Test

During the initial phase of the Guardium deployment, the Guardium administrator wants to
figure out an ideal time period to purge data from the appliance based on the data load.
Which predefined Guardium report(s) allows the administrator to determine the current
database disk usage of the Guardium Appliance?

In a centrally managed environment, while executing the report 'Enterprise Buffer Usage
Monitor', a Guardium administrator gets an empty report. Why is the report empty?

An administrator has a new standalone Guardium appliance that will be placed into
production next week. The appliance will monitor traffic from a number of databases with a
high volume of traffic. The administrator needs to configure the schedule to ensure the
appliance internal database does not get full with incoming data.
Which data management function does the administrator need to configure?

A Guardium administrator needs to use both CLI and GrdAPI functions to manage the
system.
Which are the two commands that the administrator can use to search for the required
commands and their syntax from within either CLI or GrdAPI?

An administrator just installed the Guardium product using the Guardium ISO image. Which
step must the administrator perform as part of the initial set-up of the new appliance?

During a Guardium deployment planning meeting, the team decides to deploy all S-TAP
agents on all Unix/Linux database systems. A Unix/Linux system administrator team
manager asks a Guardium administrator if there are any differences between Guardium S-
TAPs for AIX and Linux systems that the team should be aware of.
What should be the Guardium administrator's response?

A company wants to deploy S-TAPs for 2 groups of database servers located in 2 different
data centers. The current set of Collectors are fully utilized. The Aggregators and Central
Manager can handle more load.
What should a Guardium administrator recommend?

A Guardium administrator installed an S-TAP but is not seeing any data in reports on the
collector. The administrator discovered that an Inspection Engine is not configured for that
S-TAP.
What is an Inspection Engine?

A Guardium administrator is preparing a command to install Configuration Auditing System
(CAS) on a Linux server using the command line method. Which parameter is required?

A Guardium administrator needs to check the traceroute information between one
appliance and its Central Manager. Which CLI command should the administrator run?

A Guardium administrator is preparing commands to install or upgrade an S-TAP using the
command line method. Which operating system can use the ktap_allow_module_combos
parameter for the installation and upgrade?

A Guardium administrator observes certain changes to the configuration and policies. How
would the administrator identify the changes that were made and who made them?

A Guardium administrator is creating a policy to alert on actions by users that are stored on
an LDAP server. How can the administrator populate a group to use in the policy?

A Guardium administrator noticed that while the data activity monitoring is working fine, the
Guardium appliance is slower than usual. The administrator wants to check the current
CPU load of the Guardium appliance.
Which predefined Guardium report(s) allows the administrator to determine the current
system CPU load of the Guardium Appliance?

A Guardium administrator needs to monitor changes to the Oracle configuration file on a
production Oracle database server. Assuming all valid licenses are applied, which
Guardium component does the administrator need to install and where?

A Guardium administrator must configure real time policy alerts to be sent to a remote
SIEM for every SQL statement run on a sensitive object. There is no requirement for the
data to be viewed or reported on in the Guardium appliance.
Which policy action would achieve that task and store the least amount of data in the
Guardium internal database?

A Guardium administrator needs to upgrade BUNDLE-STAP on a Linux server to the latest
version using GIM. What parameter should the administrator set to ensure the upgrade will
not require a reboot of the server?

An administrator manages a Guardium environment including 4 Collectors exporting data
to an Aggregator. The Collectors export their data daily at 2, 3, 4 and 5 am Eastern
Standard Time (EST) respectively. The Collectors receive traffic every day. The logs on all
the Collectors confirm data is exported daily without errors, and all the exported files
always have data. A Session report is run on the Aggregator at noon EST for data from the
last day.
Which of the following will ensure there is data in the report?

A Guardium administrator is registering a new Collector to a Central Manager (CM). The
registration failed. As part of the investigation, the administrator wants to identify if the
firewall ports are open-How can the administrator do this?

The Quick Search window does not show up on the GUI of a standalone Collector What
technical feature should the Guardium administrator check first?

An infrastructure manager is presented with a few new servers that are available to deploy
as a Guardium Collector appliance as part of Guardium project expansion. The Guardium
administrator is asked which server option is best for a Guardium Collector.
Which server option can the Guardium administrator use for the new Collector?

AGuardium administrator just finished installing the Guardium product to build a Collector.
The administrator wants to make sure the Collector has the licenses needed to provide
functionality for data activity monitoring, masking and blocking (terminate).
Which of the following lists the minimum licenses the administrator needs to install?

A Guardium administrator needs to install and configure a physical appliance to ensure
network redundancy. Which port should the administrator use to configure IP teaming
(bonding)?

A Guardium administrator needs to monitor an Oracle database on a production database
server.
Which component does the administrator need to install on this database server that will
monitor the traffic?

Which port must be open for encrypted communication between UNIX S-TAP and
Collector?

A Guardium administrator manages portal user synchronization by using a Central
Manager.
When a change is made on the Central Manager such as, for example, adding a Guardium
user to a Guardium group, how long should be allowed for the update to be synced with the
managed units in a fully working environment?

