McAfee McAfee Certified Product Specialist MA0-107 Questions & Answers

• Question 1:

  Which of the following describes the difference in functionality between Real Protect cloud-based and Real Protect client-based?

  A. The location where the centralized management server and policies are managed

  B. The location from which AMCore content updates are pulled before on-demand scans

  C. The location where the scanning is conducted on file attributes and behavior

  D. The location where malware is quarantined on the managed system

  Correct Answer: A

• Question 2:

  An engineer needs to allow a specific application to run. The engineer just finished creating an Exploit

  Prevention process exclusion. After applying the exclusion, the engineer notices the application is not

  being run. The following information is provided to the engineer:

  Which of the following is the error with the engineer's exclusion?

  A. A signature ID was not entered.

  B. Exclusions are case sensitive.

  C. A hash was not specified.

  D. Wildcard was not used.

  Correct Answer: B

• Question 3:

  An administrator notices that on one endpoint, Threat Prevention is not currently on the latest version of AMContent. The administrator presses the "Update Now" button within the console, but a message shows the update was unsuccessful.

  Which of the following logs should the administrator look at FIRST to troubleshoot the failure?

  A. EndpointSecurityPlatform_Activity.log

  B. ThreatPrevention_Activity.bg

  C. AccessProtection_Activity.log

  D. PackageManager_Activity.log

  Correct Answer: D

• Question 4:

  Organizational security policy has recently mandated users be made aware of potentially malicious links. Which of the following features of ENS 10.5 can be used to accomplish this task?

  A. Rating Actions

  B. Sensitivity Level

  C. Event Logging

  D. Browser Control

  Correct Answer: D

• Question 5:

  An ENS administrator is configuring on-access protection but finds the trusted backup tool is causing an unneeded performance impact. Which of the following actions should the administrator take?

  A. Endpoint Security Threat Prevention Policy Category / Threat Prevention Policy Category / Access Protection / Exclusion / Exclude the Backup Tool executable

  B. Endpoint Security Threat Prevention Policy Category / Exploit Prevention/Exclusions / Exclude Backup Tool executable

  C. Endpoint Security Threat Prevention Policy Category / On Access scan / Process Settings / Low Risk Processes / Exclude Backup Tool executable

  D. Enable McAfee GTI Feedback under Endpoint Security Threat Prevention Policy Category / Options / Proactive Data Analysis

  Correct Answer: C

• Question 6:

  An ePO administrator is experiencing issues installing an ENS module on a client machine and decides to investigate by analyzing the install log. In which of the following locations will the administrator find the install log, assuming it is in its default location on the endpoint?

  A. %programdata%\mcafee\datreputation\logs

  B. **\program files\mcafee\

  C. %temp%\mcafeelogs

  D. %programdata%\mcafee\Agent\logs

  Correct Answer: D

• Question 7:

  An administrator wants to prevent incoming packets until the system reboots fully. Which of the following features should be configured to allow this?

  A. Treat McAfee GTI Match as an Intrusion

  B. Allow Bridged Traffic

  C. Allow Only Outgoing Traffic Until Firewall Services Have Started

  D. Block All Untrusted Executables

  Correct Answer: C

• Question 8:

  A help desk technician needs to gain admin rights to the ENS local client interface for troubleshooting. Which of the following is a policy setting within the ENS Common Options policy that could be used to temporarily allow admin rights to the local client?

  A. Unlock Client Interface Password

  B. Standard Access

  C. One-time Password

  D. Time-based Password

  Correct Answer: A

• Question 9:

  On Windows 8 and 10 machines, Windows places a flag in the tile of an app, causing Windows to notify the user of a problem and directing the user to the Windows Store to reinstall. This flag is placed on the tile when the Threat Prevention scanner detects a threat in the path of an installed Windows Store app, and marks the application as:

  A. malicious.

  B. suspicious.

  C. questionable.

  D. tampered.

  Correct Answer: A

• Question 10:

  Joe, an administrator, runs a policy-based, on-demand scan on a system and notices that after the scan, a threat event was created for what appears to be a false positive. Joe wants to submit the file for analysis to McAfee Labs; but every time he accesses the file, it is detected.

  In which of the following default locations can Joe find the backups of the detected files?

  A. %ProgramData%\McAfee\Common Framework\AgentEvents

  B. C:\Quarantine

  C. C:\Windows\Temp\Quarantine

  D. %deflogfir%\Quarantine

  Correct Answer: A