500-275 Exam Training Practice Tests (Cisco Securing Cisco Networks with Sourcefire FireAMP Endpoints)]

Cisco Securing Cisco Networks with Sourcefire FireAMP Endpoints - 500-275 Exam Practice Test

Question 1

Which statement describes an advantage of cloud-based detection?

A. Limited customization allows for faster detection. B. High-speed analytical engines on the endpoint limit the amount of work the cloud must perform. C. Sandboxing reduces the overall management overhead of the system. D. Fewer resources are required on the endpoint.

Correct Answer: D

Question 2

Which feature allows retrospective detection?

A. Recall Alert B. Recall Analysis C. Cloud Recall D. Total Recall

Correct Answer: C

Question 3

When discussing the FireAMP product, which term does the acronym DFC represent?

A. It is not an acronym that is associated with the FireAMP product. B. It means Detected Forensic Cause. C. It means Duplicate File Contents. D. It means Device Flow Correlation.

Correct Answer: D

Question 4

Which type of activity is shown in the Device Trajectory page?

A. the IP addresses of hosts on which a file was seen B. the hosts that are in the same group as the selected host C. the activity of the FireAMP console users D. file creation

Correct Answer: D

Question 5

If a file's SHA-256 hash is sent to the cloud, but the cloud has never seen the hash before, which disposition is returned?

A. Malware B. Unavailable C. Clean D. Neutral

Correct Answer: D