DISA HBSS 201 Admin ePO5.1 (2014 Version)

What is the default password for unlocking the client user interface when troubleshooting the McAfee HIPS client?

abcde12345

How do you uninstall the HIPS client for Windows from a managed system?

-Configure the IPS Options policy to disable IPS; Configure the McAfee Agent deployment task to remove the HIPS client. -Remove the HIPS client package from the ePO Master repository and initiate the McAfee Agent wakeup call. -Configure the McAfee Agent Update task to uninstall the HIPS client and initiate the McAfee Agent wakeup call. -Remove the Extension from the ePO server and initiate the McAfee Agent wakeup call.

Prior to imaging the system the registry entry for the McAfee Agent; which line should be deleted?

-HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePO\Agent\EpoGUID -HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePO\Agent\CMA GUID -HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePO\Agent\Agent SID -HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePO\Agent\AgentGUID

Which statement best defines Application Shielding in HIPS?

A. Applications; system registry and services are locked down against malicious activity. B. Applications are not permitted to access data; registry and services outside their own application envelope.- Wrong C. Applications are prevented from communicating with any network services that are not defined by the administrator. D. Applications can only hook to the processes that match the digital signature imported into HIPS.

From this list select the format that you cannot export your query results to.

A. CSV B. DOC C. XML- Wrong D. HTML E. PDF Dunno?

To verify that the IP address sorting criteria that has not been configured to overlap between different groups; you can use which of the following options?

A. Combined IP Integrity B. Check IP Integrity C. Check IP Groups D. Display IP Sorting- Wrong

To manually move a system from one group to another; you do which two things with the system to move it to the other group?

A. Drag and drop B. Copy and paste C. Right click and move- Wrong D. Left click and move

The Agent to Server Communication for the McAfee Agent is encrypted using which of the following?

A. IPSEC- Wrong B. SPIPE C. TLS- Correct D. HTTP

Which of the following is not a protection level defined in the IPS Protection Policy?

A. Ignore- Wrong B. Allow C. Log D. Prevent

Which statement is true concerning the ePO console?

A. It is web based and designed completely in HTML and JavaScript. B. It is a stand alone application and uses Java code. C. It utilizes the Microsoft Management Console MMC.- Wrong D. It provides remote consoles that can be installed on UNIX platforms.

Public Queries exist in which of the following lists?

A. Public Groups B. Shared Groups C. My Groups- Correct D. Query Groups- Wrong

Which IPS policy determines what options are available to a client computer with a HIPS client; including; whether or not the client icon appears in the system tray; types of intrusion alerts; and password to allow access to the client user interface?

A. Server UI B. Policy Settings- Wrong C. Client GUI D. Client UI

The Client Task Catalog allows you to create which of the following?

A. Server task objects B. Client task objects C. Client task rules- Wrong D. Client task profiles

Which of the following is a valid statement regarding the task of managing policies in ePO?

A. The only way to apply an existing policy to a node in the ePO tree is through inheritance. B. When you assign a new policy to a particular group of the Directory; then all systems under that group with inheritance intact will inherit the new policy. C. Policies that have been duplicated can only be applied to the Directory level in the ePO console. D. Policies cannot be exported or imported from one ePO server to another ePO server.- Wrong

Select the ePolicy Orchestrator component that caches policies to reduce database reads and speed up ASCI time.

A. Tomcat- Wrong B. Apache C. Event Parser D. McAfee Agent

Each Firewall Rule provides a set of conditions that which of the following has to meet?

A. Users B. Computers C. Traffic D. Protocols- Wrong

Which ePO user listed below can create and edit tags in ePO?

Administrator

If a connection is in the state table; what action will occur with future traffic for that connection?

Allow

Select the ePolicy Orchestrator component that provides the UI of the System tree; sorting of nodes; tags and policies.

Apache

What can be created to prevent interpreting a normal behavior as an attack?

Exception

Which of the following can be created to prevent interpreting a normal behavior as an attack?

Exception

What are the four main types of Permission Sets in ePO?

Executive Reviewer; Global Reviewer; Group Admin; Group Reviewer

What column is not displayed in the Audit Log?

Failure

Which executable runs the main HIPS service?

Firesvc.exe

What are the four severity levels of signature in HIPS?

High, Medium, Low, Informational

Which is not a type of IPS Signature?

Host Signatures Custom Host Signatures- Wrong Network Signatures Global Signatures

Assume three IPS policies are applied to a node; 1 default and 2 custom. The default severity level is set to HIGH; 1 custom severity level is set to LOW and the other custom is set to MEDIUM. What is the effective severity level outcome for the applied policy?

Low Med High- Wrong Least Restrictive

Which ePO component gathers the events from the managed systems and communicates them to the ePO server?

McAfee Agent

Which ePO core component enforces the policies on the systems?

McAfee Agent

DISA HBSS 201 Admin ePO5.1 (2014 Version)

Pull Task

What ePO server task updates ePO distributed repositories from the master repository?

Pull task

How do yo uninstall the HIPS 7.0 client for Windows from a managed system?

Remove the extension from the ePO Server and initiate the McAfee Agent wakeup call.( double check answer)

Which answer lists ALL the layers of protection in the HIPS client?

Signature, behavioral and firewall protection

Which ePO repository provides all updates to the ePO Master repository?

Source

What types of Tags can you create?

Tags without criteria and Criteria-based tags

In which order are HIPS Firewall rules processed to filter incoming packets?

Top to bottom

In the Client Task Catalog you can export all of your client tasks into an XML file that can be imported into another ePolicy Orchestrator Server.

True