Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

NSVT 14 > 14.14-24 > Flashcards

14.14-24 Flashcards

1
Q

What is created so group admins can have
all permissions required to administer their individual assets while preventing access to
the rest of the ship’s network.

A

Permission Sets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When an administrator deploys with the embarkable

unit, allow them to administer their own assets by?

A

Creating a group admin account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What should you do before embarkables deploy onboard?

A

Work with group admins to remove agents before connecting to your network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What directory contains policies that have been

consolidated for a given module?

A

Comprehensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What two HIP policies are called multiple instance or

“stackable” policies, because multiple policy instances can be assigned to a single node.

A

IPS Rules and Trusted Applications,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When policies are changed in the ePO console, the changes take effect on the managed
systems when?

A

The next agent-server communication interval (ASCI).
30 minutes for smaller networks
60 minutes for larger networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Admins can assign policies in what 3 ways.

A
  1. Site or Group Level
  2. Single System
  3. Node with multiple policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What prevents admins with appropriate permissions at the same level of the System Tree from
inadvertently replacing a policy

A

Assignment Locking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q 
PA functions as what because it evaluates systems against standards developed by government and private industry such as DISA’s Security Technical
Implementation Guides (STIG) and Microsoft Best Practices Guides?
A

Independent Auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Audits consist of the what 2 components:

A
  1. A benchmark or selected profile within a benchmark

2. An audit frequency or how often data should be gathered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are documents that contain rules for describing the desired state of a system? What format is it? Essentially making them what?

A

Benchmarks
.xccdf
Files dictating what checks to run.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What appear in monitors and queries and
include additional information about the state of a system that is helpful to security officers
and network administrators when fixing issues

A

Findings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Audits are benchmarks are supplied from where?

A

McAfee
Can be imported from third-party sources
Created by you using Benchmark Editor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What monitors any specified file for changes but only maintains version changes to text files.
Admin can also: define which files should be tracked. Specify the frequency for detecting file changes

A

File Integrity Monitor

Has ability to retain up to 6 text file versions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

HIPS software requires these 6 components be installed and running to provide and
manage protection.

A
  1. ePO server and repository
  2. McAfee Agent
  3. HIP server components
  4. HIP Agent
  5. HIP content updates
  6. Policies on the server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Log settings for Firewall and IPS Logging include(4):

A
  1. Debug
  2. Information
  3. Warning
  4. Error
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a list of applications that should be considered

“trusted” and thus should cause no event to be generated.

A

Trusted Applications Policy

18
Q

What contains a list of network addresses and subnets that can be tagged as trusted. “Trusted,” means that that address, or address range, can potentially be
ignored by Network IPS and/or the Firewall, without having to created individual exceptions or
rules.

A

Trusted Networks Policy

19
Q

What tab displays exceptions

relevant to the client and provides summary and detailed information for each rule.

A

IPS Policy Tab

20
Q

What tab is used to monitor a list of blocked hosts (IP addresses) that is automatically created when NIPS protection is enabled.

A

Blocked Host Tab

21
Q

What is used to permanently delete contents of the log?

A

Clear

22
Q

What needs to be enabled for an alert to automatically appear when HIPS detects a potential attack.

A

IPS Protection

Display Pop-up Alert Option

23
Q

What provides timelines and settings for tuning your network to avoid false positives?

A

FRAGO 13

24
Q

What are the 2 types of tuning?

A

Manual and Automatic

25
Q

McAfee HIP’s automatic tuning method. Allows events to go through, then the logged event gets sent to the ePO server during ASCI.

A

Adaptive Mode

26
Q

What sends a message asking whether to allow or deny an event?

A

Learn mode

27
Q

What is a pattern that corresponds to a known threat.

A

Signature

28
Q

What is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations.

A

Anomaly-based detection

29
Q

How are the firewall policy rules grouped and why?

A

By Program of Record(POR) for quick enable or disable.

30
Q

Why does the DC2 server not respond to wake-up calls.

A

ISA Firewall Rules

31
Q

What only applies when connecting to a network with

particular parameters

A

A Location-aware firewall rules group

32
Q

What prevents undesirable traffic from accessing a network

A

Connection Isolation

33
Q

What is a layer of defense solution that inspects user’s actions regarding sensitive content in
their work environment.

A

DLP

34
Q

DLP Management Tools require what

controls.

A

Net Framework 3.5

ActiveX

35
Q

DLP Agent generated events are sent to where?

A

ePO Event Parser

36
Q

Managed — Device classes that can be used in device definitions.

A

Managed

37
Q

Device classes not used by the device definitions, but whose status the system administrator can change to Managed, as needed.

A

Unmanaged

38
Q

Device classes that cannot be used by the device definitions because they can affect the managed computer, system health, and efficiency.

A

Unmanageable
includes devices such as battery devices, computer, display adapters, fixed disk
drives, monitors, processors, storage volumes, and system devices

39
Q

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

A

Registry Key String

40
Q

Minor fixes to the core operating system

A

Updates

41
Q

Complete system-wide snapshot version increase of all software within HBSS.

A

Upgrade

NSVT 14 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions