500-285 sample questions

Question 1

What are the two categories of variables that you can configure in Object Management? A.System Default Variables and FireSIGHT-Specific VariablesB.System Default Variables and Procedural VariablesC.Default Variables and Custom VariablesD.Policy-Specific Variables and Procedural Variables

Accepted Answer

Default Variables and Custom Variables

Answer

System Default Variables and FireSIGHT-Specific Variables

Answer

System Default Variables and Procedural Variables

Answer

Policy-Specific Variables and Procedural Variables

Question 2

Which option is true regarding the $HOME_NET variable? A.is a policy-level variableB.has a default value of "all"C.defines the network the active policy protectsD.is used by all rules to define the internal network

Accepted Answer

defines the network the active policy protects

Answer

is a policy-level variable

Answer

has a default value of "all"

Answer

is used by all rules to define the internal network

Question 3

Which option is one of the three methods of updating the IP addresses in Sourcefire Security Intelligence? A.subscribe to a URL intelligence feedB.subscribe to a VRTC.upload a list that you createD.automatically upload lists from a network share

Accepted Answer

upload a list that you create

Answer

subscribe to a URL intelligence feed

Answer

subscribe to a VRT

Answer

automatically upload lists from a network share

Question 4

Which statement is true in regard to the Sourcefire Security Intelligence lists? A.The global blacklist universally allows all traffic through the managed device.B.The global whitelist cannot be edited.C.IP addresses can be added to the global blacklist by clicking on interactive graphs in Context Explorer.D.The Security Intelligence lists cannot be updated.

Accepted Answer

IP addresses can be added to the global blacklist by clicking on interactive graphs in Context Explorer.

Answer

The global blacklist universally allows all traffic through the managed device.

Answer

The global whitelist cannot be edited.

Answer

The Security Intelligence lists cannot be updated.

Question 5

A security architect is designing a variable set for a multi-tenant environment using FireSIGHT Management Center. Tenant A uses the 10.1.0.0/16 subnet, and Tenant B uses 10.2.0.0/16. Both tenants share the same Intrusion Policy but require distinct protection scopes. How should the architect configure the $HOME_NET variable to ensure the Intrusion Policy correctly identifies the protected network for each tenant's specific traffic flow when applied via Access Control Rules?

Accepted Answer

Create two distinct Variable Sets, each defining $HOME_NET for the specific tenant subnet, and assign the appropriate Variable Set to the corresponding Access Control Rule.

Answer

Create two separate Intrusion Policies, hardcoding the $HOME_NET default value in each policy to match the respective tenant subnets.

Answer

Define $HOME_NET as 'any' in the default variable set and rely on the Access Control Rule's source network condition to filter traffic before inspection.

Answer

Create a single Variable Set with two custom variables, assigning one to each tenant, and reference both in the global Snort configuration.

Question 6

An administrator observes that a critical business application using a proprietary TCP protocol on port 8888 is being dropped by the default 'Balanced Security and Connectivity' intrusion policy. The drops are triggered by a preprocessor anomaly. What is the most efficient method to allow this traffic without disabling the preprocessor globally?

Accepted Answer

Add a global suppression rule for the specific GID:SID targeting the destination IP of the application server.

Answer

Create a Pass Rule in the Access Control Policy for port 8888 before the Intrusion Policy rule.

Answer

Disable the specific preprocessor in the Network Analysis Policy.

Answer

Modify the $HTTP_PORTS variable to exclude port 8888.

Question 7

While analyzing the Context Explorer, an analyst notices that the operating system information for several critical servers is listed as 'Unknown' or incorrect. This inaccuracy is affecting the FireSIGHT recommended rules generation. Which feature must be tuned to improve the accuracy of this passive discovery?

Accepted Answer

Network Discovery Policy

Answer

Host Attribute Update Policy

Answer

Network Analysis Policy (NAP)

Answer

Access Control Policy Logging

Question 8

Which of the following Snort 2.9 rule headers is valid for alerting on traffic originating from the external network destined for the HTTP servers defined in the variable set? (Select TWO)

Accepted Answer

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS

Accepted Answer

alert tcp !$HOME_NET any -> $HOME_NET 80

Answer

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HTTP_SERVERS any

Answer

log udp any any -> $HTTP_SERVERS 80

Answer

drop ip $EXTERNAL_NET any $HTTP_SERVERS any

Top vendors

Top exams

Free 500-285 sample questions

What are the two categories of variables that you can configure in Object Management? A.System Default Variables and FireSIGHT-Specific VariablesB.System Default Variables and Procedural VariablesC.Default Variables and Custom VariablesD.Policy-Specific Variables and Procedural Variables

Which option is true regarding the $HOME_NET variable? A.is a policy-level variableB.has a default value of "all"C.defines the network the active policy protectsD.is used by all rules to define the internal network

Which option is one of the three methods of updating the IP addresses in Sourcefire Security Intelligence? A.subscribe to a URL intelligence feedB.subscribe to a VRTC.upload a list that you createD.automatically upload lists from a network share

Which of the following Snort 2.9 rule headers is valid for alerting on traffic originating from the external network destined for the HTTP servers defined in the variable set? (Select TWO)

9 more free samples are waiting