2017 February Cisco Official New Released 500-290 Dumps in Lead2pass.com!
100% Free Download! 100% Pass Guaranteed!
Amazing,100% candidates have passed the 500-290 exam by practising the preparation material of Lead2pass, because the braindumps are the latest and cover every aspect of 500-290 exam. Download the braindumps for an undeniable success in 500-290 exam.
Following questions and answers are all new published by Cisco Official Exam Center: http://www.lead2pass.com/500-290.html
QUESTION 51
Which rating is determined by adjusting the risk rating with respect to preventative actions taken by the sensor?
A. attack severity rating
B. attack relevancy rating
C. damage assessment rating
D. hazard rating
E. threat rating
F. event action delta
Answer: E
QUESTION 52
Stacking allows a primary device to utilize which resources of secondary devices?
A. interfaces, CPUs, and memory
B. CPUs and memory
C. interfaces, CPUs, memory, and storage
D. interfaces and storage
Answer: B
QUESTION 53
Which three statements are true with respect to IPS false positives? (Choose three.)
A. An example of a false positive is when the IPS appliance produces an alert in response to the
normal activities of the company’s network management system.
B. Increasing the set of TCP ports that a signature matches on may reduce false positives.
C. False positives may be reduced by disabling certain signatures.
D. Event action filters can be implemented to reduce false positives.
E. An example of a false positive is the IPS not reacting to a successful denial of service attack.
Answer: ACD
QUESTION 54
Which Cisco IPS appliance signature engine uses signature events as input to correlate different signatures into a higher level event?
A. Atomic signature engine
B. Service signature engine
C. Meta signature engine
D. Sweep signature engine
E. Multistring signature engine
F. Normalizer signature engine
Answer: C
QUESTION 55
Which application within the Cisco IPS appliance can modify the configurations of other devices on the network?
A. SDEE
B. POSFP
C. ARC
D. global correlation
E. reputation filter
F. anomaly detection
Answer: C
QUESTION 56
Which interface type allows for bypass mode?
A. inline
B. switched
C. routed
D. grouped
Answer: A
QUESTION 57
Which interface type allows for VLAN tagging?
A. inline
B. switched
C. high-availability link
D. passive
Answer: B
QUESTION 58
Correlation policy rules allow you to construct criteria for alerting on very specific conditions.
Which option is an example of such a rule?
A. testing password strength when accessing an application
B. limiting general user access to administrative file shares
C. enforcing two-factor authentication for access to critical servers
D. issuing an alert if a noncompliant operating system is detected or if a host operating system changes to a noncompliant operating system when it was previously profiled as a compliant one
Answer: D
QUESTION 59
Which option is a valid whitelist evaluation value?
A. pending
B. violation
C. semi-compliant
D. not-evaluated
Answer: D
QUESTION 60
What does the whitelist attribute value “not evaluated” indicate?
A. The host is not a target of the whitelist.
B. The host could not be evaluated because no profile exists for it.
C. The whitelist status could not be updated because the correlation policy it belongs to is not enabled.
D. The host is not on a monitored network segment.
Answer: A
You can pass Cisco 500-290 exam if you get a complete hold of 500-290 braindumps in Lead2pass. What’s more, all the 500-290 Certification exam Q and As provided by Lead2pass are the latest.
500-290 new questions on Google Drive: https://drive.google.com/open?id=0B3Syig5i8gpDbVYtOTNZU0FUYTQ
2017 Cisco 500-290 exam dumps (All 70 Q&As) from Lead2pass:
http://www.lead2pass.com/500-290.html [100% Exam Pass Guaranteed]