Free 500-280 Questions for Cisco Securing Cisco Networks with Open Source Snort 500-280 Exam as PDF & Practice Test Engine

Exam Code/Number: 500-280
Exam Name/Title: Securing Cisco Networks with Open Source Snort
Certification Provider: Cisco
Corresponding Certification: Additional Online Exams for Validating Knowledge

Exam Questions: 60
Updated On: Jul 20, 2026

Question #1

Which keyword can you use to check a packet IP header TTL value?

A. tos

B. byte_test

C. ipopts

D. ttl

Discussion 0

Correct Answer: D Vote an answer

Question #2

Which command-line argument can you use with Snort to produce a binary output file?

A. -U

B. -B

C. -b

D. -u

Discussion 0

Correct Answer: C Vote an answer

Question #3

Barnyard has a mode of operation that reads the most current unified log file and processes new unified files as they become available. What is this mode called?

A. unified

B. continual

C. one-shot

D. continual with checkpoint

Discussion 0

Correct Answer: B Vote an answer

Question #4

An IPS addresses evasion by implementing countermeasures. What is one such countermeasure?

A. send packets to the origination host of a given communication session, to confirm or eliminate spoofing

B. automate scans of suspicious source IP addresses

C. periodically reset statistical buckets to zero for memory utilization, maximization, and performance

D. perform pattern and signature analysis against the entire packet, rather than against individual fragments

Discussion 0

Correct Answer: D Vote an answer

Question #5

What must you do to produce ASCII-formatted output from Snort?

A. Do nothing because Snort produces ASCII output by default.

B. Use a third-party application to convert native Snort output to ASCII.

C. Use the -K ascii switch when you start Snort from the command line.

D. Compile Snort with the -K ascii flag in the configure command.

Discussion 0

Correct Answer: C Vote an answer

Question #6

Which statement about the detection engine configuration settings in snort.conf is true?

A. Some decoder settings are on and others must be uncommented.

B. The decoder is no longer in use.

C. All the decoder alerts are on by default.

D. All the decoder settings are off by default.

Discussion 0

Correct Answer: D Vote an answer

Free 500-280 Questions for Cisco Securing Cisco Networks with Open Source Snort 500-280 Exam as PDF & Practice Test Engine

Download Free Cisco 500-280 Demo