Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

NSVT > Week 5 > Flashcards

Week 5 Flashcards

1
Q

Two ways to access ESX

A
  • cmd line

- Vsphere client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Primary means of accessing VMs

A
  • console tab

- console window

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does HBSS provide?

A
  • signature and behavior based threat protection

- desktop firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the McAfee Agent do?

A

Tells point products what to do

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does HIPS do?

A

Provides capability to block known intrusion systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does RSD do?

A
  • Rogue System Detection

- Notifies admin of any rogue/no agent/wrong agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does VSE do?

A

Active

-protects hosts from viruses, worms, Trojans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does DCM/DLP do?

A

Module is what allows/prevents plug and play and USB devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does ABM do?

A
  • asset baseline monitor
  • passive
  • notifies admin when host goes against compose baseline
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does PA do?

A
  • policy auditor
  • passive
  • notifies admin when policies set in ePO are not enforced on host
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Where are polices applied?

A

System Tree

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Characteristics of Lost and Found group

A
  1. Cannot be deleted
  2. Cannot be renamed
  3. Sorting criteria cannot be changed from being a catch-all group
  4. Always appears last
  5. Users must be granted permissions to see contents
  6. When a system is sorted into L&F, it is placed in a subgroup named for the systems domain. If it doesn’t exist, it will be created
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What contains all the necessary information that a client will need to install the McAfee Agent and communicate with ePO server?

A

Framepkg.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the HIP sub-agents?

A
  • buffer overflow
  • logon
  • SQL
  • registry
  • services
  • files
  • HTTP
  • HIP API
  • Get Admin
  • Illegal Use
  • Program
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How often is detected network device information forwarded to the ePO server?

A

5 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What allows HBSS admins to configure and manage the instances of the rogue system sensor installed throughout the network?

A

RSD Policy Settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the system statuses?

A
  1. Exceptions
  2. Inactive
  3. Managed
  4. Rogue
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the Rogue System Sensor Statuses?

A
  1. Active
  2. Missing
  3. Passive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How many Rogue System Sensors should you have?

A

2 per subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the Subnet Statuses?

A
  1. Contains rogues
  2. Covered
  3. Uncovered
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a policy?

A

Collection of settings that are created, configured, and then enforced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How are policy settings grouped?

A

By product then by category

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the stackable policy rules?

A

Firewall rules can’t be stacked and only one policy can be applied at a time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How often is policy enforcement?

A

30 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Admins can assign policies by?

A
  • site or group level
  • single systems
  • node with multiple policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does HIP do?

A
  • Provides the ability to protect systems from attacks such as buffer overflows and privilege escalation
  • uses the IPS signature base to identify threats to the host from both the network and application later perspective
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the detection methodology?

A

HIP uses both signature and ananomly (behavior) based methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Elements that HIPS examines

A
  • system calls
  • file system access
  • system registry settings
  • host input/output
  • host network traffic monitoring
  • shielding
  • enveloping of applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the general policies?

A
  • Client UI
  • Trusted Networks
  • trusted applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How to navigate to threat event log

A

Menu>reporting>threat event log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the trusted application policy?

A

When you mark an application as trusted, it helps to eliminate creating exceptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What do the IPS options tell you?

A

Whether it is on or off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does protect mode mean?

A

Blocks according to policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is adapted mode?

A
  • Blocks all high severity events

- allows everything else

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What does learned mode require?

A

User interaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the components of HIP policy?

A
  • general
  • IPS
  • Firewall
  • Application Blocking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the policy categories under General?

A
  • Client UI
  • Trusted Networks
  • Trusted Application
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the purpose of a Client UI?

A

To configure the HIP Agent interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the purpose of a Trusted Network?

A

To specify network ranges to allow through the Firewall with rules that specify “Trusted” specify IP address to “trust for NIPS”

40
Q

What is the purpose of the Trusted Application?

A

To specify applications to ignore IPS/Firewall/Application Blocking at a specified path

41
Q

What are the policy categories for IPS?

A
  • options
  • rules
  • protection
42
Q

What is the purpose of options (IPS)?

A

Turns IPS protection on or off

43
Q

What is the purpose of rules (IPS)?

A

Specified the signatures and behaviors and their associates severity levels

44
Q

What is the purpose of protection?

A

Specified the protective reaction to detected signatures

45
Q

What are the policy categories for firewall?

A
  • options

- rules

46
Q

What is options (firewall) for?

A

Turns firewall on or off

47
Q

What is the purpose of rules (firewall)?

A

Specified the access rules through the firewall with their ports, protocols, services, and “trusted”

48
Q

What are the sub-components of IPS?

A
  • HIPS
  • NIPS
  • Application Protection
49
Q

What are the sub-components of Firewall?

A
  • incoming comms

- outgoing comms

50
Q

What is hooking (application blocking)?

A

-controls which applications can BIND together

51
Q

What are the components of HBSS?

A

Server side: ACAS, HBSS, MSSQL

Client side: McAfee Agent

51
Q

Why is RDP the preferred method of accessing VMs?

A

Less resource intensive

51
Q

What order do you power on VMs?

A
  • MSSQL, ACAS, HBSS

- to allow services to start on MSSQL

51
Q

How many types of users are in HBSS? What are they? How are they defined?

A
  • Global: creates accounts, does everything
  • Everyone Else: view
  • defined based on permissions given
51
Q

What does the System tree contain?

A
  • sites
  • groups
  • subgroups
51
Q

Why do we create subgroups?

A

To manage policies for systems in one place, rather than setting policies for each system individually

51
Q

How do you break inheritance?

A

At lowest level possible

  • break DLP Policy? Do it at the workstation
  • apply McAfee default policy? Do it at the top
51
Q

What criteria is used to place managed systems into a system tree group?

A

Tags with and without criteria

51
Q

What is the default Agent to Server Client Intervals?

A

-30 minutes

51
Q

Which file contains all necessary information that a client will need to install the McAfee Agent?
What does it contain?

A
  • frampkg.exe

- contains drivers, ePO server information, and encryption keys

51
Q

What does the Wake Up Agent do?

A

Forces agents to call in and update policies and tasks

52
Q

What is priority event forwarding?

A

Forwards priority events immediately according to user-selected level of priority

53
Q

What is SADR?

A

A repository for ships

54
Q

What option must be selected in order for a system to become a superagent?

A

-convert Agent to Super Agent

55
Q

Explain lazy caching.

A

-a workstation needs software, it goes to SADR and gives it to the workstation. If SADR doesn’t have it, it goes to HBSS

55
Q

Where are HBSS servers located?

A

-UARNOC and PRNOC

56
Q

In regards to RSD, how many sensors are required to be on each subset and what kind of information do they gather?

A
  • 2

- ARP, IP, DHCP, info about computers, routers, printers

57
Q

What is the purpose of detected systems menu?

A

Makes monitoring and managing network easier.

58
Q

What is the default policy enforcement?

A

15 minutes

59
Q

What does the overall system status show?

A

-a percentage of compliant systems. Managed, rogue, and exceptions

60
Q

What is a rogue device?

A

-device not managed by ePO server.

61
Q

DISA requires how many days before System is reported as rogue?

A

10 days

62
Q

3 classes of rogue devices and explain

A
  • Alien: not in local ePO database
  • Inactive: in ePO database by not detected
  • No Agent: no McAfee Agent installed
63
Q

How is Rogue System Sensor Status displayed and explain them.

A
  • active: sensors report info to ePO server
  • missing: sensors that haven’t communicated in a certain amount of time
  • passive: check in but do not report info
64
Q

What is the subnet status? Explain.

A

Subnet status: how many detected sinners are on network

  • contains rogues
  • covered
  • uncovered
65
Q

What systems would you include on the Rogue Sensor blacklist?

A

-mission critical servers of core services

66
Q

Explain merging systems.

A

-a computer with multiple NICs with it’s own MAC address

67
Q

What are the three methods to installing McAfee Agents?

A
  1. Rogue Agent Auto Push
  2. Deploying agents via RSD
  3. Manually installing agents
68
Q

When does an alien system occur?

A

When an agent is not recognized by the ePO server

69
Q

What is that logic statement?

A

-if rogue equals true & & domain = shipboard domain

70
Q

Other issues that may cause inactive

A
  • system not on board
  • network cable damaged
  • agent service fail/corrupt
  • system decommissioned and not removed from system tree
  • system disconnected
71
Q

What kind of systems are excluded in RSD?

A
  • routers
  • switches
  • WAP
  • printers
  • IP phones
  • storage arrays
  • ESX
  • hypervisors
72
Q

What are the 3 days to correct a duplicate GUID?

A
  • via server tasks
  • via registry
  • agent de-installation
73
Q

What are the steps for embarkable units to have the McAfee Agent installed?

A
  • contact the embarkable unit prior to arrival
  • create a custom group within system tree
  • create a permission set
  • create a group admin account
74
Q

What policy is crucial to your network to where if improperly configured, will not allow your network to receive updates?

A

McAfee Default Policy

75
Q

How do policies get enforced?

A
  • every 15 minutes

- how long locally set client changes will last until server overwrites them

76
Q

Explain inheritance.

A

Child groups inherit policies from parent groups

77
Q

What does a host based IPS provide?

A
  • protects systems from attacks such as buffer overflows and privilege escalation
  • uses IPs to identify threats to the host from both the network and application layer perspective
78
Q

What is the IPS software responsible for?

A
  • Host and network intrusion protection

- shielding and enveloping of applications

79
Q

What is the benefit of trusting applications and networks?

A

-eliminates the need to create exceptions

80
Q

Why do we have HIP tuning?

A
  • network is a constantly hanging environment
  • manual
  • auto: learned, adaptive
81
Q

What type of incidents does intrusion detection and prevention protect against?

A
  • incidents have many causes, malware
  • attackers gaining unauthorized access to systems from internet
  • authorized users of systems who misuse privileges
82
Q

The IPS protection policy sets the reaction to events based on what level?

A

Severity: high, medium, low, Informational

83
Q

What is an exception rule for?

A

-to allow a device that would otherwise be blocked

84
Q

Within DLP, what are the 3 device class statuses? Explain each.

A
  • managed: USB, plug n play
  • unmanaged: no McAfee Agent, could be managed but we don’t, like local printers and scanners
  • unmanageable
85
Q

What does the computer assignment group features allow?

A

-DLP rules for specific groups of computer objects

NSVT (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions