0% found this document useful (0 votes)
260 views19 pages

Deep Security 11 Certified Professional - Exam: Erro

The document appears to be a quiz about Deep Security and its various protection modules. It contains 12 multiple choice questions testing knowledge of features like scan caching, smart protection servers, firewall rules, recommendation scans, smart scan, log inspection, integrity monitoring, and application control. The questions cover how these different modules function and how to best configure them.

Uploaded by

machadotulio
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
260 views19 pages

Deep Security 11 Certified Professional - Exam: Erro

The document appears to be a quiz about Deep Security and its various protection modules. It contains 12 multiple choice questions testing knowledge of features like scan caching, smart protection servers, firewall rules, recommendation scans, smart scan, log inspection, integrity monitoring, and application control. The questions cover how these different modules function and how to best configure them.

Uploaded by

machadotulio
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 19

https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Erro:
Infelizmente sua pontuação de 62% não alcançou a pontuação mínima de aprovação de 65%.

Deep Security 11 Certified Professional | Exam


QUESTIONS: 45 | ATTEMPTS: 3

1 How is scan caching used in agentless implementations of Deep


Security?

Scan caching maintains the Inclusions and Exclusions lists from


the Malware Scan Configuration in memory to improve performance.

Scan caching is used in Agent-based installations only and is not


supported in an agentless implementation.

Scan caching manages resource usage by staggering the launch


of malware scans to prevent scan storms
Scan caching enhances the performance of the Deep Security
Virtual Appliance in that files scanned for malware on a virtual machine
that appear on other virtual machines may not need to be scanned
again.

2 Which Protection Modules can make use of a locally installed Smart


Protection Server?

All Protection Modules can make use of the locally installed Smart
Protection Server.
Anti-Malware is the only Protection Modules that can use the
locally installed Smart Protection Server.

The Anti-Malware, Web Reputation and Intrusion Prevention


Protection Modules can make use of the locally installed Smart
Protection Server.

The Anti-Malware and Web Reputation Protection Modules can


make use of the locally installed Smart Protection Server.

3 The details for an event are displayed in the exhibit. Based on these
details, which Protection Module generated the event?

1 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Firewall

Integrity Monitoring
Intrusion Prevention

Application Control

4 The Intrusion Prevention Protection Module is enabled and a


Recommendation Scan is run to identify vulnerabilities on a Windows
Server 2016 computer. How can you insure that the list of
recommendations is always kept up to date?

Disabling, then re-enabling the Intrusion Prevention Protection


Module will trigger a new Recommendation Scan to be run. New rules
will be included in the results of this new scan.

New rules are configured to be automatically sent to Deep


Security Agents when Recommendation Scans are run.
Recommendation Scans are only able to suggest Intrusion
Prevention rules when the Protection Module is initially enabled.
Enable "Ongoing Scans" to run a recommendation scan on a
regular basis. This will identify new Intrusion Prevention rules to be
applied.

5 A collection of servers protected by Deep Security do not have Internet


access. How can Smart Scan be used on these computers.

2 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Smart Scan must contact the Smart Protection Network to


function. Any servers without Internet access will be unable to use
Smart Scan.

Install a Smart Protection Server in the environment and set it as


the source for File Reputation information.
Smart Scan can be configured to use a local pattern file
containing the same information as the Smart Protection Network.
Promote one of the Deep Security Agents on the air gapped
computers to become a Relay.

6 Which of the following Firewall rule actions will allow data packets to
pass through the Firewall Protection Module without being subjected to
analysis by the Intrusion Prevention Protection Module?

Force Allow
Deny

Bypass
Allow

7 Recommendation scans can detect applications and/or vulnerabilities on


servers on the network. Which of the following Protection Modules make
use of Recommendation scans?

Intrusion Prevention, Integrity Monitoring, and Log Inspection

Intrusion Prevention, Firewall, Integrity Monitoring and Log


Inspection
Firewall, Application Control, and Integrity Monitoring

Log Inspection, Application Control, and Intrusion Prevention

8 Which of the following statements is false regarding the Log Inspection


Protection Module?

Scan for Recommendations identifies Log Inspection rules that


Deep Security should implement.
Deep Security Manager collects Log Inspection Events from Deep
Security Agents at every heartbeat.
The Log Inspection Protection Module is supported in both agent-
based and agentless environments.

Custom Log Inspections rules can be created using the Open


Source Security (OSSEC) standard.

3 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

9 Which of the following statements correctly identifies the purpose of the


Integrity Monitoring Protection Module?

The Integrity Monitoring Protection Module monitors and analyzes


the integrity of application logs to identify tampering, corruption and
other suspicious modifications to the logs.
The Integrity Monitoring Protection Module monitors critical
operating system objects such as services, processes, registry keys
and ports to detect and report malicious or unexpected changes.

The Integrity Monitoring Protection Module monitors incoming


traffic to confirm the integrity of header information including packet
source and destination details.

The Integrity Monitoring Protection Module monitors traffic to


verify the integrity of incoming traffic to identify protocol deviations,
packets fragments and other protocol anomalies.

10 The details of a policy are displayed in the exhibit. Based on these


details, which of the following statements is true?

Any events generated by computers within your corporate


network, as defined by an IP address range, will be ignored

Packets failing the Network Packet Sanity Check will still be


allowed to pass through the network engine.

Live packet streams coming through the network engine will be


replicated and all traffic analysis will be performed on the replicated
stream

The credibility scores for visited web sites will be cached. If


access to the web site is requested again within 30 minutes, its
credibility score will be retrieved from the cache instead of the
configured Smart Protection source.

11 Which of the following statements is true regarding software inventories


used as part of the Application Control Protection Module?

4 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Disable the Application Control Protection Module when installing


software upgrades, otherwise, the new software will be prevented from
installing.

An administrator can share the inventory of allowed software with


other computers protected by Deep Security Agents, by copying the
inventory database file (ac.db) from the source computer.

An administrator can view the list of allowed of software in the


inventory from the Details tab for each individual Computer.

When an administrator allows software that would be otherwise


blocked by the Enforcement Mode, it isn't added to the inventory of
approved software. Instead, it is added to that computer's white list.

12 Which of the following statements correctly describes Smart Folders?

Smart Folders are the containers used to store the results of


Recommendation Scans. Once a Recommendation Scan has
completed, and administrator can click a Smart Folder and select
which of the recommended rules to apply.

Smart Folders identify the folders that will be scanned when a


Real-Time, Manual or Scheduled malware scan is run.

Smart Folders act as a saved search of computers which is


executed each time the folder is clicked to display its contents.
Smart Folders are a collection of subfolders containing the policy
settings that are applied to child policies or directly to Computers.

13 Which of the following statements is true regarding Firewall Rules?

Firewall Rules applied through a parent-level Policy cannot be


unassigned in a child-level policy.
Firewall Rules are always processed in the order in which they
appear in the rule list, as displayed in the Deep Security manager Web
console.

Firewall Rules applied to Policy supersede similar rules applied to


individuals computers.
When traffic is intercepted by the network filter, Firewall Rules in
the policy are always applied before any other processing is done.

14 How does Smart Scan vary from conventional pattern-based anti-


malware scanning?

5 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Smart Scan is performed in real time, where conventional


scanning must be triggered manually, or run on a schedule.
Smart Scan identifies files to be scanned based on the content of
the file, not the extension.
Smart Scan shifts much of the malware scanning functionality to
an external Smart Protection Server.
Smart Scan improves the capture rate for malware scanning by
sending features of suspicious files to an cloud-based server where
the features are compared to known malware samples.

15 While viewing the details of the Firewall Protection Module, as displayed


in the exhibit, you note that a few rules have already been assigned.
You try to disable these rules, but they can not be unassigned. Why can
the displayed rules not be unassigned?

The rules displayed in the exhibit can not be unassigned as the


administrator currently logged into the Deep Security Manager Web
console does not have the permissions necessary to unassign rules.
The rules displayed in the exhibit have been hard-coded with the
details of the policy. These rules will automatically be assigned to all
Firewall policies that are created and can not be unassigned.

