Question 1

The normalization value assigned to each data-source event allows

Accepted Answer

A)   increased usability via views based on category rather than signature ID.
B)   more efficient parsing of each event by the McAfee SIEM Receiver.
C)   quicker ELM searches.
D)   the McAfee ESM database to retain fewer events overall.

Question 2

A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur

Accepted Answer

A)   when no one is logged in; for example, after hours or on weekends.
B)   across an unusual range of ports or destinations; for example, all high ports.
C)   irregularly; for example, only on Fridays, or only at end-of-quarter.
D)   in accordance with expected systems use.

Question 3

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

Accepted Answer

A)   NOR and AND
B)   AND and SET
C)   OR and SET
D)   OR and AND

Question 4

Which options within the Receiver properties should be selected to configure the device to respond to ICMP echo requests?

Accepted Answer

A)   Receiver Management\Update Device
B)   Receiver Configuration\Interface
C)   Connection\Status
D)   Key Management\ Key Device

Question 5

The historical ACE function allows the user to perform retrospective correlations on older data. In which of the following devices is the data located that the historical correlation engine uses?

Accepted Answer

A)   ELM
B)   REC
C)   ADM
D)   ESM

Question 6

A McAfee Event Receiver (ERC)  will allow for how many Correlation Data Sources to be configured?

Accepted Answer

A)   1
B)   3
C)   5
D)   10

Question 7

By default, the McAfee Enterprise Security Manager (ESM)  communicates with the McAfee Event Receiver (ERC)  and McAfee Enterprise Log Manager (ELM)  over port

Accepted Answer

A)   21.
B)   443.
C)   22.
D)   23.

Question 8

In the context of McAfee SIEM, the local protected network address space is a variable referred to as

Accepted Answer

A)   TRUSTED_NET
B)   INTERNAL_NET
C)   EXTERNAL_NET
D)   HOME_NET

Question 9

The fundamental purpose of the Receiver Correlation Subsystem (RCS)  is

Accepted Answer

A)   to analyze data from the ESM and detect matching patterns.
B)   to collect and consolidate identical data from the ESM into a single summary event.
C)   to classify or categorize data from the Receiver into related types and sub-types.
D)   to organize, retrieve and archive data from the Receiver into the SIEM database.

Question 10

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the following watchlists in the McAfee SIEM?

Accepted Answer

A)   MTIE Suspicious and Malicious
B)   TSI Suspicious and Malicious
C)   GTI Suspicious and Malicious
D)   MTI Suspicious and Malicious

Question 11

The security Analyst notices that there has been a large spike for Secure Shell (SSH)  drops in the Network Intrusion Prevention System (NIPS) . What other perimeter device will add more insight into what is happening?

Accepted Answer

A)   McAfee ePlocy Orchestrator (ePO) 
B)   The core switch
C)   The external switch
D)   The firewall

Question 12

Which of the following is the Primary function of the Event Receiver (ERC)  in relation to the Enterprise Security Manager (ESM) ?

Accepted Answer

A)   Collect and parse events before the ESM pulls them form the ERC
B)   Collect and parse the events before the receiver forwards them to the ESM
C)   Collect and store the events before they are forwarded to the ESM for parsing
D)   Collect and parse the events before forwarding them to the ELM

Question 13

The fundamental purpose of the Receiver Correlation Subsystem (RCS)  is

Accepted Answer

A)   to analyze data from the ESM and detect matching patterns.
B)   to collect and consolidate identical data from the ESM into a single summary event.
C)   to classify or categorize data from the Receiver into related types and sub-types.
D)   to organize, retrieve and archive data from the Receiver into the SIEM database.

Question 14

If the SIEM Administrator deploys the Enterprise Security Manager (ESM)  using the Federal Information Processing Standards (FIPS)  encryption mode, which of the following types of user authentication will NOT be compliant with FIPS?

Accepted Answer

A)   Windows Active Directory
B)   Radius
C)   Lightweight Directory Access Protocol (LDAP) 
D)   Local Authentication

Question 15

The security Analyst notices that there has been a large spike for Secure Shell (SSH)  drops in the Network Intrusion Prevention System (NIPS) . What other perimeter device will add more insight into what is happening?

Accepted Answer

A)   McAfee ePlocy Orchestrator (ePO) 
B)   The core switch
C)   The external switch
D)   The firewall

Question 16

On the McAfee enterprise Security Manager (ESM) , the default data Retention setting specifies that Event and Flow data should be maintained for

Accepted Answer

A)   365 days.
B)   same value as configured on the ELM.
C)   90 Days.
D)   all data allowed by system.

Question 17

The McAfee SIEM baselines daily events over

Accepted Answer

A)   three days
B)   five days
C)   seven days
D)   nine days

Question 18

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM)  as a virtual machine?

Accepted Answer

A)   100 GB
B)   250 GB
C)   500 GB
D)   1 TB

Question 19

Which authentication methods can be configured to control alarm management privileges?

Accepted Answer

A)   SNMP
B)   SSH Key Pair
C)   Active Directory
D)   Access Groups

Question 20

Which of the following is the name of the Dashboard View that shows correlated events for the selected Data Source?

Accepted Answer

A)   Default Summary
B)   Normalized Dashboard
C)   Incidents Dashboard
D)   Triggered Alarms

Exam 3: Intel Security Certified Product Specialist

The historical ACE function allows the user to perform retrospective correlations on older data. In which of the following devices is the data located that the historical correlation engine uses?

Correct AnswerverifiedShow Answer

The normalization value assigned to each data-source event allows

Correct AnswerverifiedShow Answer

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

Correct AnswerverifiedShow Answer

The McAfee SIEM baselines daily events over

Correct AnswerverifiedShow Answer

On the McAfee enterprise Security Manager (ESM) , the default data Retention setting specifies that Event and Flow data should be maintained for

Correct AnswerverifiedShow Answer

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

Correct AnswerverifiedShow Answer

Which options within the Receiver properties should be selected to configure the device to respond to ICMP echo requests?

Correct AnswerverifiedShow Answer

In the context of McAfee SIEM, the local protected network address space is a variable referred to as

Correct AnswerverifiedShow Answer

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the following watchlists in the McAfee SIEM?

Correct AnswerverifiedShow Answer

The fundamental purpose of the Receiver Correlation Subsystem (RCS) is

Correct AnswerverifiedShow Answer

By default, the McAfee Enterprise Security Manager (ESM) communicates with the McAfee Event Receiver (ERC) and McAfee Enterprise Log Manager (ELM) over port

Correct AnswerverifiedShow Answer

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS) . What other perimeter device will add more insight into what is happening?

Correct AnswerverifiedShow Answer

Which of the following is the name of the Dashboard View that shows correlated events for the selected Data Source?

Correct AnswerverifiedShow Answer

The fundamental purpose of the Receiver Correlation Subsystem (RCS) is

Correct AnswerverifiedShow Answer

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS) . What other perimeter device will add more insight into what is happening?

Correct AnswerverifiedShow Answer

A McAfee Event Receiver (ERC) will allow for how many Correlation Data Sources to be configured?

Correct AnswerverifiedShow Answer

Which of the following is the Primary function of the Event Receiver (ERC) in relation to the Enterprise Security Manager (ESM) ?

Correct AnswerverifiedShow Answer

If the SIEM Administrator deploys the Enterprise Security Manager (ESM) using the Federal Information Processing Standards (FIPS) encryption mode, which of the following types of user authentication will NOT be compliant with FIPS?

Correct AnswerverifiedShow Answer

Which authentication methods can be configured to control alarm management privileges?

Correct AnswerverifiedShow Answer

A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified