Deep

Question 1

-Which of the following allows you to prevent a file from being scanned for malware?

Accepted Answer

Add the file to the Exclusions list in the Malware Scan Configuration

Answer

Enable File Types scanned by IntelliScan in the Malware Scan Configuration properties in the Deep Security Manager Web console. Click Scan All Except and type the filename to exclude from the scan ()

Answer

Edit the Scan Exclusions section of the dsa.properties configuration file on the Deep Security Agent computer to include the file name. Save the configuration file and restart the Deep Security Agent service.

Answer

Add the file to the Exclusions list in the Allowed Spyware/Grayware Configuration

Question 2

Policies in Deep Security can include a Context value. Which of the following statements regarding Context is correct?

Accepted Answer

The Context provides Deep Security Agents with location awareness and is associated with Firewall and Intrusion Prevention Rules

Answer

The Context provides Deep Security Agents with location awareness and is associated with Anti-Malware and Web Reputation Rules.

Answer

The Context provides Deep Security Agents with location awareness and is associated with Log Inspection and Integrity Monitoring Rules

Answer

The Context provides Deep Security Agents with location awareness and is associated with Web Reputation Rules only

Question 3

What Trend Micro product offers pre-runtime scanning of containers?

Accepted Answer

Cloud One – Container Security

Answer

Deep Security Agent

Answer

Deep Security Manager

Answer

Deep Security Scanner

Question 4

The details for an event are displayed in the exhibit. Based on these details, which protection module generated the event?

Accepted Answer

Firewall

Answer

Intrusion Prevention

Answer

Integrity Monitoring

Answer

Log Inspection

Question 5

Which of the following statements is false regarding Firewall rules using the Bypass action?

Accepted Answer

Applying a Firewall rule using the Bypass action to traffic in one direction automatically applies the same action to traffic in the other direction

Answer

Firewall rules using the Bypass action do not generate log events

Answer

Firewall rules using the Bypass action allow traffic to flow as efficiently as if a Deep Security Agent was not there.

Answer

Firewall rules using the Bypass action allow incoming traffic to skip both Firewall and Intrusion Prevention analysis.

Question 6

Which of the following statements is true regarding Deep Security Relays?

Accepted Answer

Deep Security Agents communicate with Deep Security Relays to obtain security updates.

Answer

Both 32-bit and 64-bit Deep Security Agents can be promoted to a Deep Security Relay

Answer

Deep Security Agents promoted to Deep Security Relays no longer provide the security capabilities enabled by the protection modules.

Answer

Deep Security Relays are able to process Deep Security Agent requests during updates

Question 7

Multiple Application Control events are being displayed in Deep Security after a series of application updates and the administrator would like to reset Application Control. How can this be done?

Accepted Answer

Application Control can be reset by disabling the protection module, then enabling it once again. This will cause local rulesets to be rebuilt.

Answer

On the Deep Security Agent computer, type the following command to reset Application Control: dsa_control -r

Answer

Click Clear All on the Actions tab in the Deep Security Manager Web console to reset the list of Application Control events.

Answer

Application Control cannot be reset.

Question 8

Which of the following correctly describes the Firewall rule action of Force Allow?

Accepted Answer

Force Allow permits traffic that would otherwise be denied by other Firewall rules to pass, but still enforces filtering by the Intrusion Prevention protection module

Answer

Force Allow permits traffic to bypass analysis by both the Firewall and Intrusion Prevention protection modules

Answer

Force Allow permits traffic to bypass analysis by all Deep Security protection modules

Answer

Force Allow explicitly allows traffic that matches the Firewall rule to pass, and implicitly denies all other traffic

Question 9

Your organization stores PDF and Microsoft Office files within the SAP Netweaver platform and requires these documents to be scanned for malware. Which Deep Security component is required to satisfy this requirement?

Accepted Answer

The Netweaver plug-in must be installed on the Deep Security Agent.

Answer

No extra components are required, this can be done by enabling the Anti-Malware protection module on the SAP Netweaver server.

