Question 1

To correlate known vulnerabilities to devices that are currently exposed to such vulnerabilities, which of the following must be selected on the Receiver?

Accepted Answer

A)  Auto Download VulnEvents 
B)  Enable Vulnerability Event Correlation 
C)  Generate Vulnerability Events 
D)  Enable VA Source

Question 2

The McAfee Enterprise Log Manager (ELM) offers three levels of compression (Low, Medium, and High). By default, the ELM compression level is set to Low. Which of the following is the compression ratio for the Medium level?

Accepted Answer

A)  17:1 
B)  20:1 
C)  10:1 
D)  14:1

Question 3

Analysts can effectively use the McAfee SIEM to identify threats by

Accepted Answer

A)  focusing on aggregated and correlated events data. 
B)  disabling aggregation, so all data are visible. 
C)  studying ELM archives, to analyze the original data. 
D)  use the streaming event viewer to analyze data.

Question 4

Malware performing a network enumeration scan will be visible at the McAfee SIEM as

Accepted Answer

A)  data -source events. 
B)  Application Data Monitor (ADM) events. 
C)  Database Event Monitor (DEM) events. 
D)  Enhanced Log manager (ELM) entries.

Question 5

The Global Blacklist feature can be used to block specific traffic from which of the following devices?

Accepted Answer

A)  Corporate Firewall 
B)  Application Data Monitor (ADM) 
C)  Event Receiver (ER
C)  
D)  Nitro IPS

Exam 3: Intel Security Certified Product Specialist

To correlate known vulnerabilities to devices that are currently exposed to such vulnerabilities, which of the following must be selected on the Receiver?

The McAfee Enterprise Log Manager (ELM) offers three levels of compression (Low, Medium, and High) . By default, the ELM compression level is set to Low. Which of the following is the compression ratio for the Medium level?

Analysts can effectively use the McAfee SIEM to identify threats by

Malware performing a network enumeration scan will be visible at the McAfee SIEM as

The Global Blacklist feature can be used to block specific traffic from which of the following devices?