1. What is a feature of the tcpdump tool?
- It records metadata about packet flows.
- It uses agents to submit host logs to centralized management servers.
- It can display packet captures in real time or write them to a file.
- It provides real-time reporting and long-term analysis of security events.
2. Which Windows tool can be used to review host logs?
- Event Viewer
- Device Manager
- Task Manager
3. Which type of security data can be used to describe or predict network behavior?
4. Which statement describes the tcpdump tool?
- It accepts and analyzes data captured by Wireshark.
- It is a command-line packet analyzer.
- It can be used to analyze network log data in order to describe and predict network behavior.
- It is used to control multiple TCP-based applications.
5. What are two popular SIEM platforms? (Choose two.)
- Cisco Umbrella
- Security Onion with ELK
6. Which Windows host log event type describes the successful operation of an application, driver, or service?
- success audit
7. Which Windows log records events related to login attempts and operations related to file or object access?
- system logs
- application logs
- security logs
- setup logs
8. What are two of the 5-tuples? (Choose two.)
- source port
9. In a Cisco AVC system, in which module is NBAR2 deployed?
- Metrics Collection
- Application Recognition
- Management and Reporting
10. A NIDS/NIPS has identified a threat. Which type of security data will be generated and sent to a logging device?
11. Which statement describes an operational characteristic of NetFlow?
- NetFlow can provide services for user access control.
- NetFlow flow records can be viewed by the tcpdump tool.
- NetFlow collects basic information about the packet flow, not the flow data itself.
- NetFlow captures the entire contents of a packet.
12. Which type of data is used by Cisco Cognitive Intelligence to find malicious activity that has bypassed security controls, or entered through unmonitored channels, and is operating inside an enterprise network?