Answer

Deep Security Scanner is required

Answer

A Smart Protection Server must be installed and configured to service the SAP Netweaver platform

Question 10

Which of the following are valid methods for pre-approving software updates to prevent Application Control Events from being triggered by the execution of the modified software? Select all that apply

Accepted Answer

Software updates performed by a Trusted Updater will be automatically approved

Accepted Answer

Maintenance mode can be enabled while completing the udpates.

Answer

Edit the inventory database file (AC.db) on the Agent computer to include the hash of the newly updated software.

Answer

Save the change and restart the Deep Security Agent. The updates software will now be approved. Once the inventory scan has run when Application Control is first enabled, there is no way to update the inventory to incorporate modified software.

Question 11

1-Deep Security Agents			a-Collects and submits suspicious files for analysis
2-Deep Security Manager		b-Compiles and distributes the Suspicious Objects List
3-Deep Discovery Analyzer		c-Executes and observes the suspicious files in an 						isolated sandbox environment
4-Apex Central				d-Detects suspicious files
[blank_start]___[blank_end]

Accepted Answer

___

Question 12

Which of the following statements correctly identifies the purpose of the Integrity Monitoring protection module?

Accepted Answer

The Integrity Monitoring protection module monitors critical operating system objects such as services, processes, registry keys and ports to detect and report malicious or unexpected changes.

Answer

The Integrity Monitoring protection module monitors traffic to verify the integrity of incoming traffic to identify protocol deviations, packets fragments and other protocol anomalies.

Answer

The Integrity Monitoring protection module monitors incoming traffic to confirm the integrity of header information including packet source and destination details.

Answer

The Integrity Monitoring protection module monitors and analyzes the integrity of application logs to identify tampering, corruption and other suspicious modifications to the logs.

Question 13

- Which of the following statements is true regarding Event Tagging?

Accepted Answer

Events can be tagged automatically if they are similar to known good events.

Answer

Only a single tag can be assigned to an event

Answer

Events can be automatically deleted based on tags

Answer

Adding a tag to an event modifies the event data by adding fields, including the name of the tag, the date the tag was applied, and whether the tag was applied manually or automatically.

Question 14

Based on the details of the event displayed in the exhibit, which of the following statements is false?

Accepted Answer

The Intrusion Prevention protection module must be enabled to detect reconnaissance scans.

Answer

The scan may be generated from an IP address which may be known to you. If so, the source IP address can be added to the reconnaissance allow list

Answer

You can instruct the Deep Security Agents and Appliances to block traffic from the source IP address for a period of time.

Answer

You can create a firewall rule to permanently block traffic from the originating IP address.

Question 15

Which of the following statements regarding the Integrity Monitoring protection module is true?

Accepted Answer

The Integrity Monitoring protection module can detect changes to the system but lacks the ability to distinguish between legitimate and malicious changes

Answer

Any changes to the system objects monitored by the Integrity Monitoring protection module are assumed to be legitimate, however, an administrator can revise the status of the object modification to malicious during a review of the Integrity Monitoring events.

Answer

The Integrity Monitoring rules include a property that identifies whether a change to a monitored system object was performed as part of a legitimate operation.

Answer

Any changes to monitored system objects that are detected after a Recommendation Scan is run on the protected computer are assumed to be malicious.

Question 16

The Intrusion Prevention protection module is enabled, and a recommendation scan is run to identify vulnerabilities on a Windows Server 2016 computer. How can you ensure that the list of recommendations is always kept up to date?

Accepted Answer

Enable Ongoing Scans to run a recommendation scan on a regular basis. This will identify new Intrusion Prevention rules to be applied.

Answer

When Automatically implement Intrusion Prevention Recommendations is enabled for a computer, any new rules released by Trend Micro over time will automatically be applied.

Answer

Recommendation scans are only able to suggest Intrusion Prevention rules when the protection module is initially enabled

Answer

Disabling, then re-enabling the Intrusion Prevention protection module will trigger a new recommendation scan. New rules will be included in the results of this new scan.

Question 17

Which of the following is not an operation that is performed when network traffic is intercepted by the network driver on the Deep Security Agent?

