Cisco Implementing Cisco Security Monitoring, Analysis and Response System Set 1

1.

Which item is the best practice to follow while restoring archived data to a Cisco Security MARS appliance?

Use Secure FTP to protect the data transfer. Use "mode 5" restore from the Cisco Security MARS CLI to provide enhanced security during the datatransfer.

Choose Admin > System Maintenance > Data Archiving on the Cisco Security MARS GUI to perform therestore operations on line.

To avoid problems, restore only to an identical or higher-end Cisco Security MARS appliance.

2.

What is the reporting IP address of the device while adding a device to the Cisco Security MARS appliance?

The source IP address that sends syslog information to the Cisco Security MARS appliance The pre-NAT IP address of the device The IP address that Cisco Security MARS uses to access the device via SNMP The IP address that Cisco Security MARS uses to access the device via Telnet or SSH

3.

Which statement best describes the case management feature of Cisco Security MARS?

It is used to conjunction with the Cisco Security MARS incident escalation feature for incident reporting It is used to capture, combine and preserve user-selected Cisco Security MARS data within a specializedreport It is used to automatically collect and save information on incidents, sessions, queries and reportsdynamically without user interventions It is used to very quickly evaluate the state of the network

4.

Here is a question that you need to answer. You can click on the Question button to the left to view the question and click on the MARS GUI Screen button to the left to capture the MARS GUI screen in order to answer the question. While viewing the GUI screen capture, you can view the complete screen by use of the left/right scroll bar on the bottom of the GUI screen. Choose the correct answer from among the options. What actions will you take to configure the MARS appliance to send out an alert when the system rule fires according to the MARS GUI screen shown?

Click "Edit" to edit the "Operation" field of the rule, select the appropriate alert option(s), then apply.

Click on "None" in the "Action" field, select the appropriate alerts, then apply.

Click "Edit" to edit the "Reported User" field of the rule, select the appropriate alert option(s), then apply.

Click on "Active" in the "Status" field, select the appropriate alerts, then apply.

5.

Which action enables the Cisco Security MARS appliance to ignore false-positive events by either dropping the events completely or by just logging them to the database?

Inactivating the rules Creating system inspection rules using the drop operation Deleting the false-positive events from the events management page Creating drop rules

6.

Which additional steps should you take after manually adding the BR-FW-1 device shown in the MARS GUI screen?

Click "Submit" to enable the device.

Click "Submit" to test access to the device, When access is successful. Click "Activate" to activate thedevice.

Click "Activate" to activate the device, then click "Submit" to save the device configuration.

Click "Discover" to initiate manual discovery. When discovery is completed, click "Submit", then "Activate."

7.

Which incident type is pushed from a local controller to a global controller?

Incidents on the local controller triggered by predefined system rules Any incidents on the local controller Incidents on the local controller triggered by local rules True positive incidents on the local controller

8.

Which statement about the Cisco Security MARS maintenance procedure is true?

No new events can be logged when the Cisco Security MARS local database reaches its maximum storage capacity. If the archive is generated with one release of software, then the restore has to be done with the sameversion of software. Cisco Security MARS disk drives are not hot-swappable. Cisco Security MARS audit logs can be exported to a centralized server for the consolidation and protectionof the log data.

9.

Global Controller is a master unit that allows for global management of one or more Local Controllers. Is correct?

Correct

10.

Which log agent is installed and configured on the Microsoft Windows IIS server to configure a Microsoft Windows IIS server to publish logs to the Cisco Security MARS?

pnLog agent Cisco Security MARS agent SNARE None. Cisco Security MARS is an agentless device.

Cisco Implementing Cisco Security Monitoring, Analysis and Response System Set 1

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Congratulations

COMPANY

Products

OTHERS

Partner

Cisco Implementing Cisco Security Monitoring, Analysis and Response System Set 1

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Congratulations

Detail Form

COMPANY

Products

OTHERS

Partner