Quiz
Deep
Dieses Quiz enthält Fragetypen, die sich im gewohnten Player öffnen.
Fragen in diesem Quiz (70)
1-Which of the following allows you to prevent a file from being scanned for malware?
- AEnable File Types scanned by IntelliScan in the Malware Scan Configuration properties in the Deep Security Manager Web console. Click Scan All Except and type the filename to exclude from the scan ()
- BEdit the Scan Exclusions section of the dsa.properties configuration file on the Deep Security Agent computer to include the file name. Save the configuration file and restart the Deep Security Agent service.
- CAdd the file to the Exclusions list in the Allowed Spyware/Grayware Configuration
- DAdd the file to the Exclusions list in the Malware Scan Configuration
2Policies in Deep Security can include a Context value. Which of the following statements regarding Context is correct?
- AThe Context provides Deep Security Agents with location awareness and is associated with Anti-Malware and Web Reputation Rules.
- BThe Context provides Deep Security Agents with location awareness and is associated with Log Inspection and Integrity Monitoring Rules
- CThe Context provides Deep Security Agents with location awareness and is associated with Web Reputation Rules only
- DThe Context provides Deep Security Agents with location awareness and is associated with Firewall and Intrusion Prevention Rules
3What Trend Micro product offers pre-runtime scanning of containers?
- ADeep Security Agent
- BDeep Security Manager
- CCloud One – Container Security
- DDeep Security Scanner
4The details for an event are displayed in the exhibit. Based on these details, which protection module generated the event?
- AIntrusion Prevention
- BFirewall
- CIntegrity Monitoring
- DLog Inspection
5Which of the following statements is false regarding Firewall rules using the Bypass action?
- AFirewall rules using the Bypass action do not generate log events
- BFirewall rules using the Bypass action allow traffic to flow as efficiently as if a Deep Security Agent was not there.
- CFirewall rules using the Bypass action allow incoming traffic to skip both Firewall and Intrusion Prevention analysis.
- DApplying a Firewall rule using the Bypass action to traffic in one direction automatically applies the same action to traffic in the other direction
6Which of the following statements is true regarding Deep Security Relays?
- ABoth 32-bit and 64-bit Deep Security Agents can be promoted to a Deep Security Relay
- BDeep Security Agents promoted to Deep Security Relays no longer provide the security capabilities enabled by the protection modules.
- CDeep Security Agents communicate with Deep Security Relays to obtain security updates.
- DDeep Security Relays are able to process Deep Security Agent requests during updates
7Multiple Application Control events are being displayed in Deep Security after a series of application updates and the administrator would like to reset Application Control. How can this be done?
- AOn the Deep Security Agent computer, type the following command to reset Application Control: dsa_control -r
- BClick Clear All on the Actions tab in the Deep Security Manager Web console to reset the list of Application Control events.
- CApplication Control cannot be reset.
- DApplication Control can be reset by disabling the protection module, then enabling it once again. This will cause local rulesets to be rebuilt.
8Which of the following correctly describes the Firewall rule action of Force Allow?
- AForce Allow permits traffic that would otherwise be denied by other Firewall rules to pass, but still enforces filtering by the Intrusion Prevention protection module
- BForce Allow permits traffic to bypass analysis by both the Firewall and Intrusion Prevention protection modules
- CForce Allow permits traffic to bypass analysis by all Deep Security protection modules
- DForce Allow explicitly allows traffic that matches the Firewall rule to pass, and implicitly denies all other traffic
9Your organization stores PDF and Microsoft Office files within the SAP Netweaver platform and requires these documents to be scanned for malware. Which Deep Security component is required to satisfy this requirement?
- ANo extra components are required, this can be done by enabling the Anti-Malware protection module on the SAP Netweaver server.
- BThe Netweaver plug-in must be installed on the Deep Security Agent.
- CDeep Security Scanner is required
- DA Smart Protection Server must be installed and configured to service the SAP Netweaver platform
10Which of the following are valid methods for pre-approving software updates to prevent Application Control Events from being triggered by the execution of the modified software? Select all that apply
- ASoftware updates performed by a Trusted Updater will be automatically approved
- BEdit the inventory database file (AC.db) on the Agent computer to include the hash of the newly updated software.