Accepted Answer

Compare the data in the packet against the Anti-Malware Scan Configuration to verify whether any of the data related to files and folders on the Exclusion list.

Answer

Verify the integrity of the packet to ensure the packet is suitable for analysis.

Answer

Verify the packet is not part of a reconnaissance scan used to discover weaknesses on the Deep Security Agent host computer

Answer

Analyze the packet within the context of traffic history and connection state

Question 18

- Which of the following is NOT an operation that can be performed on Deep Security resources using the API?

Accepted Answer

VIEW

Answer

PUT

Answer

GET

Answer

POST

Question 19

- Recommendation scans can detect applications, system objects and/or vulnerabilities on servers on the network. Which of the following protection modules make use of recommendation scans?

Accepted Answer

Intrusion Prevention, Integrity Monitoring, and Log Inspection

Answer

Intrusion Prevention, Firewall, Integrity Monitoring and Log Inspection

Answer

Firewall, Application Control, and Integrity Monitoring

Answer

Log Inspection, Application Control, and Intrusion Prevention

Question 20

A priority value of 0 is always assigned to Firewall rules using the Allow action. Select the correct answer from the drop-down list. TRUE

Accepted Answer

True

Answer

False

Question 21

Which of the following statements correctly describes Smart Folders?

Accepted Answer

Smart Folders act as a saved search of computers which is executed each time the folder is clicked to display its contents

Answer

Smart Folders are a collection of subfolders containing the policy settings that are applied to child policies or directly to computers.

Answer

Smart Folders identify the folders that will be scanned when a real-time, manual or scheduled malware scan is run.

Answer

Smart Folders are the containers used to store the results of recommendation scans. Once a recommendation scan has completed, and administrator can click a Smart Folder and select which of the recommended rules to apply

Question 22

Which of the following statements is true regarding Intrusion Prevention rules?

Accepted Answer

Intrusion Prevention rules can detect, or block traffic associated with specific applications, such as Skype or file-sharing utilities.

Answer

Intrusion Prevention rules can block unrecognized software from executing.

Answer

Intrusion Prevention rules check for the IP addresses of known malicious senders within a packet.

Answer

Intrusion Prevention rules monitor the system for changes to a baseline configuration

Question 23

Why is a multi-node installation of Deep Security recommended?

Accepted Answer

Multi-node installations provide Deep Security with failover capabilities since a second Deep Security Manager can handle all requests if the first one fails.

Answer

Since multi-node installations distribute database information across multiple database servers, Deep Security can easily scale to accommodate any number of Deep Security Agent servers.

Answer

Since each Deep Security Manager server in a multi-node installation uses its own database, this type of installation can balance the load of requests.

Answer

Multi-node installations are helpful in disaster recovery situations as each combination of Deep Security Manager and database are clones of each other. When the original Deep Security Manager fails, the administrator can immediately switch to a clone.

Question 24

Which of the following correctly identifies the order of the steps used by the Web Reputation protection module to determine if access to a web site should be allowed?

Accepted Answer

1. Checks the Approved list.
2. Checks the Deny list.
3. Checks the cache.
4. If not found in any of the above, retrieves the credibility score from the Web Reputation Service.
5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

Answer

1. Retrieves the credibility score from Web Reputation Service. Evaluates the credibility score against the Security Level
2. Checks the Deny list to determine if access to the web site should be blocked.
3. Checks the Approved list to determine if access to the web site should be allowed.

Answer

1. Checks the cache.
2. Checks the Approved list.
3. Checks the Deny list.
4. If not found in any of the above, retrieves the credibility score from the Web Reputation Service.
5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

Answer

1. Checks the Deny list.
2. Checks the Approved list.
3. Checks the cache.
4. If not found in any of the above, retrieves the credibility score from Rating Server.
5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

Question 25

The [blank_start]_________[blank_end] modules does not benefit from recommendation scans. Select the correct answer from the drop-down list..

Accepted Answer

Firewall

Question 26

Based on the policy configuration displayed in the exhibit, which of the following statements is true?

Accepted Answer

Deep Security Agents will send event information to Deep Security Manager every 10 minutes.

