Question 1

A Reconnaissance Policy can be applied to which of the following?

Accepted Answer

A)  Sensors 
B)  Sensor Ports 
C)  Sensors and sensor ports 
D)  Specific Hosts 
A)  Sensors 
B)  Sensor Ports 
C)  Sensors and sensor ports 
D)  Specific Hosts

Question 2

Which attack cannot be blocked when the sensor has been set for in-line mode?

Accepted Answer

A)  TCP Control Anomaly 
B)  ICMP Echo Anomaly 
C)  Too Many Inbound Syn 
D)  SCADA Attacks 
A)  TCP Control Anomaly 
B)  ICMP Echo Anomaly 
C)  Too Many Inbound Syn 
D)  SCADA Attacks

Question 3

Which of the following activities require a reboot of a sensor? (Choose three)

Accepted Answer

A)  Enabling/Disabling SSL 
B)  Enabling/Disabling parsing and detection of attacks in IPv4 traffic 
C)  Enabling/Disabling parsing and detection of attacks in IPv6 traffic 
D)  Sensor software upgrade 
E)  Signature update 
A)  Enabling/Disabling SSL 
B)  Enabling/Disabling parsing and detection of attacks in IPv4 traffic 
C)  Enabling/Disabling parsing and detection of attacks in IPv6 traffic 
D)  Sensor software upgrade 
E)  Signature update

Question 4

Which port needs to be opened for install Channel communication between Sensor and Manager through a firewall?

Accepted Answer

A)  8501 
B)  8502 
C)  8503 
D)  8555 
A)  8501 
B)  8502 
C)  8503 
D)  8555

Question 5

A sensor is placed in-line and is dropping traffic. This situation demands an immediate removal of the sensor from the network to let traffic flow uninterrupted. Which option will you use to verify whether the issue is due to sensor configuration or network congestion?

Accepted Answer

A)  Layer2modeon 
B)  Layer2 mode assert 
C)  Layer2 mode deassert 
D)  Layer2 mode off 
A)  Layer2modeon 
B)  Layer2 mode assert 
C)  Layer2 mode deassert 
D)  Layer2 mode off

Question 6

Which of the following are the methods used by NSP to recognize and react to Denial-of-Service (DoS) attacks? (Choose three)

Accepted Answer

A)  Blocking 
B)  Shutting down the sensor 
C)  Thresholds 
D)  Self-learning 
E)  Logging
F) DDoS attack tool with exploit signatures 
A)  Blocking 
B)  Shutting down the sensor 
C)  Thresholds 
D)  Self-learning 
E)  Logging
F) DDoS attack tool with exploit signatures

Question 7

Which of the following modes can be used to implement DoS detection? (Choose two)

Accepted Answer

A)  Learning Mode 
B)  Threshold Mode 
C)  Configuration Mode 
D)  Adaptive Mode 
E)  Transition Mode 
A)  Learning Mode 
B)  Threshold Mode 
C)  Configuration Mode 
D)  Adaptive Mode 
E)  Transition Mode

Question 8

How are packet logs viewed from within the Manager?

Accepted Answer

A)  Push the packet log to the Sensor and open it from there 
B)  Packet logs cannot be viewed from within the Manager 
C)  Save and export the Packet log in order to open it 
D)  Set the log to be viewable with Wireshark/Ethereal 
A)  Push the packet log to the Sensor and open it from there 
B)  Packet logs cannot be viewed from within the Manager 
C)  Save and export the Packet log in order to open it 
D)  Set the log to be viewable with Wireshark/Ethereal

Question 9

Setting a threshold on a sensor to react if traffic volume exceeds the threshold limit is an example of what specific detection method?

Accepted Answer

A)  Signature based 
B)  DHCP based 
C)  Pattern matching 
D)  Denial of Service (DoS) 
A)  Signature based 
B)  DHCP based 
C)  Pattern matching 
D)  Denial of Service (DoS)

Question 10

Which CLI command is used to copy sensor SSL certificates from external flash when replacing a failed sensor?

