MA0-104 Intel Security Certified Product Specialist Questions and Answers

The McAfee SIEM baselines daily events over

Which of the following is the minimum amount of disk space required to install the McAfee Enterprise Security Manager (ESM) as a virtual machine?

Which of the following statements about Client Data Sources is TRUE?

Which authentication methods can be configured to control alarm management privileges?

Event Aggregation is performed on which of the following fields?

Which of the following operations is NOT an available selection when using Multi-Device Management?

One or more storage allocations, which together specify a total amount of storage, coupled with a data retention time that specifies the maximum number of days a log is to be stored, is known as a

If the maximum size for the Policy Change History log is reached, which of the following happens to new entries?

Which of the following are the three compression ratios available for raw logs being handled by the ELM?

Zones allow a user to group devices and the events they generate by

Which of the following is the minimum number of CPUs required to build a virtual image Enterprise Security Manager (ESM)?

The ESM supports five Authentication methods. The default login option uses the standard Username and Password format. Which of the following are the other four methods available?

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the following watchlists in the McAfee SIEM?

In the Default Summary view on the Enterprise Security manager (ESM). which of the following panels shows the baseline averages?

Which of the following are the Boolean logic functions that can be used to create Correlation Rules?

When a Correlation Rule successfully triggers, this occurs at the

Where can the ESM event database archive inactive partitions?

A security administrator is configuring the Enterprise Security Manager (ESM) to comply with corporate security policy and wishes to restrict access to the ESM to certain users and machines Which of the following actions would accomplish this?