Deck 2: Certified McAfee Security Specialist - NSP

Question 1

Which CLI command is used to copy sensor SSL certificates from external flash when replacing a failed sensor?

A) Exportsensorcerts
B) Importsensorcerts
C) Exportcerts
D) Importcerts

Answer 1

Importsensorcerts

Question 2

Which of the following deployment modes receives a copy of the packet from a mirrored switch port?

A) Redundant
B) SPAN
C) TAP
D) In-line

Answer 2

SPAN

Question 3

If the Health level of a Host cannot be determined. McAfee NAC assigns which of the following System Health levels to that Host?

A) Fair
B) Poor
C) Serious
D) Unknown

Answer 3

Unknown

Question 4

Which attack cannot be blocked when the sensor has been set for in-line mode?

A) TCP Control Anomaly
B) ICMP Echo Anomaly
C) Too Many Inbound Syn
D) SCADA Attacks

Question 5

Setting a threshold on a sensor to react if traffic volume exceeds the threshold limit is an example of what specific detection method?

A) Signature based
B) DHCP based
C) Pattern matching
D) Denial of Service (DoS)

Question 6

When the buffer on the alert cache has been filled, what happens to current incoming alerts?

A) Incoming alerts are added to the cache and the oldest alerts are dropped
B) Incoming alerts are not added to the cache and are dropped
C) Incoming alerts are held in queue until cache space is cleared
D) Incoming alerts are added to the database directly

Question 7

Policies can be configured to drop packets when which of the following has been defined?

A) The policy has been enabled
B) The underlying rule set permits dropped packets
C) The sensor is deployed in Inline mode
D) The policy has been cloned

Question 8

The Network Security Manager provides the following built-in Network Access Zones. (Choose three)

A) Allow DNS Access
B) Allow Full Access
C) Public Network Only
D) Allow DHCP Access
E) Allow Intranet Access

Question 9

Which policy is assigned to a child domain by default?

A) The default IDS policy
B) The default IPS policy
C) No default policy
D) The policy of the parent domain

Question 10

Reconnaissance Policies can be applied to which of the following sensor nodes?

A) Sensor name node only
B) Sensor interface node only
C) Sensor sub-interface node only
D) Sensor name, interface and sub-interface node

Question 11

Which mode needs to be set to redirect an unmanaged system to the guest portal?

A) Audit
B) Simulation
C) Enforcement
D) Prevention

Question 12

Which of the following modes can be used to implement DoS detection? (Choose two)

A) Learning Mode
B) Threshold Mode
C) Configuration Mode
D) Adaptive Mode
E) Transition Mode

Question 13

Which database is supported for Network Security Manager?

A) MSSQL
B) Oracle
C) MySQL
D) Sybase

Question 14

Which of the following deployment modes is not included in standard NAC?

A) System Health based NAC
B) DHCP based NAC
C) L2 based NAC
D) L3 based NAC

Question 15

Which logs are used to determine who was logged into the Manager the last time a signature set update was pushed from the Manager to the Sensor?

A) Trace log
B) Fault log
C) Manager ems log
D) User Activity Audit log

Question 16

Which of the following methods are available for upgrading a Sensor image?

A) TFTP and/or through the Manager
B) PUTTY and/or through the Manager
C) Console connection and/or through the Manager
D) TFTP, console connection and/or through the Manager

Question 17

Which command is used to manually download signature tiles from the tftpserver when connectivity to the Manager is not available?

A) Loadimage WORD
B) Loadconfig WORD
C) Loadconfiguration WORD
D) Loadsigset WORD

Question 18

Which of the following is the correct extension for a Sensor image imported into the Manager?

A) ext
B) .opt
C) jar
D) .mfe

Question 19

A sensor will redirect the host to which of the following when McAfee NAC reports the Host status as "unmanaged with an Unknown Health Level"?

A) Guest Client Portal
B) NAC Client Portal
C) Sensor Client Portal
D) DNS Server Portal

Question 20

Which of the following are considered part of the Operational mode of System Health-based NAC? (Choose three)

A) Audit
B) IPS
C) TAP
D) Simulation
E) Enforcement
F) SPAN

Question 21

Which command can be issued on a Sensor to check the health of the Sensor?

A) show
B) show settings
C) status
D) check health

Question 22

Which port needs to be opened for install Channel communication between Sensor and Manager through a firewall?

A) 8501
B) 8502
C) 8503
D) 8555

Question 23

Which CLI command is used to determine that the Sensor has established trust with the Manager?

A) config
B) status
C) trust
D) show

Question 24

Which is the correct syntax for the 'set dosprevenbonseverity' command?

A) Set dospreventionseveriry tcp-rst 150
B) Set dospreventionseverity icmp-echo-reply enable 150
C) Set dospreventionseverity tcp-syn inbound 150
D) Set dosprevenbonseverity ip-fragment inbound

Question 25

How are packet logs viewed from within the Manager?

A) Push the packet log to the Sensor and open it from there
B) Packet logs cannot be viewed from within the Manager
C) Save and export the Packet log in order to open it
D) Set the log to be viewable with Wireshark/Ethereal

Question 26

Which NSP sensor models support SSL encryption? (Choose three)

A) M-4050
B) M-1450
C) M-2750
D) M-1250
E) M-6050

Question 27

McAfee recommends which of the following methods to cable the heartbeat connection of a sensor failover pair?

A) direct fiber connection with specified monitoring ports
B) direct copper connection using response ports
C) switched fiber connection
D) direct copper connection using failopen port

Question 28

A sensor is placed in-line and is dropping traffic. This situation demands an immediate removal of the sensor from the network to let traffic flow uninterrupted. Which option will you use to verify whether the issue is due to sensor configuration or network congestion?

