?

A. It can limit how much server-side traffic to process.

B. It can reassemble FTP fragments.

C. It can normalize FTP network traffic.

D. It can check for correctness of Telnet commands.

Correct Answer: C

Question 4

To accept input from Snort and produce various forms of output, the Barnyard architecture consists of which components?

A. data processors and output plug-ins

B. data processors and reassemblers

C. preprocessors and detection engine

D. preprocessors and reassemblers

Correct Answer: A

Question 5

When you instruct Snort to place ASCII-formatted log data in a specific directory, what does Snort use to organize the alert data?

A. packet

B. port number

C. IP address

D. interface

Correct Answer: C

Question 6

To execute a command in Linux while in the directory where it is located, and be sure you are only running that particular copy, what would you use in front of the executable name?

A. ../

B. ..\

C. .\

D. ./

Correct Answer: D

Welcome to TestSimulate

Cisco Securing Cisco Networks with Open Source Snort (500-280) Free Practice Test