Download Free Testking Implementing Cisco Security Monitoring 642-544 Dumps

Testking Implementing Cisco Security Monitoring 642-544

Implementing Cisco Security Monitoring, Analysis and Response System

Exam Number: 642-544
Associated Certifications: Implementing Cisco Security Monitoring, Analysis and Response System
Duration: 60 minutes (40-50 Questions)
Available Languages: English
Click Here to Register: Pearson VUE
Exam Policies: Read current policies and requirements
Exam Tutorial: Review type of exam questions
Question: 1
The definitions on the left to the appropriate terms on the right

Answer:

Question: 2
What will happen if you try to run a Cisco Security MARS query that will take a long time to complete?

A. After submitting the query, the Cisco Security MARS GUI screen will be locked up until the query is completed.
B. The query will be automatically saved as a rule.
C. The query will be automatically saved as a report.
D. You will be prompted to “Submit Batch” to run the query in batch mode.

Exam Name: Implementing Cisco Security Monitoring, Analysis and Response
Exam Type: CISCO
Exam Code: 642-544 Total Questions: 39

Answer: D

Question: 3
The Cisco Security MARS appliance supports which protocol for data archiving and restoring?

A. NFS B. TFTP C. FTP
D. Secure FTP E. SSH
Answer: A Question: 4
What is a benefit of using the dollar variable (as in $TARGET01) when creating queries in Cisco
Security MARS?

A. The dollar variable enables multiple queries to reference the same common 5-tuple information using a variable.
B. The dollar variable ensures that the probes and attacks that are reported are happening to the same host.
C. The dollar variable allows matching of any unknown reporting device. D. The dollar variable allows matching of any event type groups.
E. The dollar variable enables the same query to be applied to different reports.
F. The dollar variable enables the same query to be applied to different cases.
Answer: B Question: 5
A Cisco Security MARS appliance cannot access certain devices through the default gateway. Troubleshooting has determined that this is a Cisco Security MARS configuration issue.
Which additional Cisco Security MARS configuration will be required to correct this issue?

A. use the Cisco Security MARS GUI or CLI to enable a dynamic routing protocol
B. use the Cisco Security MARS CLI to add a static route
C. use the Cisco Security MARS GUI to configure multiple default gateways
D. use the Cisco Security MARS GUI or CLI to configure multiple default gateways
Answer: B Question: 6
What are three ways to add devices to the Cisco Security MARS appliance? (Choose three.)

A. import the devices from CiscoWorks
B. import the devices from Cisco Security Manager
C. load the devices from seed files
D. use SNMP auto discovery
E. use CDP to automatically discover the neighboring devices
F. manually add the devices, one at a time

Answer: C, D, F Question: 7

Exam Name: Implementing Cisco Security Monitoring, Analysis and Response
Exam Type: CISCO
Exam Code: 642-544 Total Questions: 39

Which action enables the Cisco Security MARS appliance to ignore false-positive events by either
dropping the events completely, or by just logging them to the database?

A. creating system inspection rules using the drop operation
B. creating drop rules
C. inactivating the rules
D. inactivating the events
E. deleting the false-positive events from the Incidents page
F. deleting the false-positive events from the Event Management page

Answer: Pending

Question: 8
Which three statements are true about Cisco Security MARS rules? (Choose three.)

A. There are three types of rules. B. Rules can be saved as reports. C. Rules can be deleted.
D. Rules trigger incidents.
E. Rules can be defined using a seed file. F. Rules can be created using a query.
Answer: B Question: 9
Which of the following alert actions can be transmitted to a user as notification that a Cisco
Security MARS rule has fired, and that an incident has been logged? (Choose two.)

A. Distributed Threat Mitigation
B. Short Message Service
C. SNMP trap
D. XML notification
E. syslog
F. OPSEC-LEA (clear and encrypted)
Answer: A, D, F Question: 10
To configure a Microsoft Windows IIS server to publish logs to the Cisco Security MARS, which log agent is installed and configured on the Microsoft Windows IIS server?

A. pnLog agent
B. Cisco Security MARS agent
C. SNARE
D. None. Cisco Security MARS is an agentless device.
Answer: B, D Question: 11
What three data points are used to correlate reports in the Cisco Security MARS? (Choose three.)

A. Maximum Rank Returned
B. Query Criterion
C. View Type

Exam Name: Implementing Cisco Security Monitoring, Analysis and Response
Exam Type: CISCO
Exam Code: 642-544 Total Questions: 39

D. Order/Rank By
E. Incident Type
F. Period of Time
Answer: C Question: 12
The Service variables defined are used for what purpose?

A. for Event Groups creation
B. for Query/Reports and Rules creation
C. for IP Management Groups creation
D. for NetFlow Events Management
E. for Data Reduction
Answer: B, C Question: 13
Refer to the Cisco Security MARS Event Management partial screen shown above.
Exam 642-544: Implementing Cisco Security MARS (MARS)

Related Certifications: CCSP

Number of Questions: 40-50

Duration: 60 minutes

Exam Topics Include:

Install and configure the Cisco Security MARS product
Identify the components, features and functions of the Cisco Security MARS product
Installing the Cisco Security MARS appliance
Add Cisco reporting devices into the Cisco Security MARS appliance
Investigate events that the Cisco Security MARS appliance collects from configured security devices
Configure the Cisco Security MARS appliance to send alerts
Configure rules to detect interesting patterns of network activity and other anomalous network behavior
Configure the Cisco Security MARS appliance hardware maintenance activities
The 642-544 MARS Implementing Cisco Security Monitoring, Analysis and Response System exam is associated with the Cisco Certified Security Professional certification. This is one of the optional exams required for the CCSP.

Interactive Testing Engine Included!
46 Questions
Updated : 08/30/2008
Price : $87.99 $79.99
Free download?testking Implementing Cisco Security Monitoring 642-544
Free download?pass4sure Implementing Cisco Security Monitoring 642-544