Cisco Secure Intrusion Detection System Questions Answers

1. 

Which of the following sensor models is capable of delivering 200 Mbps or more of monitoring and analyzing?

1. The IDSM module for the Catalyst 5500

2. The IDSM module for the Catalyst 6500

3. The 4235-network sensor appliance

4. The 4250-network sensor appliance

2. 

On which of the following operation systems will CSPM operate properly?

1. Windows NT 4.0

2. Windows NT 3.5

3. Windows 2000

4. Sun Solaris or HPUX

3. 

What is the command that can be used to start the IDS system on a 4200 series network sensor appliance?

1. startids

2. idsstart

3. Idsstart

4. nr.idsstart

4. 

Which of the following daemons is responsible for the monitoring and analyzing of network traffic?

1. packetd

2. services

3. auth

4. managed

5. 

Where are archived IP session log files located?

1. /usr/nr/var

2. /usr/nr/var/new

3. /usr/nr/var/iplog

4. /usr/nr/var/iplog/new

6. 

Which file would you open to see the IP address and UDP port associated with the host name of a CIDS component?

1. auth

2. routes

3. destinations

4. hosts

7. 

What is the default installation directory on all CIDS sensors?

1. root\usr

2. \usr\var

3. \usr\nr

4. \usr\nr\etc

8. 

What command would return the current services running and their versions?

1. idsvers

2. showidsver

3. showver

4. idsshowver

9. 

What is the protocol used as a communication vehicle between the sensor and director platforms?

1. postofficed

2. SMTP

3. IMAP

4. PostOffice

10. 

The CIDS Director for UNIX will run on which of the following operating systems?

1. HPUX

2. HPOV

3. Sun Solaris

4. HP OpenView

11. 

Why should IP blocking be used cautiously?

1. Because it’s difficult to configure

2. Because it gives too much control to the sensor

3. Because it’s impossible to unblock an address once it’s been blocked

4. Because hackers can use this feature to attack your infrastructure

12. 

What type of files are stored in the /usr/nr/etc directory?

1. Configuration files

2. System files

3. IP session log files

4. Archived log files

13. 

What is a token?

1. A configuration parameter

2. A configuration file

3. A daemon installed on a sensor

4. A device used in video games

14. 

What script can assist administrators in troubleshooting communication issues between CIDS devices?

1. auths

2. idscomm

3. idsconn

4. idsstatus

15. 

Which of the following files should not be changed unless directed by Cisco?

1. signature

2. hosts

3. auth

4. destinations

16. 

What are the four types of log files?

1. packetd, postofficed, fileXferd, loggerd

2. idsstart, idsstop, idsstatus, idsvers

3. alarm, notification, event, error

4. event, error, IP session, command

17. 

The director platform can be configured to respond automatically to an attack by what?

1. Blocking the offending IP address

2. Sending a TCP reset packet

3. Creating an IP Session log

4. None of the above

18. 

Which of the following daemons are responsible for file deletion and for moving log files to the database staging area?

1. loggerd

2. packetd

3. fileXferd

4. sapd

19. 

Which of the following daemons allow the director platforms to configure sensors remotely?

1. fileXferd

2. managed

3. postofficed

4. smid

20. 

Which of the following daemons runs only on the sensor or only on the director, but doesn’t run on both?

1. loggerd

2. smid

3. packetd

4. fileXferd