- CSave the change and restart the Deep Security Agent. The updates software will now be approved. Once the inventory scan has run when Application Control is first enabled, there is no way to update the inventory to incorporate modified software.
- DMaintenance mode can be enabled while completing the udpates.
111-Deep Security Agents a-Collects and submits suspicious files for analysis
2-Deep Security Manager b-Compiles and distributes the Suspicious Objects List
3-Deep Discovery Analyzer c-Executes and observes the suspicious files in an isolated sandbox environment
4-Apex Central d-Detects suspicious files
[blank_start]___[blank_end]- A___
12Which of the following statements correctly identifies the purpose of the Integrity Monitoring protection module?
- AThe Integrity Monitoring protection module monitors critical operating system objects such as services, processes, registry keys and ports to detect and report malicious or unexpected changes.
- BThe Integrity Monitoring protection module monitors traffic to verify the integrity of incoming traffic to identify protocol deviations, packets fragments and other protocol anomalies.
- CThe Integrity Monitoring protection module monitors incoming traffic to confirm the integrity of header information including packet source and destination details.
- DThe Integrity Monitoring protection module monitors and analyzes the integrity of application logs to identify tampering, corruption and other suspicious modifications to the logs.
13- Which of the following statements is true regarding Event Tagging?
- AOnly a single tag can be assigned to an event
- BEvents can be automatically deleted based on tags
- CEvents can be tagged automatically if they are similar to known good events.
- DAdding a tag to an event modifies the event data by adding fields, including the name of the tag, the date the tag was applied, and whether the tag was applied manually or automatically.
14Based on the details of the event displayed in the exhibit, which of the following statements is false?
- AThe scan may be generated from an IP address which may be known to you. If so, the source IP address can be added to the reconnaissance allow list
- BYou can instruct the Deep Security Agents and Appliances to block traffic from the source IP address for a period of time.
- CYou can create a firewall rule to permanently block traffic from the originating IP address.
- DThe Intrusion Prevention protection module must be enabled to detect reconnaissance scans.
15Which of the following statements regarding the Integrity Monitoring protection module is true?
- AAny changes to the system objects monitored by the Integrity Monitoring protection module are assumed to be legitimate, however, an administrator can revise the status of the object modification to malicious during a review of the Integrity Monitoring events.
- BThe Integrity Monitoring rules include a property that identifies whether a change to a monitored system object was performed as part of a legitimate operation.
- CThe Integrity Monitoring protection module can detect changes to the system but lacks the ability to distinguish between legitimate and malicious changes
- DAny changes to monitored system objects that are detected after a Recommendation Scan is run on the protected computer are assumed to be malicious.
16The Intrusion Prevention protection module is enabled, and a recommendation scan is run to identify vulnerabilities on a Windows Server 2016 computer. How can you ensure that the list of recommendations is always kept up to date?
- AWhen Automatically implement Intrusion Prevention Recommendations is enabled for a computer, any new rules released by Trend Micro over time will automatically be applied.
- BEnable Ongoing Scans to run a recommendation scan on a regular basis. This will identify new Intrusion Prevention rules to be applied.
- CRecommendation scans are only able to suggest Intrusion Prevention rules when the protection module is initially enabled
- DDisabling, then re-enabling the Intrusion Prevention protection module will trigger a new recommendation scan. New rules will be included in the results of this new scan.
17Which of the following is not an operation that is performed when network traffic is intercepted by the network driver on the Deep Security Agent?
- AVerify the integrity of the packet to ensure the packet is suitable for analysis.
- BVerify the packet is not part of a reconnaissance scan used to discover weaknesses on the Deep Security Agent host computer
- CCompare the data in the packet against the Anti-Malware Scan Configuration to verify whether any of the data related to files and folders on the Exclusion list.
- DAnalyze the packet within the context of traffic history and connection state
18- Which of the following is NOT an operation that can be performed on Deep Security resources using the API?
- AVIEW
- BPUT
- CGET
- DPOST
19- Recommendation scans can detect applications, system objects and/or vulnerabilities on servers on the network. Which of the following protection modules make use of recommendation scans?
- AIntrusion Prevention, Integrity Monitoring, and Log Inspection
- BIntrusion Prevention, Firewall, Integrity Monitoring and Log Inspection
- CFirewall, Application Control, and Integrity Monitoring
- DLog Inspection, Application Control, and Intrusion Prevention
20A priority value of 0 is always assigned to Firewall rules using the Allow action. Select the correct answer from the drop-down list. TRUE
- ATrue
- BFalse
21Which of the following statements correctly describes Smart Folders?
- ASmart Folders are a collection of subfolders containing the policy settings that are applied to child policies or directly to computers.
- BSmart Folders act as a saved search of computers which is executed each time the folder is clicked to display its contents
- CSmart Folders identify the folders that will be scanned when a real-time, manual or scheduled malware scan is run.
- DSmart Folders are the containers used to store the results of recommendation scans. Once a recommendation scan has completed, and administrator can click a Smart Folder and select which of the recommended rules to apply
22Which of the following statements is true regarding Intrusion Prevention rules?
- AIntrusion Prevention rules can block unrecognized software from executing.
- BIntrusion Prevention rules check for the IP addresses of known malicious senders within a packet.
- CIntrusion Prevention rules can detect, or block traffic associated with specific applications, such as Skype or file-sharing utilities.
- DIntrusion Prevention rules monitor the system for changes to a baseline configuration
23Why is a multi-node installation of Deep Security recommended?
- ASince multi-node installations distribute database information across multiple database servers, Deep Security can easily scale to accommodate any number of Deep Security Agent servers.
- BSince each Deep Security Manager server in a multi-node installation uses its own database, this type of installation can balance the load of requests.
- CMulti-node installations are helpful in disaster recovery situations as each combination of Deep Security Manager and database are clones of each other. When the original Deep Security Manager fails, the administrator can immediately switch to a clone.
- DMulti-node installations provide Deep Security with failover capabilities since a second Deep Security Manager can handle all requests if the first one fails.
24Which of the following correctly identifies the order of the steps used by the Web Reputation protection module to determine if access to a web site should be allowed?
- A1. Retrieves the credibility score from Web Reputation Service. Evaluates the credibility score against the Security Level
2. Checks the Deny list to determine if access to the web site should be blocked.
3. Checks the Approved list to determine if access to the web site should be allowed. - B1. Checks the cache.
2. Checks the Approved list.
3. Checks the Deny list.
4. If not found in any of the above, retrieves the credibility score from the Web Reputation Service.
5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed. - C1. Checks the Deny list.
2. Checks the Approved list.
3. Checks the cache.
4. If not found in any of the above, retrieves the credibility score from Rating Server.
5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed. - D1. Checks the Approved list.
2. Checks the Deny list.
3. Checks the cache.
4. If not found in any of the above, retrieves the credibility score from the Web Reputation Service.
5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.
- A1. Retrieves the credibility score from Web Reputation Service. Evaluates the credibility score against the Security Level
25The [blank_start]_________[blank_end] modules does not benefit from recommendation scans. Select the correct answer from the drop-down list..
- AFirewall
26Based on the policy configuration displayed in the exhibit, which of the following statements is true?
- AAdministrators with access to the protected server will be able to uninstall the Deep Security Agent through Windows Control Panel.
- BIf the Deep Security Manager does not receive a message from the Deep Security agent every 20 minutes, an alert will be raised.
- CDeep Security Agents will send event information to Deep Security Manager every 10 minutes.
- DChanges to any of the Deep Security policies will be send to the Deep Security Agents as soon as the changes are saved
27Which of the following statements is true regarding Maintenance Mode in the Application Control protection module?
- AWhen in Maintenance Mode, the Application Control protection module will continue to block software identified in Block rules but will allow new and changed applications to be added to the software inventory.
- BWhen enabled, Maintenance Mode rescans the protected computer to rebuild the software inventory. Any new or changed software will be included in this rebuilt inventory
- CMaintenance Mode can be configured as a scheduled event. In this scenario, all software upgrades will be performed at the same time every day to avoid creating alerts for normal software updates
- DWhile in Maintenance Mode, all Block and Allow rules are ignored while new or updated applications are added to the software inventory
28Which of the following items must be included in any request for resources that are made through the Deep Security API? Select all that apply.
