McAfee McAfee Certified Product Specialist MA0-107 Questions & Answers

• Question 21:

  In which of the following ways would ATP determine the reputation information if Adaptive Threat Protection (ATP) is deployed and neither a TIE server nor an Internet connection is available?

  A. ATP will use information from the local system.

  B. ATP will query other systems in the environment.

  C. ATP will do nothing and auto-disable itself.

  D. ATP will prompt the user for manual input.

  Correct Answer: B

• Question 22:

  Exploit prevention content is released

  A. once per month.

  B. every other week.

  C. once per quarter.

  D. every two months.

  Correct Answer: A

• Question 23:

  For which of the following reasons does ENS 10 store two previous versions of AMCore content?

  A. To allow for content rollback if it is needed

  B. To allow for comparison of detections between content versions

  C. To allow for backup when an Extra.DAT is deployed

  D. To allow for choice of which content to scan a file against

  Correct Answer: C

• Question 24:

  Which of the following fields can an ePO administrator use when creating exclusions for Dynamic Application Containment?

  A. Certificate

  B. Rule

  C. File version

  D. MD5 hash

  Correct Answer: D

• Question 25:

  A security professional is configuring ENS for a client and wants to ensure applications will be prevented from executing software locally from the browser or email client. Which of the following McAfee-defined rules should be implemented?

  A. Creating new executable files in the Windows folder

  B. Installing browser helper objects or shell extensions

  C. Registering programs to autorun

  D. Running files from common user folders by common programs

  Correct Answer: B

• Question 26:

  The ENS administrator wants to monitor remotely the modification of files, but BigFix.exe is generating many false positives. Which of the following should the ENS administrator do?

  A. Exclude the file under Threat Prevention / Access Protection / Remotely creating or modifying Files or Folders.

  B. Add the file as a High Risk Process under Threat Prevention / On Access Scan / Process settings.

  C. Exclude the file under Common Options / Self Protection.

  D. Add the file under Threat Prevention / Options/ Exclusions by detection name.

  Correct Answer: C

• Question 27:

  An administrator wants to exclude folder ABC on various drives. In which of the following ways should the administrator list the exclusion in the policy?

  A. ??\ABC

  B. **\ABC

  C. ***\ABC

  D. ???\ABC

  Correct Answer: C

• Question 28:

  A security technician is configuring the exploit prevention policy. Based on best practices for critical servers, which of the following severity levels should the technician configure signatures to block after a requisite period of tuning?

  A. Low

  B. High

  C. Informational

  D. Medium

  Correct Answer: B

• Question 29:

  A user is reporting a functional issue with the ENS client. Which of the following logs should be checked?

  A. ExploitPrevention_Debug.log

  B. OnDemandScan_Debug.log

  C. EndpointSecurityPlatform_Errors.log

  D. AdaptiveThreatProtection_Debug.log

  Correct Answer: C

• Question 30:

  An administrator is running new software, and a file is detected by the On-Access scanner as a Potentially Unwanted Program. In which of the following ways can the administrator prevent the file from being detected?

  A. Adding the process name within standard process settings

  B. Excluding by detection name

  C. Adding to Potentially Unwanted Program Detections.

  D. Configuring low-risk settings and low risk the software

  Correct Answer: C