NEW QUESTION 1
Which IPS signature regular expression CLI command matches a host issuing a domain lookup for www.theblock.com?

• A. regex-string (x03[Tt][Hh][Ee]x05[Bb][Ll][Oo][Cc][Kk])
• B. regex-string (x0b[theblock.com])
• C. regex-string (x03[the]x05[block]0x3[com])
• D. regex-string (x03[T][H][E]x05[B][L][O][C][K]x03[.][C][O][M]

Answer: A

NEW QUESTION 2




What is the maximum message size that the Cisco Email Security Appliance will accept from the violet.public domain?

• A. 1 KB
• B. 100 KB
• C. 1 MB
• D. 10 MB
• E. 100 MB
• F. Unlimited

Answer: D

NEW QUESTION 3

Refer to the exhibit. Which option is a result of this configuration?

• A. All ingress traffic on the inside interface that matches the access list is redirected.
• B. All egress traffic on the outside interface that matches the access list is redirected.
• C. All TCP traffic that arrives on the inside interface is redirected.
• D. All ingress and egress traffic is redirected to the Cisco FirePOWER module.

Answer: C

NEW QUESTION 4
Which three options are characteristics of router-based IPS? (Choose three.)

• A. It is used for large networks.
• B. It is used for small networks.
• C. It supports virtual sensors.
• D. It supports multiple VRFs.
• E. It uses configurable anomaly detection.
• F. Signature definition files have been deprecated.

Answer: BDF

NEW QUESTION 5
The Web Cache Communication Protocol (WCCP) is a content-routing protocol that can facilitate the redirection of traffic flows in real time. Your organization has deployed WCCP to redirect web traffic that traverses their Cisco Adaptive Security Appliances (ASAs) to their Cisco Web Security Appliances (WSAs).
The simulator will provide access to the graphical user interfaces of one Cisco ASA and one Cisco WSA that are participating in a WCCP service. Not all aspects of the GUIs are implemented in the simulator. The options that have been implemented are sufficient to determine the best answer to each of the questions that are presented.
Your task is to examine the details available in the simulated graphical user interfaces and select the best answer.




How many Cisco ASAs and how many Cisco WSAs are participating in the WCCP service?

• A. One Cisco ASA or two Cisco ASAs configured as an Active/Standby failover pair, and one Cisco WSA.
• B. One Cisco ASA or two Cisco ASAs configured as an Active/Active failover pair, and one Cisco WSA.
• C. One Cisco ASA or two Cisco ASAs configured as an Active/Standby failover pair, and two Cisco WSAs.
• D. One Cisco ASA or two Cisco ASAs configured as an Active/Active failover pair, and two Cisco WSAs.
• E. Two Cisco ASAs and one Cisco WSA.
• F. Two Cisco ASAs and two Cisco WSAs.

Answer: A

Explanation: We can see from the output that the number of routers (ASA’s) is 1, so there is a single ASA or an active/ standby pair being used, and 1 Cache Engine. If the ASA’s were in a active/active role it would show up as 2 routers.

NEW QUESTION 6
Which Cisco Advanced Malware Protection event is generated when a file disposition changes because more information is gathered and evaluated about the file?

• A. quarantine event
• B. threat detected event
• C. policy update event
• D. retrospective event

Answer: D

NEW QUESTION 7
What are two arguments that can be used with the show content-scan command in Cisco IOS software? (Choose two. )

• A. data
• B. session
• C. buffer
• D. statistics
• E. verbose

Answer: BD

NEW QUESTION 8
Which protocols can be specified in a Snort rule header for analysis?

• A. TCP, UDP, ICMP, and IP
• B. TCP, UDP, and IP
• C. TCP, UDP, and ICMP
• D. TCP, UDP, ICMP, IP, and ESP
• E. TCP and UDP

Answer: A

NEW QUESTION 9
Which SSL traffic decryption feature is used when decrypting traffic from an external host to a server on your network?

• A. Decrypt by stripping the server certificate.
• B. Decrypt by resigning the server certificate
• C. Decrypt with a known private key
• D. Decypt with a known public key

Answer: B

NEW QUESTION 10
What is a difference between a Cisco Content Security Management virtual appliance and a physical appliance?

• A. The virtual appliance requires an additional license to run on a host.
• B. The physical appliance requires an additional license to activate its adapters.
• C. Migration between virtual appliances of varying sizes is possible, but physical appliances must be of equal size.
• D. The physical appliance is configured with a DHCP-enabled management port to receive an IP address automatically, but you must assign the virtual appliance an IP address manually in your management subnet.

Answer: A

NEW QUESTION 11
Which Cisco ASA object group type offers the most flexibility for grouping different services together based on arbitrary protocols?

• A. network
• B. ICMP
• C. protocol
• D. TCP-UDP
• E. service

Answer: E

NEW QUESTION 12
When the WSA policy trace tool is used to make a request to the proxy, where is the request logged?

• A. proxy logs
• B. access logs
• C. authentication logs
• D. The request is not logged

Answer: B

NEW QUESTION 13
In which two places can thresholding settings be configured? (Choose two.)

• A. globally, per intrusion policy
• B. globally, within the network analysis policy
• C. on each access control rule
• D. on each IPS rule
• E. per preprocessor, within the network analysis policy

Answer: CD

NEW QUESTION 14
Within Cisco IPS anomaly detection, what is the default IP range of the external zone?

• A. 0.0.0.0 0.0.0.0
• B. 0.0.0.0 - 255.255.255.255
• C. 0.0.0.0/8
• D. the network of the management interface

Answer: B

NEW QUESTION 15
Drag and drop the Cisco Security IntelliShield Alert Manager Service components on the left onto the corresponding description on the right.

Answer:

Explanation:

NEW QUESTION 16
Which Cisco WSA is intended for deployment in organizations of up to 1500 users?

• A. WSA S370
• B. WSA S670
• C. WSA S370-2RU
• D. WSA S170

Answer: D

NEW QUESTION 17
Which version of AsyncOS for web is required to deploy the Web Security Appliance as a CWS connector?

• A. AsyncOS version 7.7.x
• B. AsyncOS version 7.5.x
• C. AsyncOS version 7.5.7
• D. AsyncOS version 7.5.0

Answer: C

NEW QUESTION 18
What is a valid search parameter for the Cisco ESA find event tool?

• A. Envelope Origination
• B. Envelope Type
• C. Message ID
• D. Download Type

Answer: C