- AAPI key
- BURL of the API-enabled resource
- CAPI version
- DAdministrator password
29Based on the Malware Scan Configuration displayed in the exhibit, which of the following statements is false?
- ADeep Security Agents will only be able to identify malware in files by using patterns downloaded from the Smart Protection Network.
- BDeep Security Agents using this Malware Scan Configuration will not monitor for compromised Windows processes.
- CAny document files that display suspicious behavior will be submitted and executed in a sandbox environment on a Deep Discover Analyzer device
- DInternet access is required to properly enable the features identified in this configuration.
30A Deep Security administrator wishes to monitor a Windows SQL Server database and be alerted of any critical events which may occur on that server. How can this be achieved using Deep Security?
- AThe administrator could install a Deep Security Agent on the server hosting the Windows SQL Server database and enable the Intrusion Prevention protection module. A recommendation scan can be run, and any suggested rules can be assigned to monitor the Windows SQL Server for any vulnerabilities, with alerts enabled.
- BThis cannot be achieved using Deep Security. Instead, the administrator could set up log forwarding within Window SQL Server and the administrator could monitor the logs within the syslog device
- CThe administrator could install a Deep Security Agent on the server hosting the Windows SQL Server database and enable the Log Inspection protection module. A rule can be assigned to monitor the Windows SQL Server for any critical events, with alerts enabled.
- DThe administrator could install a Deep Security Agent on the server hosting the Windows SQL Server database and enable the Integrity Monitoring protection module. A rule can be assigned to monitor the Windows SQL Server for any modifications to the server, with alerts enabled.
31Based on the Computer settings displayed in the exhibit, which of the following statements is correct?
- ARecommendation Scans will be performed automatically on this server whenever new rules are downloaded from the ActiveUpdate Server to determine if they must be applied.
- BThe Deep Security Agent on this server will contact the Smart Protection Network directly to submit file features for Predictive Machine Learning analysis.
- CIf this server does not communicate with Deep Security Manager for a specific period, it will be automatically removed from the computers list
- DAdministrators performing maintenance on this server will require a password to disable the Deep Security Agent service
32A collection of servers protected by Deep Security do not have Internet access. How can Smart Scan be used on these computers?
- ASmart Scan can be configured to use a local pattern file containing the same information as the Smart Protection Network.
- BInstall a Smart Protection Server in the environment and set it as the source for the File Reputation Service.
- CPromote one of the Deep Security Agents on the air-gapped computers to become a Relay
- DSmart Scan must contact the Smart Protection Network to function. Any servers without Internet access will be unable to use Smart Scan
33Which of following statements best describes Machine Learning in Deep Security?
- AMachine Learning is a malware detection technique in which files are scanned based on the true file type as determined by the file content, not the extension
- BMachine Learning is malware detection technique in which features of an executable file are compared against a cloud-based learning model to determine the probability of the file being malware.
- CMachine Learning is a malware detection technique in which the Deep Security Agent monitors process memory in real time and once a process is deemed to be suspicious, Deep Security will perform additional checks with the Smart Protection Network to determine if this is a known good process.
- DMachine Learning is a malware detection technique in which processes on the protected computer are monitored for actions that are not typically performed by a given process.
34Which of the following Smart Protection Services is used by Smart Scan?
- ACensus Service
- BFile Reputation Service
- CWeb Reputation
- DCertified Safe Software Service
35Which of the following statements is correct regarding the policy settings displayed in the exhibit?
- ADeep Security Manager will refresh the policy details on the Deep Security Agents using this policy every 5 minutes
- BDeep Security Agents using the displayed policy will send event details to Deep Security Manager every 5 minutes.
- CThe Heartbeat interval value displayed in this policy is inherited from the parent policy.
- DAll Deep Security Agents will send event details to Deep Security Manager every 5 minutes.
36The Intrusion Prevention protection module is enabled, but the traffic it is trying to analyze is encrypted through https. How is it possible for the Intrusion Prevention protection module to monitor this encrypted traffic against the assigned rules?
- AIt is possible to monitor the https traffic by creating an SSL Configuration. Creating a new SSL Configuration will make the private key information needed to decrypt the traffic available to the Deep Security Agent.
- BThe Intrusion Prevention protection module is not able to analyze encrypted https traffic
- CThe Intrusion Prevention protection module can analyze https traffic if the public certificate of the originating server is imported into the certificate store on the Deep Security Agent computer.
- DThe Intrusion Prevention protection module can only analyze https traffic originating from other servers hosting a Deep Security Agent.
37Which of the following operations makes use of the Intrusion Prevention protection module?
- AStateful traffic analysis
- BApplication traffic control
- CIntegrity scans
- DPort scans
38The Log Inspection protection module is supported in both Agent-based and Agentless implementations.
- ALog Inspection can only examine new events and cannot examine logs entries created before the protection module was enabled
- BThe Log Inspection protection module is supported in both Agent-based and Agentless implementations.
- CDeep Security Agents forward Log Inspection event details to Deep Security Manager in real time.
- DLog Inspection can only examine Deep Security log information
39Your organization would like to implement a mechanism to alert administrators when files on a protected servers are modified or tampered with. Which Deep Security protection module should you enable to provide this functionality?
- AThe File Inspection protection module
- BDeep Security cannot provide this type of functionality
- CThe Integrity Monitoring protection module
- DThe Intrusion Prevention protection module
40The Overrides settings for a computer are displayed in the exhibit. Which of the following statements is true regarding the displayed configuration?
- AThe protection modules identified as Inherited in the exhibit have not yet been configured. Only the Web Reputation and Application Control protection modules have been configured.
- BThe configuration for the protection modules is inherited from the policy assigned to this computer, except for the configuration of the Web Reputation and Application Control protection modules which have been set at the computer level.
- CThe protection modules identified as Inherited in the exhibit have not yet been enabled. Only the Web Reputation and Application Control protection modules have been enabled at this point.
- DThe Web Reputation and Application Control protection modules have been assigned a different policy that the other protection modules and as a result, are displayed with overrides.
41Which of the following file types would not be evaluated by the Application Control protection module?
- A.exe files
- B.class files
- C.py scripts
- D.docx files
42What is the purpose of the Deep Security Relay?
- ADeep Security Relays distribute load to the Deep Security Manager nodes in a high-availability implementation.
- BDeep Security Relays maintain the caches of policies applied to Deep Security Agents on protected computers to improve performance
- CDeep Security Relays forward policy details to Deep Security Agents and Virtual Appliances immediately after changes to the policy are applied.
- DDeep Security Relays are responsible for retrieving security and software updates and making them available them to Deep Security Manager, Agents and Virtual Appliances.
43New servers are added to the computers list in the Deep Security Manager Web console by running a Discover operation. What behavior can you expect for newly discovered computers?
- AAny servers within the IP address range that are hosting Deep Security Agents will be added to the computers list and will be automatically activated.
- BAny servers discovered in the selected Active Directory branch hosting a Deep Security Agent will be added to the computers list.
- CAny servers within the IP address range will be added to the computers list, regardless of whether they are hosting a Deep Security Agent or not.
- DAny servers within the IP address range hosting a Deep Security Agent will be added to the computers list.
44What is the result of performing a reset operation on a Deep Security Agent?
- AA reset operation forces an update to the Deep Security Agent software installed on a managed computer.
- BA reset operation wipes out any Deep Security Agent settings and policies, as well as its relationship with Deep Security Manager.
- CA reset operation forces the Deep Security Agent service to restart on the managed computer.
- DA reset operation generates event information that can be used to troubleshoot Agent-to-Manager communication issues.
45Which of the following statements is false regarding the Log Inspection protection module?
- ACustom Log Inspections rules can be created using the Open-Source Security (OSSEC) standard.
- BDeep Security Manager collects Log Inspection Events from Deep Security Agents at every heartbeat.
- CScan for Recommendations identifies Log Inspection rules that Deep Security could implement.
- DThe Log Inspection protection module is supported in both agent-based and agentless environments.
