Exam4Help - Get 100% Passing Assurance

Question No: 1

The normalization value assigned to each data-source event allows

A. increased usability via views based on category rather than signature ID

B. more efficient parsing of each event by the McAfee SIEM Receiver.

C. quicker ELM searches

D. the McAfee ESM database to retain fewer events overall.

Answer: A

Question No: 2

Reports can be created by selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen, or by which of the following other method selecting the ESM System Properties window, the Reports Icon in the top right of the ESM screen or by which of the following other methods within Alarm Creation?

A. Actions tab

B. Conditions tab

C. Escalation tab

D. Summary tab

Answer: A

Question No : 3

The McAfee SIEM solution satisfies which of the following compliance requirements?

A. Continuous monitoring, Log retention

B. Personally Identifiable Information (Pll) protection

C. Payment Card Industry/ Data Security Standard {PCI/ DSS) protection

D. Patch management automation

Answer: A

Question No: 4

Which of the following statements about Client Data Sources is TRUE?

A. They will have VIPS, Policy, and Agent rights.

B. They will be d splayed on the Receiver Properties > Data Sources table.

C. They will appear on the System Navigation tree.

D. They can have independent time zones.

Answer: C

Question No: 5

A SIEM allows an organization the ability to correlate seemingly disparate streams of traffic into a central console for analysis. This correlation, in many cases, can point out activities that might otherwise go undetected This type of detection is also known as

A. anomaly-based detection

B. behavioral-based detection.

C. heuristic-based detection.

D. signature-based detection

Answer: A

Question No: 6

Which of the following is the name of the Dashboard View that shows correlated events for the selected Data Source?

A. Default Summary

B. Normalized Dashboard

C. Incidents Dashboard

D. Triggered Alarms

Answer: A

Question No: 7

One or more storage allocations, which together specify a total amount of storage, coupled with a data retention time that specifies the maximum number of days a log is to be stored, is known as a

A. Storage Volume.

B. Storage Pool.

C. Storage Device.

D. Storage Area Network (SAN).

Answer: B

Question No: 8

With regard to Data Source configuration and event collection, what does the acronym CEF stand for?

A. Correlation Event Framing

B. Common Event Format

C. Common Event Framing

D. Condition Event Format

Answer: B