A Guardium administrator needs to configure EMC Centera for Archive and/or Backup.
In addition to the server IP address, what else is required to establish connection with an
EMC Centera on the network?

A Guardium administrator needs to use CLI commands to maintain the internal database,
clean static orphans, produce static system reports and to monitor live network traffic
filtered by IP addresses and port numbers.
Which combination of commands should the administrator use for these tasks?

An administrator previously had an issue with a Guardium system. This was resolved with
the assistance from the IBM Guardium support team, who provided the shell script, a CLI
command and the encrypted key to execute the uploaded shell script.
Which CLI command should the administrator use to review the commands that were
previously run?

A Guardium administrator is setting up a Collector schedule to export data to an
Aggregator and Archive its data to an Archive storage unit for additional data safety.
Given this scenario, which is true regarding the purge schedule?

A Guardium administrator must configure a policy to ignore all traffic from an application
with a known client IP. Due to the high amount of traffic from this application, performance
of the S-TAP and sniffer is a concern.
What action should the administrator use in the rule?

The last Vulnerability Assessment tests performed in a company were run one year ago.
The company wants to ensure the Vulnerability Assessment tests keep up with the latest
database common vulnerabilities. The company wants to use the Guardium default tests
instead of customer designed tests.
What should the Guardium administrator do to update the tests that will be run?

The guard_tap.ini of a UNIX S-TAP is configured with the following parameters:
firewall_installed=1
firewall_fail_close=1
firewall_default_state=1
firewall_timeout=10

The collector that this S-TAP is sending data to has become unavailable and there is no
failover option configured. A Guardium administrator must communicate the impact of this
outage to users of the monitored database.
What should the administrator advise is the expected behavior for a database session?

A Guardium administrator plans to use the Guardium Installation Manager (GIM) to install
and upgrade agents. Where should the administrator manually install the GIM client for the
first time?

After a successful purge, a Guardium administrator observes that the full percentage of the
Guardium internal database is not decreasing. The administrator uses support show db-
top-tables all and finds the size of the largest tables has decreased significantly.
What should the administrator do?

A Guardium administrator handles a large environment and has been asked to restore old
data for auditors to review. This old data needs to be restored so that it does not impact the
current data being collected or any merge settings. In order to keep the reports separate
(old datavs current data), the administrator sets up an Investigation Center.
Which is a key requirement for users of the Investigation Center?

A Guardium administrator needs to build new appliances with the latest version of
Guardium. How should the administrator obtain the ISO image?

A Guardium administrator is planning to build an environment that contains an S-TAP with
one primary Collector and one failover Collector. What must the administrator ensure when
setting up this environment?

While looking at the S-TAP Status report on a Collector, a Guardium administrator notices
that the status of the S-TAPs is changing every few minutes. The administrator suspects
that the sniffer is restarting every few minutes and that is why the status change is
happening.
How can the Guardium administrator confirm if the sniffer is restarting every few minutes?

Guardium reports are showing multiple records with client ip as 0.0.0.0. Users are unable
to identify which client the connections came from. The Guardium administrator has
identified that the databases are using encryption.
Which column can the administrator add that would help users to better identify the client?

A Guardium administrator is checking the scheduled jobs exceptions report on a standalone
Collector The following error is repeating every 15 minutes.
java.lang.NumberFormatException: empty String
The administrator also notices that the anomaly detection polling interval is 15 minutes.
What should the administrator do next to contribute troubleshooting the problem?

During a Guardium deployment planning meeting, a database administrator indicated that
the mission critical databases were clustered. How should the Guardium administrator
handle S-TAP installation and configuration with respect to clustered databases?

A Guardium administrator has an issue with Guardium. The administrator has not seen this
particular issue before and needs to get it fixed. To get this resolved, what should the
administrator do?

Auditors request a report of all unsuccessful login attempts to a database monitored by
Guardium. How should a Guardium administrator create such a report?

A Guardium environment is set up to send daily reports to users. The users are complaining
that their report has not been delivered to their inbox for the past week. What is the first
action the Guardium administrator should take in order to diagnose the problem?

A Guardium administrator manages an environment containing four standalone Collectors.
The administrator has been asked to provide a weekly report showing all Data Manipulation
Language (DML) SQL statements performed by all database administrators on all
databases. The administrator does not want to run the report on each Collector.
What should the administrator do to simplify this task and run the report in only one place
every week?

A Guardium administrator installed the BUNDLE-STAP module and is monitoring the state
of the install. Which state requires a database server reboot to complete the installation
process?

A Guardium administrator has rebuilt an appliance, and wants now to restore a backup
image of the entire database, audit data, and all definitions from Data backup.Which CLI
command should the administrator use to accomplish this?

A company is installing S-TAPS on new Database Clusters. The Guardium administrator
was provided with the PVU load of each node. The clusters are in active/passive mode.
The administrator is associating S-TAPs to Collectors using the PVU count.
How should the administrator treat the PVUs of passive nodes?

A Guardium administrator needs to configure daily purge.

What is the default value for purge data older than configured on the Guardium appliance?

During the installation phase, the Guardium administartor ensured that the same S-TAP installation procedures were performed on both Oracle 11 and DB2 10.5 systems. They both run on servers with the same version of Linux.

However, during the testing, it was found that all local DB2 connection activities were not captured in the activity report. Meanwhile, all activities on Oracle and all DB2 TCP activities were captured.

What additional step should the administartor take on the database server to capture the missing DB2 shared memory traffic?

A Guardium administrator is notified by the Security Incident Event Manager (SIEM) administrator in the organization that Guardium is sending real time policy alerts to the SIEM in an incorrect format.

How can the Guardium administrator verify the format that is being used?

An audit process is currently scheduled to run with User1 as a receiver, the Guardium administrator is asked to replace User1 with User2.

User1 leaves the company. How can the administrator achieve this?

A Guardium administrator has a standalone Collector which is monitoring critical production databases during the working day. Archive are taken daily before work starts and purges take place on all data older than 5 days, This is all working well. However, an auditor arrives at 10:00 am local time and wants to review data from 3 weeks ago.

When can the administrator restore the data for the auditor?

What is the least free space that the /var partition must have?

Which is the network adapter recommended for a virtual machine?

How can we display the parameters for a particular grdapi command?

We have a physical environment with 20 Collectors, 3 Aggregators and 1 Central Manager, and we want the same environment but in a virtual machine, how many collectors, aggregators and CM do we need?

If we need IBM Technical Support, they will use the root password to gain access to the appliance as root.

How can we see the current root password?

Which is the default license that is installed automatically by the Guardium product installer?

How is the upgrade hierarchical of appliances?

Where can we download patches and agents for Guardium system?

Which port is for Windows S-TAP heartbeat signal (two-way traffic)?

Which port must be open for GIM authenticated TLS, both directions, between the GIM client and the GIM server (on the Central Manager or collector)?

What happend if a PMR Severity 4 is sent to IBM Support and the answer doesn't work?

What set of commands can be run through the CLI to generate specific information about the state of any Guardium system?

If you receive a HTTP error 403, when you refresh the Guardium GUI, you can disable the Cross-Site Request Forgery (CSRF) protection feature to prevent the error.
How can we do that using CLI commands?

By default, the log files rotate weekly and keep five files. However, you can change the log rotation strategy for the log files.

What is the purpose of doing this?

When you view an Audit report (in .csv format) in Microsoft Excel, you notice that certain rows are filled with unexpected characters. The characters might look similar to what you find in the full SQL column. The problem is not seen in .pdf reports or in GUI reports.

Which could be the cause?

While Guardium is decrypting the traffic, the IP address is initially recorded as 0.0.0.0 because the sniffer does not know what the actual IP address is.

What can we do to view the correct client IP for newer traffic?

What is the first step to follow when you lost the Guardium accessmgr password and cannot log in to the GUI?

You attempt to save new settings for the data export and get the error when you click Apply to save the configuration:
"Please correct the following errors and try again:
A test data file could not be sent to this host with the parameters given. Please confirm the hostname or IP address is entered correctly, the host is online, the target directory exists and can be written to by the user given, and the password given is correct for that user"

Which could be the cause of this problem?

A user is disabled in the managed unit. The user's account is re-enabled in the Central Manager but the user is still showing as disabled in the managed unit. The user's account shows as enabled in the Central Manager.

How can we resolve the problem?

After you configure DB2 COMM_EXIT_LIST to use Guardium libguard and restart the DB2 server, you get the following error in the DB2 diag log:
.......
.......
Error opening shared memory area errno=2 err=8

This message indicates that the Guardium library is unable to create the shared memory device that it requires.

What can we do to resolve the problem?

A Guardium system had a problem and the administrator did the following:
Checked the inspection engine configuration to ensure that the value in the Process Name field matches the result of the following command on the database server: ls -lrt /INFORMIXTMP/.inf.* (For Informix with Linux, example: /home/informix11/bin/oninit )

What was the problem?

A message similar to the following is reported one or more times in Guardium system log (messages) or Alerts:
"Nanny process error condition. The nanny process killed the sniffer. VmData was number and was over the limit."

Which could be the cause and the solution for the problem?

What can we do If pages do not load correctly in Guardium GUI?

What should we do if the changes are not saved when we add an inspection engine?

What can we do If the Guardium internal database is filling up?

The S-TAP cannot start and issues the following messages:
"mmap: Not enough space
Can't initialize: Can't mmap buffer file /tmp/stapbuf/192.168.100.107.0.buf
Error Initializing: Stap cannot initialize SQLGuard queue"

What can we do to resolve the problem?

Which could be a cause for the S-TAP on a Windows server does not start and crashes with error ID 1000?

z/OS S-TAP fails to show active on the Guardium system after you start it for the first time. The policy is correctly configured with a DB2 or IMS Collection Profile and installed. The z/OS S-TAP is properly configured to use port 16022. All messages on the mainframe indicate connectivity.

What can we do to resolve the problem?

Which could be a cause for the Guardium Installation Manager (GIM) service does not start in Windows, after a succesful installation?

If SSLv3 is enabled on your system, this vulnerability allows attackers to force an SSL/TLS fallback to SSLv3, break the encryption, and intercept network traffic in plaintext. What we should do?