Exam 3: Intel Security Certified Product Specialist

If the SIEM Administrator deploys the Enterprise Security Manager (ESM) using the Federal Information Processing Standards (FIPS) encryption mode, which of the following types of user authentication will NOT be compliant with FIPS?

(Multiple Choice)

4.8/5

(68)

Question 21

The fundamental purpose of the Receiver Correlation Subsystem (RCS) is

(Multiple Choice)

4.9/5

(85)

Question 22

The fundamental purpose of the Receiver Correlation Subsystem (RCS) is

(Multiple Choice)

4.7/5

(79)

Question 23

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

(Multiple Choice)

4.9/5

(94)

Question 24

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS). What other perimeter device will add more insight into what is happening?

(Multiple Choice)

4.7/5

(79)

Question 25

By default, the McAfee Enterprise Security Manager (ESM) communicates with the McAfee Event Receiver (ERC) and McAfee Enterprise Log Manager (ELM) over port

(Multiple Choice)

5.0/5

(72)

Question 26

Which of the following is the Primary function of the Event Receiver (ERC) in relation to the Enterprise Security Manager (ESM)?

(Multiple Choice)

4.7/5

(82)

Question 27

The normalization value assigned to each data-source event allows

(Multiple Choice)

4.8/5

(85)

Question 28

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS). What other perimeter device will add more insight into what is happening?

(Multiple Choice)

5.0/5

(82)

Question 29

A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur

(Multiple Choice)

4.8/5

(81)

Question 30

Which authentication methods can be configured to control alarm management privileges?

(Multiple Choice)

4.9/5

(88)

Question 31

A McAfee Event Receiver (ERC) will allow for how many Correlation Data Sources to be configured?

(Multiple Choice)

4.9/5

(83)

Question 32

The historical ACE function allows the user to perform retrospective correlations on older data. In which of the following devices is the data located that the historical correlation engine uses?

(Multiple Choice)

4.8/5

(72)

Question 33

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the following watchlists in the McAfee SIEM?

(Multiple Choice)

4.9/5

(86)

Question 34

The McAfee SIEM baselines daily events over

(Multiple Choice)

4.9/5

(79)

Question 35

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

(Multiple Choice)

4.8/5

(96)

Question 36

In the context of McAfee SIEM, the local protected network address space is a variable referred to as

(Multiple Choice)

4.8/5

(76)

Question 37

Which of the following is the name of the Dashboard View that shows correlated events for the selected Data Source?

(Multiple Choice)

4.7/5

(75)

Question 38

Which options within the Receiver properties should be selected to configure the device to respond to ICMP echo requests?

(Multiple Choice)

4.8/5

(73)

Question 39

On the McAfee enterprise Security Manager (ESM), the default data Retention setting specifies that Event and Flow data should be maintained for

(Multiple Choice)

4.8/5

(85)

Question 40

Showing 21 - 40 of 85

If the SIEM Administrator deploys the Enterprise Security Manager (ESM) using the Federal Information Processing Standards (FIPS) encryption mode, which of the following types of user authentication will NOT be compliant with FIPS?

The fundamental purpose of the Receiver Correlation Subsystem (RCS) is

The fundamental purpose of the Receiver Correlation Subsystem (RCS) is

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS). What other perimeter device will add more insight into what is happening?

By default, the McAfee Enterprise Security Manager (ESM) communicates with the McAfee Event Receiver (ERC) and McAfee Enterprise Log Manager (ELM) over port

Which of the following is the Primary function of the Event Receiver (ERC) in relation to the Enterprise Security Manager (ESM)?

The normalization value assigned to each data-source event allows

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS). What other perimeter device will add more insight into what is happening?

A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur

Which authentication methods can be configured to control alarm management privileges?

A McAfee Event Receiver (ERC) will allow for how many Correlation Data Sources to be configured?

The historical ACE function allows the user to perform retrospective correlations on older data. In which of the following devices is the data located that the historical correlation engine uses?

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the following watchlists in the McAfee SIEM?

The McAfee SIEM baselines daily events over

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

In the context of McAfee SIEM, the local protected network address space is a variable referred to as

Which of the following is the name of the Dashboard View that shows correlated events for the selected Data Source?

Which options within the Receiver properties should be selected to configure the device to respond to ICMP echo requests?

On the McAfee enterprise Security Manager (ESM), the default data Retention setting specifies that Event and Flow data should be maintained for

Certified McAfee Security Specialist - Epo

Certified McAfee Security Specialist - NSP

Filters