Question 1

A SIEM allows an organization the ability to correlate seemingly disparate streams of traffic into a central console for analysis. This correlation, in many cases, can point out activities that might otherwise go undetected. This type of detection is also known as

Accepted Answer

Anomaly-based detection involves identifying patterns that deviate from the norm, which is what SIEM systems do by correlating disparate data streams to detect unusual activities.

Question 2

A McAfee Event Receiver (ERC) will allow for how many Correlation Data Sources to be configured?

Accepted Answer

The McAfee Event Receiver (ERC) allows for only one Correlation Data Source to be configured.

Question 3

The analyst has created a correlation rule to correlate events from Anti-Virus (AV), Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?

Accepted Answer

Heuristics are used by NIPS and AV systems to detect unknown or new threats by analyzing behavior patterns. If heuristics are turned off, these systems may not detect the Command and Control traffic, leading to no alerts being generated.

Question 4

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

Accepted Answer

The answer of Which of the following are the Boolean...

Question 5

Which authentication methods can be configured to control alarm management privileges?

Accepted Answer

The answer of Which authentication methods can be configured to...

Question 6

The possibility of both data source Network Interface Cards (NICs) using the shared IP and MAC address at the same time is eliminated by using which of the following?

Accepted Answer

The answer of The possibility of both data source Network...

Question 7

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

Accepted Answer

The answer of Which of the following is the minimum...

Question 8

Which of the following two appliances contain Event databases?

Accepted Answer

ESM and REC contain Event databases.

Question 9

The primary function of the Application Data Monitor (ADM) appliance is to decode traffic at layer

Accepted Answer

The Application Data Monitor (ADM) appliance primarily functions to decode traffic at layer seven, which is the application layer, for inspection.

Question 10

A security administrator is configuring the Enterprise Security Manager (ESM) to comply with corporate security policy and wishes to restrict access to the ESM to certain users and machines. Which of the following actions would accomplish this?

Accepted Answer

Configuring the Access Control List and setting up user accounts allows the security administrator to specify which users and machines have access to the ESM, thereby restricting access according to the corporate security policy.

Question 11

To correlate known vulnerabilities to devices that are currently exposed to such vulnerabilities, which of the following must be selected on the Receiver?

Accepted Answer

The answer of To correlate known vulnerabilities to devices that...

Question 12

By default, the McAfee Enterprise Security Manager (ESM) communicates with the McAfee Event Receiver (ERC) and McAfee Enterprise Log Manager (ELM) over port

Accepted Answer

The answer of By default, the McAfee Enterprise Security Manager...

Question 13

Which of the following features of the Enterprise Log Manager (ELM) can alert the user if any data has been modified?

Accepted Answer

The Integrity Check feature in the Enterprise Log Manager (ELM) is designed to alert users if any data has been modified, ensuring data integrity.

Question 14

On the McAfee enterprise Security Manager (ESM), the default data Retention setting specifies that Event and Flow data should be maintained for

Accepted Answer

The answer of On the McAfee enterprise Security Manager (ESM),...

Question 15

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS). What other perimeter device will add more insight into what is happening?

Accepted Answer

The firewall will provide more insight into the SSH traffic as it monitors and controls incoming and outgoing network traffic based on predetermined security rules, and can log detailed information about the traffic it blocks or allows.

Question 16

If the SIEM Administrator deploys the Enterprise Security Manager (ESM) using the Federal Information Processing Standards (FIPS) encryption mode, which of the following types of user authentication will NOT be compliant with FIPS?

Accepted Answer

The answer of If the SIEM Administrator deploys the Enterprise...

Question 17

Be default, events in McAfee SIEM are aggregated on which of the following three fields?

Accepted Answer

By default, McAfee SIEM aggregates events based on Signature ID, Source IP, and Destination IP.

Question 18

The normalization value assigned to each data-source event allows

Accepted Answer

Normalization allows events to be categorized based on their characteristics rather than specific signature IDs, enhancing usability by enabling views and searches based on these categories.

Question 19

Checkpoint firewalls provide logs to the McAfee SIEM Receiver in which of the following formats?

Accepted Answer

The answer of Checkpoint firewalls provide logs to the McAfee...

Question 20

Malware performing a network enumeration scan will be visible at the McAfee SIEM as

Accepted Answer

Network enumeration scans generate data-source events as they involve network traffic that is captured and logged by the SIEM.

Exam 3: Intel Security Certified Product Specialist