Accepted Answer

A)  Exportsensorcerts 
B)  Importsensorcerts 
C)  Exportcerts 
D)  Importcerts 
A)  Exportsensorcerts 
B)  Importsensorcerts 
C)  Exportcerts 
D)  Importcerts

Question 11

Why is the DBAdmin tool considered a preferred method of performing system maintenance tasks that could be performed within the Manager?

Accepted Answer

A)  Saves additional workload on the Manager 
B)  Reliability 
C)  Speed 
D)  Ease of use 
A)  Saves additional workload on the Manager 
B)  Reliability 
C)  Speed 
D)  Ease of use

Question 12

Which is the correct syntax for the 'set dosprevenbonseverity' command?

Accepted Answer

A)  Set dospreventionseveriry tcp-rst 150 
B)  Set dospreventionseverity icmp-echo-reply enable 150 
C)  Set dospreventionseverity tcp-syn inbound 150 
D)  Set dosprevenbonseverity ip-fragment inbound 
A)  Set dospreventionseveriry tcp-rst 150 
B)  Set dospreventionseverity icmp-echo-reply enable 150 
C)  Set dospreventionseverity tcp-syn inbound 150 
D)  Set dosprevenbonseverity ip-fragment inbound

Question 13

Which policy is assigned to a child domain by default?

Accepted Answer

A)  The default IDS policy 
B)  The default IPS policy 
C)  No default policy 
D)  The policy of the parent domain 
A)  The default IDS policy 
B)  The default IPS policy 
C)  No default policy 
D)  The policy of the parent domain

Question 14

A Sensor allows the option of Layer2 forwarding for which of the following?

Accepted Answer

A)  TCP and UDP ports only 
B)  UDP ports and VLAN interfaces only 
C)  TCP ports and VLAN interfaces only 
D)  TCP ports, UDP ports and VLAN interfaces 
A)  TCP and UDP ports only 
B)  UDP ports and VLAN interfaces only 
C)  TCP ports and VLAN interfaces only 
D)  TCP ports, UDP ports and VLAN interfaces

Question 15

Which command can be issued on a Sensor to check the health of the Sensor?

Accepted Answer

A)  show 
B)  show settings 
C)  status 
D)  check health 
A)  show 
B)  show settings 
C)  status 
D)  check health

Question 16

_____________________are a set of Access Control List (ACL) rules that define network access provided to a host, subject to Network Access Control.

Accepted Answer

A)  Network Access Lists 
B)  Network Access Objects 
C)  Network Access Zones 
D)  Network Access Policy 
A)  Network Access Lists 
B)  Network Access Objects 
C)  Network Access Zones 
D)  Network Access Policy

Question 17

________________allows a host to be subjected to both DHCP based NAC and Identity Based Access Control when configured on different ports.

Accepted Answer

A)  Integrated NAC 
B)  DHCP based NAC 
C)  Hybrid NAC 
D)  Health based NAC 
A)  Integrated NAC 
B)  DHCP based NAC 
C)  Hybrid NAC 
D)  Health based NAC

Question 18

Which logs are used to determine who was logged into the Manager the last time a signature set update was pushed from the Manager to the Sensor?

Accepted Answer

A)  Trace log 
B)  Fault log 
C)  Manager ems log 
D)  User Activity Audit log 
A)  Trace log 
B)  Fault log 
C)  Manager ems log 
D)  User Activity Audit log

Question 19

Which domains does a Super User have full rights to access?

Accepted Answer

A)  Super Users have full rights to all domains 
B)  Super Users have full rights to only the domains in which they reside 
C)  Super Users have full rights to only sensor configuration 
D)  Super Users have full rights to only Parent domains 
A)  Super Users have full rights to all domains 
B)  Super Users have full rights to only the domains in which they reside 
C)  Super Users have full rights to only sensor configuration 
D)  Super Users have full rights to only Parent domains

Question 20

Reconnaissance Policies can be applied to which of the following sensor nodes?

