|
Question 1.
What field in the Message Record contains the pattern that is matched against the Event Console Messages?
A. Description Field
B. Message ID
C. Sequence Number
D. Token Number
Answer: B
Question 2.
Workload Management can submit jobs to:
A. Servers that have Workload Agent installed
B. Servers that have Workload Agent installed and are defined as Stations by the Workload
Manager
C. Any Unicenter Server
D. Servers that have Workload Server installed and are defined as Stations by the Workload
Agent
Answer: B
Question 3.
SNMP relies on which transport from the TCP/IP protocol suite?
A. FTP
B. HTTP
C. TCP
D. UDP
Answer: D
Question 4.
The Unicenter 2D and 3D Maps visually represent system, database, and application resources. They are in which component of the World View Layer?
A. Common Object Repository
B. Real World Interface
C. World View Application Programming Interface
D. World View Gateway
Answer: B
Question 5.
What Unicenter NSM Classic tool is used to customize Classes in the COR?
A. Node view
B. Class Wizard
C. DSM Wizard
D. Object View
Answer: B
Question 6.
Communication between the SNMP Administrator and Agents is routed through which component?
A. Common Object Repository
B. Distributed Services Bus
C. Distributed State Machine
D. Finite State Machine
Answer: B
Question 7.
What must be installed before World View that includes a local repository?
A. Agent components
B. DSM components
C. Microsoft SQL Client
D. Microsoft SQL Server
Answer: D
Question 8.
What are the three conceptual layers within Unicenter NSM? (Choose three.)
A. Agent Technology Layer
B. Application Management Layer
C. Manager Layer
D. Internet Control Layer
E. Network Management Layer
F. World View Layer
Answer: A, C, F
Question 9.
When installing Microsoft SQL Server in a Unicenter NSM environment, what network protocol must be installed for a routed environment?
A. Banyan VINES
B. Named Pipe only
C. NW Link IPX/SPX
D. TCP/IP Sockets
Answer: D
Question 10.
CCI provides communication between which Unicenter NSM components?
A. Agent Technologies Components
B. Enterprise Management Components
C. Unicenter Agents
D. World View Gateway and the Common Object Repository
Answer: B
Question 11.
Which of the following are valid Station types? (Choose three.)
A. CPU
B. CPUTNG
C. POSTCPU
D. PRECPU
Answer: A, C, D
Question 12.
What is the default Calendar provided by Unicenter NSM?
A. Standard
B. Default
C. MAIN
D. BASE
Answer: D
Question 13.
Which Left Pane option is used to create a new Calendar inside the Unicenter Explorer?
A. Topology
B. Tools
C. Properties
D. Enterprise Management
Answer: D
Question 14.
When creating a new Calendar within the Unicenter Explorer, what is the default
Time increment?
A. 5 Minutes
B. 15 Minutes
C. 10 Minutes
D. 12 Minutes
Answer: B
Question 15.
To access a remote enterprise manager through the Unicenter explorer the user must specify what type of User id?
A. The MS SQL server system administrator user id, 'sa'
B. The COR user id and password
C. An operating system user id that allows login to the remote system.
D. The caunint user id.
Answer: C
Question 16.
All message records and message actions are stored in the Event Management database. When you add, modify, or delete message records and message actions, you are not changing active policy; you are simply updating the database.
What is the default logical name for this database?
A. caioprdb
B. caioprlog
C. caoprdmn process
D. opreload
Answer: A
Question 17.
The opreload process reads the policy stored in the Event Management database and creates two copies of the Decision Support Binary. One is placed in memory and the other is stored on the disk.
What is the default name of the DSB copy stored on the disk?
A. caioprdb
B. caopr.dsb
C. caoprdmn process
D. caoprlog process
Answer: B
Question 18.
What are the Message Records and Action policies referred to after they are loaded into physical memory?
A. Common Object Repository
B. Decision Support Binary
C. Distributed Services Bus
D. Event Console
Answer: B
Question 19.
What command directs Event Management to refresh the active Message Record and Message Action lists immediately with the definitions stored in the Event Management database?
A. cawto
B. clean_sadmin
C. opreload
D. resetdsm
Answer: C
Question 20.
What component is selected to install the Report Builder and Report Administrator?
A. Unicenter Explorer
B. Performance Management
C. Unicenter Reports
D. Software Development Kit
Answer: C
|
Question 1. Which of the following should a computer forensics lab used for investigations have? A. isolation B. restricted access C. open access D. an entry log Answer: B Question 2. Corporate investigations are typically easier than public investigations because: A. the users have standard corporate equipment and software B. the investigator does not have to get a warrant C. the investigator has to get a warrant D. the users can load whatever they want on their machines Answer: B Question 3. If you discover a criminal act while investigating a corporate policy abuse, it becomes a public sector investigation and should be referred to law enforcement? A. true B. false Answer: A Question 4. If a suspect computer is located in an area that may have toxic chemicals, you must: A. coordinate with the HAZMAT team B. determine a way to obtain the suspect computer C. assume the suspect machine is contaminated D. do not enter alone Answer: A Question 5. You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors? A. 0:1000, 150 B. 0:1709, 150 C. 1:1709, 150 D. 0:1709-1858 Answer: B Question 6. What does the superblock in Linux define? A. file system names B. available space C. location of the first inode D. disk geometry Answer: B, C, D Question 7. A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker . Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt. (Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.) 03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84 Len: 64 01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ................ 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 ................ 00 00 00 11 00 00 00 00 ........ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104 Len: 1084 47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8 G..c............ 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 20 ............... 3A B1 5E E5 00 00 00 09 6C 6F 63 61 6C 68 6F 73 :.^.....localhost =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= + 03/15-20:21:36.539731 211.185.125.124:4450 -> 172.16.1.108:39168 TCP TTL:43 TOS:0x0 ID:31660 IpLen:20 DgmLen:71 DF ***AP*** Seq: 0x9C6D2BFF Ack: 0x59606333 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23679878 2880015 63 64 20 2F 3B 20 75 6E 61 6D 65 20 2D 61 3B 20 cd /; uname -a; 69 64 3B id; A. The attacker has conducted a network sweep on port 111 B. The attacker has scanned and exploited the system using Buffer Overflow C. The attacker has used a Trojan on port 32773 D. The attacker has installed a backdoor Answer: A Question 8. The newer Macintosh Operating System is based on: A. OS/2 B. BSD Unix C. Linux D. Microsoft Windows Answer: B Question 9. Before you are called to testify as an expert, what must an attorney do first? A. engage in damage control B. prove that the tools you used to conduct your examination are perfect C. read your curriculum vitae to the jury D. qualify you as an expert witness Answer: D Question 10. You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network? A. create a compressed copy of the file with DoubleSpace B. create a sparse data copy of a folder or file C. make a bit-stream disk-to-image fileC D. make a bit-stream disk-to-disk file Answer: C
Copyright © 2004 CertsBraindumps.com Inc. All rights reserved.