A) Layer2modeon
B) Layer2 mode assert
C) Layer2 mode deassert
D) Layer2 mode off

Question 29

Why is the DBAdmin tool considered a preferred method of performing system maintenance tasks that could be performed within the Manager?

A) Saves additional workload on the Manager
B) Reliability
C) Speed
D) Ease of use

Question 30

Which sensor action detects and drop attacks in real-time?

A) Drop further packets
B) Host Quarantine action
C) TCP reset
D) ICMP host unreachable

Question 31

Malware Protection requires which of the following feature or features to be enabled?

A) HTTP response scanning
B) Attack Filters
C) Performance Monitoring
D) The "Default Inline IPS" policy

Question 32

A Sensor allows the option of Layer2 forwarding for which of the following?

A) TCP and UDP ports only
B) UDP ports and VLAN interfaces only
C) TCP ports and VLAN interfaces only
D) TCP ports, UDP ports and VLAN interfaces

Question 33

A Reconnaissance Policy can be applied to which of the following?

A) Sensors
B) Sensor Ports
C) Sensors and sensor ports
D) Specific Hosts

Question 34

Which of the following commands will reestablish the Alert and packet log channel connection between the sensor and manager?

A) Connectalertandpktlogchannels
B) Disconnectalertandptologchannels
C) reconnectalertandpktlogchannets
D) deinstall

Question 35

Which sensor action allows the detection and dropping of attacks in real-time?

A) Host Quarantine action
B) ICMP Host unreachable
C) TCP reset
D) Drop further packets

Question 36

Which of the following actions can a Standby Manager of an MDR pair perform?

A) Modify sensor configuration
B) Policy configuration
C) Signature update
D) Configuration backup

Question 37

________________allows a host to be subjected to both DHCP based NAC and Identity Based Access Control when configured on different ports.

A) Integrated NAC
B) DHCP based NAC
C) Hybrid NAC
D) Health based NAC

Question 38

Which of the following is the proper step to take if an IP address change is made to the server where the Network Security Manager has been installed?

A) Change the IP address in the Network Security Manager settings
B) Change the IP address through a command-line statement
C) Reinstall the Network Security Manager
D) The IP address can never be changed on the Network Security Manager

Question 39

Which operating mode allows a sensor lo prevent attacks from reaching their intended targets?

A) Tap
B) Span
C) In-line
D) Failover

Question 40

When creating policies, which of the following rule sets are available for selection within those policies?

A) Only rule sets created using the Rule Set Editor
B) Only rule sets imported from the Sensor
C) Only rule sets created using the Rule Set Editor and Default rule sets
D) Only Default Rule sets

Question 41

_____________________are a set of Access Control List (ACL) rules that define network access provided to a host, subject to Network Access Control.

A) Network Access Lists
B) Network Access Objects
C) Network Access Zones
D) Network Access Policy

Question 42

What type of encryption is used for alert channel (control channel) communication between the Sensor and the Manager?

A) SSL with RC4
B) SSL with MD5
C) SSL with RC4 and MD5
D) DES

Question 43

Which of the following options is the best practice to use if you need to edit all attacks with a specific seventy number within an IPS policy?

A) Use the Bulk Edit feature within the Policy Editor
B) Create and run the appropriate database query
C) Edit the attacks individually
D) Use the Bulk Edit feature within the Reconnaissance Editor

Question 44

If the Health Level of the host cannot be determined, which of the following System Health Levels would be assigned?

A) Fair
B) Poor
C) Serious
D) Unknown

Question 45

By default, sensors are configured to operate in which operating mode?

A) In-line
B) Tap
C) SPAN
D) Failover

Question 46

When McAfee NAC reports the host status as unmanaged with an Unknown Hearth Level, the sensor redirects the host to which of the following?

A) Guest Client Portal
B) NAC Client Portal
C) Sensor Client Portal
D) DNS Server Portal

Question 47

Which of the following activities require a reboot of a sensor? (Choose three)

A) Enabling/Disabling SSL
B) Enabling/Disabling parsing and detection of attacks in IPv4 traffic
C) Enabling/Disabling parsing and detection of attacks in IPv6 traffic
D) Sensor software upgrade
E) Signature update

Question 48

Which of the following are the methods used by NSP to recognize and react to Denial-of-Service (DoS) attacks? (Choose three)

A) Blocking
B) Shutting down the sensor
C) Thresholds
D) Self-learning
E) Logging
F) DDoS attack tool with exploit signatures

Question 49

Which domains does a Super User have full rights to access?

A) Super Users have full rights to all domains
B) Super Users have full rights to only the domains in which they reside
C) Super Users have full rights to only sensor configuration
D) Super Users have full rights to only Parent domains

Question 50

Which of the following CLI commands will not cause an automatic reboot of the Sensor?

A) resetconfig
B) delete signatures
C) factorydefaults
D) deinstall

Question 51

Which of the following cannot be configured at the sub-interface level?

A) DoS Learning Mode
B) Assigned Policy
C) Attack Filters
D) Interface type

Question 52

In double VLAN tagging, the second VLAN tag inserted into the frame is called the:

A) Customer Identification tag (CD)
B) VLAN Identifier tag (VID)
C) Outer Identifier tag (OID)
D) Inner Identifier tad (ID)

Question 53

In L3 mode, a sensor detects an L2 device based on which address?

A) MAC
B) IP
C) Default Gateway
D) DNS

Question 54

Where in the Network Security Manager console can you see a hierarchical view of all the installed applications currently deployed and the resources associated with each?

A) Device List
B) Resource Tree
C) Details Pane
D) System Links