Question 1

Which of the following features of the Enterprise Log Manager (ELM) can alert the user if any data has been modified?

Accepted Answer

A)   Integrity Check
B)   SNMP Trap
C)   Log Audit
D)   ELM Database Check A

Question 2

An organization notices an increasing number of ESM concurrent connection events. To mitigate risks related to concurrent sessions which action should the organization take?

Accepted Answer

A)   Increase the concurrent session alarm threshold
B)   Decrease the console timeout value
C)   Increase the number of the concurrent sessions allowed
D)   Customize the login page with the organization's logo B

Question 3

How often does the configuration and policy data from the primary Enterprise Security Manager (ESM) get synchronized with the redundant ESM?

Accepted Answer

A)   Every 2 minutes
B)   Every 5 minutes
C)   Every 10 minutes
D)   This is based on manual selection B

Question 4

The primary function of the Application Data Monitor (ADM) appliance is to decode traffic at layer

Accepted Answer

A)   one for inspection.
B)   three for inspection.
C)   five for inspection.
D)   seven for inspection.

Question 5

A backup of the ELM management database captures

Accepted Answer

A)   ELM configuration settings
B)   ELM configuration settings, and the ELM archive index.
C)   ELM configuration settings, the ELM archive index, and all archived ELM contents.
D)   ELM configuration settings, the ELM archive index, and all archived ELM contents up to the ESM database retention limit.

Question 6

The analyst has created a correlation rule to correlate events from Anti-Virus (AV), Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?

Accepted Answer

A)   Alerting
B)   Heuristics
C)   Advanced Persistent Threats (APT) 
D)   Automatic DAT updates

Question 7

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

Accepted Answer

A)   NOR and AND
B)   AND and SET
C)   OR and SET
D)   OR and AND

Question 8

To correlate known vulnerabilities to devices that are currently exposed to such vulnerabilities, which of the following must be selected on the Receiver?

Accepted Answer

A)   Auto Download VulnEvents
B)   Enable Vulnerability Event Correlation
C)   Generate Vulnerability Events
D)   Enable VA Source

Question 9

The McAfee Enterprise Security Manager (ESM) system clock is set to

Accepted Answer

A)   International Date Line West.
B)   Daylight Savings Offset.
C)   Greenwich Mean Time.
D)   Geo-Location.

Question 10

The McAfee SIEM solution satisfies which of the following compliance requirements?

Accepted Answer

A)   Continuous monitoring, Log retention  
B)   Personally Identifiable Information (PII)  protection
C)   Payment Card Industry/ Data Security Standard (PCI/ DSS)  protection
D)   Patch management automation

Question 11

The ESM database is unavailable for use during

Accepted Answer

A)   a configuration backup.
B)   a full backup.
C)   archiving of inactive partitions.
D)   synchronization with the redundant ESM.

Question 12

A McAfee Event Receiver (ERC) will allow for how many Correlation Data Sources to be configured?

Accepted Answer

A)   1
B)   3
C)   5
D)   10

Question 13

A SIEM allows an organization the ability to correlate seemingly disparate streams of traffic into a central console for analysis. This correlation, in many cases, can point out activities that might otherwise go undetected. This type of detection is also known as

Accepted Answer

A)   anomaly based detection.
B)   behavioral based detection.
C)   heuristic based detection.
D)   signature based detection.

Question 14

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

Accepted Answer

A)   100 GB
B)   250 GB
C)   500 GB
D)   1 TB

Question 15

Zones allow a user to group devices and the events they generate by

Accepted Answer

A)   Geographical location and IP reputation
B)   Geographical reputation and IP Address
C)   Geographical location and IP Address
D)   Geographical location and File reputation

Question 16

Be default, events in McAfee SIEM are aggregated on which of the following three fields?

Accepted Answer

A)   Signature ID, Source IP, Source Port
B)   Signature ID, Source IP, Destination IP
C)   Signature ID, Destination IP, Source User
D)   Signature ID, Event ID, Source IP

Question 17

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the following watchlists in the McAfee SIEM?

Accepted Answer

A)   MTIE Suspicious and Malicious
B)   TSI Suspicious and Malicious
C)   GTI Suspicious and Malicious
D)   MTI Suspicious and Malicious

Question 18

Zones allow a user to group devices and the events they generate by

Accepted Answer

A)   Geographical location and IP reputation
B)   Geographical reputation and IP Address
C)   Geographical location and IP Address
D)   Geographical location and File reputation

Question 19

Event Aggregation is performed on which of the following fields?

Accepted Answer

A)   Signature ID, Destination IP, User ID
B)   Source IP, Destination IP, User ID
C)   Signature ID, Source IP, Destination IP
D)   Signature ID, Source IP, User ID

Question 20

The normalization value assigned to each data-source event allows

Accepted Answer

A)   increased usability via views based on category rather than signature ID.
B)   more efficient parsing of each event by the McAfee SIEM Receiver.
C)   quicker ELM searches.
D)   the McAfee ESM database to retain fewer events overall.

Exam 3: Intel Security Certified Product Specialist

Which of the following features of the Enterprise Log Manager (ELM) can alert the user if any data has been modified?

An organization notices an increasing number of ESM concurrent connection events. To mitigate risks related to concurrent sessions which action should the organization take?

How often does the configuration and policy data from the primary Enterprise Security Manager (ESM) get synchronized with the redundant ESM?

The primary function of the Application Data Monitor (ADM) appliance is to decode traffic at layer

A backup of the ELM management database captures

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

To correlate known vulnerabilities to devices that are currently exposed to such vulnerabilities, which of the following must be selected on the Receiver?

The McAfee Enterprise Security Manager (ESM) system clock is set to

The McAfee SIEM solution satisfies which of the following compliance requirements?

The ESM database is unavailable for use during

A McAfee Event Receiver (ERC) will allow for how many Correlation Data Sources to be configured?

A SIEM allows an organization the ability to correlate seemingly disparate streams of traffic into a central console for analysis. This correlation, in many cases, can point out activities that might otherwise go undetected. This type of detection is also known as

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

Zones allow a user to group devices and the events they generate by

Be default, events in McAfee SIEM are aggregated on which of the following three fields?

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the following watchlists in the McAfee SIEM?

Zones allow a user to group devices and the events they generate by

Event Aggregation is performed on which of the following fields?

The normalization value assigned to each data-source event allows