Which protocol is expected to have NTP a user agent, host, and referrer headers in a packet capture?

A. NTP
B. HTTP
C. DNS
D. SSH

Answer: B

Which option is an advantage to using network-based anti-virus versus host-based anti- virus?

A. Network-based has the ability to protect unmanaged devices and unsupported operating systems.
B. There are no advantages compared to host-based antivirus.
C. Host-based antivirus does not have the ability to collect newly created signatures.
D. Network-based can protect against infection from malicious files at rest.

Answer: A

Which definition of vulnerability is true?

A. an exploitable unpatched and unmitigated weakness in software
B. an incompatible piece of software
C. software that does not have the most current patch applied
D. software that was not approved for installation

Answer: A

Which event occurs when a signature-based IDS encounters network traffic that triggers an alert?

A. connection event
B. endpoint event
C. NetFlow event
D. intrusion event

Answer: D

Which evasion method involves performing actions slower than normal to prevent detection?

A. traffic fragmentation
B. tunneling
C. timing attack
D. resource exhaustion

Answer: C

How many broadcast domains are created if three hosts are connected to a Layer 2 switch in full-duplex mode?

A. 4
B. 3
C. None
D. 1

Answer: D

Which network device is used to separate broadcast domains?

A. router
B. repeater
C. switch
D. bridge

Answer: A

In NetFlow records, which flags indicate that an HTTP connection was stopped by a security appliance, like a firewall, before it could be built fully?

A. ACK
B. SYN ACK
C. RST
D. PSH, ACK

Answer: B