Create a free account to browse all 17 sample questions. The full practice test includes 257 questions. Use the simulator for timed and flashcard mode.
What are the two categories of variables that you can configure in Object Management? A.System Default Variables and FireSIGHT-Specific VariablesB.System Default Variables and Procedural VariablesC.Default Variables and Custom VariablesD.Policy-Specific Variables and Procedural Variables
Correct answer: C
Which option is true regarding the $HOME_NET variable? A.is a policy-level variableB.has a default value of "all"C.defines the network the active policy protectsD.is used by all rules to define the internal network
Correct answer: C
Which option is one of the three methods of updating the IP addresses in Sourcefire Security Intelligence? A.subscribe to a URL intelligence feedB.subscribe to a VRTC.upload a list that you createD.automatically upload lists from a network share
Correct answer: C
Which statement is true in regard to the Sourcefire Security Intelligence lists? A.The global blacklist universally allows all traffic through the managed device.B.The global whitelist cannot be edited.C.IP addresses can be added to the global blacklist by clicking on interactive graphs in Context Explorer.D.The Security Intelligence lists cannot be updated.
Correct answer: C
A security architect is designing a variable set for a multi-tenant environment using FireSIGHT Management Center. Tenant A uses the 10.1.0.0/16 subnet, and Tenant B uses 10.2.0.0/16. Both tenants share the same Intrusion Policy but require distinct protection scopes. How should the architect configure the $HOME_NET variable to ensure the Intrusion Policy correctly identifies the protected network for each tenant's specific traffic flow when applied via Access Control Rules?
Correct answer: D
In FireSIGHT/Firepower, variables are linked to Intrusion Policies, but the assignment happens within the Access Control Policy (ACP). By creating different Variable Sets (e.g., Set_A with $HOME_NET=10.1.0.0/16 and Set_B with $HOME_NET=10.2.0.0/16), the administrator can reuse the same Intrusion Policy in different ACP rules while applying the correct network context for each rule.
An administrator observes that a critical business application using a proprietary TCP protocol on port 8888 is being dropped by the default 'Balanced Security and Connectivity' intrusion policy. The drops are triggered by a preprocessor anomaly. What is the most efficient method to allow this traffic without disabling the preprocessor globally?
Correct answer: B
Suppression rules allow an administrator to prevent specific signature or preprocessor events (identified by GID:SID) from firing for specific source or destination IP addresses. This stops the drop action for the authorized application without disabling the protection for the rest of the network.
While analyzing the Context Explorer, an analyst notices that the operating system information for several critical servers is listed as 'Unknown' or incorrect. This inaccuracy is affecting the FireSIGHT recommended rules generation. Which feature must be tuned to improve the accuracy of this passive discovery?
Correct answer: C
The Network Discovery Policy controls how the FirePOWER system collects data about the network assets (hosts, OS, applications, users). Tuning the networks being monitored and the active/passive discovery settings in this policy ensures accurate host profiling, which is essential for FireSIGHT recommendations.
Which of the following Snort 2.9 rule headers is valid for alerting on traffic originating from the external network destined for the HTTP servers defined in the variable set? (Select TWO)
Correct answers: A, B
This is a standard valid header: Action (alert) Protocol (tcp) SourceIP ($EXTERNAL_NET) SourcePort (any) Direction (->) DestIP ($HTTP_SERVERS) DestPort ($HTTP_PORTS).
This is also valid. It uses the negation operator (!) to specify traffic NOT from the home network (effectively external) destined for the home network on port 80.
Register free to unlock 9 more sample questions
Create a free account to continue with the rest of the 500-285 sample set.
Own this practice test forever.
Any 2 exams per month.
Any 4 exams per month.
Any 12 exams over 3 months.