Answer

Administrators with access to the protected server will be able to uninstall the Deep Security Agent through Windows Control Panel.

Answer

If the Deep Security Manager does not receive a message from the Deep Security agent every 20 minutes, an alert will be raised.

Answer

Changes to any of the Deep Security policies will be send to the Deep Security Agents as soon as the changes are saved

Question 27

Which of the following statements is true regarding Maintenance Mode in the Application Control protection module?

Accepted Answer

When in Maintenance Mode, the Application Control protection module will continue to block software identified in Block rules but will allow new and changed applications to be added to the software inventory.

Answer

When enabled, Maintenance Mode rescans the protected computer to rebuild the software inventory. Any new or changed software will be included in this rebuilt inventory

Answer

Maintenance Mode can be configured as a scheduled event. In this scenario, all software upgrades will be performed at the same time every day to avoid creating alerts for normal software updates

Answer

While in Maintenance Mode, all Block and Allow rules are ignored while new or updated applications are added to the software inventory

Question 28

Which of the following items must be included in any request for resources that are made through the Deep Security API? Select all that apply.

Accepted Answer

API key

Accepted Answer

URL of the API-enabled resource

Accepted Answer

API version

Answer

Administrator password

Question 29

Based on the Malware Scan Configuration displayed in the exhibit, which of the following statements is false?

Accepted Answer

Any document files that display suspicious behavior will be submitted and executed in a sandbox environment on a Deep Discover Analyzer device

Answer

Deep Security Agents will only be able to identify malware in files by using patterns downloaded from the Smart Protection Network.

Answer

Deep Security Agents using this Malware Scan Configuration will not monitor for compromised Windows processes.

Answer

Internet access is required to properly enable the features identified in this configuration.

Question 30

A Deep Security administrator wishes to monitor a Windows SQL Server database and be alerted of any critical events which may occur on that server. How can this be achieved using Deep Security?

Accepted Answer

The administrator could install a Deep Security Agent on the server hosting the Windows SQL Server database and enable the Log Inspection protection module. A rule can be assigned to monitor the Windows SQL Server for any critical events, with alerts enabled.

Answer

The administrator could install a Deep Security Agent on the server hosting the Windows SQL Server database and enable the Intrusion Prevention protection module. A recommendation scan can be run, and any suggested rules can be assigned to monitor the Windows SQL Server for any vulnerabilities, with alerts enabled.

Answer

This cannot be achieved using Deep Security. Instead, the administrator could set up log forwarding within Window SQL Server and the administrator could monitor the logs within the syslog device

Answer

The administrator could install a Deep Security Agent on the server hosting the Windows SQL Server database and enable the Integrity Monitoring protection module. A rule can be assigned to monitor the Windows SQL Server for any modifications to the server, with alerts enabled.

Question 31

Based on the Computer settings displayed in the exhibit, which of the following statements is correct?

Accepted Answer

Administrators performing maintenance on this server will require a password to disable the Deep Security Agent service

Answer

Recommendation Scans will be performed automatically on this server whenever new rules are downloaded from the ActiveUpdate Server to determine if they must be applied.

Answer

The Deep Security Agent on this server will contact the Smart Protection Network directly to submit file features for Predictive Machine Learning analysis.

Answer

If this server does not communicate with Deep Security Manager for a specific period, it will be automatically removed from the computers list

Question 32

A collection of servers protected by Deep Security do not have Internet access. How can Smart Scan be used on these computers?

Accepted Answer

Install a Smart Protection Server in the environment and set it as the source for the File Reputation Service.

Answer

Smart Scan can be configured to use a local pattern file containing the same information as the Smart Protection Network.

Answer

Promote one of the Deep Security Agents on the air-gapped computers to become a Relay

Answer

Smart Scan must contact the Smart Protection Network to function. Any servers without Internet access will be unable to use Smart Scan

Question 33

Which of following statements best describes Machine Learning in Deep Security?

Accepted Answer

Machine Learning is malware detection technique in which features of an executable file are compared against a cloud-based learning model to determine the probability of the file being malware.

