Drag and drop the descriptions from the left onto the correct protocol versions on the right.
Correct Answer:
Question 472
How does a WCCP-configured router identify if the Cisco WSA is functional?
Correct Answer: D
The WCCP-configured router identifies if the Cisco WSA is functional by exchanging periodic messages with the WSA. The WSA sends a Here-I-Am message every 10 seconds to the router, which contains information such as the WSA's IP address, service group, and hash assignment. The router responds with an I-See-You message, which acknowledges the receipt of the Here-I-Am message and provides information such as the router's IP address, service group, and view of the WCCP topology. These messages allow the router and the WSA to maintain a bidirectional communication and to detect any changes or failures in the WCCP network12. Option C is the correct answer, as it describes the correct message exchange between the WCCP-configured router and the Cisco WSA. Option A is incorrect, as the router does not use ICMP ping to check the WSA's functionality, and the traffic is not transmitted to the router, but redirected by the router. Option B is incorrect, as the router does not use ICMP ping to check the WSA's functionality, and the traffic is not transmitted to the WSA, but redirected by the WSA. Option D is incorrect, as the router does not send a Here-I-Am message, but an I-See-You message, and the WSA does not acknowledge with an I-See-You message, but a Here-I-Am message. References: WCCP Router Configuration Example - Cisco. Cisco ASA WCCP Traffic Redirection Guide - Cisco.
Question 473
What are two list types within AMP for Endpoints Outbreak Control? (Choose two)
Correct Answer: B,D
Explanation Advanced Malware Protection (AMP) for Endpoints offers a variety of lists, referred to as Outbreak Control, that allow you to customize it to your needs. The main lists are: Simple Custom Detections, Blocked Applications, Allowed Applications, Advanced Custom Detections, and IP Blocked and Allowed Lists. A Simple Custom Detection list is similar to a blocked list. These are files that you want to detect and quarantine. Allowed applications lists are for files you never want to convict. Some examples are a custom application that is detected by a generic engine or a standard image that you use throughout the company Reference: https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdf Advanced Malware Protection (AMP) for Endpoints offers a variety of lists, referred to as Outbreak Control, that allow you to customize it to your needs. The main lists are: Simple Custom Detections, Blocked Applications, Allowed Applications, Advanced Custom Detections, and IP Blocked and Allowed Lists. A Simple Custom Detection list is similar to a blocked list. These are files that you want to detect and quarantine. Explanation Advanced Malware Protection (AMP) for Endpoints offers a variety of lists, referred to as Outbreak Control, that allow you to customize it to your needs. The main lists are: Simple Custom Detections, Blocked Applications, Allowed Applications, Advanced Custom Detections, and IP Blocked and Allowed Lists. A Simple Custom Detection list is similar to a blocked list. These are files that you want to detect and quarantine. Allowed applications lists are for files you never want to convict. Some examples are a custom application that is detected by a generic engine or a standard image that you use throughout the company Reference: https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdf
Question 474
A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address https://<FMC IP>/capure/CAPI/pcap/test.pcap, an error 403: Forbidden is given instead of the PCAP file. Which action must the engineer take to resolve this issue?
Correct Answer: A
Question 475
Drag and drop the capabilities of Cisco Firepower versus Cisco AMP from the left into the appropriate category on the right.
