Free Practice Questions for Trend Deep-Security-Professional Exam

Question 1

A Recommendation Scan is run to determine which Intrusion Prevention rules are appropriate for a Server. The scan is configured to apply the suggested rules automatically and ongoing scans are enabled. Some time later, an operating system patch is applied. How can you de-termine which Intrusion Prevention rules are no longer needed on this Server?

AThe READ ME file provided with the software patch will indicate which issues were addressed with this release. Compare this list to the rules that are applied to determine which rules are no longer needed and can be disabled.

BSince the rules are being applied automatically, when the next Intrusion Prevention Recommendation Scan is run automatically, any rules that are no longer needed will be automatically unassigned. These are rules that are no longer needed as the vulnerability was corrected with the patch.

CSince there is no performance effect when multiple Intrusion Prevention rules are ap-plied, there is no need to determine which rules are no longer needed. The original rec-ommended rules can remain in place without affecting the system.

CSince the rules are being applied automatically, when the next Intrusion Prevention Recommendation Scan is run automatically, any rules that are no longer needed will be displayed on the Recommended for Unassignment tab in the IPS Rules. These are rules that are no longer needed and can be disabled as the vulnerability was corrected with the patch.

Correct Answer: B. Since the rules are being applied automatically, when the next Intrusion Prevention Recommendation Scan is run automatically, any rules that are no longer needed will be automatically unassigned. These are rules that are no longer needed as the vulnerability was corrected with the patch.

Question 2

Which of the following correctly identifies the order of the steps used by the Web Reputation Protection Module to determine if access to a web site should be allowed?

AChecks the cache. 2. Checks the Deny list. 3. Checks the Approved list. 4. If not found in any of the above, retrieves the credibility score from Rating Server. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

BChecks the cache. 2. Checks the Approved list. 3. Checks the Deny list. 4. If not found in any of the above, retrieves the credibility score from the Rating Server. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

CChecks the Deny list. 2. Checks the Approved list. 3. Checks the cache. 4. If not found in any of the above, retrieves the credibility score from Rating Server. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

DChecks the Approved list. 2. Checks the Deny list. 3. Checks the cache. 4. If not found in any of the above, retrieves the credibility score from the Rating Server. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

Correct Answer: D. Checks the Approved list. 2. Checks the Deny list. 3. Checks the cache. 4. If not found in any of the above, retrieves the credibility score from the Rating Server. 5. Evaluates the credibility score against the Security Level to determine if access to the web site should be allowed.

Question 3

Which of the following is NOT an operation that can be performed on Deep Security resources using the API?

AGET

BPUT

CVIEW

DPOST

Correct Answer: C. VIEW

Explanation:

Rest API

Question 4

Which of following statements best describes Machine Learning in Deep Security?

AMachine Learning is malware detection technique in which features of an executable file are compared against a cloud-based learning model to determine the probability of the file being malware.

BMachine Learning is a malware detection technique in which files are scanned based on the true file type as determined by the file content, not the extension.

CMachine Learning is a malware detection technique in which the Deep Security Agent monitors process memory in real time and once a process is deemed to be suspicious, Deep Security will perform additional checks with the Smart Protection Network to determine if this is a known good process.

DMachine Learning is malware detection technique in which processes on the protected computer are monitored for actions that are not typically performed by a given process.

Correct Answer: A. Machine Learning is malware detection technique in which features of an executable file are compared against a cloud-based learning model to determine the probability of the file being malware.

Explanation:

Predictive Machine Learning

Question 5

What is the role of Apex Central in the Connected Threat Defense infrastructure?

AApex Central distributes Deep Security policies to Agents on the protected Servers.

BApex Central submits suspicious files to Deep Discovery Analyzer for further analysis.

CApex Central stores suspicious files that are awaiting submission to the Deep Discovery Analyzer.

DApex Central compiles the Suspicious Objects List based on the result of file analysis in Deep Discovery Analyzer.

Correct Answer: D. Apex Central compiles the Suspicious Objects List based on the result of file analysis in Deep Discovery Analyzer.

