Exam 3: Intel Security Certified Product Specialist

Malware performing a network enumeration scan will be visible at the McAfee SIEM as

Where can the ESM event database archive inactive partitions?

Which of the following features of the Enterprise Log Manager (ELM) can alert the user if any data has been modified?

When a Correlation Rule successfully triggers, this occurs at the

Which of the following is the minimum number of CPUs required to build a virtual image Enterprise Security Manager (ESM)?

Alarms using field match as the condition type allow for selected Actions to be taken when the Alarm condition is met. Which of the following McAfee ePolicy Orchestrator (ePO) Actions can be selected when creating such Alarm?

Which of the following are the three default users defined within the Users and Groups option in the ESM properties?

The McAfee SIEM solution satisfies which of the following compliance requirements?

If the SIEM Administrator deploys the Enterprise Security Manager (ESM) using the Federal Information Processing Standards (FIPS) encryption mode, which of the following types of user authentication will NOT be compliant with FIPS?  

Alarms using field match as the condition type allow for selected Actions to be taken when the Alarm condition is met. Which of the following McAfee ePolicy Orchestrator (ePO) Actions can be selected when creating such Alarm?

The possibility of both data source Network Interface Cards (NICs) using the shared IP and MAC address at the same time is eliminated by using which of the following?

A security administrator is configuring the Enterprise Security Manager (ESM) to comply with corporate security policy and wishes to restrict access to the ESM to certain users and machines. Which of the following actions would accomplish this?

When the automated system backup is configured to include events, flows and log data, the first backup will capture all events, flows and logs

Which of the following is the default port used to communicate between McAfee SIEM devices?

A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur

The McAfee Enterprise Log Manager (ELM) offers three levels of compression (Low, Medium, and High). By default, the ELM compression level is set to Low. Which of the following is the compression ratio for the Medium level?

Reports can be created by selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen or by which of the following other methods within Alarm Creation?

The configuration of a receiver has recently been modified and issues occur. Which command will collect historical data?

The primary function of the Application Data Monitor (ADM) appliance is to decode traffic at layer

By default, the McAfee Enterprise Security Manager (ESM) communicates with the McAfee Event Receiver (ERC) and McAfee Enterprise Log Manager (ELM) over port