Answer

Machine Learning is a malware detection technique in which files are scanned based on the true file type as determined by the file content, not the extension

Answer

Machine Learning is a malware detection technique in which the Deep Security Agent monitors process memory in real time and once a process is deemed to be suspicious, Deep Security will perform additional checks with the Smart Protection Network to determine if this is a known good process.

Answer

Machine Learning is a malware detection technique in which processes on the protected computer are monitored for actions that are not typically performed by a given process.

Question 34

Which of the following Smart Protection Services is used by Smart Scan?

Accepted Answer

File Reputation Service

Answer

Census Service

Answer

Web Reputation

Answer

Certified Safe Software Service

Question 35

Which of the following statements is correct regarding the policy settings displayed in the exhibit?

Accepted Answer

The Heartbeat interval value displayed in this policy is inherited from the parent policy.

Answer

Deep Security Manager will refresh the policy details on the Deep Security Agents using this policy every 5 minutes

Answer

Deep Security Agents using the displayed policy will send event details to Deep Security Manager every 5 minutes.

Answer

All Deep Security Agents will send event details to Deep Security Manager every 5 minutes.

Question 36

The Intrusion Prevention protection module is enabled, but the traffic it is trying to analyze is encrypted through https. How is it possible for the Intrusion Prevention protection module to monitor this encrypted traffic against the assigned rules?

Accepted Answer

It is possible to monitor the https traffic by creating an SSL Configuration. Creating a new SSL Configuration will make the private key information needed to decrypt the traffic available to the Deep Security Agent.

Answer

The Intrusion Prevention protection module is not able to analyze encrypted https traffic

Answer

The Intrusion Prevention protection module can analyze https traffic if the public certificate of the originating server is imported into the certificate store on the Deep Security Agent computer.

Answer

The Intrusion Prevention protection module can only analyze https traffic originating from other servers hosting a Deep Security Agent.

Question 37

Which of the following operations makes use of the Intrusion Prevention protection module?

Accepted Answer

Stateful traffic analysis

Answer

Application traffic control

Answer

Integrity scans

Answer

Port scans

Question 38

The Log Inspection protection module is supported in both Agent-based and Agentless implementations.

Accepted Answer

Log Inspection can only examine new events and cannot examine logs entries created before the protection module was enabled

Answer

The Log Inspection protection module is supported in both Agent-based and Agentless implementations.

Answer

Deep Security Agents forward Log Inspection event details to Deep Security Manager in real time.

Answer

Log Inspection can only examine Deep Security log information

Question 39

Your organization would like to implement a mechanism to alert administrators when files on a protected servers are modified or tampered with. Which Deep Security protection module should you enable to provide this functionality?

Accepted Answer

The Integrity Monitoring protection module

Answer

The File Inspection protection module

Answer

Deep Security cannot provide this type of functionality

Answer

The Intrusion Prevention protection module

Question 40

The Overrides settings for a computer are displayed in the exhibit. Which of the following statements is true regarding the displayed configuration?

Accepted Answer

The configuration for the protection modules is inherited from the policy assigned to this computer, except for the configuration of the Web Reputation and Application Control protection modules which have been set at the computer level.

Answer

The protection modules identified as Inherited in the exhibit have not yet been configured. Only the Web Reputation and Application Control protection modules have been configured.

Answer

The protection modules identified as Inherited in the exhibit have not yet been enabled. Only the Web Reputation and Application Control protection modules have been enabled at this point.

Answer

The Web Reputation and Application Control protection modules have been assigned a different policy that the other protection modules and as a result, are displayed with overrides.

Question 41

Which of the following file types would not be evaluated by the Application Control protection module?

Accepted Answer

.docx files

Answer

.exe files

Answer

.class files

Answer

.py scripts

Question 42

What is the purpose of the Deep Security Relay?

Accepted Answer

Deep Security Relays are responsible for retrieving security and software updates and making them available them to Deep Security Manager, Agents and Virtual Appliances.

Answer

Deep Security Relays distribute load to the Deep Security Manager nodes in a high-availability implementation.

Answer

Deep Security Relays maintain the caches of policies applied to Deep Security Agents on protected computers to improve performance

Answer

Deep Security Relays forward policy details to Deep Security Agents and Virtual Appliances immediately after changes to the policy are applied.

Question 43

New servers are added to the computers list in the Deep Security Manager Web console by running a Discover operation. What behavior can you expect for newly discovered computers?

Accepted Answer

Any servers within the IP address range will be added to the computers list, regardless of whether they are hosting a Deep Security Agent or not.

Answer

Any servers within the IP address range that are hosting Deep Security Agents will be added to the computers list and will be automatically activated.

Answer

Any servers discovered in the selected Active Directory branch hosting a Deep Security Agent will be added to the computers list.

Answer

Any servers within the IP address range hosting a Deep Security Agent will be added to the computers list.

Question 44

What is the result of performing a reset operation on a Deep Security Agent?

Accepted Answer

A reset operation wipes out any Deep Security Agent settings and policies, as well as its relationship with Deep Security Manager.

Answer

A reset operation forces an update to the Deep Security Agent software installed on a managed computer.

Answer

A reset operation forces the Deep Security Agent service to restart on the managed computer.

Answer

A reset operation generates event information that can be used to troubleshoot Agent-to-Manager communication issues.

Question 45

Which of the following statements is false regarding the Log Inspection protection module?

Accepted Answer

The Log Inspection protection module is supported in both agent-based and agentless environments.

Answer

Custom Log Inspections rules can be created using the Open-Source Security (OSSEC) standard.

Answer

Deep Security Manager collects Log Inspection Events from Deep Security Agents at every heartbeat.

Answer

Scan for Recommendations identifies Log Inspection rules that Deep Security could implement.

Question 46

The Intrusion Prevention protection module is enabled, its behavior is set to Prevent and rules are assigned. When viewing the events, you notice that one of Intrusion Prevention rules is being triggered and an event is being logged but the traffic is not being blocked. What is a possible reason for this?

Accepted Answer

The default prevention behavior in this particular rule may be set to Detect. This logs the triggering of the rule but does not actually enforce the block.

Answer

The Deep Security Agent is experiencing a system problem and is not processing packets since the Network Engine System Failure mode is set to Fail Open.

Answer

The Intrusion Prevention rule is being triggered as a result of the packet sanity check failing and the packet is being allowed to pass.

Answer

The network engine is running in Inline mode. In Inline mode, Deep Security provides no protection beyond a record of events.

Question 47

Which of the following are valid methods for forwarding event information from Deep Security? Select all that apply.

Accepted Answer

Deep Security Application Programming Interface (API)

Accepted Answer

Security Information and Event Management (SIEM)

Accepted Answer

Amazon Simple Notification Service (SNS)

Accepted Answer

Simple Network Management Protocol (SNMP)

Question 48

Based on the following exhibit, what behavior would you expect for the Application Control protection module?

Accepted Answer

Since this computer is in Maintenance Mode, new or changed software will be automatically added to the software inventory for this server.

Answer

Since this computer is in Maintenance Mode, updates to the Application Control protection module will be applied.

Answer

Since this computer is in Maintenance Mode, Application Control will ignore any blocked software in the currently active ruleset.

Answer

Since this computer is in Maintenance Mode, Application Control will allow any blocked software to temporarily run.

Question 49

Which of the following statements is true regarding Intrusion Prevention protection?

Accepted Answer

Intrusion Prevention protection can drop or reset a connection.

Answer

Intrusion Prevention protection only works in conjunction with the Anti-Malware protection module.

Answer

Intrusion Prevention protection can drop malicious packets but cannot reset the connection

Answer

Intrusion Prevention protection can only work on computers where a Deep Security Agent is installed; agentless protection is not supported.

Question 50

In the policy displayed in the exhibit, the state of the Web Reputation protection module is set to Inherited (On), while the state for the other protection modules is set to On. Why is the Web Reputation protection module displayed differently than the other protection modules.

Accepted Answer

In this example, the state for the Web Reputation protection module is inherited from the parent policy, while the other protection modules were turned on specifically in this child policy.

Answer

In this example, the state for the Web Reputation protection module is inherited from the parent policy, while the other protection modules were turned on at the computer level.

Answer

The state for a protection module is always displayed as Inherited (On) until the module components are installed on the Deep Security Agent.

Answer

In this example, the state for the Web Reputation protection module is listed as Inherited (On) as it was inherited from the default setting in the Base Policy.

Question 51

In which of the following scenarios should a new Integrity Monitoring baseline be created? Select all that apply.

Accepted Answer

A new baseline should be created after applying software patches.

Accepted Answer

A new baseline should be created whenever new Integrity Monitoring rules are downloaded from the Trend Micro ActiveUpdate server.

Answer

Once created, there is no need to create a new Integrity Monitoring baseline.

Answer

A new baseline should be created whenever changing the Integrity Monitoring scan interval, for example, changing from real-time to manual scans.

Question 52

An administrator attempts to activate the Deep Security Agent installed on a server by typing the following command in the Command Prompt on the Deep Security Agent computer:
 dsa_control -a dsm://server1.acme.com:4120
The Agent does not activate as expected. What is a valid reason for this issue?

Accepted Answer

Allow Agent-Initiated Activation is currently not enabled in Deep Security Manager.

Answer

The incorrect port was used. The correct command would be:
dsa_control -a dsm://server1.acme.com:4118

Answer

Deep Security Agents cannot be activated through the Command Prompt. They must be activated through the Deep Security Manager Web console or through a deployment script.

Answer

The command listed can only executed from the Command Prompt on the Deep Security Manager computer.

Question 53

Which of the following statements is true regarding software inventories used as part of the Application Control protection module?

Accepted Answer

When an administrator allows software that would be otherwise blocked by the Enforcement Mode, it isn't added to the inventory of approved software. Instead, it is added to that computer's allow list.

Answer

An administrator can view the list of allowed software in the inventory from the Details tab for each individual Computer.

Answer

Disable the Application Control protection module when installing software upgrades, otherwise, the new software will be prevented from installing.

Answer

An administrator can share the inventory of allowed software with other computers protected by Deep Security Agents, by copying the inventory database file (ac.db) from the source computer.

Question 54

What is the purpose of the Deep Security Notifier?

Accepted Answer

The Deep Security Notifier is an application in the Windows System Tray that communicates the state of Deep Security Agents and Relays to endpoint computers.

Answer

The Deep Security Notifier is a server component used in agentless configurations to allow Deep Security Manager to notify managed computers of pending updates.

Answer

The Deep Security Notifier is a server components that collects log entries from managed computers for delivery to a configured SIEM device.

Answer

The Deep Security Notifier is an application in the Windows System Tray that displays the status of Deep Security Manager during policy and software updates.

Question 55

What is IntelliScan?

Accepted Answer

IntelliScan is a technique used to identify which files are subject to malware infection and scans only those files.

Answer

IntelliScan is a malware scanning technique that monitors process memory in real time. It can identify known malicious processes and terminate them.

Answer

IntelliScan reduces the risk of viruses entering your network by blocking real-time compressed executable files and pairs them with other characteristics to improve malware catch rates.

Answer

IntelliScan is a mechanism that improves scanning performance. It recognizes files that have already been scanned based on a digital fingerprint of the file

Question 56

Which of the following statements is true regarding the Intrusion Prevention protection module?

Accepted Answer

The Intrusion Prevention protection module analyzes the payload within incoming and outgoing data packets to identify content that can signal an attack.

Answer

The Intrusion Prevention protection module blocks or allows traffic based on header information within data packets.

Answer

The Intrusion Prevention protection module can prevent applications from executing, allowing an organization to block unallowed software.

Answer

The Intrusion Prevention protection module can identify changes applied to protected objects, such as the Hosts file, or the Windows Registry.

Question 57

Which Deep Security protection modules can be used to provide runtime protection for the Kubernetes and Docker platforms? Select all that apply.

Accepted Answer

Log Inspection

Accepted Answer

Intrusion Prevention

Accepted Answer

Integrity Monitoring

Answer

Anti-Malware

Question 58

The maximum disk space limit for the Identified Files folder is reached. What is the expected Deep Security Agent behavior in this scenario?

