Sys Ops - Mod 5-4 Book Questions PT 2

Question 1

AF-wide ESS policies and products are pulled from the _ to the managed ESS Suites.

Accepted Answer

AFCERT Suite

Question 2

triaging alerts from your endpoint security tools to determine which threats are real &/or the priority in which to addr

Accepted Answer

Response

Question 3

RSDs should NOT be placed on critical systems that move subnets frequently.

Accepted Answer

True

Question 4

The first function of ENS. Blocks based on a pre-determined criteria

Accepted Answer

Access Protection

Question 5

Base Comm, SADR

Accepted Answer

T-3

Question 6

Similar to MECM/ACAS/ARAD. This funct is NOT used at NOS/Base level due to better solutions being available currently

Accepted Answer

Asset Configuration Control Module (ACCM)

Question 7

Whitelist within DLP are also used to give identified users _ burn rights

Accepted Answer

SIPR

Question 8

PMO Master Source Repository, AFCERT Suite, Master Server

Accepted Answer

T-1

Question 9

The agent is installed utilizing a file called a _. Once an agent is installed on a system, it is a managed system.

Accepted Answer

Frame Package (frmpackage)

Question 10

DLP uses device definitions to configure for mission required devices to allow them to be connected.

Accepted Answer

whitelists

Question 11

This feature is not currently supp/used at NOS/base level, however the _ Endpoint software MUST be installed on clients

Accepted Answer

Policy Auditor (PA)

Question 12

The purpose of ESS is to enhance the overall security posture of DoD endpoints

Accepted Answer

True

Question 13

NOS/COS, 5 Ops Units, ePO

Accepted Answer

T-2

Question 14

HIP is comprised of 2 functions: _ and _.

Accepted Answer

Intrusion Prevention System (IPS), Host Based Firewall

Question 15

a piece of software w/in ESS that can be used for scanning clients & returning info from their current state of Windows.

Accepted Answer

Asset Configuration Control Module (ACCM)

Question 16

a comprehensive security management solution that runs on network computers to identify and stop threats automatically

Accepted Answer

McAfee® Endpoint Security (Endpoint Security or ENS)

Question 17

HIDS/HIPS is often part of an endpoint protection solution like Symantec&#x27;s or McAfee&#x27;s Endpoint Protection

Accepted Answer

True

Question 18

Incident response (IR) is a process, not an isolated event.

Accepted Answer

True

Question 19

ESS is comprised of 7 endpoint products. These 7 endpoint products are: MA, DLP, ENS, HIP, RSD, PA, ACCM

Accepted Answer

True

Question 20

The first function of ENS is the Access Protection. Pre-determined criteria for ENS Access Protection:

Accepted Answer

Workstations and servers sending system-generated e-mails, mIRC chat, Running scripts from temp folders

Question 21

eradication of the security risk, reviewing & reporting on what happened, updating your threat intelligence w/new info

Accepted Answer

Recovery and Follow-up

Question 22

able to establish benchmarks by using DISA STIGs and it is installed on all Windows and Linux systems.

Accepted Answer

Policy Auditor (PA)

Question 23

It is the _ responsibility to ensure the agent is installed on all capable systems.

Accepted Answer

base’s

Question 24

The third function of ENS. These scans are mandated by DISA to be completed weekly. uses DAT files.no exclusions allowed

Accepted Answer

On-Demand Scan

Question 25

The RSD must be placed, and remain on the subnet it is assigned to cover.

Accepted Answer

True

Question 26

containing & neutralizing threat-isolating, shutting down, or otherwise disconnecting infected sys frm ntwk to prev attk

Accepted Answer

Response

Question 27

The McAfee agent is used for communication to the ePO server. The default port it uses is _.

Accepted Answer

80 and 443

Question 28

The first function of _ is the Access Protection. Access Protection blocks based on a pre-determined criteria.

Accepted Answer

Endpoint Security (ENS)

Question 29

first phase of incident response planning & most crucial in protecting our digital assets. doc,outl,expl IR roles&resp

Accepted Answer

Preparation

Question 30

The second function of ENS. Will scan files as they are created or accessed. May be config w/excl for known good files

Accepted Answer

On-Access Scan

Question 31

involves monitoring, detecting, alerting, and reporting on security events

Accepted Answer

Detection & Analysis

Question 32

DLP does not use the internal serial number of device and/or the Device Instance Path to configure the whitelist.

Accepted Answer

False

Question 33

McAfee Agent employs Agent to Server Communication Interval (ASCI) which mand how often the agent “check-ins” w/the ePO.

Accepted Answer

True

Sys Ops - Mod 5-4 Book Questions PT 2

Questions 33

Sys Ops - Mod 5-4 Book Questions PT 2

Questions 33