Deck 47: Designing Cisco Unified Contact Center Enterprise (UCCED)

Question 1

If a file's SHA-256 hash is sent to the cloud, but the cloud has never seen the hash before, which disposition is returned?

A) Clean
B) Neutral
C) Malware
D) Unavailable

Answer 1

Neutral

Question 2

The FireAMP connector supports which proxy type?

A) SOCKS6
B) HTTP_proxy
C) SOCKS5_filename
D) SOCKS7

Answer 2

HTTP_proxy

Question 3

Which statement describes an advantage of cloud-based detection?

A) Limited customization allows for faster detection.
B) Fewer resources are required on the endpoint.
C) Sandboxing reduces the overall management overhead of the system.
D) High-speed analytical engines on the endpoint limit the amount of work the cloud must perform.

Answer 3

Fewer resources are required on the endpoint.

Question 4

What is the default clean disposition cache setting?

A) 3600
B) 604800
C) 10080
D) 1 hour

Question 5

The FireAMP connector monitors the system for which type of activity?

A) Vulnerabilities
B) Enforcement of usage policies
C) File operations
D) Authentication activity

Question 6

What do policies enable you to do?

A) specify a custom whitelist
B) specify group membership
C) specify hosts to include in reports
D) specify which events to view

Question 7

When discussing the FireAMP product, which term does the acronym DFC represent?

A) It means Detected Forensic Cause.
B) It means Duplicate File Contents.
C) It means Device Flow Correlation.
D) It is not an acronym that is associated with the FireAMP product.

Question 8

The FireAMP Mobile endpoint connector currently supports which mobile OS device?

A) Firefox
B) HTML5
C) Android
D) iPhone

Question 9

File information is sent to the Sourcefire Collective Security Intelligence Cloud using which format?

A) MD5
B) SHA-1
C) filenames
D) SHA-256

Question 10

How does application blocking enhance security?

A) It identifies and logs usage.
B) It tracks application abuse.
C) It deletes identified applications.
D) It blocks vulnerable applications from running, until they are patched.

Question 11

Custom whitelists are used for which purpose?

A) to specify which files to alert on
B) to specify which files to delete
C) to specify which files to ignore
D) to specify which files to sandbox

Question 12

Which option is a detection technology that is used by FireAMP?

A) fuzzy matching
B) Norton AntiVirus
C) network scans
D) Exterminator

Question 13

Advanced custom signatures are written using which type of syntax?

A) Snort signatures
B) Firewall signatures
C) ClamAV signatures
D) bash shell

Question 14

What is a valid data source for DFC Windows connector policy configuration?

A) SANS
B) NIST
C) Emerging Threats
D) Custom and Sourcefire

Question 15

Which statement describes an advantage of the FireAMP product?

A) Signatures are pushed to endpoints more quickly than other antivirus products.
B) Superior detection algorithms on the endpoint limit the amount of work the cloud must perform.
C) It provides enterprise visibility.
D) It relies on sandboxing.

Question 16

Which disposition can be returned in response to a malware cloud lookup?

A) Dirty
B) Virus
C) Malware
D) Infected

Question 17

Which set of actions would you take to create a simple custom detection?

A) Add a SHA-256 value; upload a file to calculate a SHA-256 value; upload a text file that contains SHA-256 values.
B) Upload a packet capture; use a Snort rule; use a ClamAV rule.
C) Manually input the PE header data, the MD-5 hash, and a list of MD-5 hashes.
D) Input the file and file name.

Question 18

Which feature allows retrospective detection?

A) Total Recall
B) Cloud Recall
C) Recall Alert
D) Recall Analysis

Question 19

Which hosts merit special consideration for crafting a policy?

A) end-user hosts
B) domain controllers
C) Linux servers
D) none, because all hosts should get equal consideration

Question 20

The Update Window allows you to perform which action?

A) identify which hosts need to be updated
B) email the user to download a new client
C) specify a timeframe when an upgrade can be started and stopped
D) update your cloud instance

Question 21

Which statement about two-step authentication is true?

A) It is the ability to use two separate passwords.
B) It is the ability to enable biometric authentication.
C) It is the ability to have a passphrase sent to a mobile device.
D) It is the ability to use a verification code in conjunction with the correct username and password.

Question 22

Which type of activity is shown in the Device Trajectory page?

A) the IP addresses of hosts on which a file was seen
B) the activity of the FireAMP console users
C) the hosts that are in the same group as the selected host
D) file creation

Question 23

Which statement represents a best practice for deploying on Windows servers?

A) You should treat Windows servers like any other host in the deployment.
B) You should obtain the Microsoft TechNet article that describes the proper exclusions for Windows servers.
C) You should never configure exclusions for Windows servers.
D) You should deploy FireAMP connectors only alongside existing antivirus software on Windows servers.

Question 24

Which action can you take from the Detections/Quarantine screen?

A) Create a policy.
B) Restore the detected file.
C) Run a report.
D) Change computer group membership.

Question 25

Which information does the File Trajectory feature show?

A) the time that the scan was run
B) the name of the file
C) the hosts on which the file was seen and points in time where events occurred
D) the protocol

Question 26

What is the first system that is infected with a particular malware called?

A) Patient Zero
B) Source
C) Infector
D) Carrier

Question 27

Which of these can you use for two-step authentication?

A) the Apple Authenticator app
B) the Google Authenticator app
C) a SecurID token
D) any RFC 1918 compatible application

Question 28

How many days' worth of data do the widgets on the dashboard page display?

A) the previous 5 days of data
B) the previous 6 days of data
C) the previous 7 days of data
D) the number of days you set in the dashboard configuration

Question 29

When a user initiates a scan, which types of scan are available as options?

A) scheduled scan, thorough scan, quick scan, network scan
B) jiffy scan, overnight scan, scan when available, vulnerability scan
C) flash scan, custom scan, full scan
D) none, because user-initiated scans are not allowed

Question 30

The Accounts menu contains items that are related to FireAMP console accounts. Which menu allows you to set the default group policy?

A) Audit Log
B) Users
C) Applications
D) Business

Question 31

From the Deployment screen, you can deploy agents via which mechanism?

A) push to client
B) .zip install file
C) user download from Sourcefire website or email
D) precompiled RPM package

Question 32

How can customers feed new intelligence such as files and hashes to FireAMP?

A) by uploading it to the FTP server
B) from the connector
C) through the management console
D) by sending it via email

Question 33

Incident responders use which policy mode for outbreak control?

A) Audit
B) Protect
C) Triage
D) Emergency

Question 34

FireAMP reports can be distributed by which mechanism?

A) email
B) cloud sync
C) Windows file share
D) a Crystal Reports subscription

Question 35

A default FireAMP Private Cloud installation can accommodate how many connectors over which period of time?

A) 100 connectors over a 15-day period
B) 1000 connectors over a 45-day period
C) 5000 connectors over a 10-day period
D) 500 connectors over a 30-day period

Question 36

What is the default command-line switch configuration, if you run a connector installation with no parameters?

A) /desktopicon 0 /startmenu 1 /contextmenu 1 /skipdfc 0 /skiptetra 0
B) /desktopicon 1 /startmenu 0 /contextmenu 0 /skipdfc 0 /skiptetra 0
C) /desktopicon 0 /startmenu 0 /contextmenu 0 /skipdfc 1 /skiptetra 1
D) /desktopicon 1 /startmenu 0 /contextmenu 0 /skipdfc 0 /skiptetra 1

Question 37

Which tool can you use to query the history.db file?

A) Curl
B) FireAMP_Helper.vbs
C) cscript
D) SQLite

Question 38

When you are viewing information about a computer, what is displayed?

A) the type of antivirus software that is installed
B) the internal IP address
C) when the operating system was installed
D) the console settings

Question 39

Which pair represents equivalent processes whose names differ, depending on the connector version that you are running?

A) immunet_protect and iptray
B) agent.exe and sfc.exe
C) TETRA and SPERO
D) ETHOS and SPERO

Question 40

Which question should be in your predeployment checklist?

A) How often are backup jobs run?
B) Are any Linux servers being deployed?
C) Who are the users of the hosts on which you will deploy?
D) Which applications are installed on the hosts on which you will deploy?

Question 41

When adding source and destination ports in the Ports tab of the access control policy rule editor, which restriction is in place?

A) The protocol is restricted to TCP only.
B) The protocol is restricted to UDP only.
C) The protocol is restricted to TCP or UDP.
D) The protocol is restricted to TCP and UDP.

Question 42

FireSIGHT uses three primary types of detection to understand the environment in which it is deployed. Which option is one of the detection types?

A) protocol layer
B) application
C) objects
D) devices

Question 43

When you are editing an intrusion policy, how do you know that you have changes?

A) The Commit Changes button is enabled.
B) A system message notifies you.
C) You are prompted to save your changes on every screen refresh.
D) A yellow, triangular icon displays next to the Policy Information option in the navigation panel.

Question 44

Which option is used to implement suppression in the Rule Management user interface?

A) Rule Category
B) Global
C) Source
D) Protocol

Question 45

The IP address ::/0 is equivalent to which IPv4 address and netmask?

A) 0.0.0.0
B) 0.0.0.0/0
C) 0.0.0.0/24
D) The IP address ::/0 is not valid IPv6 syntax.

Question 46

Which option is derived from the discovery component of FireSIGHT technology?

A) connection event table view
B) network profile
C) host profile
D) authentication objects

Question 47

Which option is true of the Packet Information portion of the Packet View screen?

A) provides a table view of events
B) allows you to download a PCAP formatted file of the session that triggered the event
C) displays packet data in a format based on TCP/IP layers
D) shows you the user that triggered the event

Question 48

In addition to the discovery of new hosts, FireSIGHT can also perform which function?

A) block traffic
B) determine which users are involved in monitored connections
C) discover information about users
D) route traffic

Question 49

In a FireAMP Private Cloud installation, which server does an administrator use to manage connector policy and view events?

A) opadmin..com
B) console..com
C) cloud..com
D) aws..com

Question 50

Host criticality is an example of which option?

A) a default whitelist
B) a default traffic profile
C) a host attribute
D) a correlation policy

Question 51

Which option transmits policy-based alerts such as SNMP and syslog?

A) the Defense Center
B) FireSIGHT
C) the managed device
D) the host

Question 52

Which FireAMP capability can tell you how malware has spread in a network?

A) File Analysis
B) Threat Root Cause
C) File Trajectory
D) Heat Map

Question 53

One of the goals of geolocation is to identify which option?

A) the location of any IP address
B) the location of a MAC address
C) the location of a TCP connection
D) the location of a routable IP address

Question 54

FireSIGHT recommendations appear in which layer of the Policy Layers page?

A) Layer Summary
B) User Layers
C) Built-In Layers
D) FireSIGHT recommendations do not show up as a layer.

Question 55

Which statement is true when adding a network to an access control rule?

A) You can select only source networks.
B) You must have preconfigured the network as an object.
C) You can select the source and destination networks or network groups.
D) You cannot include multiple networks or network groups as sources or destinations.

Question 56

Which option is not a characteristic of dashboard widgets or Context Explorer?

A) Context Explorer is a tool used primarily by analysts looking for trends across varying periods of time.
B) Context Explorer can be added as a widget to a dashboard.
C) Widgets offer users an at-a-glance view of their environment.
D) Widgets are offered to all users, whereas Context Explorer is limited to a few roles.

Question 57

Access control policy rules can be configured to block based on the conditions that you specify in each rule. Which behavior block response do you use if you want to deny and reset the connection of HTTP traffic that meets the conditions of the access control rule?

A) interactive block with reset
B) interactive block
C) block
D) block with reset

Question 58

When configuring FireSIGHT detection, an administrator would create a network discovery policy and set the action to "discover". Which option is a possible type of discovery?

A) host
B) IPS event
C) anti-malware
D) networks

Question 59

Which option is true when configuring an access control rule?

A) You can use geolocation criteria to specify source IP addresses by country and continent, as well as destination IP addresses by country and continent.
B) You can use geolocation criteria to specify destination IP addresses by country but not source IP addresses.
C) You can use geolocation criteria to specify source and destination IP addresses by country but not by continent.
D) You can use geolocation criteria to specify source and destination IP addresses by continent but not by country.

Question 60

How do you configure URL filtering?

A) Add blocked URLs to the global blacklist.
B) Create a Security Intelligence object that contains the blocked URLs and add the object to the access control policy.
C) Create an access control rule and, on the URLs tab, select the URLs or URL categories that are to be blocked or allowed.
D) Create a variable.

Question 61

Which option describes Spero file analysis?

A) a method of analyzing the SHA-256 hash of a file to determine whether a file is malicious or not
B) a method of analyzing the entire contents of a file to determine whether it is malicious or not
C) a method of analyzing certain file characteristics, such as metadata and header information, to determine whether a file is malicious or not
D) a method of analyzing a file by executing it in a sandbox environment and observing its behaviors to determine if it is malicious or not

Question 62

Alert priority is established in which way?

A) event classification
B) priority.conf file
C) host criticality selection
D) through Context Explorer

Question 63

Other than navigating to the Network File Trajectory page for a file, which option is an alternative way of accessing the network trajectory of a file?

A) from Context Explorer
B) from the Analysis menu
C) from the cloud
D) from the Defense Center

Question 64

Context Explorer can be accessed by a subset of user roles. Which predefined user role is valid for FireSIGHT event access?

A) Administrator
B) Intrusion Administrator
C) Maintenance User
D) Database Administrator

Question 65

Which policy controls malware blocking configuration?

A) file policy
B) malware policy
C) access control policy
D) IPS policy

Question 66

Which event source can have a default workflow configured?

A) user events
B) discovery events
C) server events
D) connection events

Question 67

Which option describes the two basic components of Sourcefire Snort rules?

A) preprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place
B) a rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol
C) a rule header to define source, destination, and protocol, and the output configuration to determine which form of output to produce if the rule triggers
D) a rule body that contains packet-matching criteria or options to define where to look for content in a packet, and a rule header to define matching criteria based on where a packet originates, where it is going, and over which protocol

Question 68

Which option can you enter in the Search text box to look for the trajectory of a particular file?

A) the MD5 hash value of the file
B) the SHA-256 hash value of the file
C) the URL of the file
D) the SHA-512 hash value of the file

Question 69

When configuring an LDAP authentication object, which server type is available?

A) Microsoft Active Directory
B) Yahoo
C) Oracle
D) SMTP

Question 70

Which statement regarding user exemptions is true?

A) Non-administrators can be made exempt on an individual basis.
B) Exempt users have a browser session timeout restriction of 24 hours.
C) Administrators can be exempt from any browser session timeout value.
D) By default, all users cannot be exempt from any browser session timeout value.

Question 71

A user discovery agent can be installed on which platform?

A) OpenLDAP
B) Windows
C) RADIUS
D) Ubuntu

Question 72

What is the maximum timeout value for a browser session?

A) 60 minutes
B) 120 minutes
C) 1024 minutes
D) 1440 minutes

Question 73

Where do you configure widget properties?

A) dashboard properties
B) the Widget Properties button in the title bar of each widget
C) the Local Configuration page
D) Context Explorer

Question 74

Which mechanism should be used to write an IPS rule that focuses on the client or server side of a TCP communication?

A) the directional operator in the rule header
B) the "flow" rule option
C) specification of the source and destination ports in the rule header
D) The detection engine evaluates all sides of a TCP communication regardless of the rule options.

Question 75

A context box opens when you click on an event icon in the Network File Trajectory map for a file. Which option is an element of the box?

A) Scan
B) Application Protocol
C) Threat Name
D) File Name

Question 76

Context Explorer can be accessed by a subset of user roles. Which predefined user role is not valid for FireSIGHT event access?

A) Administrator
B) Intrusion Administrator
C) Security Analyst
D) Security Analyst (Read-Only)

Question 77

Remote access to the Defense Center database has which characteristic?

A) read/write
B) read-only
C) Postgres
D) Estreamer

Question 78

The collection of health modules and their settings is known as which option?

A) appliance policy
B) system policy
C) correlation policy
D) health policy

Question 79

Which statement is true regarding malware blocking over HTTP?

A) It can be done only in the download direction.
B) It can be done only in the upload direction.
C) It can be done in both the download and upload direction.
D) HTTP is not a supported protocol for malware blocking.

Question 80

Which statement describes the meaning of a red health status icon?

A) A critical threshold has been exceeded.
B) At least one health module has failed.
C) A health policy has been disabled on a monitored device.
D) A warning threshold has been exceeded.