Question 1

Which of the following is the default port used to communicate between McAfee SIEM devices?

Accepted Answer

A)  22 
B)  222 
C)  21 
D)  211

Question 2

Which of the following are the three compression ratios available for raw logs being handled by the ELM?

Accepted Answer

A)  10:1, 14:1, 19:1 
B)  14:1, 18:1, 20:1 
C)  14:1, 17:1, 21:1 
D)  14:1, 17:1, 20:1

Question 3

The ESM database is unavailable for use during

Accepted Answer

A)  a configuration backup. 
B)  a full backup. 
C)  archiving of inactive partitions. 
D)  synchronization with the redundant ESM.

Question 4

The configuration of a receiver has recently been modified and issues occur. Which command will collect historical data?

Accepted Answer

A)  htop 
B)  getstatsdata 
C)  snmpget 
D)  df

Question 5

Reports can be created by selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen or by which of the following other methods within Alarm Creation?

Accepted Answer

A)  Actions tab 
B)  Conditions tab 
C)  Escalation tab 
D)  Summary tab

Question 6

Checkpoint firewalls provide logs to the McAfee SIEM Receiver in which of the following formats?

Accepted Answer

A)  Syslog 
B)  Open Platform for Security (OPSE
C)  
C)  McAfee Event Format (MEF) 
D)  Common Event Format (CEF)

Question 7

McAfee's SIEM provides awareness of illicit behavior across multiple internal systems via

Accepted Answer

A)  default data-source events. 
B)  default correlation events. 
C)  default alerts. 
D)  default reports.

Question 8

When displaying baseline averages using the automatic time range option, baseline data is correlated by using the same time period that is being used for the current query for which of the following past number of intervals?

Accepted Answer

A)  Three 
B)  Seven 
C)  Five 
D)  Ten

Question 9

The McAfee SIEM baselines daily events over

Accepted Answer

A)  three days 
B)  five days 
C)  seven days 
D)  nine days

Question 10

The possibility of both data source Network Interface Cards (NICs) using the shared IP and MAC address at the same time is eliminated by using which of the following?

Accepted Answer

A)  iSCSI Adapter 
B)  IPMI Card 
C)  PCI Adapter 
D)  SAN Card

Question 11

When a Correlation Rule successfully triggers, this occurs at the

Accepted Answer

A)  Correlation Element. 
B)  Correlation Processor. 
C)  Correlation Engine. 
D)  Correlation Manager.

Question 12

Which of the following operations is NOT an available selection when using Multi-Device Management?

Accepted Answer

A)  Reboot 
B)  Update 
C)  Start 
D)  Disable

Question 13

The analyst has created a correlation rule to correlate events from Anti-Virus (AV), Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?

Accepted Answer

A)  Alerting 
B)  Heuristics 
C)  Advanced Persistent Threats (APT) 
D)  Automatic DAT updates

Question 14

How often does the configuration and policy data from the primary Enterprise Security Manager (ESM) get synchronized with the redundant ESM?

Accepted Answer

A)  Every 2 minutes 
B)  Every 5 minutes 
C)  Every 10 minutes 
D)  This is based on manual selection

Question 15

If there is no firewall at the border of the network, which of the following could be used to simulate the protection a firewall provides?

Accepted Answer

A)  Load balancer 
B)  Router Access Control List (ACL) 
C)  Switch port blocking 
D)  An email gateway

Question 16

A security administrator is configuring the Enterprise Security Manager (ESM) to comply with corporate security policy and wishes to restrict access to the ESM to certain users and machines. Which of the following actions would accomplish this?

Accepted Answer

A)  Configure the Access Control List and setup user accounts 
B)  Define user groups and set permissions based on IP 
C)  Assign AD users to computer assignment groups 
D)  Setup local accounts based on IP Zones

Question 17

When writing custom correlation rules, the analyst should focus on

Accepted Answer

A)  multiple security controls and events specific to the environment. 
B)  any one specific high-quality indicator of compromise. 
C)  malware alerts announced by industry security groups. 
D)  firewall events, as they provide the first indication of a compromise.

Question 18

Which of the following statements about Client Data Sources is TRUE?

Accepted Answer

A)  They will have VIPS, Policy and Agent rights 
B)  They will be displayed on the Receiver Properties > Data Sources table 
C)  They will appear on the System Navigation tree 
D)  They can have independent time zones

Question 19

Which of the following are the three compression ratios available for raw logs being handled by the ELM?

Accepted Answer

A)  10:1, 14:1, 19:1 
B)  14:1, 18:1, 20:1 
C)  14:1, 17:1, 21:1 
D)  14:1, 17:1, 20:1

Question 20

Which of the following two appliances contain Event databases?

Accepted Answer

A)  ELM and REC 
B)  ESM and ELM 
C)  ESM and REC 
D)  REC and ADM

Exam 3: Intel Security Certified Product Specialist

Which of the following is the default port used to communicate between McAfee SIEM devices?

Which of the following are the three compression ratios available for raw logs being handled by the ELM?

The ESM database is unavailable for use during

The configuration of a receiver has recently been modified and issues occur. Which command will collect historical data?

Reports can be created by selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen or by which of the following other methods within Alarm Creation?

Checkpoint firewalls provide logs to the McAfee SIEM Receiver in which of the following formats?

McAfee's SIEM provides awareness of illicit behavior across multiple internal systems via

When displaying baseline averages using the automatic time range option, baseline data is correlated by using the same time period that is being used for the current query for which of the following past number of intervals?

The McAfee SIEM baselines daily events over

The possibility of both data source Network Interface Cards (NICs) using the shared IP and MAC address at the same time is eliminated by using which of the following?

When a Correlation Rule successfully triggers, this occurs at the

Which of the following operations is NOT an available selection when using Multi-Device Management?

How often does the configuration and policy data from the primary Enterprise Security Manager (ESM) get synchronized with the redundant ESM?

If there is no firewall at the border of the network, which of the following could be used to simulate the protection a firewall provides?

A security administrator is configuring the Enterprise Security Manager (ESM) to comply with corporate security policy and wishes to restrict access to the ESM to certain users and machines. Which of the following actions would accomplish this?

When writing custom correlation rules, the analyst should focus on

Which of the following statements about Client Data Sources is TRUE?

Which of the following are the three compression ratios available for raw logs being handled by the ELM?

Which of the following two appliances contain Event databases?