QUESTION: 53

Refer to the exhibit.

Which type of log is displayed?

IDS
proxy
NetFlow
sys

Answer(s): A

Explanation:

You also see the 5-tuple in IPS events, NetFlow records, and other event data. In fact, on the exam you may need to differentiate between a firewall log versus a traditional IPS or IDS event. One of the things to remember is that traditional IDS and IPS use signatures, so an easy way to differentiate is by looking for a signature ID (SigID). If you see a signature ID, then most definitely the event is a traditional IPS or IDS event.

Reveal Solution Next Question

QUESTION: 54

Refer to the exhibit.

What information is depicted?

IIS data
NetFlow data
network discovery event
IPS event data

Answer(s): B

Reveal Solution Next Question

QUESTION: 55

What is the difference between the ACK flag and the RST flag in the NetFlow log session?

The RST flag confirms the beginning of the TCP connection, and the ACK flag responds when the data for the payload is complete
The ACK flag confirms the beginning of the TCP connection, and the RST flag responds when the data for the payload is complete
The RST flag confirms the receipt of the prior segment, and the ACK flag allows for the spontaneous termination of a connection
The ACK flag confirms the receipt of the prior segment, and the RST flag allows for the spontaneous termination of a connection

Answer(s): D

Reveal Solution Next Question