Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

NSVT > Week 6 > Flashcards

Week 6 Flashcards

1
Q

What are the ePO compliance checks?

A
  • McAfee Agent Version
  • virus scan
  • anti spyware
  • HIP
  • PA
  • Assets
  • DAT files
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

FIM allows you to do what? 4 things.

A
  1. Define which files should be tracked
  2. Define what files should not be checked
  3. Specify the frequency for detecting file change
  4. See and receive notification about changes to file or file attributes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Two types of scans for ABM

A
  • baseline

- activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ABM has how many policy categories?

What are they?

A

3

  • file permissions
  • registry permissions
  • Trusted activity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

If there is a suspected attack, who do you inform?

A

IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What log details all actions of the ePO Application Server?

A

EpoApSvr.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What log file is a more detailed version of the log available through the McAfee Agent GUI?

A

Agent_.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What log provides detailed information of all actions performed by Rogue System Sensors?

A

RSDSensor_out.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How often does the RSS log communicate with ePO?

A

Every 5 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the common logs contained on all Windows machines?

A
  • Application
  • Security
  • System
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the boot order?

A
  • MSSQL
  • ACAS (SSCVI)
  • HBSS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the two services on MSSQL that are required to run?

A
  • SQL Server (MSSQLSERVER)

- SQL Server Agent (MSSQLSERVER)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When is MSSQL backed up?

A

Daily at 0030

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When is ACAS/SCCVI backed up?

A

Weekly on Sunday

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CANES she’s what for cross domain services?

A

Thin client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What VMs are used on DHCP in the UNCLAS and Secret enclaves?

A
  • IAEXET

- WEB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Is DHCP allowed on SCI?

A

No!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is used to restrict data flow from applications and users in each enclave?

A

-virtual routing and forwarding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How is CANES providing data-at-rest protection?

A

Hard drive encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Net IQ is used for?

A

Analyze siem log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Are CANES logging standards the same as DISA, what we currently use?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

EMET can be used to prevent?

A

PKI based man-in-the-middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is he module that applies local security to servers on COMPOSE networks?

A

SCM-security configuration module

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where is Symantec Endpoint Protection Manager installed?

A

EX001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the 4 enforcers for COMPOSE Security Architecture?

A
  • gateway
  • LAN
  • DHCP
  • Integrated
18
Q

What are the Symantec Mail Security policies?

A
  • general
  • antivirus
  • anti spam
19
Q

What stage of CCRI asks for documentation?

A

Stage 1

20
Q

How do you make system changes after a CCRI?

A

Coordinate with the SYSCOM

21
Q

What system service migrates events from an old database to a new database?

A

Event migration

22
Q

What system service takes systems older than 14 days, moves them to the inactive group, and hen deletes after 30 days?

A

Inactive agent cleanup

23
Q

What system service syncs select Windows NT domains in Active Directory containers that are mapped to system groups?

A

NT domain active directory sync task

24
Q

What system service retrieved packages from the source site and places them in the master repository?

A

Repository pull

25
Q

What system service updates distributed repository from master repository?

A

Repository replication

26
Q

What system service imports summary compliance far from other registered ePO servers?

A

Roll up data compliance

27
Q

What system service imports summary data from other registered ePO servers?

A

Roll up managed systems

28
Q

What system service evaluated all managed systems against selected tag criteria?

A

Run tag criteria

29
Q

What system service runs selected query?

A

Run query

30
Q

What is the type of auditor that PA functions as because it evaluates against both government and industry standards?

A

Independent auditor

31
Q

What is a benchmark? How do you get them?

A
  • a file dictating what checks to run
  • third party
  • DISA
  • supplied by McAfee
32
Q

What will a waiver do on a system?

A

-it will not include it in audit scanning

33
Q

Is ABM active or passive?

A

Passive

34
Q

How far apart should NIPR and SIPR workstations be?

A

1 meter

35
Q

Agent_.log

A

Detailed version of the log available through the McAfee Agent GUI

36
Q

EpoApSvr.log

A

All actions of the ePO Application Server

37
Q

Server.log

A

Details all actions of ePO server

38
Q

RSDSensor_out.log

A

All actions performed by Rogue System Sensor

39
Q

Eventparser.log

A

All info regarding event parser

40
Q

Debug_sycit.log

A

SCCVI, used to troubleshoot retina issues

41
Q

What log is used to investigate USB events?

A

DLP log

42
Q

What services allow hardware and software access in information transferred to different security domains or levels of classification?

A

Cross domain/multi-layer System

43
Q

What do we use PKI certificates for?

A
  • authentication

- email signing

44
Q

What service is the first layer of firewall protection for wireless access to CANES?

A

NAC

45
Q

What protects Windows/OS/workstations from host and network based intrusions?

A

IPS/HBSS

46
Q

COMPOSE has automated hardening

A

True

47
Q

GPO is used to ensure what?

A
  • policy settings
  • user rights
  • computer behavior
48
Q

The TMG server will be deployed as a member server of what domain?

A

COMPOSE

49
Q

When blue team comes onboard, what must you do?

A

Create exceptions in the HBSS suite

50
Q

What must IPS protection status on all systems be set to?

A

Enabled

51
Q

Block high severity set to?

A

Prevent

52
Q

Block medium severity set to?

A

Prevent

53
Q

Block/log low severity set to?

A

Prevent/log

NSVT (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions