Quiz
Guardium
Erstelle ein kostenloses Konto, um dieses Quiz zu beenden
Speichere deinen Fortschritt und sieh dir dein Endergebnis an.
oder mit deiner E-Mail registrieren
Schon ein Konto? Anmelden
Fragen in diesem Quiz (43)
1What is Guardium's primary storage mechanism for logs and audit information?
- AData can only be stored in flat files on the collector (one file per S-TAP).
- BData storage can only be managed individually by each S-TAP, with audit data stored locally on the data server in flat files.
- CData is stored on the collector in a normalized relational database.
- DData is stored locally on each server with an S-TAP but is managed centrally through the collector.
2A database known to contain the medical records of a foreign head of state is accessed at 1:30 AM. No security mechanism is installed and so this highly sensitive information is leaked to the media. Could this breach have been detected by running a Guardium vulnerability assessment without creating any custom assessment tests?
- ANo, this type of test is not included with Guardium.
- BYes, but only if the appliance includes Guardium's Database Protection Subscription service.
- CYes,after hours login detection is one of the standard behavioral vulnerability tests included with Guardium.
- DYes, however this particular test is only available for IBM DB2 and Informix servers.
3What are the different types of rules available to be used with Guardium policies?
- AAccess, Data Throughput and Privileged Transactions.
- BExtrusion, Exception and Analysis.
- CData Morphing, SOX-compliant, Extrusion and Data Throughput.
- DAccess, Extrusion and Exception.
4On a Big Data environment protected by Guardium, which scenario is invalid?
- AWhenever a user executes a HDFS file command like chmod, the S-TAP agent will be able to capture the action
- BThe MapReduce Jobs operations executed by users or by the cluster system can be shown in a custom report
- CWhen someone logins with a mistyped password, will generate an exception that will not be caught by the corresponding S-TAP
- DS-TAP and Collector use ports 8021 and 50030 to monitor MapReduce Jobs operations
5Which of the following problems is the Application User Translation feature designed to help with?
- AThe use of non-English parameter values in SQL statements issued by some applications.
- BThe fact that there is no easy way for the application server to communicate with both Guardium and the data server concurrently.
- CThe inability to relate a database action to a specific application user when a pool of database connections is used by an application.
- DTranslating an application's requests made to a data server so these are compatible with all the database management systems that Guardium supports.
6An audit administrator wants to track database changes performed by database administrators and reconcile these changes with an existing change tracking database. Which Guardium features can be used to implement this scenario?
- AExternal Data Connector and Entitlement Reports.
- BApplication Events API and Entitlement Reports.
- CApplication Events API and External Data Correlation.
- DSensitive Object Discovery and User Application Translation.
7What is CAS?
- AAn agent installed on the database server that reports to the collector whenever a monitored entity, such as a file, environment variable or script output has changed.
- BAn agent installed on the database server that reports to the collector whenever a monitored database's version has changed through upgrades or patch installs.
- CAn optional agent installed on the collector that monitors the database server for entity changes.
- DAn agent that acts as the main component of the Central Audit System.
8The query builder contains all of the following panes except for:
- AThe Entity List.
- BThe Query Fields.
- CThe Query ID Selector.
- DThe Query Conditions.
9What does "Auditing" mean in Guardium?
- AThe process of logging monitored database activity as defined by the installed security policy, creation of reports from logged data based on audit requirements, and review of the reportas part of an audit process.
- BApplying a group of data server configuration changes that allow the different versions of Guardium to safeguard sensitive information.
- CThe granting of every available privilege to a few selected users so they can take over several servers using the Guardium UIand audit these servers.
- DImporting a set of special stored procedures into many data servers to determine the security state of the database configurations.
10Which of the following is true about applying CAS templates to CAS hosts?
- AEach CAS Template can only be applied to one CAS host.
- BInstance-level changes can be made to the template items so that the same template may be applied with different parameters (ie. run frequency) to many CAS hosts.
- CApplying CAS Templates will require the database management system on the CAS host to be restarted.
- DCAS Templates are applied to collectors, which act as CAS hosts.
11Which of the following cannot be monitored using CAS?
- AEnvironment variables.
- BDatabase configurations.
- CSQL activity.
- DFile permissions.
12Which of the following is often required to ensure that Guardium can identify a user's credentials through the Stored Procedure Monitoring feature?
- AA database system-specific plug-in that attaches on to the collector's engine.
- BA well-configured custom identification procedure mapping.
- CA credential replication routine available for free from Guardium.
- DReconfiguring the security policy so the appliance knows all the application servers that contact the data server.
13What is the effect of enabling the Log Policy Violation option when creating a new correlation alert?
- AThe Guardium administrator is automatically notified whenever this alerts occurs.
- BA policy violation is logged when this alert is triggered, so it may be viewed along side real-time alerts in the Policy Violations domain.
- CThis is not an option available in the alert definition tab of the user interface.
- DAll following occurrences of this specific alert are ignored.
14What is a security policy?
- AA series of transactions where the data server communicates with the collector and shares its current security status.
- BAn XML file that must be manually created and configured so the S-TAP can understandthenature of the traffic that it reports on.
- CA Guardium object containing an ordered set of rules that are applied to the observed traffic between clients and data servers.
- DA specially-formatted document from a government or third-party institution that can be imported into Guardium for easy audit configuration.
15What are the four types of tests that can be used in a Guardium vulnerability assessment?
- AUser defined, observed behavioral, database configuration and server configuration.
- BPredefined, subscription-based, observed behavioral and configuration vulnerability.
- COS-level, native, special and external.
- DOS-level, kernel, special and external.
16Which of the following best describes the role of the aggregator in a Guardium environment?
- AThe aggregator is a Guardium appliance that collects and consolidates information from multiple collectors to a single Aggregation Server, allowing for reporting across the enterprise.
- BThe aggregator is the Guardium appliance that communicates with mainframes.
- CThe aggregator is a Guardium appliance that allows a collector and a Central Policy Manager to communicate and is required in multi-collector environments.
- DThe aggregator is another name for the Central Policy Manager.
17Which of the following items cannot be identified using database auto-discovery?
- AIP address of servers with a database instance.
- BPort(s) on which a database is communicating on each server.
- CList of databases for each database instance.
- DType of database running on each server.
18What is the purpose of Guardium's Application Events API?
- AAdding application event data, such as user ID, event type and number, to the SQL statements executed between an API no-op call and its release signal.
- BBeing part of the pattern matching engine that evaluates statements for membership in a specific security policy.
- CEnabling non-supported database engines to be used with Guardium.
- DThe Application Events API is used to increase the speed at which Guardium processes statements.
19A developer has recently created a temporary database to test her new human resources management application. To test it in a production-like environment she copies the MANAGERS table from the production server into her test database. This table includes sensitive personal information. Which of the following will help the database auditor identify this new database?
- AThe database auditor can be notified by e-mail using Guardium's scheduled database auto- discovery feature.
- BThe developer must create the new database using Guardium's Application Events API, which would show up on the Guardium interface as a change report.
- CThe database auditor can be notified of new sensitive data by a previously scheduled sensitive object discovery job.
- DThe auditor cannot incorporate the new environment into Guardium unless she is given the exact details of the database and host system.
20How would a DBA or developer notify Guardium using the Application User API that an application user has taken or given up control of a data server connection?
- ABy importing the GuardUtils library and issuing calls through it from the application.
- BBy creating a wrapper solution that sends HTTP requests to Guardium's service-oriented API whenever an event like this happens.
- CBy registering the application's connection pool with Guardium.
- DBy using the GuardAppUser call in the form of a SQL SELECT statement to indicate that a new application user has taken control of the connection.
21Which of the following components collects and parses the live database traffic used to trigger a real-time alert when a security policy rule is broken?
- AThe Real Time Communications Framework
- BThe Inspection Engine
- CThe Change Audit System
- DThe Live Report Builder
22Which of the following Big Data environments are supported by Guardium?
- AMongoDB, Cassandra, Exadata, BigInsights
- BCloudera, BigInsights, Cassandra, MongoDB
- CHadoop, CouchDB, PostgreSQL, Cloudera
- DCloudera, MongoD
23How does Guardium handle correlation alerts?
- AThe appliance sends signals to all registered probes and is able to correlate their responses.
- BThe returned values of a large number of queries are joined and the appliance correlates these data to generate alerts.
- CThe Anomaly Detection Engine runs queries that correlate exceptions or policy rule violations on a scheduled basis.
- DDifferent alerts are correlated with one another and a higher priority alert is generated.
24Which of the following actions is NOT a known benefit of using correlation alerts?
- AReal time database traffic analysis and security policy inspection.
- BMonitoring database usage and pinpointing suspicious activity.
- CAutomatically alerting users when established behavioral baselines are exceeded.
- DSaving time in alerting and analyzing versus manually doing so.
25Which of the following is true about Guardium's entitlement reports?
- AGuardium includes a set of built-in entitlement report definitions for all supported databases.
- BGuardium does not offer standard built-in entitlement reports and the user must create these reports based on their database specifications.
- CGuardium includes Oracle entitlement reports as a standard feature, however reports for all other database engines (ie. IBMDB2) must be manually created.
- DGuardium's entitlement reporting requires a monthly subscription service.
26Which of the following steps must be taken before a custom table can be defined on the Guardium appliance?
- AThe Guardium API must be used to notify the engine that a custom table is going to be defined.
- BAll other users of the Guardium user interface must be logged off since there can only be one active session when the custom table is being defined.
- CA test provided by Guardium must be run on the data server to make sure no malicious data is found in the table to be queried.
- DData in the existing database must be verified to make sure that the different data types are supported by Guardium's custom tables.
27Data is collected through a security policy using non-selective audit trail that only consists of rules with alert action. Which of the following cannot be viewed when reporting on these data?
- ASQL construct
- BSQL timestamp
- CClient IP
- DSQL Values
28How is authentication and encryption implemented between collectors, aggregators and the Central Policy Manager in a multi-tier Guardium environment?
- AUsing an encrypted file containing the system password that must be copied to the Central Policy Manager and collectors.
- BA System Shared Secret is specified through the GUI for each collector and the Central Policy Manager.
- CThe Central Policy Manager scans the network for Guardium collectors and performs a security handshake with each appliance.
- DThe communication between collectors and the Central Policy Manager is based on unsecured network packets.
29What is the name of the software-based Guardium probe that can be configured on a supported application server to capture web credentials?
- AP-TAP
- BY-TAP
- CS-TAP
- DL-TAP
30What is the simplest definition of a Guardium domain?
- AA Guardium entity containing a series of attributes.
- BA model of a Guardium system describing the different entities involved in the environment and their relationships.
- CA simple identification label to indicate ownership or control of a Guardium resource.
- DGrouping of a set of tables and relationships between those tables providing a view of the data that Guardium stores.
31In a Guardium environment where data servers can talk to the collector, what is the relationship between the S-TAP and the collector appliance?
- AThere is no relationship since the S-TAP and the collector are incompatible Guardium entities.
- BThe S-TAP reports database activity to the collector for policy management and auditing.
- CA collector can only interact with one S-TAP for policy management and auditing.
- DThe collector sends the S-TAP information about its policies so it knows what traffic to intercept.
32Which termination mechanism is most suitable for monitoring privileged users where preventing data leaks is much more important than latency?
- AS-GATE Terminate.
- BS-TAP Terminate.
- CBoth S-TAP and S-GATE Terminate.
- DRESET.
33Guardium can work on heterogeneous environments, therefore, which architectures are supported by an S-TAP agent?
- AWindows, Linux, Android, zOS
- BWindows, Unix, Linux, Mac
- CLinux, zOS, jSeries, Windows
- DiSeries, Linux, zOS, Windows
34Which of the following native SQL commands is required to link external data to internal data?
- AIMPORT
- BJOIN
- CALTER
- DLINK
35Which of the following logging actions will not log the full SQL and parameter values?
- ALog Full Details.
- BAudit Only.
- CLog Full Details with Values.
- DLog Full Details per Session.
36What is one of the advantages of S-TAP over traditional SPAN implementation?
- AMonitoring network activities.
- BNone, as S-TAP is an identical software implementation of SPAN.
- CMonitoring local traffic.
- DFaster communication with the collector.
37Which of the following Guardium facilities is used to import external data?
- AExternal Data Correlation
- BMulti-format Importing Utility
- CSpecial Data Collector
- DSystem Integration Facility.
38Which of the following statements is true about queries and reports in Guardium?
- AA query can only be used to create one report.
- BA query can be used to create many reports.
- CA report can be based on the combination of multiple queries.
- DA query can only be used to create either a tabular or a chart style report, but not both.
39What is Guardium's Database Protection Subscription Service?
- AA service that may be purchased separately in order to enable Guardium to safeguard database management systems other than Sybase AES.
- BA subscription to the latest updates for the various Guardium product components.
- CAn additional package required for the vulnerability and threat management solutions to integrate with CAS.
- DA service that provides the Guardium instance with quarterly updates to its built-in assessment tests, so the assessment is up-to-date with industry best practices and new vulnerabilities.
40What is a Guardium vulnerability assessment (VA)?
- AA test that employs state-of-the-art algorithms to determine the potential risks of your network.
- BA series of predefined and custom tests that allow customers to automatically identify and address database vulnerabilities.
- CAn optional service from Guardium where a security specialist visits a customer's site before a proof-of-concept engagement to determine the customer's specific requirements.
- DA piece of software distributed as a multi-platform plug-in that allows a supported database management system to constantly monitor potential threats and report on these periodically.
41Which of the following is not a valid termination action for an extrusion rule?
- ATermination actions are not available for extrusion rules.
- BS-TAP Terminate.
- CTermination actions are available for extrusion rules, however these are executed by the database management system and not Guardium.
- DS-GATE Terminate.
42Which of the following is a valid use case for scheduled database auto-discovery?
- ADatabase auto-discovery cannot be scheduled because the user must specify a series of IP addresses and port ranges every time prior to running the process.
- BAutomating the cataloging of new database instances so the administrator does not have to perform this task manually.
- CEnsuring that S-TAP instances have the latest database configuration for all the databases that are being monitored.
- DIdentifying new or rogue databases across environments, as well as new instances that may have been created within existing, already discovered database services.
43When the S-TAP is in open mode, what would you need to configure to enforce a termination without any data leaking?
- AUsing a rule with an S-GATE Attach action to terminate the activity.
- BUsing a rule with an S-GATE Terminate action to terminate the activity.
- CUsing an S-GATE Attach action to put the session in closed mode when the session is initiated, and using a rule with an S-GATE Terminate action to terminate the activity.
- DUsing an S-GATE Terminate action to put the session in closed mode when the session is initiated, and using a rule with an S-TAP Terminate action to terminate the activity.
Informationen
- Beschreibung
- Quiz am Guardium, erstellt von vitibo am 26/01/2016.
- Autor
- vitibo
- Sprache
- Español
- Aufrufe
- 14
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz