Ensurepass

QUESTION 11

Which statement about inline VLAN pair deployment with the Cisco IPS 4200 Series appliance is true?

 

A.      The sensing interface acts as an 802.1q trunk port, and the Cisco IPS appliance performs VLAN translation between pairs of VLANs.

B.      The Cisco IPS appliance connects to two physically distinct switches using two paired physical interfaces.

C.      Two sensing interfaces connect to the same switch that forwards traffic between two VLANs.

D.      The pair of sensing interfaces can be selectively divided (virtualized) into multiple logical “wires” by VLANs that can be analyzed separately

 

Answer: A

 

 

QUESTION 12

Which four statements about Cisco IPS appliance anomaly detection histograms are true? (Choose four.)

 

A.      Histograms are learned or configured manually.

B.      Destination IP address row is the same for all histograms.

C.      Source IP address row can be learned or configured.

D.      Anomaly detection only builds a single histogram for all services in a zone.

E.       You can enable a separate histogram and scanner threshold for specific services, or use the default one for all other services

F.       Anomaly detection histograms only track source (attacker) IP addresses.

 

Answer: A,B,C,E

 

 

QUESTION 13

You are working with Cisco TAC to troubleshoot a software problem on the Cisco IPS appliance. TAC suspects a fault with the NotificationApp software module in the Cisco IPS appliance. In this case, which Cisco IPS appliance operations may be most affected by the NotificationApp software

module fault?

 

A          SNMP

B          IDM or IME

C          global correlation

D          remote blocking

E           anomaly detection

F           SDEE

 

Answer: A

 

 

QUESTION 14

Which two switching-based mechanisms are used to deploy high availability IPS using multiple Cisco IPS appliances? (Choose two.)

 

A.      Spanning Tree-based HA

B.      HSRP-basedHA

C.      EtherChannel-based HA

D.      VRRP-basedHA

 

Answer: A,C

 

 

QUESTION 15

Which statement about the 4-port GigabitEthernet card with hardware bypass is true?

 

A.      Hardware bypass only works with inline interface pairs.

B.      Hardware bypass is only supported on the Cisco IPS 4270 appliance.

C.      Hardware bypass is independent from software bypass.

D.      Hardware bypass is enabled if software bypass is configured to “OFF”.

E.       Hardware bypass is supported between any of the four GigabitEthernet ports

 

Answer: A

 

 

QUESTION 16 DRAG DROP

clip_image002

Answer:

clip_image004

 

 

QUESTION 17

What is the correct regular expression to match a URI request equal to /test.exe?

 

A.      /test.exe

B.      Vtest\.exe

C.      /test\.exe

D.      */test\.exe

E.       \*/test\.exe

F.       */test.exe

 

Answer: C

 

 

QUESTION 18

Which four types of interface modes are available on the Cisco IPS 4200 Series appliance? (Choose four.)

 

A.      promiscuous

B.      inline TAP

C.      inline interface

D.      inline VLAN pair

E.       VLAN groups

F.       bypass

 

Answer: A,C,D,E

 

 

QUESTION 19

Which option is best to use to capture only a subset of traffic (capturing traffic per-IP-address, per-protocol, or per-application) off the switch backplane and copy it to the Cisco IPS appliance?

 

A.      SPAN

B.      PBR

C.      VACL

D.      MPF

E.       STP

 

Answer: C

 

 

QUESTION 20

Refer to the exhibit. Which statement is true?

clip_image006

A.      A summary alert is sent once during each interval for each unique Summary Key entry.

B.      An alert is generated each time the signature triggers.

C.      This signature does not fire until three events are seen during 60 seconds with the same attacker and victim IP addresses and ports

D.      This signature is disabled by default.

E.       When this signature triggers, the Cisco IPS appliance sends an SNMP trap for this event.

 

Answer: C

 

Download Latest CCNP 642-627 Real Free Tests , help you to pass exam 100%.

 

Comments are closed.