MA0-104

MA0-104 practice questions, page 2 of 3, with answer review and explanations.

Question 6

Which of the following security technologies sits inline on the network and prevents attacks based on signatures and behavioral analysis that can be configured as a data source within the SIEM?

  1. Firewall
  2. Email Gateway
  3. Host Intrusion Prevention System
  4. Network Intrusion Prevention System

Question 7

Analysts can effectively use the McAfee SIEM to identify threats by

  1. focusing on aggregated and correlated events data.
  2. disabling aggregation, so all data are visible.
  3. studying ELM archives, to analyze the original data.
  4. use the streaming event viewer to analyze data.

Question 8

If there is no firewall at the border of the network, which of the following could be used to simulate the protection a firewall provides?

  1. Load balancer
  2. Router Access Control List (ACL)
  3. Switch port blocking
  4. An email gateway

Question 9

When viewing the Policy Tree, what four columns are displayed within the Rules Display pane?

  1. Action, Severity, Aggregation, Copy Packet
  2. Action, Severity, Normalization, Copy Packet
  3. Action, Severity, Aggregation, Drop Packet
  4. Enable, Severity, Aggregation, Copy Packet

Question 10

An organization notices an increasing number of ESM concurrent connection events. To mitigate risks related to concurrent sessions which action should the organization take?

  1. Increase the concurrent session alarm threshold
  2. Decrease the console timeout value
  3. Increase the number of the concurrent sessions allowed
  4. Customize the login page with the organization’s logo