46The Intrusion Prevention protection module is enabled, its behavior is set to Prevent and rules are assigned. When viewing the events, you notice that one of Intrusion Prevention rules is being triggered and an event is being logged but the traffic is not being blocked. What is a possible reason for this?
- AThe default prevention behavior in this particular rule may be set to Detect. This logs the triggering of the rule but does not actually enforce the block.
- BThe Deep Security Agent is experiencing a system problem and is not processing packets since the Network Engine System Failure mode is set to Fail Open.
- CThe Intrusion Prevention rule is being triggered as a result of the packet sanity check failing and the packet is being allowed to pass.
- DThe network engine is running in Inline mode. In Inline mode, Deep Security provides no protection beyond a record of events.
47Which of the following are valid methods for forwarding event information from Deep Security? Select all that apply.
- ADeep Security Application Programming Interface (API)
- BSecurity Information and Event Management (SIEM)
- CAmazon Simple Notification Service (SNS)
- DSimple Network Management Protocol (SNMP)
48Based on the following exhibit, what behavior would you expect for the Application Control protection module?
- ASince this computer is in Maintenance Mode, updates to the Application Control protection module will be applied.
- BSince this computer is in Maintenance Mode, Application Control will ignore any blocked software in the currently active ruleset.
- CSince this computer is in Maintenance Mode, new or changed software will be automatically added to the software inventory for this server.
- DSince this computer is in Maintenance Mode, Application Control will allow any blocked software to temporarily run.
49Which of the following statements is true regarding Intrusion Prevention protection?
- AIntrusion Prevention protection only works in conjunction with the Anti-Malware protection module.
- BIntrusion Prevention protection can drop malicious packets but cannot reset the connection
- CIntrusion Prevention protection can only work on computers where a Deep Security Agent is installed; agentless protection is not supported.
- DIntrusion Prevention protection can drop or reset a connection.
50In the policy displayed in the exhibit, the state of the Web Reputation protection module is set to Inherited (On), while the state for the other protection modules is set to On. Why is the Web Reputation protection module displayed differently than the other protection modules.
- AIn this example, the state for the Web Reputation protection module is inherited from the parent policy, while the other protection modules were turned on at the computer level.
- BThe state for a protection module is always displayed as Inherited (On) until the module components are installed on the Deep Security Agent.
- CIn this example, the state for the Web Reputation protection module is listed as Inherited (On) as it was inherited from the default setting in the Base Policy.
- DIn this example, the state for the Web Reputation protection module is inherited from the parent policy, while the other protection modules were turned on specifically in this child policy.
51In which of the following scenarios should a new Integrity Monitoring baseline be created? Select all that apply.
- AA new baseline should be created after applying software patches.
- BA new baseline should be created whenever new Integrity Monitoring rules are downloaded from the Trend Micro ActiveUpdate server.
- COnce created, there is no need to create a new Integrity Monitoring baseline.
- DA new baseline should be created whenever changing the Integrity Monitoring scan interval, for example, changing from real-time to manual scans.
52An administrator attempts to activate the Deep Security Agent installed on a server by typing the following command in the Command Prompt on the Deep Security Agent computer:
dsa_control -a dsm://server1.acme.com:4120
The Agent does not activate as expected. What is a valid reason for this issue?- AThe incorrect port was used. The correct command would be:
dsa_control -a dsm://server1.acme.com:4118 - BAllow Agent-Initiated Activation is currently not enabled in Deep Security Manager.
- CDeep Security Agents cannot be activated through the Command Prompt. They must be activated through the Deep Security Manager Web console or through a deployment script.
- DThe command listed can only executed from the Command Prompt on the Deep Security Manager computer.
- AThe incorrect port was used. The correct command would be:
53Which of the following statements is true regarding software inventories used as part of the Application Control protection module?
- AAn administrator can view the list of allowed software in the inventory from the Details tab for each individual Computer.
- BDisable the Application Control protection module when installing software upgrades, otherwise, the new software will be prevented from installing.
- CAn administrator can share the inventory of allowed software with other computers protected by Deep Security Agents, by copying the inventory database file (ac.db) from the source computer.
