Passed with high score today for Cisco 642-544 Exam. Windows 8.1 new questions will be added so I’m lucky to pass today.Almost all questions were the same includes the new question, DirectAccess, EFS, AD CS..Only used Flydumps premium vce file.
QUESTION 31
What are three benefits in deploying Cisco Security MARS appliances using the global and local controller architecture? (Choose three.)
A. A global controller can provide a summary of all local controllers information (network topologies, incidents, queries, and reports results).
B. A global controller can provide a central point for creating rules and queries, which are applied simultaneously to multiple local controllers.
C. The architecture provides redundancy in case one of the Cisco Security MARS local controllers fails within a zone.
D. Users can seamlessly navigate to any local controller from the global controller GUI.
E. A global controller can correlate events from multiple local controllers to perform global sessionizations.
F. Rules that apply to multiple local controllers cannot be created on the global controller and pushed down to them from a central location.
Correct Answer: ABE Section: (none) Explanation
Explanation/Reference:
QUESTION 32
What are the two options for handling false-positive events reported by the Cisco Security MARS appliance? (Choose two.)
A. archive to NFS only
B. save as a false-positive report
C. drop
D. mitigate at Layer 2
E. log to the database only
F. escalate to the Cisco Security MARS administrator
Correct Answer: CE Section: (none) Explanation
Explanation/Reference:
QUESTION 33
Which three statements are correct about the Cisco Security MARS global and local controller architecture? (Choose three.)
A. The global controller can correlate events from different local controllers into a common session.
B. One global controller can support multiple local controllers.
C. Each zone can have one local controller.
D. All local controllers events are propagated to the global controller for correlations.
E. The global controller and the local controllers can be running different Cisco Security MARS OS versions.
F. Incidents can be viewed on the global controller based on a selected local controller.
Correct Answer: BCD Section: (none) Explanation
Explanation/Reference:
QUESTION 34
Which two of the following statements are correct regarding the Cisco Security MARS rules? (Choose two)
A. User-defined rules are treated as global rules. When an incident is fired by a user-defined rule on the Cisco Security MARS local controller, the rule propagates to the Cisco Security MARS global controller.
B. Predefined system rules are treated as global rules. When an incident is fired by a system rule on the Cisco Security MARS local controller, the system rule propagates to the Cisco Security MARS global controller.
C. Drop rules are treated as global rules so it will automatically propagate to the Cisco Security MARS global controller.
D. Rules can be created on both the Cisco Security MARS global controller and the Cisco Security MARS local controllers. Rules on the Cisco Security MARS global controller will propagate down to the Cisco Security MARS local controllers.
E. It is not possible to edit the global rules created on the Cisco Security MARS global controller from the Cisco Security MARS local controller.
Correct Answer: BD Section: (none) Explanation
Explanation/Reference:
QUESTION 35
Cisco Security MARS uses NetFlow data to perform which function?
A. traffic profiling and statistical anomaly detection
B. correlation across NAT boundary
C. data reductions
D. events normalization
E. false-positive analysis
F. topology-aware sessionizations to combine multiple events into end-to-end sessions
Correct Answer: A Section: (none) Explanation
Explanation/Reference:
QUESTION 36
Which two are required to enable Cisco Security MARS Level 3 operations? (Choose two.)
A. global controller
B. vulnerability scanning
C. NetFlow
D. SNMP community string
E. administrative access to the device
F. Cisco Security Manager
Correct Answer: DE Section: (none) Explanation
Explanation/Reference:
QUESTION 37
What enables the Cisco Security MARS appliance to profile network usage and detect statistically significant anomalous behavior from a computed baseline?
A. Cisco Security MARS Global Controller
B. Cisco Security Manager
C. NetFlow
D. Cisco Security MARS Custom Parser
Correct Answer: C Section: (none) Explanation
Explanation/Reference:
QUESTION 38
Drop A. Tools that can be run in a specific moment to investigate an incident
B. Raw messages sent to the cisco security MARS appliance by the reporting devices
C. A series of events that share common 5-tuple information
D. A series of sessions that match a defined rule
E. Tools that analyze the events and sessions and generate incidents
Correct Answer: ABCDE Section: (none) Explanation
Explanation/Reference:
QUESTION 39
Which two steps are required to represent a Check Point device in the Cisco Security MARS? (Select two)
A. Define Security Contexts.
B. Define Primary Management Station.
C. Define Secure Internal Communicator (SIC).
D. Define Check Point OPSEC.
E. Define Child Enforcement Module(s).
F. Define Parent Enforcement Module.
Correct Answer: BE Section: (none) Explanation
Explanation/Reference:
Preparing Cisco 642-544 exam is not difficult now.You can prepare from Cisco 642-544 Certification or Cisco 642-544 dumps.Here we have mentioned some sample questions.You can use our Cisco 642-544 study material notes for test preparation.Latest Cisco 642-544 study material available.