Implementing Cisco Intrusion Prevention Systems Set 1

1.

Cisco Security MARS offers a family of high-performance, scalable appliances for threat management, monitoring, and mitigation, enabling customers to make more effective use of network and security devices. What is a supported mitigation feature on the Cisco Security MARS appliance?

assign blocking actions to signatures that are controlled by the State engine assign deny actions to signatures that are controlled by the Trojan engines assign the TCP reset action to signatures that are controlled by the Normalizer engine enable blocking enable application policy enforcement

2.

Cisco Security MARS combines network intelligence, context correlation, vector analysis, anomaly detection, hotspot identification, and automated mitigation capabilities. Which action will you take to enable the Cisco Security MARS appliance to ignore false-positive events by either dropping the events completely, or by just logging them to the database?

Service AIC String Sweep Flood

3.

Which three items are correct based on the Incident Vector Graph shown on the MARS GUI screen? (Choose three.) PassGuide.com-Make You Succeed To Pass IT Exams PassGuide 642-547

deny attacker reset tcp connection deny connection deny packet deny packet, reset tcp connection

4.

Cisco Security MARS uses NetFlow data to perform which function?

You must not allow entire subnets to access the Cisco IPS Sensor You must not delete the IP address used for remote management. When using access lists to permit remote access, you must specify the direction of allowedcommunications. You can only configure the allowed hosts using the CLI. You must use an inverse mask, such as 10.0.2.0 0.0.0.255, for the specified network mask for the IPaddress.

5.

Which incident type is pushed from a local controller to a global controller?

two in promiscuous mode using VLAN groups, four in inline mode supporting all interface type configurations two six the number depends on the amount of device memory four

6.

Which statement about the Cisco Security MARS maintenance procedure is true?

begin with signature number 60000 contain modified parameters of built-in signatures are tuned using the Cisco IDM Custom Signature Wizard require that you create custom signatures that can then be tuned to your needs require that you create subsignatures that can then be tuned to your needs

7.

Global Controller is a master unit that allows for global management of one or more Local Controllers. Is correct?

Any sensor that supports inline functionality can operate in either inline or promiscuous mode, but not in
both modes simultaneously. If you switch a sensor between inline and promiscuous modes, you must reboot the sensor. Inline functionality is available on any sensor that supports Cisco IPS Sensor Software Version 5.0 or later. If your sensor has a sufficient number of monitoring interfaces, you can use inline and promiscuous modessimultaneously.

8.

Match the correct relationship between the Cisco Security MARS terms and their definitions.
1. queries
2. events
3. sessions
4. incidents
5. rules

Use the Normalizer engine and remove the Produce Alert action from the component signatures. Use the Normalizer engine and set the summary mode to Global Summarize. Use the ATOMIC engine and set the summary mode to Global Summarize. Use theMeta engine and remove the Produce Alert action from the component signatures. Use the Service engine and set the summary mode to Global Summarize.

9.

Which option is correct about the case management feature of Cisco Security MARS?

service super administrator operator root

10.

Which description is correct with regard to Cisco Security MARS and Cisco IPS signature support?

Enable all signatures in the Service HTTP engine. Then create an event action override that adds the Deny
Packet Inline action to events triggered by these signatures if the traffic originates from your corporate
network. Enable both the HTTP application policy and the alarm on non-HTTP traffic signature. Assign the Deny Packet Inline action to all signatures in the Service HTTP engine. Enable the alarm for the non-HTTP traffic signature. Then create an Event Action Override that adds theDeny Packet Inline action to events triggered by the signature if the traffic originates from your corporate network. Enable all signatures in the Service HTTP engine.

Implementing Cisco Intrusion Prevention Systems Set 1

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Congratulations

COMPANY

Products

OTHERS

Partner

Implementing Cisco Intrusion Prevention Systems Set 1

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Congratulations

Detail Form

COMPANY

Products

OTHERS

Partner