Exam 3: Intel Security Certified Product Specialist

Which of the following is the default port used to communicate between McAfee SIEM devices?

Which of the following are the three compression ratios available for raw logs being handled by the ELM?

The ESM database is unavailable for use during

The configuration of a receiver has recently been modified and issues occur. Which command will collect historical data?

Reports can be created by selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen or by which of the following other methods within Alarm Creation?

Checkpoint firewalls provide logs to the McAfee SIEM Receiver in which of the following formats?

McAfee's SIEM provides awareness of illicit behavior across multiple internal systems via

When displaying baseline averages using the automatic time range option, baseline data is correlated by using the same time period that is being used for the current query for which of the following past number of intervals?

The McAfee SIEM baselines daily events over

The possibility of both data source Network Interface Cards (NICs) using the shared IP and MAC address at the same time is eliminated by using which of the following?

When a Correlation Rule successfully triggers, this occurs at the

Which of the following operations is NOT an available selection when using Multi-Device Management?

The analyst has created a correlation rule to correlate events from Anti-Virus (AV), Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?

How often does the configuration and policy data from the primary Enterprise Security Manager (ESM) get synchronized with the redundant ESM?

If there is no firewall at the border of the network, which of the following could be used to simulate the protection a firewall provides?

A security administrator is configuring the Enterprise Security Manager (ESM) to comply with corporate security policy and wishes to restrict access to the ESM to certain users and machines. Which of the following actions would accomplish this?

When writing custom correlation rules, the analyst should focus on

Which of the following statements about Client Data Sources is TRUE?

Which of the following are the three compression ratios available for raw logs being handled by the ELM?

Which of the following two appliances contain Event databases?