Master the 600-199 Securing Cisco Networks with Threat Detection and Analysis content and be ready for exam day success quickly with this Pass4sure 600-199 actual exam. We guarantee it!We make it a reality and give you real 600-199 questions in our Cisco 600-199 braindumps.Latest 100% VALID Cisco 600-199 Exam Questions Dumps at below page. You can use our Cisco 600-199 braindumps and pass your exam.
2026 New 600-199 Exam Dumps with PDF and VCE Free: https://www.2passeasy.com/dumps/600-199/
Q1. Which source should be used to recommend preventative measures against security vulnerabilities regardless of operating system or platform?
A. Microsoft security bulletins
B. Cisco PSIRT notices
C. Common Vulnerabilities and Exposure website
D. Mozilla Foundation security advisories
E. zero-day attack wiki
Answer: C
Q2. When an IDS generates an alert for a correctly detected network attack, what is this event called?
A. false positive
B. true negative
C. true positive
D. false negative
Answer: C
Q3. Which data from previous network attacks should be used to recommend architectural changes based on potential future impact?
A. SNMP statistics
B. known vulnerabilities
C. security audit reports
D. IPS signature logs
E. STP topology changes
Answer: A
Q4. After an attack has occurred, which two options should be collected to help remediate the problem? (Choose two.)
A. packet captures
B. NAT translation table
C. syslogs from affected devices
D. connection table information
E. NetFlow data
Answer: C, E
Q5. Which publication from the ISO covers security incident response?
A. 1918
B. 2865
C. 27035
D. 25012
Answer: C
Q6. What is the most important reason for documenting an incident?
A. It could be used as evidence for a criminal case.
B. It could be used to identify the person responsible for allowing it into the network.
C. To train others on what they should not do.
D. To use it for future incident response handling.
Answer: A
Q7. Which is considered to be anomalous activity?
A. an alert context buffer containing traffic to amazon.com
B. an alert context buffer containing SSH traffic
C. an alert context buffer containing an FTP server SYN scanning your network
D. an alert describing an anonymous login attempt to an FTP server
Answer: C
Q8. Which would be classified as a remote code execution attempt?
A. OLE stack overflow detected
B. null login attempt
C. BitTorrent activity detected
D. IE ActiveX DoS
Answer: A
Q9. If a company has a strict policy to limit potential confidential information leakage, which three alerts would be of concern? (Choose three.)
A. P2P activity detected
B. Skype activity detected
C. YouTube viewing activity detected
D. Pastebin activity detected
E. Hulu activity detected
Answer: A, B, D
Q10. Which two tools are used to help with traffic identification? (Choose two.)
A. network sniffer
B. ping
C. traceroute
D. route table
E. NetFlow
F. DHCP
Answer: A, E