McAfee MA0-104 - Intel Security Certified Product Specialist Exam
Page: 3 / 14
Total 70 questions
Question #11 (Topic: )
When writing custom correlation rules, the analyst should focus on
A. multiple security controls and events specific to the environment.
B. any one specific high-quality indicator of compromise.
C. malware alerts announced by industry security groups
D. firewall events, as they provide the first indication of a compromise
Answer: A
Question #12 (Topic: )
Which of the following are the three default users defined within the Users and Groups
option in the ESM properties?
option in the ESM properties?
A. NGCP, POLICY, REPORT
B. NGCP, BACKUP, REPORT
C. ADMIN, POLICY, REPORT
D. NGCP, SYSTEM, REPORT
Answer: D
Question #13 (Topic: )
How often does the configuration and policy data from the primary Enterprise Security
Manager (ESM) get synchronized with the redundant ESM?
Manager (ESM) get synchronized with the redundant ESM?
A. Every 2 minutes
B. Every 5 minutes
C. Every 10 minutes
D. This is based on manual selection
Answer: B
Question #14 (Topic: )
Which of the following security technologies sits inline on the network and prevents attacks
based on signatures and behavioral analysis that can be configured as a data source within
the SIEM?
based on signatures and behavioral analysis that can be configured as a data source within
the SIEM?
A. Firewall
B. Email Gateway
C. Host Intrusion Prevention System
D. Network Intrusion Prevention System
Answer: D
Question #15 (Topic: )
Which of the following are the Boolean logic functions that can be used to create
Correlation Rules?
Correlation Rules?
A. NOR and AND
B. AND and SET
C. ORandSET
D. OR and AND
Answer: C
