The questions that follow give you a bigger challenge than the exam itself by using an open-ended question format. By reviewing now with this more difficult question format, you can exercise your memory better and prove your conceptual and factual knowledge of this chapter. The answers to these questions are found in the appendix.
For more practice with exam-like question formats, use the exam engine on the CD-ROM.
1.
What are the major groups that signature parameters fall into?
2.
What do the Application Inspection and Control (AIC) signature engines provide, and which protocols are currently supported?
3.
What signature types can you use for AIC HTTP signatures?
4.
What are the atomic signature engines and the types of signatures they support?
5.
What is the definition of an atomic signature?
6.
What is the difference between the TCP Mask and TCP Flags parameters?
7.
Which parameter do you use to specify that a regex string needs to be located at an exact location within the packet or stream?
8.
Which Flood Net parameter defines how long the traffic must remain above the configured rate in order to trigger the signature?
9.
What is a meta signatures?
10.
What are the three inspection types available when you are creating signatures with the Service FTP signature engine?
11.
What are the three inspection types available when you are creating signatures with the Service NTP signature engine?
12.
What are the four inspection types available when you are creating signatures with the Service SNMP signature engine?
13.
Cisco IPS supports what three state machines in the State signature engine?
14.
What are the three String signature engines?
15.
Which parameter determines how many connections it takes for a sweep signature to trigger?
