500-285 試験問題を無料オンラインアクセス

When configuring FireSIGHT detection, an administrator would create a network discovery policy and set the action to "discover". Which option is a possible type of discovery?

• A.IPS event
• B.networks
• C.anti-malware
• D.host

Which option is a valid whitelist evaluation value?

• A.not-evaluated
• B.semi-compliant
• C.pending
• D.violation

Which interface type allows for bypass mode?

• A.grouped
• B.inline
• C.routed
• D.switched

What does the whitelist attribute value "not evaluated" indicate?

• A.The whitelist status could not be updated because the correlation policy it belongs to is not enabled.
• B.The host could not be evaluated because no profile exists for it.
• C.The host is not a target of the whitelist.
• D.The host is not on a monitored network segment.

Correlation policy rules allow you to construct criteria for alerting on very specific conditions. Which option is an example of such a rule?

• A.testing password strength when accessing an application
• B.limiting general user access to administrative file shares
• C.enforcing two-factor authentication for access to critical servers
• D.issuing an alert if a noncompliant operating system is detected or if a host operating system changes to a noncompliant operating system when it was previously profiled as a compliant one