- DWhen an administrator allows software that would be otherwise blocked by the Enforcement Mode, it isn't added to the inventory of approved software. Instead, it is added to that computer's allow list.
54What is the purpose of the Deep Security Notifier?
- AThe Deep Security Notifier is a server component used in agentless configurations to allow Deep Security Manager to notify managed computers of pending updates.
- BThe Deep Security Notifier is an application in the Windows System Tray that communicates the state of Deep Security Agents and Relays to endpoint computers.
- CThe Deep Security Notifier is a server components that collects log entries from managed computers for delivery to a configured SIEM device.
- DThe Deep Security Notifier is an application in the Windows System Tray that displays the status of Deep Security Manager during policy and software updates.
55What is IntelliScan?
- AIntelliScan is a malware scanning technique that monitors process memory in real time. It can identify known malicious processes and terminate them.
- BIntelliScan reduces the risk of viruses entering your network by blocking real-time compressed executable files and pairs them with other characteristics to improve malware catch rates.
- CIntelliScan is a technique used to identify which files are subject to malware infection and scans only those files.
- DIntelliScan is a mechanism that improves scanning performance. It recognizes files that have already been scanned based on a digital fingerprint of the file
56Which of the following statements is true regarding the Intrusion Prevention protection module?
- AThe Intrusion Prevention protection module blocks or allows traffic based on header information within data packets.
- BThe Intrusion Prevention protection module analyzes the payload within incoming and outgoing data packets to identify content that can signal an attack.
- CThe Intrusion Prevention protection module can prevent applications from executing, allowing an organization to block unallowed software.
- DThe Intrusion Prevention protection module can identify changes applied to protected objects, such as the Hosts file, or the Windows Registry.
57Which Deep Security protection modules can be used to provide runtime protection for the Kubernetes and Docker platforms? Select all that apply.
- AAnti-Malware
- BLog Inspection
- CIntrusion Prevention
- DIntegrity Monitoring
58The maximum disk space limit for the Identified Files folder is reached. What is the expected Deep Security Agent behavior in this scenario?
- AFiles will no longer be quarantined. Any new files due to be quarantined will be deleted instead.
- BDeep Security Agents will delete any files that have been in the folder for more than 60 days.
- CDeep Security Agents will delete the oldest files in this folder until 20% of the allocated space is available.
- DAny existing files are in the folder are compressed and forwarded to Deep Security Manager to free up disk space.
59How does Smart Scan vary from conventional pattern-based anti-malware scanning?
- ASmart Scan is performed in real time, where conventional scanning must be triggered manually, or run on a schedule.
- BSmart Scan improves the capture rate for malware scanning by sending features of suspicious files to a cloud-based server where the features are compared to known malware samples.
- CSmart Scan identifies files to be scanned based on the content of the file, not the extension.
- DSmart Scan shifts much of the malware scanning functionality to an external Smart Protection Server.
60Which of the following statements is true regarding Firewall rules?
- AFirewall rules are always processed in the order in which they appear in the rule list, as displayed in the Deep Security Manager Web console.
- BFirewall rules applied through a parent-level policy cannot be unassigned in a child-level policy.
- CWhen traffic is intercepted by the network filter, Firewall Rules in the policy are always applied before any other processing is done.
- DFirewall rules applied to policy supersede similar rules applied to individuals computers.
61The Firewall protection module is enabled on a server through the computer details. What is default behavior of the Firewall if no rules are yet applied?
- AAll traffic is permitted through the firewall until either a Deny or Allow rule is assigned.
- BAll traffic is blocked by the firewall until an Allow rule is assigned
- CA collection of default rules will automatically be assigned when the Firewall protection module is enabled.
- DAll traffic is passed through the Firewall using a Bypass rule
62The Security Level for Web Reputation in a policy is set to High. A server assigned this policy attempts to access a Web site with a credibility score of 78. What is the result?
- AThe Deep Security Agent displays a warning message as the site is unrated.
- BThe Deep Security Agent allows access to the Web site, and logs the connection attempt as an event.
- CThe Deep Security Agent allows access as the credibility score for the Web site is above the allowed threshold.
