Exhibit:

You work as an administrator at Certkiller .com. Study the exhibit carefully. In the exhibit, which rule
base would have generated the log message?

Assume that Enterprise Security Profiler (ESP) has already captured data for your network. You want
to view traffic that does not match the following protocols: HTTP,
HTTPS, DNS. Which steps must you perform?

Exhibit:

You work as an administrator at Certkiller .com. Study the exhibit carefully.
In the exhibit both firewalls are active/active, which two statements are true for this scenario?
(Choose two.)

What is “the location of an attack pattern protocol stream”?

What does the action “drop packet” instruct the sensor to do?

What is “a signature or protocol anomaly combined with context information”?

Exhibit:

In order to obtain attack information so that you can create a new attack object definition, you must
follow certain steps. Given the steps displayed in the exhibit, assume you have acquired a packet
capture of the attack.
What is the correct order for these steps?

You want Enterprise Security Profiler (ESP) to generate a message when a new host is detected on a
network. Which two steps must you perform? (Choose two.)

Exhibit:

You work as an administrator at Certkiller .com. Study the exhibit carefully. In the exhibit, which SYN
protector mode is the IDP using?

How can you monitor real-time IP flows through the IDP sensor?