MA0-104 試験問題を無料オンラインアクセス

Which of the following is the Primary function of the Event Receiver (ERC) in relation to the Enterprise
Security Manager (ESM)?

• A.Collect and parse events before the ESM pulls them form the ERC
• B.Collect and store the events before they are forwarded to the ESM for parsing
• C.Collect and parse the events before forwarding them to the ELM
• D.Collect and parse the events before the receiver forwards them to the ESM

The McAfee Advanced Correlation Engine (ACE) ca n t >e deployed in one of two modes which are.?

• A.Threshold and Anomaly.
• B.Stateful and Stateless.
• C.Prevention and Detection.
• D.Historical and Real-Time.

Malware performing a network enumeration scan will be visible at the McAfee SIEM as

• A.data -source events.
• B.Enhanced Log manager (ELM) entries.
• C.Application Data Monitor (ADM) events.
• D.Database Event Monitor (DEM) events.

On the McAfee enterprise Security Manager (ESM), the default data Retention setting specifies that Event
and Flow data should be maintained for

• A.365 days.
• B.same value as configured on the ELM.
• C.90 Days
• D.all data allowed by system

What Firewall component is natively used by the McAfee SIEM appliances to protect the appliances from
unauthorized communications?

• A.Access Control List (ACL)
• B.Linux Firewall
• C.lP tables
• D.McAfee Host Intrusion Prevention System (HIPS]