Pass the McAfee ISCPS SIEM MA0-104 Questions and answers with CertsForce

Viewing page 2 out of 3 pages
Viewing questions 11-20 out of questions
Questions # 11:

The McAfee Enterprise Log Manager (ELM) offers three levels of compression (Low, Medium, and High). By default, the ELM compression level is set to Low. Which of compression (Low, Medium, and High). By default, the ELM compression level is set to Low. Which of the following is the compression ratio for the Medium level?

Options:

A.

17:1


B.

20:1


C.

10:1


D.

14:1


Expert Solution
Questions # 12:

A SIEM allows an organization the ability to correlate seemingly disparate streams of traffic into a central console for analysis. This correlation, in many cases, can point out activities that might otherwise go undetected This type of detection is also known as

Options:

A.

anomaly based detection


B.

behavioral based detection.


C.

heuristic based detection.


D.

signature based detection


Expert Solution
Questions # 13:

McAfee's SIEM provides awareness of illicit behavior across multiple internal systems via

Options:

A.

default data-source events.


B.

default correlation events


C.

default alerts.


D.

default reports.


Expert Solution
Questions # 14:

Which of the following security technologies sits inline on the network and prevents attacks based on signatures and behavioral analysis that can be configured as a data source within the SIEM?

Options:

A.

Firewall


B.

Email Gateway


C.

Host Intrusion Prevention System


D.

Network Intrusion Prevention System


Expert Solution
Questions # 15:

Which of the following is the minimum number of CPUs required to build a virtual image Enterprise Security Manager (ESM)?

Options:

A.

Two units


B.

Four units


C.

Six units


D.

Eight units


Expert Solution
Questions # 16:

Which of the following statements about Client Data Sources is TRUE?

Options:

A.

They will have VIPS, Policy and Agent rights.


B.

They will be d splayed on the Receiver Properties > Data Sources table.


C.

They will appear on the System Navigation tree.


D.

They can have independent time zones.


Expert Solution
Questions # 17:

Which of the following is the Primary function of the Event Receiver (ERC) in relation to the Enterprise Security Manager (ESM)?

Options:

A.

Collect and parse events before the ESM pulls them form the ERC


B.

Collect and parse the events before the receiver forwards them to the ESM


C.

Collect and store the events before they are forwarded to the ESM for parsing


D.

Collect and parse the events before forwarding them to the ELM


Expert Solution
Questions # 18:

The ESM supports five Authentication methods. The default login option uses the standard Username and Password format. Which of the following are the other four methods available?

Options:

A.

RADIUS, TACACS+, Active Directory, LDAP.


B.

Active Directory, NTLM, TACACS+, LDAP.


C.

LDAP, Active Directory, RADIUS, CAC.


D.

CAC, LDAP, RADIUS,TACACS+.


Expert Solution
Questions # 19:

When a Correlation Rule successfully triggers, this occurs at the

Options:

A.

Correlation Element.


B.

Correlation Processor.


C.

Correlation Engine.


D.

Correlation Manager.


Expert Solution
Questions # 20:

The ESM database is unavailable for use during

Options:

A.

a configuration backup.


B.

a full backup.


C.

archiving of inactive partitions


D.

synchronization with the redundant ESM.


Expert Solution
Viewing page 2 out of 3 pages
Viewing questions 11-20 out of questions