exam 200 301

exam 200 301.c. NetFlow data d. Personal firewalls10. what useful reports related to endpoints can be collected from CiscoISE? (select all correct answers)a. Web server log reports b. Application ranking reportsc. RADIUS authentication reports d. Administrator login reports11.2 Cyber Insight TechniquesInsight into the network and analysis of data from the network can be used to determine if a network security incident has occurred. This section will describe the various insight techniques that can be used within a network and how such data can be captured. Even small networks can generate large amounts of data. That is why it is important to have the proper tools to analyze such data.11.2.1 Network Infrastructure Logs,When proactively detecting or responding to security incidents, knowledge of the network conditions and timely access to logs generated by network infrastructure devices (e.g., firewalls, routers, and switches) may be of great help. For example, in the case of a brute-force attack against a router, switch, or firewall, a review of the syslog messages can reveal such malicious behavior. Log collection systems typically have log correlation capabilities, and correlating Syslog events can help identify intrusions.Syslog messages generated by network devices provide insight into security events that may not be available through other channels. Syslog messages are useful for determining the validity and scope of a security incident.396 Chapter 11 Network and Host Insight Techniqueshelp. Through Syslog messages, it is possible to understand communication relationships, timeliness, and in some cases, the motivation of the attacker and the tools they used. These events should be considered complementary and used in conjunction with other forms of network monitoring that are already in place. Table 11.2 shows a breakdown of the significance of the Syslog messages generated by the CiscoASA, CiscoIOS, CiscoIOS-XE.CiscoIOS-XR, and CiscoNX-OS devices and the corresponding codes.