The rules displayed in the exhibit have been assigned to the


policy at the parent level. Rules assigned to a parent policy can not be
unassigned at the child level.
The rules displayed in the exhibit were assigned to the policy
automatically when a Recommendation Scan was run. Rules assigned
through a Recommendation Scan can not be disabled once assigned.

16 Which of the following correctly describes the Firewall rule Action of


Force Allow?

6 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Force Allow permits traffic to bypass analysis by all Deep Security


Protection Modules.
Force Allow permits traffic to bypass analysis by both the Firewall
and Intrusion Prevention Protection Modules.
Force Allow permits traffic that would otherwise be denied by
other Firewall rules to pass, but still enforces filtering by the Intrusion
Prevention Protection Module.
Force Allow explicitly allows traffic that matches the Firewall rule
to pass, and implicitly denies all other traffic.

17 How is caching used by the Web Reputation Protection Module?

Caching is used by the Web Reputation Protection Module to


keep track of Web sites that are added to the Allowed list. Any sites
added to the Allowed list will be accessible by protected servers
regardless of their credibility score.
Caching is used by the Web Reputation Protection Module to
keep track of Allowed and Blocked Web sites. Any sites that are
Allowed or Blocked do not require the retrieval of a credibility score
from the Trend Micro Web Reputation Service.

Caching is used by the Web Reputation Protection Module to


temporarily store the credibility score for a Web site. The retrieved
credibility score is cached in case the score for the Web site is
required again for the life of the cache.
Caching is used by the Web Reputation Protection Module to
temporarily store the pages that make up the Web site. The Web site
is cached in case the site is visited again for the life of the cache.

7 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

18 The Intrusion Prevention Protection Module is enabled, its Behavior is


set to Prevent and rules are assigned. When viewing the events, you
notice that one of Intrusion Prevention rules is being triggered and an
event is being logged but the traffic is not being blocked. What is a
possible reason for this?

The Deep Security Agent is experiencing a system problem and is


not processing packets since the "Network Engine System Failure"
mode is set to "Fail Open".

The default Prevention Behavior in this particular rule may be set


to Detect. This logs the triggering of the rule, but does not actually
enforce the block.
The Intrusion Prevention rule is being triggered as a result of the
packet sanity check failing and the packet is being allowed to pass.

The network engine is running in Inline mode. In Inline mode,


Deep Security provides no protection beyond a record of events.

19 What is the purpose of the Deep Security Notifier?

The Deep Security Notifier is a application in the Windows System


Tray that communicates the state of Deep Security Agents and Relays
to endpoint computers.

The Deep Security Notifier is a application in the Windows System


Tray that displays the Status of Deep Security Manager during policy
and software updates.

The Deep Security Notifier is a server components that collects


log entries from managed computers for delivery to a configured SIEM
device.

The Deep Security Notifier is a server component used in


agentless configurations to allow Deep Security Manager to notify
managed computers of pending updates.

20 The Overrides settings for a computer are displayed in the exhibit.


Which of the following statements is true regarding the displayed
configuration?

8 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

The configuration for the Protection Modules is inherited from the


policy assigned to this computer, except for the configuration of the
Web Reputation and Application Control Protection Modules which
have been set at the computer level.
The Protection Modules identified as Inherited in the exhibit have
not yet been enabled. Only the Web Reputation and Application
Control Protection Modules have been enabled at this point.

The Web Reputation and Application Control Protection Modules


have been assigned a different policy that the other Protection
Modules and as a result, are displayed with overrides.
The Protection Modules identified as Inherited in the exhibit have
not yet been configured. Only the Web Reputation and Application
Control Protection Modules have been configured.

21 New servers are added to the Computers list in Deep Security Manager
Web config by running a Discover operation. What behavior can you
expect for newly discovered computers?

Any servers within the IP address range that are hosting Deep
Security Agents will be added to the Computers list and will be
automatically activated.

