Question 1

Which of the following features of the Enterprise Log Manager (ELM) can alert the user if any data has been modified?

Accepted Answer

Integrity Check is a feature of the Enterprise Log Manager (ELM) that can alert the user if any data has been modified. It verifies the integrity of logs by calculating a hash of the log data and comparing it to a previously calculated hash. If the hashes don't match, it means that the log data has been modified and an alert is generated. The other options, SNMP Trap, Log Audit, and ELM Database Check do not specifically check for data modification.

Question 2

A McAfee Event Receiver (ERC) will allow for how many Correlation Data Sources to be configured?

Accepted Answer

The answer of A McAfee Event Receiver (ERC) will allow...

Question 3

The ESM database is unavailable for use during

Accepted Answer

The answer of The ESM database is unavailable for use...

Question 4

The possibility of both data source Network Interface Cards (NICs) using the shared IP and MAC address at the same time is eliminated by using which of the following?

Accepted Answer

The answer of The possibility of both data source Network...

Question 5

Zones allow a user to group devices and the events they generate by

Accepted Answer

Zones are used to group devices and events by their geographical location and IP address. This allows for better visibility and analysis of security events based on their source. None of the other options (A, B, or D) are accurate descriptions of how zones are used to group devices and events.

Question 6

The normalization value assigned to each data-source event allows

Accepted Answer

Normalization values assigned to each data-source event allows for increased usability via views based on category rather than signature ID. This means that events can be grouped together based on their similarity in terms of category, making it easier for analysts to analyze trends and identify any potential threats.

Question 7

Reports can be created by selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen or by which of the following other methods within Alarm Creation?

Accepted Answer

The Actions tab within Alarm Creation allows for creating reports as a part of the alarm action. The other tabs (Conditions, Escalation, Summary) do not have the option to create reports. The ESM System Properties window and Reports icon are options for creating reports outside of Alarm Creation.

Question 8

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

Accepted Answer

Correlation rules require the use of boolean logic functions such as AND, OR, and NOT. NOR and SET are not commonly used in creating correlation rules.

Question 9

Malware performing a network enumeration scan will be visible at the McAfee SIEM as

Accepted Answer

Network enumeration scans involve probing network devices to gather information about the network topology and available services. As a result, this activity generates traffic that can be detected and logged by network security tools like McAfee SIEM. McAfee SIEM classifies this type of network activity as data-source events. Therefore, the best answer is A, data-source events.

Question 10

If the SIEM Administrator deploys the Enterprise Security Manager (ESM) using the Federal Information Processing Standards (FIPS) encryption mode, which of the following types of user authentication will NOT be compliant with FIPS?

Accepted Answer

The answer of If the SIEM Administrator deploys the Enterprise...

Question 11

When writing custom correlation rules, the analyst should focus on

Accepted Answer

Custom correlation rules should consider multiple security controls and events specific to the environment to effectively detect and respond to potential threats. This approach ensures a comprehensive understanding of the security landscape and enhances the ability to identify complex attack patterns.

Question 12

The fundamental purpose of the Receiver Correlation Subsystem (RCS) is

Accepted Answer

The answer of The fundamental purpose of the Receiver Correlation...

Question 13

The analyst has created a correlation rule to correlate events from Anti-Virus (AV), Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?

Accepted Answer

If NIPS and AV were not alerting, it means that some of their functions were turned off, such as heuristics, which would have helped identify the Command and Control traffic. APT and Automatic DAT updates are not relevant to the situation.

Question 14

A security administrator is configuring the Enterprise Security Manager (ESM) to comply with corporate security policy and wishes to restrict access to the ESM to certain users and machines. Which of the following actions would accomplish this?

Accepted Answer

Configuring an Access Control List (ACL) and setting up user accounts is the best way to restrict access to the Enterprise Security Manager (ESM) to specific users and machines. The ACL will dictate which users and machines have access to the ESM, while setting up user accounts ensures that only authorized users can login to the ESM. Defining user groups and assigning AD users to computer assignment groups may be part of a larger identity and access management strategy, but they don't directly restrict access to the ESM. Setting up local accounts based on IP Zones is not a common or recommended practice for securing access to the ESM.

Question 15

Which of the following is the Primary function of the Event Receiver (ERC) in relation to the Enterprise Security Manager (ESM)?

Accepted Answer

The Event Receiver (ERC) collects and parses events before the ESM pulls them from the ERC.

Question 16

By default, the McAfee Enterprise Security Manager (ESM) communicates with the McAfee Event Receiver (ERC) and McAfee Enterprise Log Manager (ELM) over port

Accepted Answer

The answer of By default, the McAfee Enterprise Security Manager...

Question 17

The security Analyst notices that there has been a large spike for Secure Shell (SSH) drops in the Network Intrusion Prevention System (NIPS). What other perimeter device will add more insight into what is happening?

Accepted Answer

The firewall will add more insight into what is happening, as it is the device responsible for managing and controlling inbound and outbound traffic to and from the network. By examining the logs and configurations of the firewall, the security analyst can identify the source of the SSH drops and implement appropriate mitigation measures.

Question 18

The primary function of the Application Data Monitor (ADM) appliance is to decode traffic at layer

Accepted Answer

The primary function of the ADM appliance is to decode traffic at layer seven (application layer) for inspection. This allows it to identify and analyze specific application-layer protocols and behaviors, enabling it to detect and prevent advanced threats and attacks targeting these protocols.

Question 19

To correlate known vulnerabilities to devices that are currently exposed to such vulnerabilities, which of the following must be selected on the Receiver?

Accepted Answer

The answer of To correlate known vulnerabilities to devices that...

Question 20

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

Accepted Answer

The answer of Which of the following is the minimum...

Exam 3: Intel Security Certified Product Specialist