Explanation:

1 Deep Security Agents are configured with rules to enable detection of malware on the protected computers.

2 Objects deemed to be suspicious are gathered and submitted to Deep Security Manager.

3 Deep Security Manager submits the suspicious objects to Deep Discovery Analyzer for analysis.

4 Deep Discovery Analyzer executes and observes the suspicious object in a secure, isolated virtual sandbox environment.

5 Deep Discovery Analyzer pushes the analysis results to Trend Micro Apex Central, where an action can be specified for the file based on the analysis. Once the action is specified, a list of emerging threats called a Suspicious Object List is created or updated. Other Trend Micro products, such as Apex One, Deep Discovery Inspector or Deep Discovery Email Inspector, may also be connected to Trend Micro Apex Central and be able to update the list.

6 Deep Security Manager receives the list of suspicious objects from Apex Central.

7 The list is forwarded to Deep Security Agents where protection against the suspicious object is applied. Anti-Malware policies define how suspicious objects are to be handled.

Explication: Study Guide - page (387)

Question 6

What is IntelliScan?

AIntelliScan is a method of identifying which files are subject to malware scanning as determined from the file content. It uses the file header to verify the true file type.

BIntelliScan is a mechanism that improves scanning performance. It recognizes files that have already been scanned based on a digital fingerprint of the file.

CIntelliScan reduces the risk of viruses entering your network by blocking real-time compressed executable files and pairs them with other characteristics to improve mal-ware catch rates.

DIntelliScan is a malware scanning method that monitors process memory in real time. It can identify known malicious processes and terminate them.

Correct Answer: A. IntelliScan is a method of identifying which files are subject to malware scanning as determined from the file content. It uses the file header to verify the true file type.

Question 7

How is scan caching used in agentless implementations of Deep Security?

AScan caching maintains the Inclusions and Exclusions lists from the Malware Scan Configuration in memory to improve performance.

BScan caching manages resource usage by staggering the launch of malware scans to prevent scan storms

CScan caching is used in Agent-based installations only and is not supported in an agentless implementation.

DScan caching enhances the performance of the Deep Security Virtual Appliance in that files scanned for malware on a virtual machine that appear on other virtual machines may not need to be scanned again.

Correct Answer: D. Scan caching enhances the performance of the Deep Security Virtual Appliance in that files scanned for malware on a virtual machine that appear on other virtual machines may not need to be scanned again.

Question 8

An administrator attempts to activate the Deep Security Agent installed on a server by typing the following command in the Command Prompt on the Deep Security Agent computer:

dsa_control -a dsm://server1.acme.com:4120

The Agent does not activate as expected. What is a valid reason for this issue?

AThe incorrect port was used. The correct command would be: dsa_control -a dsm://server1.acme.com:4118

BDeep Security Agents can not be activated through the Command Prompt. They must be activated through the Deep Security Manager Web console or through a deployment script.

CThe command listed can only executed from the Command Prompt on the Deep Security Manager computer.

D'Allow Agent-Initiated Activation' is currently not enabled in Deep Security Manager.

Correct Answer: D. 'Allow Agent-Initiated Activation' is currently not enabled in Deep Security Manager.

Explanation:

dsa_control -a dsm://<host or IP>:/

For the command-line Agent activation option to work, Deep Security Manager must be set to ac-cept Agent-Initiated Activations (AIA) commands. This method is particularly useful when using scripts or in Cloud environments like Amazon Web Services where Deep Security Manager can not typically connect to Deep Security Agents to activate them, but the Agents can connect to Deep Security Manager.

Explication: Study Guide - page (90)

Question 9

Based on the details of event displayed in the exhibit, which of the following statements is false?

AYou can instruct the Deep Security Agents and Appliances to block traffic from the source IP address for a period of time.

BYou can create a firewall rule to permanently block traffic from the originating IP ad-dress.

CThe scan may be generated from an IP address which may be known to you. If so, the source IP address can be added to the reconnaissance whitelist.

DThe Intrusion Prevention Protection Modules must be enabled to detect reconnaissance scans.

Correct Answer: C. The scan may be generated from an IP address which may be known to you. If so, the source IP address can be added to the reconnaissance whitelist.

Question 10

Multiple Application Control Events are being displayed in Deep Security after a series of ap-plication updates and the administrator would like to reset Application Control. How can this be done?

AOn the Deep Security Agent computer, type the following command to reset Application Control: dsa_control -r

BClick 'Clear All' on the Actions tab in the Deep Security Manager Web console to reset the list of Application Control events.

CApplication Control can be reset by disabling the Protection Module, then enabling it once again. This will cause local rulesets to be rebuilt.

DApplication Control can not be reset.

Correct Answer: C. Application Control can be reset by disabling the Protection Module, then enabling it once again. This will cause local rulesets to be rebuilt.