Multiple Choice
A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur
A) when no one is logged in; for example, after hours or on weekends.
B) across an unusual range of ports or destinations; for example, all high ports.
C) irregularly; for example, only on Fridays, or only at end-of-quarter.
D) in accordance with expected systems use.
Correct Answer:
Verified
Correct Answer:
Verified
Q12: A McAfee Event Receiver (ERC) will allow
Q20: The normalization value assigned to each data-source
Q25: The security Analyst notices that there has
Q25: The security Analyst notices that there has
Q27: Which of the following is the Primary
Q31: Which authentication methods can be configured to
Q33: The historical ACE function allows the user
Q34: While investigating beaconing Malware, an analyst can
Q35: The McAfee SIEM baselines daily events over<br>A)
Q80: By default, the McAfee Enterprise Security Manager