https://www.newpassleader.com/McAfee/MA0-104-exam-preparation-materials.html

(68 Q&As Dumps, 30%OFF Special Discount: 30free)

NEW QUESTION NO: 30
The Global Blacklist feature can be used to block specific traffic from which of the following devices?
A. Corporate Firewall
B. Application Data Monitor (ADM)
C. Event Receiver (ERC)
D. Nitro IPS
Answer: D
Explanation/Reference:
References:
https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/ PD25226/en_US/esm_940_pg_en-us.pdf Page: 79

NEW QUESTION NO: 31
Which of the following two appliances contain Event databases?
A. REC and ADM
B. ESM and ELM
C. ELM and REC
D. ESM and REC
Answer: D

NEW QUESTION NO: 32
When viewing the Policy Tree, what four columns are displayed within the Rules Display pane?
A. Action, Severity, Aggregation, Copy Packet
B. Action, Severity, Normalization, Copy Packet
C. Action, Severity, Aggregation, Drop Packet
D. Enable, Severity, Aggregation, Copy Packet
Answer: A
Explanation/Reference:
References:
https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/ PD25748/en_US/esm_950_pg_0-00_en-us.pdf Page: 287

NEW QUESTION NO: 33
A backup of the ELM management database captures
A. ELM configuration settings, the ELM archive index, and all archived ELM contents up to the ESM database retention limit.
B. ELM configuration settings, the ELM archive index, and all archived ELM contents.
C. ELM configuration settings, and the ELM archive index.
D. ELM configuration settings
Answer: C

NEW QUESTION NO: 34
Checkpoint firewalls provide logs to the McAfee SIEM Receiver in which of the following formats?
A. McAfee Event Format (MEF)
B. Common Event Format (CEF)
C. Syslog
D. Open Platform for Security (OPSEC)
Answer: D

NEW QUESTION NO: 35
The primary function of the Application Data Monitor (ADM) appliance is to decode traffic at layer
A. seven for inspection.
B. five for inspection.
C. three for inspection.
D. one for inspection.
Answer: A

NEW QUESTION NO: 36
When writing custom correlation rules, the analyst should focus on
A. firewall events, as they provide the first indication of a compromise.
B. malware alerts announced by industry security groups.
C. multiple security controls and events specific to the environment.
D. any one specific high-quality indicator of compromise.
Answer: C

NEW QUESTION NO: 37
The analyst has created a correlation rule to correlate events from Anti-Virus (AV), Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?
A. Heuristics
B. Alerting
C. Automatic DAT updates
D. Advanced Persistent Threats (APT)
Answer: A

NEW QUESTION NO: 38
Which of the following are the three compression ratios available for raw logs being handled by the ELM?
A. 10:1, 14:1, 19:1
B. 14:1, 18:1, 20:1
C. 14:1, 17:1, 21:1
D. 14:1, 17:1, 20:1
Answer: D
Explanation/Reference:
References:
https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/24000/ PD24719/en_US/esm_930_product%20guide_en-us.pdf Page: 121

NEW QUESTION NO: 39
The Database Event Monitor (DEM) appliance prevents disclosure of Personally Identifiable Information (PII) by employing which of the following features to those types of information?
A. Obfuscation masks
B. Filter masks
C. PII filter masks
D. Sensitive data masks
Answer: D

NEW QUESTION NO: 40
Event Aggregation is performed on which of the following fields?
A. Signature ID, Destination IP, User ID
B. Signature ID, Source IP, Destination IP
C. Signature ID, Source IP, User ID
D. Source IP, Destination IP, User ID
Answer: B

NEW QUESTION NO: 41
Which of the following are the three default users defined within the Users and Groups option in the ESM properties?
A. NGCP, SYSTEM, REPORT
B. NGCP, BACKUP, REPORT
C. ADMIN, POLICY, REPORT
D. NGCP, POLICY, REPORT
Answer: A

NEW QUESTION NO: 42
Reports can be created by selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen or by which of the following other methods within Alarm Creation?
A. Actions tab
B. Conditions tab
C. Escalation tab
D. Summary tab
Answer: A
Explanation/Reference:
References:
https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/25000/ PD25349/en_US/McAfee_SIEM_Best_Practices_for_Alarms.pdf Page: 10

NEW QUESTION NO: 43
If there is no firewall at the border of the network, which of the following could be used to simulate the protection a firewall provides?
A. An email gateway
B. Load balancer
C. Router Access Control List (ACL)
D. Switch port blocking
Answer: C

NEW QUESTION NO: 44
Internet perimeter firewall data-sources provide excellent visibility into
A. inbound port scans.
B. server misbehavior.
C. backbone Intrusion Prevention System (IPS) detections.
D. client patch level.
Answer: A

NEW QUESTION NO: 45
Malware performing a network enumeration scan will be visible at the McAfee SIEM as
A. data -source events.
B. Application Data Monitor (ADM) events.
C. Database Event Monitor (DEM) events.
D. Enhanced Log manager (ELM) entries.
Answer: A

NEW QUESTION NO: 46
Where can the ESM event database archive inactive partitions?
A. Remote storage connected to the ESM
B. Storage on the hard disk of the ESM itself
C. Storage on the ELM
D. Storage on the hard disk of the backup ESM
Answer: A

NEW QUESTION NO: 47
Which authentication methods can be configured to control alarm management privileges?
A. SNMP
B. SSH Key Pair
C. Active Directory
D. Access Groups
Answer: D
Explanation/Reference:
References:
https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/24000/ PD24394/en_US/9_2_0_McAfeeESMUserGuide.pdf Page: 79

NEW QUESTION NO: 48
A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur
A. when no one is logged in; for example, after hours or on weekends.
B. in accordance with expected systems use.
C. irregularly; for example, only on Fridays, or only at end-of-quarter.
D. across an unusual range of ports or destinations; for example, all high ports.
Answer: B

NEW QUESTION NO: 49
Which of the following features of the Enterprise Log Manager (ELM) can alert the user if any data has been modified?
A. Integrity Check
B. SNMP Trap
C. Log Audit
D. ELM Database Check
Answer: A

NEW QUESTION NO: 50
Which of the following is the name of the Dashboard View that shows correlated events for the selected Data Source?
A. Default Summary
B. Incidents Dashboard
C. Triggered Alarms
D. Normalized Dashboard
Answer: A