Which of the following items can affect the amount of database space is required by Deep Security? Select all that apply

Number of platforms on which you install Deep Security Agents

How long event details are retained

Number of ecents recorded per second

The Intrusion Precention protection module is enabled and a Recommendation Scan is run to identify vulnerabilities on a Windows Server 2016 computer. How can you ensure that the list of recommendations is kept up tp date?

Enable Ongoing Scans to run a recommendation scan on a regular basis. This will identify new Intrusion Prevention rules that should be applied

Keeping the list of recommendations up to date is a manual operation. Monitor the Trend Micro Web site to find out which new rules have been deployed through security updates and enable those required in your configuration

Recommendation Scans are only able to suggest Intrusion Prevention rules when the protection module is initially enabled

Disabling, then re-enabling the Intrusion Prevention protection module will trigger a new Recommendation Schan to be run. New rules will be included in the results of this new scan

In a policy, you note that state of the Web Reputaion protection module is set to Inherited(On), while the state for the other protection modules is set to On. Why would the state for the Web Reputation protection module display differently than the other protection modules?

In this policy, the state for the Web Reputaion Protection module is inherited from the parent policy, while the other protection modules were turned on specifically in this child policy

In this policy, the state for the Web Reputaion Protection module is inherited from the parent policy, while the other protection modules were turned on at the computer level

The state for a protection module always displays as Inherited (On) until the module components are installed on the Agent

In this example, the state for the Web Reputation protection module is listed as Inherited (On) as this is the default settings in the Base policy

Which of the following statements is true regarding Maintenance Mode in the Application Control protection module?

When in Maintenance Mode, the Application Control protection module will continue to block software identified in Block rules, but will allow new and changed applications to be added to the software inventory

When enabled, Maintenance Mode rescans the protected computer to rebuild the software inventory. Any new or changed software will be included in this rebuilt inventory

Configure Maintenance Mode as a Scheculed Event. In this scenario, all software upgrades are performed at the same time every day to avoid creating Alerts for normal software updates

While in Maintenance Mode, all Block and Allow rules are ignored while new or updated applications are added to the software inventory

Which of the following statements is true regarding the Log Inspection protection module?

Log INspection can only examine new Events and cannot examine logs entries created before the protection module was enabled

Always apply all the Log Inspection rules suggested by a recommendation scan

Log inspection ensures that log information retrieved from 3rd party logs has not been tampered with through digital signatures

Agents forward Log Inspection Event details to Deep Security Manager in real time

Which of the following are valid integration points for forwarding Deep Security event details to third-party logging and event storage devices. Select all that apply

Amazon Simple Notification Service (SNS)

Security Information and Event Management (SIEM) servers

Simple Network Management Protocol (SNMP)

Deep Security Application Programming Interface (API)

Which of the following services offloads to the cloud some of the information used by Smart Scan to detect malware?

Certified safe Software Service

What methods are available for installing a Deep Security Agent on a server that needs protection? Select all that apply

Installing the Deep Security Agent using a deployment script

Installing the Deep Security Agent manually using an Installer

Installing the Deep Security Agent on Windows Servers from the Command Prompt using the mslexec command

Installing the Deep Security Agent From the Web Management console

Which of the following items can be assigned through policy in Deep Security? Select all that apply

The state of a protection module, for example, whether it is On or Off

Policy setting that must be applied to all computers receiving the policy

Rules assigned to protection modules that use them, for example firewall or instrusion prevention rules

Schedules for security and software updates

Which of the following allows you to prevent a file from being scanned for malware?

Add the file to the Exclusions list in the Malware Scan Configuration

Enable File Types scanned by IntelliScan in the Malware Scan Configuration properties in the Deep Security Manager Web console. Click Scan All Except and type the filename to exclude from the scan

Edit the Scan Exclusions section of the dsa.properties configuration file on the Deep Security Agent computer to include the file name. Save the configuration file and restart the Deep Security Agent service

Add the file to the Exclusions list in the Allowed Spyware/Grayware Configuration

Policies in Deep Security can include a Context value. Which of the following statements regarding Context is correct?

The Context provides Deep Security Agents with location awareness and is associated with Firewall and Intrusion Prevention Rules

The Context provides Deep Security Agents with location awareness and is associated with Anti-Malware and Web Reputation Rules

The Context provides Deep Security Agents with location awareness and is associated with Log Inspection and Integrity Monitoring Rules

The Context provides Deep Security Agents with location awareness and is associated with Web Reputation Rules only

What Trend Micro product offers pre-runtime scanning of containers?

Cloud One – Container Security

Which of the following statements is false regarding Firewall rules using the Bypass action?

Applying a Firewall rule using the Bypass action to traffic in one direction automatically applies the same action to traffic in the other direction

Firewall rules using the Bypass action do not generate log events

Firewall rules using the Bypass action allow traffic to flow as efficiently as if a Deep Security Agent was not there

Firewall rules using the Bypass action allow incoming traffic to skip both Firewall and Intrusion Prevention analysis

Which of the following statements is true regarding Deep Security Relays?

Deep Security Agents communicate with Deep Security Relays to obtain security updates

Both 32-bit and 64-bit Deep Security Agents can be promoted to a Deep Security Relay

Deep Security Agents promoted to Deep Security Relays no longer provide the security capabilities enabled by the protection modules

Deep Security Relays are able to process Deep Security Agent requests during updates

Multiple Application Control events are being displayed in Deep Security after a series of application updates and the administrator would like to reset Application Control. How can this be done?

Application Control can be reset by disabling the protection module, then enabling it once again. This will cause local rulesets to be rebuilt

On the Deep Security Agent computer, type the following command to reset Application Control: dsa_control -r

Click Clear All on the Actions tab in the Deep Security Manager Web console to reset the list of Application Control events

Application Control cannot be reset

Which of the following correctly describes the Firewall rule action of Force Allow?

Force Allow permits traffic that would otherwise be denied by other Firewall rules to pass, but still enforces filtering by the Intrusion Prevention protection module

Force Allow permits traffic to bypass analysis by both the Firewall and Intrusion Prevention protection modules

Force Allow permits traffic to bypass analysis by all Deep Security protection modules

Force Allow explicitly allows traffic that matches the Firewall rule to pass, and implicitly denies all other traffic

Your organization stores PDF and Microsoft Office files within the SAP Netweaver platform and requires these documents to be scanned for malware. Which Deep Security component is required to satisfy this requirement?

The Netweaver plug-in must be installed on the Deep Security Agent

No extra components are required, this can be done by enabling the Anti-Malware protection module on the SAP Netweaver server

Deep Security Scanner is required

A Smart Protection Server must be installed and configured to service the SAP Netweaver platform

Which of the following are valid methods for pre-approving software updates to prevent Application Control Events from being triggered by the execution of the modified software? Select all that apply

Software updates performed by a Trusted Updater will be automatically approved

Maintenance mode can be enabled while completing the udpates

Edit the inventory database file (AC.db) on the Agent computer to include the hash of the newly updated software

Save the change and restart the Deep Security Agent. The updates software will now be approved. Once the inventory scan has run when Application Control is first enabled, there is no way to update the inventory to incorporate modified software

Which of the following statements correctly identifies the purpose of the Integrity Monitoring protection module?

The Integrity Monitoring protection module monitors critical operating system objects such as services, processes, registry keys and ports to detect and report malicious or unexpected changes

The Integrity Monitoring protection module monitors traffic to verify the integrity of incoming traffic to identify protocol deviations, packets fragments and other protocol anomalies

The Integrity Monitoring protection module monitors incoming traffic to confirm the integrity of header information including packet source and destination details

The Integrity Monitoring protection module monitors and analyzes the integrity of application logs to identify tampering, corruption and other suspicious modifications to the logs

Which of the following statements is true regarding Event Tagging?

Events can be tagged automatically if they are similar to known good events

Only a single tag can be assigned to an event

Events can be automatically deleted based on tags

Adding a tag to an event modifies the event data by adding fields, including the name of the tag, the date the tag was applied, and whether the tag was applied manually or automatically

Based on the details of the event displayed in the exhibit, which of the following statements is false?

The Intrusion Prevention protection module must be enabled to detect reconnaissance scans

The scan may be generated from an IP address which may be known to you. If so, the source IP address can be added to the reconnaissance allow list

You can instruct the Deep Security Agents and Appliances to block traffic from the source IP address for a period of time

You can create a firewall rule to permanently block traffic from the originating IP address

Which of the following statements regarding the Integrity Monitoring protection module is true?

The Integrity Monitoring protection module can detect changes to the system but lacks the ability to distinguish between legitimate and malicious changes

Any changes to the system objects monitored by the Integrity Monitoring protection module are assumed to be legitimate, however, an administrator can revise the status of the object modification to malicious during a review of the Integrity Monitoring events

The Integrity Monitoring rules include a property that identifies whether a change to a monitored system object was performed as part of a legitimate operation

Any changes to monitored system objects that are detected after a Recommendation Scan is run on the protected computer are assumed to be malicious

The Intrusion Prevention protection module is enabled, and a recommendation scan is run to identify vulnerabilities on a Windows Server 2016 computer. How can you ensure that the list of recommendations is always kept up to date?

Enable Ongoing Scans to run a recommendation scan on a regular basis. This will identify new Intrusion Prevention rules to be applied

When Automatically implement Intrusion Prevention Recommendations is enabled for a computer, any new rules released by Trend Micro over time will automatically be applied

Recommendation scans are only able to suggest Intrusion Prevention rules when the protection module is initially enabled

Disabling, then re-enabling the Intrusion Prevention protection module will trigger a new recommendation scan. New rules will be included in the results of this new scan

Which of the following is not an operation that is performed when network traffic is intercepted by the network driver on the Deep Security Agent?

Compare the data in the packet against the Anti-Malware Scan Configuration to verify whether any of the data related to files and folders on the Exclusion list

Verify the integrity of the packet to ensure the packet is suitable for analysis

Verify the packet is not part of a reconnaissance scan used to discover weaknesses on the Deep Security Agent host computer

Analyze the packet within the context of traffic history and connection state

Recommendation scans can detect applications, system objects and/or vulnerabilities on servers on the network. Which of the following protection modules make use of recommendation scans?

Intrusion Prevention, Integrity Monitoring, and Log Inspection

Intrusion Prevention, Firewall, Integrity Monitoring and Log Inspection

Firewall, Application Control, and Integrity Monitoring

Log Inspection, Application Control, and Intrusion Prevention

Which of the following statements correctly describes Smart Folders?

Smart Folders act as a saved search of computers which is executed each time the folder is clicked to display its contents

Smart Folders are a collection of subfolders containing the policy settings that are applied to child policies or directly to computers

Smart Folders identify the folders that will be scanned when a real-time, manual or scheduled malware scan is run

Smart Folders are the containers used to store the results of recommendation scans. Once a recommendation scan has completed, and administrator can click a Smart Folder and select which of the recommended rules to apply

Which of the following statements is true regarding Intrusion Prevention rules?

Intrusion Prevention rules can detect, or block traffic associated with specific applications, such as Skype or file-sharing utilities

Intrusion Prevention rules can block unrecognized software from executing

Intrusion Prevention rules check for the IP addresses of known malicious senders within a packet

Intrusion Prevention rules monitor the system for changes to a baseline configuration

Why is a multi-node installation of Deep Security recommended?

Multi-node installations provide Deep Security with failover capabilities since a second Deep Security Manager can handle all requests if the first one fails

Since multi-node installations distribute database information across multiple database servers, Deep Security can easily scale to accommodate any number of Deep Security Agent servers

Since each Deep Security Manager server in a multi-node installation uses its own database, this type of installation can balance the load of requests

Multi-node installations are helpful in disaster recovery situations as each combination of Deep Security Manager and database are clones of each other. When the original Deep Security Manager fails, the administrator can immediately switch to a clone

Which of the following correctly identifies the order of the steps used by the Web Reputation protection module to determine if access to a web site should be allowed?

1. Checks the Approved list. 2. Checks the Deny list. 3. Checks the cache. 4. If not found in any of the above, retrieves the credibility score from the Web Reputation Service. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed

1. Retrieves the credibility score from Web Reputation Service. Evaluates the credibility score against the Security Level 2. Checks the Deny list to determine if access to the web site should be blocked. 3. Checks the Approved list to determine if access to the web site should be allowed

1. Checks the cache. 2. Checks the Approved list. 3. Checks the Deny list. 4. If not found in any of the above, retrieves the credibility score from the Web Reputation Service. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed

1. Checks the Deny list. 2. Checks the Approved list. 3. Checks the cache. 4. If not found in any of the above, retrieves the credibility score from Rating Server. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed

Based on the policy configuration displayed in the exhibit, which of the following statements is true?

Deep Security Agents will send event information to Deep Security Manager every 10 minutes

Administrators with access to the protected server will be able to uninstall the Deep Security Agent through Windows Control Panel

If the Deep Security Manager does not receive a message from the Deep Security agent every 20 minutes, an alert will be raised

Changes to any of the Deep Security policies will be send to the Deep Security Agents as soon as the changes are saved

Which of the following statements is true regarding Maintenance Mode in the Application Control protection module?

When in Maintenance Mode, the Application Control protection module will continue to block software identified in Block rules but will allow new and changed applications to be added to the software inventory

When enabled, Maintenance Mode rescans the protected computer to rebuild the software inventory. Any new or changed software will be included in this rebuilt inventory

Maintenance Mode can be configured as a scheduled event. In this scenario, all software upgrades will be performed at the same time every day to avoid creating alerts for normal software updates

While in Maintenance Mode, all Block and Allow rules are ignored while new or updated applications are added to the software inventory

Which of the following items must be included in any request for resources that are made through the Deep Security API? Select all that apply

URL of the API-enabled resource

Based on the Computer settings displayed in the exhibit, which of the following statements is correct?

Administrators performing maintenance on this server will require a password to disable the Deep Security Agent service

Recommendation Scans will be performed automatically on this server whenever new rules are downloaded from the ActiveUpdate Server to determine if they must be applied

The Deep Security Agent on this server will contact the Smart Protection Network directly to submit file features for Predictive Machine Learning analysis

If this server does not communicate with Deep Security Manager for a specific period, it will be automatically removed from the computers list

A collection of servers protected by Deep Security do not have Internet access. How can Smart Scan be used on these computers?

Install a Smart Protection Server in the environment and set it as the source for the File Reputation Service

Smart Scan can be configured to use a local pattern file containing the same information as the Smart Protection Network

Promote one of the Deep Security Agents on the air-gapped computers to become a Relay

Smart Scan must contact the Smart Protection Network to function. Any servers without Internet access will be unable to use Smart Scan

Which of following statements best describes Machine Learning in Deep Security?

Machine Learning is malware detection technique in which features of an executable file are compared against a cloud-based learning model to determine the probability of the file being malware

Machine Learning is a malware detection technique in which files are scanned based on the true file type as determined by the file content, not the extension

Machine Learning is a malware detection technique in which the Deep Security Agent monitors process memory in real time and once a process is deemed to be suspicious, Deep Security will perform additional checks with the Smart Protection Network to determine if this is a known good process

Machine Learning is a malware detection technique in which processes on the protected computer are monitored for actions that are not typically performed by a given process

Which of the following Smart Protection Services is used by Smart Scan?

Certified Safe Software Service

Which of the following statements is correct regarding the policy settings displayed in the exhibit?

The Heartbeat interval value displayed in this policy is inherited from the parent policy

Deep Security Manager will refresh the policy details on the Deep Security Agents using this policy every 5 minutes

Deep Security Agents using the displayed policy will send event details to Deep Security Manager every 5 minutes

All Deep Security Agents will send event details to Deep Security Manager every 5 minutes

The Intrusion Prevention protection module is enabled, but the traffic it is trying to analyze is encrypted through https. How is it possible for the Intrusion Prevention protection module to monitor this encrypted traffic against the assigned rules?

It is possible to monitor the https traffic by creating an SSL Configuration. Creating a new SSL Configuration will make the private key information needed to decrypt the traffic available to the Deep Security Agent

The Intrusion Prevention protection module is not able to analyze encrypted https traffic

The Intrusion Prevention protection module can analyze https traffic if the public certificate of the originating server is imported into the certificate store on the Deep Security Agent computer

The Intrusion Prevention protection module can only analyze https traffic originating from other servers hosting a Deep Security Agent

deep

Authored by gabriel aguiar

Professional Development, Fun

Used 55+ times

AI Actions

Add similar questions

Adjust reading levels

Convert to real-world scenario

Translate activity

More...

Content View

Student View

82 questions

Show all answers

MULTIPLE CHOICE QUESTION

1 min • 5 pts

Which of the following file types would not be evaluated by the Application Control protection module?

.exe files

.docx files

.class files

.py scripts

MULTIPLE CHOICE QUESTION

1 min • 5 pts

True or False: Standard Auto-tagging in Deep Security can only apply tags to events generated after the tagging has been enabled?

True

False

MULTIPLE CHOICE QUESTION

1 min • 5 pts

The Security Level for Web Reputation in a policy is set to High. A server assigned this policy attempts to access a Web site with a credibility score of 78. What is the result?

The Agent display a warning message, as the site is unrated

The Agent displays a message on the protected server prompting the operator to allow or block the connection

The Agent allows access as the credibility score for the Web site is above the allowed threshold

The Agent blocks access as the credibility score for the Web site is below the allowed threshold

MULTIPLE SELECT QUESTION

1 min • 5 pts

When Agent Self Protection is enabled, users are prevented from performing which of the following activities? Select all that apply

Modifyinf agent-related files

Uninstalling or unloading the Agent

Modifying agent-related Windows registry entries

Stopping the Agent services

MULTIPLE CHOICE QUESTION

1 min • 5 pts

Which of the following is a benefit of adding your cloud vendor account to Deep Security instead of adding the individual instances of virtual machines?