Any servers discovered in the selected Active Directory branch


hosting a Deep Security Agent will be added to the Computers list.
Any servers within the IP address range will be added to the
Computers list, regardless of whether they are hosting a Deep Security
Agent or not.

Any servers within the IP address range hosting a Deep Security


Agent will be added to the Computers list.

22 How can you prevent a file from being scanned for malware ?

9 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Enable "File Types scanned by IntelliScan" in the Malware Scan


Configuration properties in the Deep Security Manager Web console.
Click "Scan All Except" and type the filename to exclude from the
scan.

Add the file to the Exclusions list in the "Allowed


Spyware/Grayware Configuration".

Add the file to the Exclusions list in the Malware Scan


Configuration.

Edit the "Scan Exclusions" section of the dsa.properties


configuration file on the Deep Security Agent computer to include the
file name. Save the configuration file and restart the Deep Security
Agent service.

23 Which of the following statements is true regarding the Log Inspection


Protection Module?

Log Inspection can only examine new Events and cannot examine
logs entries created before the Protection Module was enabled.

Log Inspection can only examine Deep Security log information.


The Log Inspection Protection Module is supported in both Agent-
based and Agentless implementations.

Deep Security Agents forward Log Inspection Event details to


Deep Security Manager in real time.

24 Which of the following statements is true regarding Intrusion Prevention


protection?

Intrusion Prevention protection only works in conjunction with the


Anti-Malware Protection Module.

Intrusion Prevention protection can drop malicious packets but


cannot reset the connection.

Intrusion Prevention protection can only work on computers where


a Deep Security Agent is installed; agentless protection is not
supported.

Intrusion Prevention protection can drop or reset a connection.

25 What is the purpose of the override.properties file?

10 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

This file contains the original out-of-the-box configuration


properties for Deep Security Manager. This file is renamed to
dsm.properties upon initialization of Deep Security Manager.

This file allows properties to be tested on Deep Security Manager


without affecting the original configuration.
This file is used to transfer policy settings from one installation of
Deep Security Manager to another.
This file allows Deep Security Agents to override enforced
behavior by providing new policy configuration details.

26 Which of the following statements is true regarding the Intrusion


Prevention Protection Module?

The Intrusion Prevention Protection Module analyzes the payload


within incoming and outgoing data packets to identify content that can
signal an attack.

The Intrusion Prevention Protection Module blocks or allows traffic


based on header information within data packets.

The Intrusion Prevention Protection Module can identify changes


applied to protected objects, such as the Hosts file, or the Windows
Registry.

The Intrusion Prevention Protection Module can prevent


applications from executing, allowing an organization to block
unallowed software.

27 What is the purpose of the Deep Security Relay?

Deep Security Relays distribute load to the Deep Security


Manager nodes in a high-availability implementation.

Deep Security Relays forward policy details to Deep Security


Agents and Virtual Appliances immediately after changes to the policy
are applied.
Deep Security Relays are responsible for retrieving security and
software updates and distributing them to Deep Security Manager,
Agents and Virtual Appliances.
Deep Security Relays maintain the caches of policies applied to
Deep Security Agents on protected computers to improve
performance.

28 Your organization would like to implement a mechanism to alert


administrators when files on a protected servers are modified or
tampered with. Which Deep Security Protection Module should you
enable to provide this functionality?

11 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Deep Security can not provide this type of functionality


The File Inspection Protection Module

The Integrity Monitoring Protection Module


The Intrusion Prevention Protection Module

29 What is IntelliScan?

IntelliScan is a mechanism that improves scanning performance.


It recognizes files that have already been scanned based on a digital
fingerprint of the file.

IntelliScan is a method of identifying which files are subject to


malware scanning as determined from the file content. It uses the file
header to verify the true file type.
IntelliScan is a malware scanning method that monitors process
memory in real time. It can identify known malicious processes and
terminate them.
IntelliScan reduces the risk of viruses entering your network by
blocking real-time compressed executable files and pairs them with
other characteristics to improve malware catch rates.

30 Based on the details of event displayed in the exhibit, which of the


following statements is false?

12 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

You can instruct the Deep Security Agents and Appliances to


block traffic from the source IP address for a period of time.
The Intrusion Prevention Protection Modules must be enabled to
detect reconnaissance scans.
You can create a firewall rule to permanently block traffic from the
originating IP address.
The scan may be generated from an IP address which may be
known to you. If so, the source IP address can be added to the
reconnaissance whitelist.

31 Where does Deep Security Manager store the credentials it uses to


access the database?

In the logging.properties file


In the Windows Registry

In the database.properties file

In the dsm.properties file

32 The "Protection Source when in Combined Mode" settings are


configured for a virtual machine as in the exhibit. You would like to
enable Application Control on this virtual machine, but there is no
corresponding setting displayed. Why?

13 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

In the example displayed in the exhibit, the VMware Guest


Introspection Service has not yet been installed. This service is
required to enable Application Control in agentless installations.

In the example displayed in the exhibit, the Application Control


Protection Module has not yet been enabled. Once it is enabled for
this virtual machine, the corresponding settings are displayed.

In the example displayed in the exhibit, no activation code was


entered for Application Control. Since the Protection Module is not
licensed, the corresponding settings are not displayed.

These settings are used when both an host-based agent and


agentless protection are available for the virtual machine. Since
Application Control is not supported in agentless installations, there is
no need for the setting.

33 Which of the following statements is true regarding Intrusion Prevention


rules?

Intrusion Prevention rules can detect or block traffic associated


with specific applications, such as Skype or file-sharing utilities.

Intrusion Prevention rules check for the IP addresses of known


malicious senders within a packet.

Intrusion Prevention rules monitor the system for changes to a


baseline configuration.

Intrusion Prevention rules can block unrecognized software from


executing.

34 Based on the policy configuration displayed in the exhibit, which of the


following statements is true?

14 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Administrators with access to the protected Server will be able to


uninstall the Deep Security Agent through Windows Control Panel.
If the Deep Security Manager does not receive a message from
the Deep Security agent every 20 minutes, an alert will be raised.
Changes to any of the Deep Security policies will be send to the
Deep Security Agents as soon as the changes are saved.
Deep Security Agents will send event information to Deep
Security Manager every 10 minutes.

35 Which of following statements best describes Machine Learning in Deep


Security?

Machine Learning is a malware detection technique in which files


are scanned based on the true file type as determined by the file
content, not the extension.

Machine Learning is malware detection technique in which


processes on the protected computer are monitored for actions that
are not typically performed by a given process.

Machine Learning is malware detection technique in which


features of an executable file are compared against a cloud-based
learning model to determine the probability of the file being malware.

Machine Learning is a malware detection technique in which the


Deep Security Agent monitors process memory in real time and once a
process is deemed to be suspicious, Deep Security will perform
additional checks with the Smart Protection Network to determine if
this is a known good process.

36 Multi-tenancy is enabled in Deep Security and new tenants are created.


Where does the new tenant data get stored when using SQL Server as
the Deep Security database?

An additional database is created in SQL Server for each new


tenant to store its data.

An additional table is created for each new tenant in the existing


database in the SQL Server database to store its data.
An additional user is created for each new tenant in the SQL
Server database to store its data.
The new tenant data is added to the existing SQL Server
database.

37 Which of the following statements is false regarding Firewall rules using


the Bypass action?

15 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Firewall rules using the Bypass action can be optimized, allowing


traffic to flow as efficiently as if a Deep Security Agent was not there.
Firewall rules using the Bypass action do not generate log events.

Applying a Firewall rule using the Bypass action to traffic in one


direction automatically applies the same action to traffic in the other
direction.
Firewall rules using the Bypass action allow incoming traffic to
skip both Firewall and Intrusion Prevention analysis.

38 Multiple Application Control Events are being displayed in Deep Security


after a series of application updates and the administrator would like to
reset Application Control. How can this be done?

Application Control can not be reset.


Click "Clear All" on the Actions tab in the Deep Security Manager
Web console to reset the list of Application Control events.

On the Deep Security Agent computer, type the following


command to reset Application Control: dsa_control -r
Application Control can be reset by disabling the Protection
Module, then enabling it once again. This will cause local rulesets to
be rebuilt.

39 An administrator attempts to activate the Deep Security Agent installed


on a server by typing the following command in the Command Prompt
on the Deep Security Agent computer:

dsa_control -a dsm://server1.acme.com:4120

The Agent does not activate as expected. What is a valid reason for this
issue?

Deep Security Agents can not be activated through the Command


Prompt. They must be activated through the Deep Security Manager
Web console or through a deployment script.
The incorrect port was used. The correct command would be:
dsa_control -a dsm://server1.acme.com:4118

"Allow Agent-Initiated Activation" is currently not enabled in Deep


Security Manager.

The command listed can only executed from the Command


Prompt on the Deep Security Manager computer.

40 When viewing the details for a policy, as displayed in the exhibit, you
notice that the Application Control Protection Module is not available. In

16 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

this example, why would this Protection Modules not be available?

The Application Control Protection Module has been disabled at


the Base Policy level and is not displayed in the details for child
policies.

An Activation Code for the Application Control Protection Module


has not been provided. Unlicensed Protection Modules will not be
displayed.

The Application Control Protection Modules has not been enabled


for this tenant.

The Application Control Protection Module is only supported on


Linux computers, the policy details displayed are for Windows
computers only.

41 Which of the following statements is true regarding Maintenance Mode


in the Application Control protection Module?

When in Maintenance Mode, the Application Control Protection


Module will continue to block software identified in Block rules, but will
allow new and changed applications to be added to the software
inventory.

Maintenance Mode can be configured as a Scheduled Event. In


this scenario, all software upgrades will be performed at the same time
every day to avoid creating Alerts for normal software updates.

When enabled, Maintenance Mode rescans the protected


computer to rebuild the software inventory. Any new or changed
software will be included in this rebuilt inventory.

While in Maintenance Mode, all Block and Allow rules are ignored
while new or updated applications are added to the software inventory.

42 The maximum disk space limit for the Identified Files folder is reached.
What is the expected Deep Security Agent behavior in this scenario?

17 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Files will no longer be able to be quarantined. Any new files due


to be quarantined will be deleted instead.
Deep Security Agents will delete any files that have been in the
folder for more than 60 days.
Any existing files are in the folder are compressed and forwarded
to Deep Security Manager to free up disk space.
Deep Security Agents will delete the oldest files in this folder until
20% of the allocated space is available.

43 Which of the following statements is correct regarding the policy settings


displayed in the exhibit?

Deep Security Manager will refresh the policy details on the Deep
Security Agents using this policy every 5 minutes.
Deep Security Agents using the displayed policy will send event
details to Deep Security Manager every 5 minutes.
All Deep Security Agents will send event details to Deep Security
Manager every 5 minutes.

The Heartbeat interval value displayed in this policy is inherited


from the parent policy.

44 Which of the following statements is true regarding Deep Security


Manager-to-database communication?

18 of 19 27/06/2019 20:07
https://success.trendmicro.com/LMS/apex/lmsilt__quiz?Id=a9C0B00...

Deep Security Manager-to-database traffic is encrypted by


default, but can be disabled by modifying settings in the
dsm.properties file.

Deep Security Manager-to-database traffic is encrypted by default


but can be disabled by modifying settings in the db.properties file.
Deep Security Manager-to-database traffic is not encrypted by
default, but can be enabled by modifying settings in the dsm.properties
file.

Deep Security Manager-to-database traffic is not encrypted by


default, but can be enabled by modifying settings in the ssl.properties
file.

45 Which of the following statements is true regarding the use of the


Firewall Protection Module in Deep Security?

The Firewall Protection Module can detect and block Cross Site
Scripting and SQL Injection attacks.
The Firewall Protection Module can prevent DoS attacks coming
from multiple systems.
The Firewall Protection Module can identify suspicious byte
sequences in packets.

The Firewall Protection Module can check files for certain


characteristics such as compression and known exploit code.

OK

19 of 19 27/06/2019 20:07

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy