Free Cisco 500-280 Exam Dumps Questions & Answers

On which protocol does Snort focus to decode, process, and alert on suspicious network traffic?

• A.  IPX/SPX
• B.  Apple talk
• C.  ICMP
• D.  TCP/IP

Which preprocessor maintains connection state so that attacks that manifest over multiple packets in a session can be detected?

• A.  stream5
• B.  flow tracking module
• C.  detection engine
• D.  frag3

For which application is Snort output suitable?

• A.  any application that can read PCAP format
• B.  tcpdump
• C.  NMap
• D.  Wireshark

Which statement about the detection engine configuration settings in snort.conf is true?

• A.  The decoder is no longer in use.
• B.  All the decoder alerts are on by default.
• C.  All the decoder settings are off by default.
• D.  Some decoder settings are on and others must be uncommented.

Which syntax correctly expresses a port variable?

• A.  ports: HTTP_PORTS (80,1080,8080)
• B.  ipportvar /HTTP_PORTS: 80,1080,8080
• C.  var: ports = 80,1080,8080
• D.  portvar HTTP_PORTS [80,1080,8080]