Adding your account allows a Deep Security Agent to be installed on the individual instances of virtual machines

Adding your account ensures that changes in your cloud resource inventory are automatically reflected in the Computers list in the Deep Secutiry Web console

Adding your account ensures that all events related to aparticular instances or virtual machines are recorded properly

Adding your account ensures that you are properly billed by the protection modules you enable

MULTIPLE CHOICE QUESTION

1 min • 5 pts

True or False: When in Maintenance Mode, any preciously created Block rules are ignored. This allows previously blocked software to be updated

True

False

MULTIPLE CHOICE QUESTION

1 min • 5 pts

While viewing the details of the Firewall protection module in a child policy, you note that a few rules are already assigned. You try to disable these rules, but they cannot be unassigned. Why can these not be unassigned?

The rules were assigned to the policy at the parent leve. Rules assigned to a parent policy cannot be unassigned at he child level

The rules cannot be unassigned as the administrator currently logged into the Deep Security Web console does not have the permissions necessaty to unassing rules

These rules have been hard-coded in the details of the policy. These rules will automatically be assigned to all Firewall policies that are created and cannot be unassigned

The rules were assigned to the policy automatically when a Recommendation Schan was run. Ryles assigned through a Recommendation Schan cannot be disabled once assigned

Access all questions and much more by creating a free account

Create resources

Host any resource

Get auto-graded reports

Continue with Google

Continue with Email

Continue with Classlink

Continue with Clever

or continue with

Microsoft

Apple

Others

Already have an account?

Similar Resources on Wayground

87 questions

Mayde creek NJROTC Study Guide

Quiz

•

9th Grade

80 questions

SSRA 2020 - RA

Quiz

•

Professional Development

80 questions

Scrum Final Test / Certification Simu

Quiz

•

Professional Development

87 questions

Speed Math

Quiz

•

3rd - 4th Grade

82 questions

guess the marvel character

Quiz

•

6th Grade

80 questions

KINDER 24-25

Quiz

•

KG - University

81 questions

CSA Review - Full

Quiz

•

Professional Development

84 questions

Realtor Study Guide - Real Estate 2022

Quiz

•

Professional Development

Popular Resources on Wayground

8 questions

2 Step Word Problems

Quiz

•

KG - University

20 questions

Comparing Fractions

Quiz

•

4th Grade

15 questions

Fractions on a Number Line

Quiz

•

3rd Grade

20 questions

Equivalent Fractions

Quiz

•

3rd Grade

25 questions

Multiplication Facts

Quiz

•

5th Grade

10 questions

Latin Bases claus(clois,clos, clud, clus) and ped

Quiz

•

6th - 8th Grade

$fractions$

22 questions

fractions

Quiz

•

3rd Grade

7 questions

The Story of Books

Quiz

•

6th - 8th Grade

Discover more resources for Professional Development

8 questions

2 Step Word Problems

Quiz

•

KG - University

20 questions

Place Value

Quiz

•

KG - 3rd Grade

20 questions

CVC Words

Quiz

•

KG - 1st Grade

10 questions

Subject Verb Agreement

Quiz

•

KG - 2nd Grade

22 questions

Oh, Canada (Test Review)

Quiz

•

10 questions

14.2 Independent/Dependent Variables

Quiz

•

KG - University

16 questions

CHARACTERIZATION

Quiz

•

KG - 8th Grade

18 questions

Great Lakes States

Quiz

•

KG - University

deep

Which of the following file types would not be evaluated by the Application Control protection module?

True or False: Standard Auto-tagging in Deep Security can only apply tags to events generated after the tagging has been enabled?

The Security Level for Web Reputation in a policy is set to High. A server assigned this policy attempts to access a Web site with a credibility score of 78. What is the result?

When Agent Self Protection is enabled, users are prevented from performing which of the following activities? Select all that apply

Which of the following is a benefit of adding your cloud vendor account to Deep Security instead of adding the individual instances of virtual machines?

True or False: When in Maintenance Mode, any preciously created Block rules are ignored. This allows previously blocked software to be updated

While viewing the details of the Firewall protection module in a child policy, you note that a few rules are already assigned. You try to disable these rules, but they cannot be unassigned. Why can these not be unassigned?

Which of the following items can affect the amount of database space is required by Deep Security? Select all that apply

True of False: Allow rules are always processed last as the are assigned a priority value of 0

The Intrusion Precention protection module is enabled and a Recommendation Scan is run to identify vulnerabilities on a Windows Server 2016 computer. How can you ensure that the list of recommendations is kept up tp date?

Access all questions and much more by creating a free account

Similar Resources on Wayground

Popular Resources on Wayground

Discover more resources for Professional Development