IBM C2150-620 問題集

質問 1：
A System Administrator needs to create a pcap capture file which contains the FTP traffic inspected by the XGS and therefore has enabled the FTP_Get signature in the Default IPS Object.
Which other action needs to be performed to ensure that the desired capture file is available in the Local Management interface (LMI) for this event only?
A. Select "Log With Raw" on the FTP_Get signature that was enabled.
B. Enable the tools>capture>pinterface from the command line filtering by FTP_Get event.
C. Configure "Capture Connection" on the Response tab for an IPS Event Filter Policy rule for FTP_Get event.
D. Configure "Capture Connection" on the Response tab for the Default IPS Object.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A System Administrator wants to perform Hardware diagnostics because a network adapter is suspected of being faulty.
What command should be used from the console?
A. xgsdiag
B. phdiag
C. provdiag
D. sysdiag
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
The System Administrator of a financial company wants to control the network traffic during office hours, for example, social networking or streaming media traffic are forbidden during business hours (08:00-19:00) but are permitted after 19:00 from Monday to Friday. The consultant from an IBM business partner suggested that the Schedule Object in Network Access Policy could be used to fulfill this objective.
Which three parameters are required to create this Schedule Object? (Choose three.)
A. Activation Date
B. Comment
C. End Time
D. Daily
E. Expiration Date
F. Start Time
正解：C,D,F

質問 4：
A System Administrator sees a lot of Ping_Sweep events reported as blocked on the network. However, because the Ping_Sweep signature only blocks the ping packet that triggers the event, most of the ping packets are allowed through the XGS.
How can these suspicious packets be effectively blocked from the network?
A. Enable the Ping_Sweep event in the default IPS policy with the Block option.
B. Add a quarantine response to the Ping_Sweep event.
C. Add a catch-all rule to the bottom of the NAP that rejects all traffic.
D. Add a Network Access policy rule to reject ICMP traffic.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
The System Administrator for a bank has deployed the following Network Access Policy on the XGS appliance using default built-in Application & Inspection objects, as shown in the diagram below. No schedule objects were used in all rules.

The clients are on one side of the protection interface pair and the server are on the other side, including the gateway to internet. One user opened a browser to access
https://ibm.com. The traffic is blocked and the System Administrator opens the Network Access Events to find the events associated with the source IP address of the client.

Which Application is reported for that event?
A. http
B. tls
C. Unknown
D. https
正解：A

質問 6：
A System Administrator want to configure an XGS so that only when the SQL_Injection security event is enabled in the IPS policy and triggered, the XGS performs a packet capture of the complete connection from the point of the event triggering.
How should the System Administrator configure the XGS?
A. Create a Network Access policy object with a capture connection response object for the SQL_Injection security event.
B. Create an IPS Filter Policy object for the SQL_Injection security event and apply a response to capture the connection.
C. Edit the SQL_Injection security event within the IPS policy and apply a response to capture the connection.
D. Edit the IPS object that contains the SQL_Injection security event and apply a response to capture the connection.
正解：B
解説: (Topexam メンバーにのみ表示されます)