Accepted Answer

Deep Security Agents will delete the oldest files in this folder until 20% of the allocated space is available.

Answer

Files will no longer be quarantined. Any new files due to be quarantined will be deleted instead.

Answer

Deep Security Agents will delete any files that have been in the folder for more than 60 days.

Answer

Any existing files are in the folder are compressed and forwarded to Deep Security Manager to free up disk space.

Question 59

How does Smart Scan vary from conventional pattern-based anti-malware scanning?

Accepted Answer

Smart Scan shifts much of the malware scanning functionality to an external Smart Protection Server.

Answer

Smart Scan is performed in real time, where conventional scanning must be triggered manually, or run on a schedule.

Answer

Smart Scan improves the capture rate for malware scanning by sending features of suspicious files to a cloud-based server where the features are compared to known malware samples.

Answer

Smart Scan identifies files to be scanned based on the content of the file, not the extension.

Question 60

Which of the following statements is true regarding Firewall rules?

Accepted Answer

Firewall rules applied through a parent-level policy cannot be unassigned in a child-level policy.

Answer

Firewall rules are always processed in the order in which they appear in the rule list, as displayed in the Deep Security Manager Web console.

Answer

When traffic is intercepted by the network filter, Firewall Rules in the policy are always applied before any other processing is done.

Answer

Firewall rules applied to policy supersede similar rules applied to individuals computers.

Question 61

The Firewall protection module is enabled on a server through the computer details. What is default behavior of the Firewall if no rules are yet applied?

Accepted Answer

All traffic is permitted through the firewall until either a Deny or Allow rule is assigned.

Answer

All traffic is blocked by the firewall until an Allow rule is assigned

Answer

A collection of default rules will automatically be assigned when the Firewall protection module is enabled.

Answer

All traffic is passed through the Firewall using a Bypass rule

Question 62

The Security Level for Web Reputation in a policy is set to High. A server assigned this policy attempts to access a Web site with a credibility score of 78. What is the result?

Accepted Answer

The Deep Security Agent blocks access as the credibility score for the Web site is below the allowed threshold. An error page is displayed in the Web browser

Answer

The Deep Security Agent displays a warning message as the site is unrated.

Answer

The Deep Security Agent allows access to the Web site, and logs the connection attempt as an event.

Answer

The Deep Security Agent allows access as the credibility score for the Web site is above the allowed threshold.

Question 63

How is caching used by the Web Reputation protection module?

Accepted Answer

Caching is used by the Web Reputation protection module to temporarily store the credibility score for a Web site. The retrieved credibility score is cached in case the score for the Web site is required again for the life of the cache.

Answer

Caching is used by the Web Reputation protection module to temporarily store the pages that make up the Web site. The Web site is cached in case the site is visited again within the life of the cache.

Answer

Caching is used by the Web Reputation protection module to keep track of Allowed and Blocked Web sites. Any sites that are Allowed or Blocked do not require the retrieval of a credibility score from the Trend Micro Web Reputation Service.

Answer

Caching is used by the Web Reputation protection module to keep track of Web sites that are added to the Allowed list. Any sites added to the Allowed list will be accessible by protected servers regardless of their credibility score.

Question 64

While viewing the details of the Firewall protection module, as displayed in the exhibit, you note that a few rules have already been assigned. You try to disable these rules, but they cannot be unassigned. Why can the displayed rules not be unassigned?

Accepted Answer

The rules displayed in the exhibit have been assigned to the policy at the parent level. Rules assigned to a parent policy cannot be unassigned at the child level

Answer

The rules displayed in the exhibit were assigned to the policy automatically when a recommendation scan was run. Rules assigned through a recommendation scan cannot be disabled once assigned

Answer

The rules displayed in the exhibit have been hard coded with the details of the policy. These rules will automatically be assigned to all Firewall policies that are created and cannot be unassigned.

Answer

The rules displayed in the exhibit cannot be unassigned as the administrator currently logged into the Deep Security Manager Web console does not have the permissions necessary to unassign rules.

Deep

Questions in this quiz (70)

Information

Feedback

What do you think of the new look?