Spring Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Securing Cisco Networks with Sourcefire IPS

Last Update 9 hours ago Total Questions : 60

The Securing Cisco Networks with Sourcefire IPS content is now fully updated, with all current exam questions added 9 hours ago. Deciding to include 500-285 practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our 500-285 exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these 500-285 sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any Securing Cisco Networks with Sourcefire IPS practice test comfortably within the allotted time.

Question # 1

Which event source can have a default workflow configured?

A.

user events

B.

discovery events

C.

server events

D.

connection events

Question # 2

The collection of health modules and their settings is known as which option?

A.

appliance policy

B.

system policy

C.

correlation policy

D.

health policy

Question # 3

Which option describes Spero file analysis?

A.

a method of analyzing the SHA-256 hash of a file to determine whether a file is malicious or not

B.

a method of analyzing the entire contents of a file to determine whether it is malicious or not

C.

a method of analyzing certain file characteristics, such as metadata and header information, to determine whether a file is malicious or not

D.

a method of analyzing a file by executing it in a sandbox environment and observing its behaviors to determine if it is malicious or not

Question # 4

Other than navigating to the Network File Trajectory page for a file, which option is an alternative way of accessing the network trajectory of a file?

A.

from Context Explorer

B.

from the Analysis menu

C.

from the cloud

D.

from the Defense Center

Question # 5

Which Sourcefire feature allows you to send traffic directly through the device without inspecting it?

A.

fast-path rules

B.

thresholds or suppressions

C.

blacklist

D.

automatic application bypass

Question # 6

Which interface type allows for VLAN tagging?

A.

inline

B.

switched

C.

high-availability link

D.

passive

Question # 7

Which option describes the two basic components of Sourcefire Snort rules?

A.

preprocessor configurations to define what to do with packets before the detection engine sees them, and detection engine configurations to define exactly how alerting is to take place

B.

a rule statement characterized by the message you configure to appear in the alert, and the rule body that contains all of the matching criteria such as source, destination, and protocol

C.

a rule header to define source, destination, and protocol, and the output configuration to determine which form of output to produce if the rule triggers

D.

a rule body that contains packet-matching criteria or options to define where to look for content in a packet, and a rule header to define matching criteria based on where a packet originates, where it is going, and over which protocol

Question # 8

FireSIGHT recommendations appear in which layer of the Policy Layers page?

A.

Layer Summary

B.

User Layers

C.

Built-In Layers

D.

FireSIGHT recommendations do not show up as a layer.

Question # 9

Which mechanism should be used to write an IPS rule that focuses on the client or server side of a TCP communication?

A.

the directional operator in the rule header

B.

the " flow " rule option

C.

specification of the source and destination ports in the rule header

D.

The detection engine evaluates all sides of a TCP communication regardless of the rule options.

Question # 10

When you are editing an intrusion policy, how do you know that you have changes?

A.

The Commit Changes button is enabled.

B.

A system message notifies you.

C.

You are prompted to save your changes on every screen refresh.

D.

A yellow, triangular icon displays next to the Policy Information option in the navigation panel.

Go to page: