McAfee MA0-107 Online Practice Questions and Exam Preparation

McAfee MA0-107 Online Questions & Answers

• Question 21:

  Organizational security policy requires a host-based firewall on endpoints. Some endpoints have applications where documentation depicting network traffic flows is not readily available. Which of the following ENS 10.5 firewall features should be used to develop rules for their firewall policy?

  A. Location-aware Groups
  B. Trusted Networks
  C. Trusted Executables
  D. Adaptive Mode
  B. Trusted Networks

• Question 22:

  Which of the following fields can an ePO administrator use when creating exclusions for Dynamic Application Containment?

  A. Certificate
  B. Rule
  C. File version
  D. MD5 hash
  D. MD5 hash

• Question 23:

  If a TIE server is unavailable and the system is connected to the Internet, which of the following components can the Adaptive Threat Protection leverage for reputation decisions?

  A. Event Security Manager
  B. Global Threat Intelligence
  C. Data Exchange Layer
  D. Advanced Threat Defense
  B. Global Threat Intelligence

• Question 24:

  An administrator wants to prevent incoming packets until the system reboots fully. Which of the following features should be configured to allow this?

  A. Treat McAfee GTI Match as an Intrusion
  B. Allow Bridged Traffic
  C. Allow Only Outgoing Traffic Until Firewall Services Have Started
  D. Block All Untrusted Executables
  C. Allow Only Outgoing Traffic Until Firewall Services Have Started

• Question 25:

  An administrator wants to allow remote users the ability to access the Internet from unsecure WiFi access points to connect to the VPN. Which of the following ENS 10.5 features should the administrator use to accomplish this?

  A. Trusted Networks
  B. Location-based Groups
  C. Timed Groups
  D. Connection Isolation Groups
  B. Location-based Groups

• Question 26:

  Security operations has recently received indicators of compromise (IOCs) detailing a new piece of malware for which coverage is not available. The threat advisory recommends a list of file paths and registry keys to prevent this new malware from successfully executing. Which of the following ENS 10.5 features should be used to achieve this goal?

  A. Web Control
  B. Exploit Prevention
  C. Real Protect
  D. Access Protection
  D. Access Protection

• Question 27:

  A user navigates to a website and notices a small blue square around an "M" in the upper-right corner of the Chrome browser. Which of the following does the blue color indicate within the toolbar?

  A. It is an internal website.
  B. Web Control is disabled.
  C. No rating is available.
  D. It is a phishing website.
  C. No rating is available.

• Question 28:

  A user is unable to access a website. The Web Control browser toolbar appears gray. Other websites are accessible. Which of the following features of ENS Web Control has been enabled and is causing the issue?

  A. Block links to risky sites in the search results.
  B. Block phishing pages for all sites.
  C. Block sites that are not verified by GTI.
  D. Block sites by default if the McAfee GTI ratings server is not reachable.
  B. Block phishing pages for all sites.

• Question 29:

  The ePO administrators have already tuned and configured dynamic application containment rules within the policy. In which of the following ways will dynamic application containment protect against malware once enforcement is enabled?

  A. The scan engine will learn the behavior of the application and send up to GT1 for analysis, and then receive an action to block all actions from the application's process.
  B. If an application's reputation is below the threshold while triggering a block rule and is not an excluded application, malicious behavior of the application will be contained.
  C. The ENS client will receive the reputation as "highly suspicious" from either the McAfee GTI or TIE server, and then immediately uninstall the application on the system.
  D. The adaptive threat protection scanner will send the file automatically to a preconfigured "Sandbox" folder and analyze the application for malicious features before use.
  B. If an application's reputation is below the threshold while triggering a block rule and is not an excluded application, malicious behavior of the application will be contained.

• Question 30:

  By default, an individual file is flushed from the Adaptive Threat Protection local reputation cache every:

  A. 7 days.
  B. 14 days.
  C. 30 days.
  D. 60 days.
  D. 60 days.