Q1. If inline-TCP-evasion-protection-mode on a Cisco IPS is set to asymmetric mode, what is a side effect? 

A. Packet flow is normal. 

B. TCP requests are throttled. 

C. Embryonic connections are ignored. 

D. Evasion may become possible. 

View Answer

Q2. When you configure the Cisco ESA to perform blacklisting, what are two items you can disable to enhance performance? (Choose two.) 

A. spam scanning 

B. antivirus scanning 

C. APT detection 

D. rootkit detection 

View Answer

Q3. At which value do custom signatures begin? 

A. 1024 

B. 10000 

C. 1 

D. 60000 

View Answer

Q4. Which three options are IPS signature classifications? (Choose three.) 

A. tuned signatures 

B. response signatures 

C. default signatures 

D. custom signatures 

E. preloaded signatures 

F. designated signatures 

View Answer

Q5. A network engineer can assign IPS event action overrides to virtual sensors and configure 

which three modes? (Choose three.) 

A. Anomaly detection operational mode 

B. Inline TCP session tracking mode 

C. Normalizer mode 

D. Load-balancing mode 

E. Inline and Promiscuous mixed mode 

F. Fail-open and fail-close mode 

View Answer

Q6. What are three features of the Cisco Security Intellishield Alert Manager Service? (Choose three.) 

A. validation of alerts by security analysts 

B. custom notifications 

C. complete threat and vulnerability remediation 

D. vendor-specific threat analysis 

E. workflow-management tools 

F. real-time threat and vulnerability mitigation 

View Answer

Q7. Which three options are characteristics of router-based IPS? (Choose three.) 

A. It is used for large networks. 

B. It is used for small networks. 

C. It supports virtual sensors. 

D. It supports multiple VRFs. 

E. It uses configurable anomaly detection. 

F. Signature definition files have been deprecated. 

View Answer

Q8. What can you use to access the Cisco IPS secure command and control channel to make configuration changes? 

A. SDEE 

B. the management interface 

C. an HTTP server 

D. Telnet 

View Answer

Q9. Which command establishes a virtual console session to a CX module within a Cisco Adaptive Security Appliance? 

A. session 1 ip address 

B. session 2 ip address 

C. session 1 

D. session ips console 

E. session cxsc console 

View Answer

Q10. Which three sender reputation ranges identify the default behavior of the Cisco Email Security Appliance? (Choose three.) 

A. If it is between -1 and +10, the email is accepted 

B. If it is between +1 and +10, the email is accepted 

C. If it is between -3 and -1, the email is accepted and additional emails from the sender are throttled 

D. If it is between -3 and +1, the email is accepted and additional emails from the sender are throttled 

E. If it is between -4 and +1, the email is accepted and additional emails from the sender are throttled 

F. If it is between -10 and -3, the email is blocked 

G. If it is between -10 and -3, the email is sent to the virus and spam engines for additional scanning 

H. If it is between -10 and -4, the email is blocked 

View Answer