Accepted Answer

A)  Sensor name node only 
B)  Sensor interface node only 
C)  Sensor sub-interface node only 
D)  Sensor name, interface and sub-interface node 
A)  Sensor name node only 
B)  Sensor interface node only 
C)  Sensor sub-interface node only 
D)  Sensor name, interface and sub-interface node

A Reconnaissance Policy can be applied to which of the following?

Which attack cannot be blocked when the sensor has been set for in-line mode?

Which of the following activities require a reboot of a sensor? (Choose three)

Which port needs to be opened for install Channel communication between Sensor and Manager through a firewall?

A sensor is placed in-line and is dropping traffic. This situation demands an immediate removal of the sensor from the network to let traffic flow uninterrupted. Which option will you use to verify whether the issue is due to sensor configuration or network congestion?

Which of the following are the methods used by NSP to recognize and react to Denial-of-Service (DoS) attacks? (Choose three)

Which of the following modes can be used to implement DoS detection? (Choose two)

How are packet logs viewed from within the Manager?

Setting a threshold on a sensor to react if traffic volume exceeds the threshold limit is an example of what specific detection method?

Which CLI command is used to copy sensor SSL certificates from external flash when replacing a failed sensor?

Why is the DBAdmin tool considered a preferred method of performing system maintenance tasks that could be performed within the Manager?

Which is the correct syntax for the 'set dosprevenbonseverity' command?

Which policy is assigned to a child domain by default?

A Sensor allows the option of Layer2 forwarding for which of the following?

Which command can be issued on a Sensor to check the health of the Sensor?

_____________________are a set of Access Control List (ACL) rules that define network access provided to a host, subject to Network Access Control.

________________allows a host to be subjected to both DHCP based NAC and Identity Based Access Control when configured on different ports.

Which logs are used to determine who was logged into the Manager the last time a signature set update was pushed from the Manager to the Sensor?

Which domains does a Super User have full rights to access?

Reconnaissance Policies can be applied to which of the following sensor nodes?

Certified McAfee Security Specialist - Epo

Intel Security Certified Product Specialist

Filters

Exam 2: Certified McAfee Security Specialist - NSP

A Reconnaissance Policy can be applied to which of the following?

Which attack cannot be blocked when the sensor has been set for in-line mode?

Which of the following activities require a reboot of a sensor? (Choose three)

Which port needs to be opened for install Channel communication between Sensor and Manager through a firewall?

A sensor is placed in-line and is dropping traffic. This situation demands an immediate removal of the sensor from the network to let traffic flow uninterrupted. Which option will you use to verify whether the issue is due to sensor configuration or network congestion?

Which of the following are the methods used by NSP to recognize and react to Denial-of-Service (DoS) attacks? (Choose three)

Which of the following modes can be used to implement DoS detection? (Choose two)

How are packet logs viewed from within the Manager?

Setting a threshold on a sensor to react if traffic volume exceeds the threshold limit is an example of what specific detection method?

Which CLI command is used to copy sensor SSL certificates from external flash when replacing a failed sensor?

Why is the DBAdmin tool considered a preferred method of performing system maintenance tasks that could be performed within the Manager?

Which is the correct syntax for the 'set dosprevenbonseverity' command?

Which policy is assigned to a child domain by default?

A Sensor allows the option of Layer2 forwarding for which of the following?

Which command can be issued on a Sensor to check the health of the Sensor?

_____________________are a set of Access Control List (ACL) rules that define network access provided to a host, subject to Network Access Control.

________________allows a host to be subjected to both DHCP based NAC and Identity Based Access Control when configured on different ports.

Which logs are used to determine who was logged into the Manager the last time a signature set update was pushed from the Manager to the Sensor?

Which domains does a Super User have full rights to access?

Reconnaissance Policies can be applied to which of the following sensor nodes?

Certified McAfee Security Specialist - Epo

Intel Security Certified Product Specialist

Filters