- DThe Deep Security Agent blocks access as the credibility score for the Web site is below the allowed threshold. An error page is displayed in the Web browser
63How is caching used by the Web Reputation protection module?
- ACaching is used by the Web Reputation protection module to temporarily store the pages that make up the Web site. The Web site is cached in case the site is visited again within the life of the cache.
- BCaching is used by the Web Reputation protection module to temporarily store the credibility score for a Web site. The retrieved credibility score is cached in case the score for the Web site is required again for the life of the cache.
- CCaching is used by the Web Reputation protection module to keep track of Allowed and Blocked Web sites. Any sites that are Allowed or Blocked do not require the retrieval of a credibility score from the Trend Micro Web Reputation Service.
- DCaching is used by the Web Reputation protection module to keep track of Web sites that are added to the Allowed list. Any sites added to the Allowed list will be accessible by protected servers regardless of their credibility score.
64While viewing the details of the Firewall protection module, as displayed in the exhibit, you note that a few rules have already been assigned. You try to disable these rules, but they cannot be unassigned. Why can the displayed rules not be unassigned?
- AThe rules displayed in the exhibit have been assigned to the policy at the parent level. Rules assigned to a parent policy cannot be unassigned at the child level
- BThe rules displayed in the exhibit were assigned to the policy automatically when a recommendation scan was run. Rules assigned through a recommendation scan cannot be disabled once assigned
- CThe rules displayed in the exhibit have been hard coded with the details of the policy. These rules will automatically be assigned to all Firewall policies that are created and cannot be unassigned.
- DThe rules displayed in the exhibit cannot be unassigned as the administrator currently logged into the Deep Security Manager Web console does not have the permissions necessary to unassign rules.
65Which of the following Firewall rule actions will allow data packets to pass through the Firewall protection module without being subjected to analysis by the Intrusion Prevention protection module?
- AAllow
- BForce Allow
- CDeny
- DBypass
66Which protection modules can make use of a locally installed Smart Protection Server?
- AThe Anti-Malware, Web Reputation and Intrusion Prevention protection modules can make use of the locally installed Smart Protection Server
- BThe Anti-Malware and Web Reputation protection modules can make use of the locally installed Smart Protection Server
- CAll protection modules can make use of the locally installed Smart Protection Server.
- DAnti-Malware is the only protection module that can use the locally installed Smart Protection Server.
67Based on the configuration setting highlighted in the exhibit, what behavior can be expected during a malware scan?
- AWith the highlighted setting enabled, Deep Security Agents will scan files for viruses and malware using supplementary aggressive detection pattern files.
- BWith the highlighted setting enabled, Deep Security Agents will scan files for known viruses and malware using patterns and any files deemed suspicious will be submitted to a configured Deep Discovery Analyzer for further analysis.
- CWith the highlighted setting enabled, Deep Security Agents will scan files for unknown malware using Predictive Machine Learning.
- DWith the highlighted setting enabled, Deep Security Agents will scan files for known malware as well as newly encounted malware by accessing the Suspicious Objects List
68In which Network Engine Mode is the live traffic stream passed through the network engine and firewall rules applied? Type the correct answer in the space provided. [blank_start]_____[blank_end]
- AInline
69Which of the following statements is true regarding the use of the Firewall protection module in Deep Security?
- AThe Firewall protection module can prevent DoS attacks originating from multiple systems.
- BThe Firewall protection module can identify suspicious byte sequences in packets.
- CThe Firewall protection module can check files for certain characteristics such as compression and known exploit code
- DThe Firewall protection module can detect and block Cross Site Scripting and SQL Injection attacks.
70When the Integrity Monitoring protection module is enabled, how often will the Deep Security Agent scan for changes between a monitored system object and its baseline state? Select all that apply
- AThe scan will run alongside ongoing recommendation scans.
- BThe scan can be triggered manually (on-demand) by an administrator
- CThe scan can be scheduled to run on a regular basis.
- DThe scan can be done in real-time.
Informationen
- Beschreibung
- Quiz am Deep, erstellt von Lucas Campelo am 29/07/2022.
- Autor
- Lucas Campelo
- Sprache
- Português
- Aufrufe
- 3
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz