NEW QUESTION 1
A system administrator wants to know if the email traffic from a remote partner will activate special treatment message filters that are created just for them. Which tool on the Cisco Email Security gateway can you use to debug or emulate the flow that a message takes through the work queue?

• A. the message tracker interface
• B. centralized or local message tracking
• C. the CLI findevent command
• D. the trace tool
• E. the CLI grep command

Answer: D

NEW QUESTION 2
When using Cisco AMP for Networks, which feature copies a file to the Cisco AMP cloud for analysis?

• A. Spero analysis
• B. dynamic analysis
• C. sandbox analysis
• D. malware analysis

Answer: B

NEW QUESTION 3
Which option represents the cisco event aggregation product?

• A. CVSS system
• B. IntelliShield
• C. ASACX Event Viewer
• D. ASDM 7

Answer: C

NEW QUESTION 4
The Web Cache Communication Protocol (WCCP) is a content-routing protocol that can facilitate the redirection of traffic flows in real time. Your organization has deployed WCCP to redirect web traffic that traverses their Cisco Adaptive Security Appliances (ASAs) to their Cisco Web Security Appliances (WSAs).
The simulator will provide access to the graphical user interfaces of one Cisco ASA and one Cisco WSA that are participating in a WCCP service. Not all aspects of the GUIs are implemented in the simulator. The options that have been implemented are sufficient to determine the best answer to each of the questions that are presented.
Your task is to examine the details available in the simulated graphical user interfaces and select the best answer.




How many Cisco ASAs and how many Cisco WSAs are participating in the WCCP service?

• A. One Cisco ASA or two Cisco ASAs configured as an Active/Standby failover pair, and one Cisco WSA.
• B. One Cisco ASA or two Cisco ASAs configured as an Active/Active failover pair, and one Cisco WSA.
• C. One Cisco ASA or two Cisco ASAs configured as an Active/Standby failover pair, and two Cisco WSAs.
• D. One Cisco ASA or two Cisco ASAs configured as an Active/Active failover pair, and two Cisco WSAs.
• E. Two Cisco ASAs and one Cisco WSA.
• F. Two Cisco ASAs and two Cisco WSAs.

Answer: A

Explanation: We can see from the output that the number of routers (ASA’s) is 1, so there is a single ASA or an active/ standby pair being used, and 1 Cache Engine. If the ASA’s were in a active/active role it would show up as 2 routers.

NEW QUESTION 5
Which two TCP ports can allow the Cisco Firepower Management Center to communication with FireAMP cloud for file disposition information? (Choose two.)

• A. 8080
• B. 22
• C. 8305
• D. 32137
• E. 443

Answer: DE

Explanation: http://www.cisc
o.com/c/en/us/support/docs/security/sourcefire-fireamp-private-cloud-virtual-appliance/118336-configure-fiream page=http://www.cisco.com/c/en/us/support/docs/security/sourcefire-amp-appliances/118121-technote-so urcefire-00.html

NEW QUESTION 6
Which option is a benefit of a Cisco Email Security Virtual Appliance as compared to a physical Cisco ESA?

• A. simplifies the distribution of software updates
• B. enables the allocation of additional resources
• C. provides faster performance
• D. provides an automated setup process

Answer: B

NEW QUESTION 7
What can you use to access the Cisco IPS secure command and control channel to make configuration changes?

• A. SDEE
• B. the management interface
• C. an HTTP server
• D. Telnet

Answer: B

NEW QUESTION 8
Which two pieces of information are required to implement transparent user identification using context Directory Agent? (Choose two.)

• A. the shared secret
• B. the server name where Context Directory Agent is installed
• C. the server name of the global catalog domaint controller
• D. the syslog server IP address

Answer: AB

NEW QUESTION 9
Which two Cisco IPS events will generate an IP log? (Choose two.)

• A. A signature had an event action that was configured with log packets.
• B. A statically configured IP or IP network criterion was matched.
• C. A dynamically configured IP address or IP network was matched.
• D. An attack produced a response action.

Answer: AB

NEW QUESTION 10
What is the correct deployment for an IPS appliance in a network where traffic identified as threat traffic should be blocked and all traffic is blocked if the IPS fails?

• A. Inline; fail open
• B. Inline; fail closed
• C. Promiscuous; fail open
• D. Promiscuous; fail closed

Answer: B

NEW QUESTION 11
Which three operating systems are supported with Cisco AMP for Endpoints? (Choose three.)

• A. Windows
• B. AWS
• C. Android
• D. Cisco IOS
• E. OS X
• F. ChromeOS

Answer: ACE

Explanation: http://www.cisco.com/c/en/us/products/security/fireamp-endpoints/index.html

NEW QUESTION 12
Which option is the main function of the Cisco CWS Connector on mobile devices?

• A. it provides a connection to the FireAMP cloud to block threats that other security layers fail to detect.
• B. it integrates with the Cisco AnyConnect Secure Mobility Client to provide web security.
• C. it integrates with the Cisco NAC Agent to collect web-browser history for reporting purposes.
• D. it integrates with the Cisco Firepower Management Console to manage application and web traffic.

Answer: A

NEW QUESTION 13
After configuring an ISR with the Cisco Cloud Web security connector, which command does a network engineer run to verify connectivity to the CVV proxy?

• A. show content-scan summary
• B. show content-scan statistics
• C. show scansafe server
• D. show scansafe statistics

Answer: A

NEW QUESTION 14
Which command allows the administrator to access the Cisco WSA on a secure channel on port 8443?

• A. strictssl
• B. adminaccessconfig
• C. ssl
• D. ssh

Answer: A

NEW QUESTION 15
Using the default modular policy framework global configuration on the Cisco ASA, how does the Cisco ASA process outbound HTTP traffic?

• A. HTTP flows are not permitted through the Cisco ASA, because HTTP is not inspected by default.
• B. HTTP flows match the inspection_default traffic class and are inspected using HTTP inspection.
• C. HTTP outbound traffic is permitted, but all return HTTP traffic is denied.
• D. HTTP flows are statefully inspected using TCP stateful inspection.

Answer: D

NEW QUESTION 16
Which Cisco deployment architectures support Clustering? (Choose 2).

• A. Cisco FirePOWER Management Center
• B. Cisco ASAv
• C. Cisco FirePOWER Appliances (NGIPS)
• D. Cisco ASA with FirePOWER Services

Answer: CD

NEW QUESTION 17
Which three sender reputation ranges identify the default behavior of the Cisco Email Security Appliance? (Choose three.)

• A. If it is between -1 and +10, the email is accepted
• B. If it is between +1 and +10, the email is accepted
• C. If it is between -3 and -1, the email is accepted and additional emails from the sender are throttled
• D. If it is between -3 and +1, the email is accepted and additional emails from the sender are throttled
• E. If it is between -4 and +1, the email is accepted and additional emails from the sender are throttled
• F. If it is between -10 and -3, the email is blocked
• G. If it is between -10 and -3, the email is sent to the virus and spam engines for additional scanning
• H. If it is between -10 and -4, the email is blocked

Answer: ACF

NEW QUESTION 18
The Web Cache Communication Protocol (WCCP) is a content-routing protocol that can facilitate the redirection of traffic flows in real time. Your organization has deployed WCCP to redirect web traffic that traverses their Cisco Adaptive Security Appliances (ASAs) to their Cisco Web Security Appliances (WSAs).
The simulator will provide access to the graphical user interfaces of one Cisco ASA and one Cisco WSA that are participating in a WCCP service. Not all aspects of the GUIs are implemented in the simulator. The options that have been implemented are sufficient to determine the best answer to each of the questions that are presented.
Your task is to examine the details available in the simulated graphical user interfaces and select the best answer.




What traffic is not redirected by WCCP?

• A. Traffic destined to public address space
• B. Traffic sent from public address space
• C. Traffic destined to private address space
• D. Traffic sent from private address space

Answer: B

Explanation: From the screen shot below we see the WCCP-Redirection ACL is applied, so all traffic from the Private IP space to any destination will be redirected.

NEW QUESTION 19
How does a user access a Cisco Web Security Appliance for initial setup?

• A. Connect the console cable and use the terminal at 9600 baud to run the setup wizard.
• B. Connect the console cable and use the terminal at 115200 baud to run the setup wizard.
• C. Open the web browser at 192.168.42.42:8443 for the setup wizard over https.
• D. Open the web browser at 192.168.42.42:443 for the setup wizard over https.

Answer: C