SOLUTIONS GRADED A+
◉ What action should be taken if an event is found to be a false
positive?
Answer: Ignore It
Start the tuning process
Call the helpdesk
Open a ticket with DISA
-Start the tuning process
◉ Which product is responsible for collecting endpoint properties
and policy enforcement?
Answer: McAfee VirusScan
McAfee HIPS
McAfee Agent
ACCM
-McAfee Agent
, ◉ What is the correct order for prioritizing events?
Answer: Severity; Action Taken; Volume
Action Taken; Severity; Volume
Volume; Severity; Action Taken
Severity; Volume; Action Taken
-Severity; Action Taken; Volume
◉ An admin creates ___________ to manage the software installed on
the endpoint.
Answer: Rules
Policies
Groups
Client tasks
-Policies
◉ Which HIPS label shows the friendly name of a HIPS event?
Answer: Threat Name
Signature Name (Host IPS)
Param value
Product name