Cisco 210-250 Exam
Exam Code: 210-250
Exam Name: Understanding Cisco Cybersecurity
Fundamentals
Version: 1.0
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 1
Which security monitoring data type requires the most storage space?
transaction data
session data
statistical data
full packet capture
QUESTION 2
Which security principle states that more than one person is required to perform a critical task?
due diligence
least privilege
need to know
separation of duties
QUESTION 3
Which definition of a fork in Linux is true?
parent directory name of a file pathname
macros for manipulating CPU sets
daemon to execute scheduled commands
new process created by a parent process
QUESTION 4
Which two protocols are used for email (Choose two )
IMAP
SMTP
HTTP
NTP
DNS
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 5
Which statement about digitally signing a document is true?
The document is hashed and then the document is encrypted with the private key.
The document is encrypted and then the document is hashed with the public key
The document is hashed and then the document is encrypted with the public key.
The document is hashed and then the hash is encrypted with the private key.
QUESTION 6
Which two actions are valid uses of public key infrastructure? (Choose two )
ensuring the privacy of a certificate
revoking the validation of a certificate
creating duplicate copies of a certificate
changing ownership of a certificate
validating the authenticity of a certificate
QUESTION 7
While viewing packet capture data, you notice that one IP is sending and receiving traffic for multiple devices by
modifying the IP header, Which option is making this behavior possible?
TOR
encapsulation
tunneling
NAT
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 8
Which term represents a weakness in a system that could lead to the system being compromised?
risk
exploit
threat
vulnerability
QUESTION 9
Which definition of a process in Windows is true?
running program
database that stores low-level settings for the OS and for certain applications
basic unit to which the operating system allocates processor time
unit of execution that must be manually scheduled by the application
QUESTION 10
Which two options are recognized forms of phishing? (Choose two )
whaling
mailbomb
hooking
mailnet
spear
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 11
Which protocol is primarily supported by the third layer of the Open Systems Interconnection reference model?
TCP/UDP
ATM/ MPLS
IPv4/IPv6
HTTP/TLS
QUESTION 12
An intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources.
Which evasion technique does this attempt indicate?
timing attack
tunneling
traffic fragmentation
resource exhaustion
QUESTION 13
Which identifier is used to describe the application or process that submitted a log message?
selector
priority
facility
action
QUESTION 14
A firewall requires deep packet inspection to evaluate which layer?
link
application
Internet
transport
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 15
Which option is a purpose of port scanning?
Determine if the network is up or down
Identify legitimate users of a system.
Identify the Internet Protocol of the target system.
Identify which ports and services are open on the target host.
QUESTION 16
For which reason can HTTPS traffic make security monitoring difficult?
large packet headers
Signature detection takes longer.
encryption
SSL interception
QUESTION 17
Which protocol maps IP network addresses to MAC hardware addresses so that IP packets can be sent across
networks?
Internet Control Message Protocol
Session Initiation Protocol
Transmission Control Protocol/Internet Protocol
Address Resolution Protocol
QUESTION 18
Which evasion method involves performing actions slower than normal to prevent detection?
tunneling
traffic fragmentation
resource exhaustion
timing attack
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 19
Which network device is used to separate broadcast domains?
repeater
bridge
router
switch
QUESTION 20
Which term represents the practice of giving employees only those permissions necessary to perform their
specific role within an organization?
due diligence
need to know
least privilege
integrity validation
QUESTION 21
Which definition of the virtual address space for a Windows process is true?
system-level memory protection feature that is built into the operating system
set of pages that are currently resident in physical memory
actual physical location of an object in memory
set of virtual memory addresses that it can use
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 22
Which definition of permissions in Linux is true?
table maintenance program
attributes of ownership and control of an object
rules that allow network traffic to go in and out
written affidavit that you have to sign before using the system
QUESTION 23
Which term represents the chronological record of how evidence was collected- analyzed, preserved, and
transferred?
chain of custody
chain of evidence
evidence chronology
record of safekeeping
QUESTION 24
hich security monitoring data type is associated with application server logs?
statistical data
session data
alert data
transaction data
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 25
Which data can be obtained using NetFlow?
session data
report full packet capture
network downtime
application logs
QUESTION 26
Which encryption algorithm is the strongest?
DES
3DES
CES
AES
QUESTION 27
Which definition of the IIS Log Parser tool is true?
a powerful versatile tool that verifies the integrity of the log files
a powerful, versatile tool that makes it possible to run SQL-like queries against log flies
a data source control to connect to your data source
a logging module for IIS that allows you to log to a database
QUESTION 28
Which information security property is supported by encryption?
availability
sustainability
confidentiality
integrity
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 29
If a web server accepts input from the user and passes it to a bash shell, to which attack method is it
vulnerable?
input validation
command injection
hash collision
integer overflow
QUESTION 30
Which hash algorithm is the weakest?
SHA-256
SHA-1
SHA-512
RSA 4096
QUESTION 31
Based on which statement does the discretionary access control security model grant or restrict access ?
role of a user within an organization
security policy defined by the owner of an object
discretion of the system administrator
security policy defined by the system administrator
QUESTION 32
Which definition of Windows Registry is true?
database that stores low-level settings for the operating system
set of virtual memory addresses
set of pages that are currently resident m physical memory
basic unit to which the operating system allocates processor time
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 33
Which option is an advantage to using network-based anti-virus versus host-based anti-virus?
There are no advantages compared to host-based antivirus.
Network-based can protect against infection from malicious files at rest.
Network-based has the ability to protect unmanaged devices and unsupported operating systems.
Host-based antivirus does not have the ability to collect newly created signatures.
QUESTION 34
Which directory is commonly used on Linux systems to store log files, including syslog and apache access
logs?
/lib/log
/var/log
/etc/log
/root/log
QUESTION 35
A user reports difficulties accessing certain external web pages, When examining traffic to and from the external
domain in full packet captures, you notice many SYNs that have the same sequence number, source, and
destination IP address, but have different payloads. Which problem is a possible explanation of this situation?
misconfiguration of web filter
failure of full packet capture solution
TCP injection
insufficient network resources
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 36
Which definition of a daemon on Linux is true?
set of basic CPU instructions
new process created by duplicating the calling process
error check right after the call to fork a process
program that runs unobtrusively in the background
QUESTION 37
Which definition of an antivirus program is true?
program that scans a running application for vulnerabilities
program used to detect and remove unwanted malicious software from the system
rules that allow network traffic to go in and out
program that provides real time analysis of security alerts generated by network hardware and
application
QUESTION 38
Which event occurs when a signature-based IDS encounters network traffic that triggers an alert?
endpoint event
intrusion event
NetFlow event
connection event
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 39
Which two terms are types of cross site scripting attacks? (Choose two )
encoded
directed
cascaded
stored
reflected
QUESTION 40
Drag the data source on the left to the left to the correct data type on the right.
Wireshark - full packet capture
Netflow - session data
Server log - Transaction data
IPS - alert data
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 41
In NetFlow records, which flags indicate that an HTTP connection was stopped by a security appliance, like a
firewall, before it could be built fully?
RST
PSH, ACK
ACK
SYN ACK
QUESTION 42
Which concern is important when monitoring NTP servers for abnormal levels of traffic?
Being the cause of a distributed reflection denial of service attack.
Users changing the time settings on their systems.
Watching for rogue devices that have been added to the network.
A critical server may not have the correct time synchronized.
QUESTION 43
Refer to the exhibit. During an analysis this list of email attachments is found. Which files contain the same
content?
1 and 3
3 and 4
1 and 2
1 and 4
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 44
Which term represents a potential danger that could take advantage of a weakness in a system?
vulnerability
exploit
threat
risk
QUESTION 45
Drag the technology on the left to the data type the technology provides on the right.
Tcpdump - full packet capture
netflow - session data
Traditional stateful firewall - connection event
Web content filtering - transaction data
QUESTION 46
One of the objectives of information security is to protect the CIA of information and systems. What does CIA
mean in this context?
Confidentiality, Integrity, and Availability
Confidentiality, Identity, and Authorization
Confidentiality, Integrity, and Authorization
Confidentiality, Identity, and Availability
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 47
Which definition of vulnerability is true?
software that does not have the most current patch applied
software that was not approved for installation
an exploitable unpatched and unmitigated weakness in software
an incompatible piece of software
QUESTION 48
Which hashing algorithm is the least secure?
SHA-3
MD5
SHA-2
RC4
QUESTION 49
According to RFC 1035 which transport protocol is recommended for use with DNS queries?
Hypertext Transfer Protocol
Transmission Control Protocol
User Datagram Protocol
Reliable Data Protocol
QUESTION 50
Where is a host-based intrusion detection system located?
on a particular end-point as an agent or a desktop application
on a tap switch port
on a span switch port
on a dedicated proxy server monitoring egress traffic
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 51
In computer security, which information is the term PHI used to describe?
private host information
protected health information
personal health information
protected host information
QUESTION 52
You must create a vulnerability management framework. Which main purpose of this framework is true?
Identify remove and mitigate system vulnerabilities.
Detect and remove vulnerabilities in source code.
Conduct vulnerability scans on the network.
Manage a list of reported vulnerabilities.
QUESTION 53
Which cryptographic key is contained in an X.509 certificate?
public
symmetric
private
asymmetric
QUESTION 54
Which protocol is expected to have NTP a user agent, host, and referrer headers in a packet capture?
HTTP
SSH
DNS
NTP
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 55
Which situation indicates application-level white listing?
Allow specific executable files and deny specific executable files.
Writing current application attacks on a whiteboard daily.
Allow specific files and deny everything else.
Allow everything and deny specific executable files.
QUESTION 56
Which two activities are examples of social engineering? (Choose two)
sending a verbal request to an administrator to change the password to the account of a user the
administrator does know
receiving an unexpected email from an unknown person with an uncharacteristic attachment from
someone in the same company
receiving an invite to your department's weekly WebEx meeting
receiving an email from MR requesting that you visit the secure HR website and update your contract
information
receiving call from the IT department asking you to verify your username/password to maintain the
account
QUESTION 57
Which term describes the act of a user, without authority or permission, obtaining rights on a system, beyond
what were assigned?
administrative abuse
rights exploitation
authentication tunneling
privilege escalation
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 58
Which two features must a next generation firewall include? (Choose two.)
Security Information and Event Management
host-based antivirus
application visibility and control
data mining
intrusion detection system
QUESTION 59
Which type of exploit normally requires the culprit to have prior access to the target system?
denial of service
local exploit
remote exploit
system vulnerability
QUESTION 60
Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two
IPS phones?
man-in-the-middle
dictionary
replay
known-plaintext
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 61
Which two tasks can be performed by analyzing the logs of a traditional stateful firewall? (Choose two.)
Map internal private IP addresses to dynamically translated external public IP addresses
Determine the user IDs involved in an instant messaging exchange.
Confirm the timing of network connections differentiated by the TCP 5-tuple
Audit the applications used within a social networking web site.
Identify the malware variant carried by ^n SMTP connection
QUESTION 62
Which type of attack occurs when an attacker utilizes a botnet to reflect requests off an NTP server to
overwhelm their target?
distributed denial of service
man in the middle
replay
denial of service
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 63
Refer to the exhibit. A TFTP server has recently been installed in the Atlanpero ta office. The network
administrator is located in the NY office and has attempted to make a connection to the TFTP server. They are
unable to backup the configuration file and Cisco IOS of the NY router to the TFTP server Which cause of this
problem is true?
The TFTP server cannot obtain an address from a DHCP Server.
The network administrator computer has an incorrect IP address
The TFTP server has an incorrect IP address.
The TFTP server has an incorrect subnet mask.
QUESTION 64
Which definition describes the main purpose of a Security Information and Event Management solution ?
a monitoring interface that manages firewall access control lists for duplicate firewall filtering
a security product that collects, normalizes, and correlates event log data to provide holistic views of
the security posture
a database that collects and categorizes indicators of compromise to evaluate and search for potential
security threats
a relay server or device that collects then forwards event logs to another log collection device
www.lead2pass.com
Cisco 210-250 Exam
QUESTION 65
Which tool is commonly used by threat actors on a webpage to take advantage of the software vulnerabilities of
a system to spread malware?
vulnerability kit
exploit kit
root kit
script kiddie kit
www.lead2pass.com
